Re: [vox-tech] Installing Java

2004-12-30 Thread Rick Moen
Quoting Jay Strauss ([EMAIL PROTECTED]):

 What's the drawback of just using the java installer/binary from 
 java.sun.com?  I don't really need the apt advantages

Distributions' packagers perform valuable quality control and
distro-specific porting.  E.g., all the pieces land where they're
supposed to, and interact with the system in accordance with its 
policy.  Given that you're a Debian guy, I imagine you're aware of the
importance of policy.  ;-

Also, this ensures that the software is known to your
software-registration system.  (That has nothing to do with apt.
It would apply equally well if you used carrier pigeons, floppy disks,
and dpkg -i.)

 I wouldn't want java just updated automatically when I do apt-get
 upgrade anyway.

If software that uses it is likewise known to the software-registration
system, you most certainly (logically) would.  However, having the package
(thus) known to the software-registration system doesn't mean it need be
updated automatically unless you want it to:  You may want to look up
how to set package hold status using dpkg, dselect, etc.

Locally installing software (/usr/local, /opt -- i.e., not under
software-tracking) when you don't have to strikes me as a ghastly
mistake, generally, and I'm sure more reasons than I've cited above will
occur to you.  If you're stuck, read my EBLUG-talk slides on
http://linuxmafia.com/presentations/ , and note the lessons drawn from
the tcp-wrappers-7.6.tar.gz trojaning in 1999, for one reason.   ;-

-- 
Cheers,  Hardware:  The part you kick.
Rick MoenSoftware:  The part you boot.
[EMAIL PROTECTED]
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Jay Strauss
Rick Moen wrote:
Quoting Ken Bloom ([EMAIL PROTECTED]):

On Debian, the best way to install Java is to download the binary
installer and then use make-jpkg from java-package to create .debs of
Java that do the right thing.

For Java2 v. 1.5.  If you're content with 1.4 for now, try using this as
an apt source:
# Sun Java J2r1.4
deb ftp://ftp.tux.org/pub/java/debian woody non-free

Looks like they moved it to:
deb ftp://ftp.tux.org/java/debian/ sarge non-free
and since I'm on sarge, I'll use that.
Thanks
Jay
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Jay Strauss
If you're stuck, read my EBLUG-talk slides on
http://linuxmafia.com/presentations/ , and note the lessons drawn from
the tcp-wrappers-7.6.tar.gz trojaning in 1999, for one reason.   ;-
I'm gonna read it tonight
Thanks
Jay
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Rick Moen
Quoting Jay Strauss ([EMAIL PROTECTED]):

 If you're stuck, read my EBLUG-talk slides on
 http://linuxmafia.com/presentations/ , and note the lessons drawn from
 the tcp-wrappers-7.6.tar.gz trojaning in 1999, for one reason.   ;-
 
 I'm gonna read it tonight
 Thanks

You're welcome, but I feel a bit bad that, being just slides, a lot of
that's going to seem cryptic.  (Actually, this being the first set of
presentation slides I've ever created in my life, I screwed them up by
making them too verbose by about a factor of three, but they'll still be 
cryptic, anyway.  :(  )

Essentially, having finished back in November cataloguing and
analysing[1] all of the highly diverse stuff claimed, here and there, to
be Linux malware, I sat down and gave the subject a good mulling over:
Most of the attack threats were pretty laughable, or were not attacks 
per se but rather post-attack tools used by bad guys who broke into your
system by other means entirely.  However, I stopped and thought:  That
bit aside, if I were one of the bad guys, how and where would I deploy
Linux malware (especially trojans) to actually affect systems?  Moreover, 
has it ever been thus deployed with even partial success, and where?

Moreover^2, to the extent that such deployments have never taken off,
what mechanisms, social or technical, have prevented that?

One of the things I examined was the site compromise and trojaning of
several ftp/Web sites over the years.  Those sites were ones offering
public download of source tarballs, of both security-sensitive packages
(e.g., tcp-wrappers, util-linux, the Linux kernel as offered on the
BK-CVS gateway host, network tools on monkey.org) and less so (e.g., the
irssi IRC client).  I noticed that all of these were compromises of
source code at the upstream maintainer sites, i.e., that distros'
packages were _not_ compromised.  That turned out to be significant --
and no accident.

Weise Venema's TCP Wrappers package got trojaned in 1999 on what was
then its main source hosting site, a well-known public ftp server at
Eindhoven University in the Netherlands (ftp.win.tue.nl).  Someone
covertly root-compromised the host, and then posted a trojaned, phoney
tcp-wrappers-7.6.tar.gz in the ftp directory.  

About fifty people downloaded that file in the first few hours after
its release, suspected nothing, and presumably wrecked their systems
(installing a backdoor for the bad guy).  Approximately the fifty-first
was Andrew Brown of Crossbar Security, who was alert enough to say to
himself Hey, how come _this_ release of TCP Wrappers isn't PGP-signed?
He raised the alarm, and the fifty-odd prior downloaders were notified
by mail.

One of the things that downstream package maintainers for distros do for
you, if they're on the ball at all, is to be at least as alert and
constructively paranoid and Andrew Brown was.  They're an additional
check against _both_ quality problems and security compromise, between
you and various sorts of harm.  You should make use of that protection
(and other advantages, such as distro-specific patches) preferentially, 
and be aware of the need to perform personally the same sort of checks
(e.g., meaningfully verifying PGP signatures and md5sums) and
distro-specific adjustments, whenever you elect to go outside the
package system.

So, that's about two of my slides out of the 34 total that should now be
a little less cryptic.  ;-

[1] http://linuxmafia.com/~rick/faq/index.php?page=virus#virus5

-- 
Cheers,  Hardware:  The part you kick.
Rick MoenSoftware:  The part you boot.
[EMAIL PROTECTED]
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Rick Moen
Correcting my typo:

 One of the things that downstream package maintainers for distros do for
 you, if they're on the ball at all, is to be at least as alert and
 constructively paranoid and Andrew Brown was.
  ^^^
 as.

Screwed up one of my main points.  Figures.  ;-

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


[vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Richard S. Crawford
I'm trying to build a LuMiX box; the distribution comes as a big tar file on a 
CD.  I've got Tom's Root Boot on a floppy, and I've used it to hose the NT 
partition that was already on the HD, and I've already created my Linux 
partitions and my swap partition.  I now want to copy the tar file from the 
cdrom to /dev/hda1.

Unfortunately I can't seem to figure out how to get to the cdrom drive.  I 
imagine that when I booted the computer, it detected the cdrom drive somehow, 
but dmesg reveals nothing about it.  I've tried to mount /dev/hdc 
through /dev/hde to /cdrom, but I've had no luck.  The message I receive is:

# mount -a
mount: the kernel does not recognize /dev/hdc as a block device (maybe 'insmod 
driver'?)

The relevant entry in /etc/fstab looks like this:

/dev/hdc /cdrom iso9660 1 1

What am I missing?  I've never done an installation like this; these 
newfangled distributions like FC3 and even Debian make everything too easy.


-- 
Richard S. Crawford (mailto: [EMAIL PROTECTED])
AIM: Buffalo2K / http://www.mossroot.com
You can't depend on your judgment when your imagination is out of focus.
-Mark Twain

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04, 10:58 AM, Richard S. Crawford [EMAIL PROTECTED] said:
 I'm trying to build a LuMiX box; the distribution comes as a big tar file on a
 Unfortunately I can't seem to figure out how to get to the cdrom drive.  I 
 imagine that when I booted the computer, it detected the cdrom drive somehow, 
 but dmesg reveals nothing about it.  I've tried to mount /dev/hdc 
 through /dev/hde to /cdrom, but I've had no luck.  The message I receive is:
 
 # mount -a
 mount: the kernel does not recognize /dev/hdc as a block device (maybe 
 'insmod 
 driver'?)
 
 The relevant entry in /etc/fstab looks like this:
 
 /dev/hdc /cdrom iso9660 1 1
 
 What am I missing?  I've never done an installation like this; these 
 newfangled distributions like FC3 and even Debian make everything too easy.

Hi Richard,

Please post:

   dmesg | egrep '^hd[a-z]'

Pete

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Phoenix BIOS Blind Video Switch

2004-12-30 Thread Henry House
På torsdag, 30 december 2004, skrev Peter Jay Salzman:
[...]
 Also, I thought someone had asked this exact question on vox-tech a couple
 of years ago.   Was it Henry House?  Could be wrong.

I asked about redirecting BIOS IO to the serial port at one point. The only
solution to this turned out to be getting a non-i386 machine. :-(

-- 
Henry House
+1 530 753 3361 ext. 13
Please don't send me HTML mail! My mail system usually rejects it.
The unintelligible text that may follow is a digital signature.
See http://hajhouse.org/pgp to find out how to use it.
My OpenPGP key: http://hajhouse.org/hajhouse.asc.



signature.asc
Description: Digital signature
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Phoenix BIOS Blind Video Switch

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04, 11:03 AM, Henry House [EMAIL PROTECTED] said:
 På torsdag, 30 december 2004, skrev Peter Jay Salzman:
 [...]
  Also, I thought someone had asked this exact question on vox-tech a couple
  of years ago.   Was it Henry House?  Could be wrong.
 
 I asked about redirecting BIOS IO to the serial port at one point. The only
 solution to this turned out to be getting a non-i386 machine. :-(
 
Ah, yeah.  That's what I was thinking of.  I remember putting brain power
into a similar question, but couldn't remember what the question actually
was.   :-P

Pete

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


[vox-tech] Running Multiple Distros

2004-12-30 Thread Robert G. Scofield
I have two questions about running more than one Linux distribution on a 
single machine.

#1:  Does the existence of a separate partition for /home mean that it is not 
practical to run more than one Linux distribution on a machine?

I have SuSE on one partition, and I have space allocated for another distro.  
But my home directory is on still another partition.  When certain programs 
are run they put hidden files and directories in /home.  For example .kde is 
a directory containing many subdirectories and some files.

If I install Debian in my spare partition, will the programs in Debian insert 
hidden configuration files that will break SuSE's connection to it's 
configuration files in /home.  Will Debian's .kde break SuSE's connection 
with the .kde that KDE installed when it was originally started in SuSE?

#2  Suppose the answer to #1 is that the second distro will break the first 
distro's connection to it's configuration files in /home.  Will there still 
be a problem if I install the same version of SuSE in the spare partition?

Suppose, for example, that I want a duplicate version of SuSE in which to 
experiment with configuring files and compiling programs so that if I blow 
the system, I can still run the original SuSE system.

Thank you.

Bob
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


trusting downloaded code (was: [vox-tech] Installing Java)

2004-12-30 Thread Henry House
På torsdag, 30 december 2004, skrev Rick Moen:
[...]
 One of the things that downstream package maintainers for distros do for
 you, if they're on the ball at all, is to be at least as alert and
 constructively paranoid and Andrew Brown was.  They're an additional
 check against _both_ quality problems and security compromise, between
 you and various sorts of harm.  You should make use of that protection
 (and other advantages, such as distro-specific patches) preferentially, 
 and be aware of the need to perform personally the same sort of checks
 (e.g., meaningfully verifying PGP signatures and md5sums) and
 distro-specific adjustments, whenever you elect to go outside the
 package system.

I've occasionally speculated that it would be really useful for
distributions to provide a package containing all the public keys used by
upstram maintainers (e.g., kernel.org) to sign releases. There is no
guarantee that when I download Foo Group GmBH's latest tarball and PGP key
from their FTP server, then verify the former against the latter, that I
have not downloaded a compromised tarball AND conpromised PGP key. Thoughts?


-- 
Henry House
+1 530 753 3361 ext. 13
Please don't send me HTML mail! My mail system usually rejects it.
The unintelligible text that may follow is a digital signature.
See http://hajhouse.org/pgp to find out how to use it.
My OpenPGP key: http://hajhouse.org/hajhouse.asc.



signature.asc
Description: Digital signature
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Henry House
På torsdag, 30 december 2004, skrev Richard S. Crawford:
 I'm trying to build a LuMiX box; the distribution comes as a big tar file on 
 a 
 CD.  I've got Tom's Root Boot on a floppy, and I've used it to hose the NT 
 partition that was already on the HD, and I've already created my Linux 
 partitions and my swap partition.  I now want to copy the tar file from the 
 cdrom to /dev/hda1.
 
 Unfortunately I can't seem to figure out how to get to the cdrom drive.  I 
 imagine that when I booted the computer, it detected the cdrom drive somehow, 
 but dmesg reveals nothing about it.  I've tried to mount /dev/hdc 
 through /dev/hde to /cdrom, but I've had no luck.  The message I receive is:
 
 # mount -a
 mount: the kernel does not recognize /dev/hdc as a block device (maybe 
 'insmod 
 driver'?)
 
 The relevant entry in /etc/fstab looks like this:
 
 /dev/hdc /cdrom iso9660 1 1
 
 What am I missing?  I've never done an installation like this; these 
 newfangled distributions like FC3 and even Debian make everything too easy.

Try:

- modprobe ide-cd
- modprobe cdrom

-- 
Henry House
+1 530 753 3361 ext. 13
Please don't send me HTML mail! My mail system usually rejects it.
The unintelligible text that may follow is a digital signature.
See http://hajhouse.org/pgp to find out how to use it.
My OpenPGP key: http://hajhouse.org/hajhouse.asc.



signature.asc
Description: Digital signature
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Running Multiple Distros

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04, 11:11 AM, Robert G. Scofield [EMAIL PROTECTED] said:
 I have two questions about running more than one Linux distribution on a 
 single machine.
 
 #1:  Does the existence of a separate partition for /home mean that it is not 
 practical to run more than one Linux distribution on a machine?
 
You prolly don't want to do this for exactly you suspect.  Different
programs will have different versions on the different distros.  Different
versions, different dotfiles.  It's certainly not going to be a good scene.

If you run two distros, you probably want different home directories.

If you wanted to test out a distro, there's no crime in making a single
partition system.  It's definitely not what you want to use for your for
reals system, but for the purposes of taking an OS out on a test drive,
it's perfectly reasonable to do.

 #2  Suppose the answer to #1 is that the second distro will break the first 
 distro's connection to it's configuration files in /home.  Will there still 
 be a problem if I install the same version of SuSE in the spare partition?

Ummm... not really sure.  Off the top of my head, I'd say it's OK.


This is probably more than you want to do, but one trick that I've used in
the past is to put my home directory files (but not dotfiles) into cvs.
Whenever I'm at someone's house, I can securely pull anything from my home
directory via CVS.  If you've learned CVS from somewhere, it might not be a
bad option to share your personal files between two operating systems.

I understand there's something called LDAP which can do this too, but I
don't know anything about LDAP.

Pete

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: trusting downloaded code (was: [vox-tech] Installing Java)

2004-12-30 Thread Rick Moen
Quoting Henry House ([EMAIL PROTECTED]):

 I've occasionally speculated that it would be really useful for
 distributions to provide a package containing all the public keys used by
 upstram maintainers (e.g., kernel.org) to sign releases. There is no
 guarantee that when I download Foo Group GmBH's latest tarball and PGP key
 from their FTP server, then verify the former against the latter, that I
 have not downloaded a compromised tarball AND conpromised PGP key. Thoughts?

I suppose that would be useful.  

Debian, for example, could have package upstream-keyring to go along
with their debian-keyring package that furnishes the gpg keys of all
registered Debian developers.  

At the same time, they may see maintaining such a package (checking
continually for revocations and compromises, etc.) as not their problem.
Dunno.

A more _standard_ (extant and functional) way you verify that a PGP/gpg
key is valid is via signatures in that key (and absence of a revocation
certificates) in the worldwide web of trust.  Obviously, you would not
_ever_ want to trust an upstream package _merely_ because it was
accompanied by either J. Random PGP/gpg key or an MD5 sum, as any halfway
competent intruder would fake those, too.


___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Running Multiple Distros

2004-12-30 Thread Rod Roark
On Thursday 30 December 2004 11:21 am, Peter Jay Salzman wrote:
 On Thu 30 Dec 04, 11:11 AM, Robert G. Scofield [EMAIL PROTECTED] said:
  I have two questions about running more than one Linux distribution on a 
  single machine.
  
  #1:  Does the existence of a separate partition for /home mean that it is 
  not 
  practical to run more than one Linux distribution on a machine?
  
 You prolly don't want to do this for exactly you suspect.  Different
 programs will have different versions on the different distros.  Different
 versions, different dotfiles.  It's certainly not going to be a good scene.
 
 If you run two distros, you probably want different home directories.

Hmm.  The purpose of a home directory is to hold personal
stuff, for example your mail, documents, browser bookmarks,
contacts, development projects, VIM preferences, desktop
preferences, etc.

In theory each application should have its own unique dot-
file, and be able to deal with compatibility issues across
versions.  In practice some apps might not handle version
differences gracefully; for example I've had to blow away
~/.kde a couple of times in the past after upgrading KDE.

So if what you want to do is work with different distribu-
tions in the course of doing your normal tasks, then it
should be OK to share the home directory - but after making
a backup just in case!

 If you wanted to test out a distro, there's no crime in making a single
 partition system.  It's definitely not what you want to use for your for
 reals system, but for the purposes of taking an OS out on a test drive,
 it's perfectly reasonable to do.

For testing or rescue purposes, absolutely.

  #2  Suppose the answer to #1 is that the second distro will break the first 
  distro's connection to it's configuration files in /home.  Will there still 
  be a problem if I install the same version of SuSE in the spare partition?
 
 Ummm... not really sure.  Off the top of my head, I'd say it's OK.

No problem, I do this kind of thing all the time.

-- Rod
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Running Multiple Distros

2004-12-30 Thread Rick Moen
Quoting Rod Roark ([EMAIL PROTECTED]):

 In theory each application should have its own unique dot-
 file, and be able to deal with compatibility issues across
 versions.  In practice some apps might not handle version
 differences gracefully; for example I've had to blow away
 ~/.kde a couple of times in the past after upgrading KDE.

It should be added that, even when newer versions of the software can
deal gracefully with older versions' dotfiles, the reverse is very often
_not_ the case -- because the developers anticipated people upgrading,
but _not_ their going backwards.  Therefore, with two distros sharing
(e.g.) ~/.kde directories and having different k-app versions, the
distro with older k-apps might get severe indigestion from your shared
~/.kde trees, even if the other doesn't.

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Running Multiple Distros

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04, 12:22 PM, Rick Moen [EMAIL PROTECTED] said:
 Quoting Robert G. Scofield ([EMAIL PROTECTED]):
 
  Is there anyway to install a new distro on /dev/hdb3 and have it use a
  /home on /dev/hdb3?
 
 You betcha.  Just assign the new distro's / (root directory)
 mountpoint to /dev/hdb3, and just avoid assigning mountpoint home to
 /dev/hdb7.  Then, /home will live within /dev/hdb3 by default, rather
 than being on a separate filesystem.
 
Exacly.  I suspect this is the sort of thing that may be more difficult to
explain in advance than it is to actually do.  The solution is as simple
as commenting out one line in /etc/fstab.

If you have any doubts, go ahead and install SuSE on your blank partition.
Try to get SuSE to mount /home on /dev/hdb3.  If you can't figure it out,
and SuSE *insists* on mounting /dev/hdb(whatever) as /home, no worries.
Post back, and the instructions on fixing it the way you want will be
very easy.

Essentially, /etc/fstab is a very important file.  You ask how can I have
two home partitions on a single computer.  The answer is that /etc/fstab
tells the operating system about partitions.  Anything that /etc/fstab
doesn't tell the OS, the OS doesn't know about.  If you make no reference to
home on /dev/hdb7 in /etc/fstab for the new OS, the new OS won't even know
it exists.



BTW, if you wanted to try Debian, Debian lets you do whatever you want,
transparently and easily.  The downside is that the Debian installer  (the
one that comes with Debian) can be a little disconcerting if you're new to
all this aych-dee-bee stuff.  When I first saw the Sarge installer, those
little icons made me pause for a second.  ;)

Pete

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Richard S. Crawford
On Thursday 30 December 2004 11:12, Henry House wrote:

 - modprobe ide-cd
 - modprobe cdrom

# modprobe ide-cd
modprobe: not found

-- 
Richard S. Crawford (mailto: [EMAIL PROTECTED])
AIM: Buffalo2K / http://www.mossroot.com
You can't depend on your judgment when your imagination is out of focus.
-Mark Twain

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Nick Schmalenberger
Jay,
If you haven't already gotten the Blackdown thing from where Rick Moen
said, you could try getting the RPM of JDK from Sun and converting it to
deb with alien, then installing it. It worked nicely for me and I now
have v1.5 , although you may prefer the Blackdown one anyway because it
is apparently more free and certainly easier to install and maintain
with apt. Also, when I used alien on the RPM of just JRE and then
installed the plugins, they didn't work, I had to get JDK.

So that is another option to consider, especially if you want v1.5 .
Alien is useful because a lot of places will only distribute their
proprietary distribution format and RPMs. Something else to consider.
Nick
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Rick Moen
Quoting Nick Schmalenberger ([EMAIL PROTECTED]):

 If you haven't already gotten the Blackdown thing from where Rick Moen
 said, you could try getting the RPM of JDK from Sun and converting it to
 deb with alien, then installing it. It worked nicely for me and I now
 have v1.5 , although you may prefer the Blackdown one anyway because it
 is apparently more free and certainly easier to install and maintain
 with apt.

Just to clarify:  Since Blackdown's versions are an authorised port of 
Sun's software, they're under the same proprietary licence.

-- 
Cheers,  Hardware:  The part you kick.
Rick MoenSoftware:  The part you boot.
[EMAIL PROTECTED]
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Richard S. Crawford
On Thursday 30 December 2004 11:03, Peter Jay Salzman wrote:
 On Thu 30 Dec 04, 10:58 AM, Richard S. Crawford [EMAIL PROTECTED] 
said:
  I'm trying to build a LuMiX box; the distribution comes as a big tar file
  on a Unfortunately I can't seem to figure out how to get to the cdrom
  drive.  I imagine that when I booted the computer, it detected the cdrom
  drive somehow, but dmesg reveals nothing about it.  I've tried to mount
  /dev/hdc through /dev/hde to /cdrom, but I've had no luck.  The message I
  receive is:
 
  # mount -a
  mount: the kernel does not recognize /dev/hdc as a block device (maybe
  'insmod driver'?)
 
  The relevant entry in /etc/fstab looks like this:
 
  /dev/hdc /cdrom iso9660 1 1
 
  What am I missing?  I've never done an installation like this; these
  newfangled distributions like FC3 and even Debian make everything too
  easy.

 Hi Richard,

 Please post:

dmesg | egrep '^hd[a-z]'

# dmesg | egrep '^hd[a-z]'
hda: WDC AC23200L, ATA DISK drive
hda: WDC AC23200L, 2098MB w/256kB Cache, CHS=787/128/63
 hda: hda1 hda2 hda3

Apparently the CD-ROM drive is *not* being detected during boot, even though 
I've got the BIOS to boot from the CD-ROM drive, and it spins up during 
bootup.  The cable to the drive is firmly seated.

-- 
Richard S. Crawford (mailto: [EMAIL PROTECTED])
AIM: Buffalo2K / http://www.mossroot.com
You can't depend on your judgment when your imagination is out of focus.
-Mark Twain

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04,  1:03 PM, Richard S. Crawford [EMAIL PROTECTED] said:
 
 # dmesg | egrep '^hd[a-z]'
 hda: WDC AC23200L, ATA DISK drive
 hda: WDC AC23200L, 2098MB w/256kB Cache, CHS=787/128/63
  hda: hda1 hda2 hda3
 
 Apparently the CD-ROM drive is *not* being detected during boot, even though 
 I've got the BIOS to boot from the CD-ROM drive, and it spins up during 
  ^^^

Oh, oops.  Let me see if I have this straight.  You booted the operating
system off the cdrom drive.  In other words, the kernel was read off a CD,
and still, the cdrom drive isn't detected?

Pete

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04, 12:45 PM, Richard S. Crawford [EMAIL PROTECTED] said:
 On Thursday 30 December 2004 11:12, Henry House wrote:
 
  - modprobe ide-cd
  - modprobe cdrom
 
 # modprobe ide-cd
 modprobe: not found
 
Try insmod.  Modprobe is a fancy schmancy front end to insmod.  :)
You have to get the dependencies right, though.

   insmod /lib/modules/path/to/cdrom.o
   insmod /lib/modules/path/to/ide-cd.o

or

   insmod /lib/modules/path/to/ide-cd.o
   insmod /lib/modules/path/to/cdrom.o

Pete

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Running Multiple Distros

2004-12-30 Thread Robert G. Scofield
On Thursday 30 December 2004 12:13, Rod Roark wrote:
 
  It seems like any new distro put into /dev/hdb3 will automatically
  use /dev/hdb7 (which SuSE 9.2 is using), right?  Is there anyway to
  install a new distro on /dev/hdb3 and have it use a /home on /dev/hdb3?

 I would expect that to be the default.  If the new distro
 does somehow figure out that you were using hdb7 for /home
 and decides to make that the default, it should at least
 give you a chance to override it.

Right, and I just discovered the truth of what you're saying.  You put SuSE9.2 
in my spare partition when you built this Sunset Systems machine.  (Though 
it's not part of the GRUB menu at present and so doesn't boot.) So I just 
cd'd over to that partition and noticed that /home was empty.

But I'm glad I asked this question anyway because of the information I got in 
the responses.  I will use that information in my future experiments.

Thanks again Pete, Rod and Rick.

Bob
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Richard S. Crawford
On Thursday 30 December 2004 13:17, Peter Jay Salzman wrote:

 Oh, oops.  Let me see if I have this straight.  You booted the operating
 system off the cdrom drive.  In other words, the kernel was read off a CD,
 and still, the cdrom drive isn't detected?

Sorry, I was unclear.  Nope, I'm using Tom's Root Boot on a floppy.  The 
computer's set to boot from the CD-ROM drive first, but I figured it wasn't 
since there was nothing in the CD-ROM to boot from.

Going through the BIOS, I find no option to automatically detect all IDE 
drives.  When I go to device list, though, the CD-ROM drive does not show 
up; and I don't see the CD ROM drive listed in the list of IDE devices that 
pop up at the end of the boot sequence before LILO kicks in.  So I'm guessing 
that the CD-ROM drive is not being detected by the system for some reason.

Weird.  I'm going to contact the sysadmin who maintained this computer at the 
library and see if he had disabled the CD-ROM drive for some reason.

-- 
Richard S. Crawford (mailto: [EMAIL PROTECTED])
AIM: Buffalo2K / http://www.mossroot.com
You can't depend on your judgment when your imagination is out of focus.
-Mark Twain

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Ken Bloom
On Thu, Dec 30, 2004 at 01:01:00PM -0800, Rick Moen wrote:
 Quoting Nick Schmalenberger ([EMAIL PROTECTED]):
 
  If you haven't already gotten the Blackdown thing from where Rick Moen
  said, you could try getting the RPM of JDK from Sun and converting it to
  deb with alien, then installing it. It worked nicely for me and I now
  have v1.5 , although you may prefer the Blackdown one anyway because it
  is apparently more free and certainly easier to install and maintain
  with apt.
 
 Just to clarify:  Since Blackdown's versions are an authorised port of 
 Sun's software, they're under the same proprietary licence.

Why do we need Blackdown's versions then if Sun offers downloads for
Linux already?
-- 
I usually have a GPG digital signature included as an attachment.
See http://www.gnupg.org/ for info about these digital signatures.


signature.asc
Description: Digital signature
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04,  2:06 PM, Richard S. Crawford [EMAIL PROTECTED] said:
 On Thursday 30 December 2004 13:17, Peter Jay Salzman wrote:
 
  Oh, oops.  Let me see if I have this straight.  You booted the operating
  system off the cdrom drive.  In other words, the kernel was read off a CD,
  and still, the cdrom drive isn't detected?
 
 Sorry, I was unclear.  Nope, I'm using Tom's Root Boot on a floppy.  The 
 computer's set to boot from the CD-ROM drive first, but I figured it wasn't 
 since there was nothing in the CD-ROM to boot from.
 
 Going through the BIOS, I find no option to automatically detect all IDE 
 drives.  When I go to device list, though, the CD-ROM drive does not show 
 up; and I don't see the CD ROM drive listed in the list of IDE devices that 
 pop up at the end of the boot sequence before LILO kicks in.  So I'm guessing 
 that the CD-ROM drive is not being detected by the system for some reason.
 
 Weird.  I'm going to contact the sysadmin who maintained this computer at the 
 library and see if he had disabled the CD-ROM drive for some reason.
 
Agreed: wierd.  IDE (at this level) is usually foolproof.  I can't think of
any way to disable a cdrom.

One last thing you might want to try: press the open door button (or if
the cdrom has a light, see if the light goes on) when the system turns on.
Honestly, this sounds like the cdrom drive isn't getting power.

Actually, one more thing pops to mind.  Maybe this used to be a SCSI only
system, so BIOS was set to reserve IRQ 14/15?  But if this were the case,
I'd think that BIOS would still report the hardware.  Maybe I'm wrong.  I've
never really understood the interplay between BIOS and the PC very well.
It's still a very mysterious thing to me.

Pete

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Running Multiple Distros

2004-12-30 Thread Ken Bloom
On Thu, Dec 30, 2004 at 11:11:47AM -0800, Robert G. Scofield wrote:
 I have two questions about running more than one Linux distribution on a 
 single machine.
 
 #1:  Does the existence of a separate partition for /home mean that it is not 
 practical to run more than one Linux distribution on a machine?
 
 I have SuSE on one partition, and I have space allocated for another distro.  
 But my home directory is on still another partition.  When certain programs 
 are run they put hidden files and directories in /home.  For example .kde is 
 a directory containing many subdirectories and some files.
 
 If I install Debian in my spare partition, will the programs in Debian insert 
 hidden configuration files that will break SuSE's connection to it's 
 configuration files in /home.  Will Debian's .kde break SuSE's connection 
 with the .kde that KDE installed when it was originally started in SuSE?

See an answer I wrote to this question previously at
http://lugod.org/mailinglists/archives/vox-tech/2004-07/msg00264.html

 #2  Suppose the answer to #1 is that the second distro will break the first 
 distro's connection to it's configuration files in /home.  Will there still 
 be a problem if I install the same version of SuSE in the spare partition?
 
 Suppose, for example, that I want a duplicate version of SuSE in which to 
 experiment with configuring files and compiling programs so that if I blow 
 the system, I can still run the original SuSE system.

-- 
I usually have a GPG digital signature included as an attachment.
See http://www.gnupg.org/ for info about these digital signatures.


signature.asc
Description: Digital signature
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Nick Schmalenberger
 Message: 7
 Date: Thu, 30 Dec 2004 13:01:00 -0800
 From: Rick Moen [EMAIL PROTECTED]
 Subject: Re: [vox-tech] Installing Java
 To: vox-tech@lists.lugod.org
 Message-ID: [EMAIL PROTECTED]
 Content-Type: text/plain; charset=us-ascii
[snip]
  have v1.5 , although you may prefer the Blackdown one anyway because it
  is apparently more free and certainly easier to install and maintain
  with apt.
 
 Just to clarify:  Since Blackdown's versions are an authorised port of 
 Sun's software, they're under the same proprietary licence.
Huh. Thanks, I didn't know that. Previously I had the impression that
Blackdown was a totally Sun-independent implementation of Java, which
was why it was behind in Java compatibility, but had a more free
license. So then is more Linux compatibility at the cost of less Java
compatibility all there is to Blackdown? 
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04,  2:15 PM, Ken Bloom [EMAIL PROTECTED] said:
 On Thu, Dec 30, 2004 at 01:01:00PM -0800, Rick Moen wrote:
  Quoting Nick Schmalenberger ([EMAIL PROTECTED]):
  
   If you haven't already gotten the Blackdown thing from where Rick Moen
   said, you could try getting the RPM of JDK from Sun and converting it to
   deb with alien, then installing it. It worked nicely for me and I now
   have v1.5 , although you may prefer the Blackdown one anyway because it
   is apparently more free and certainly easier to install and maintain
   with apt.
  
  Just to clarify:  Since Blackdown's versions are an authorised port of 
  Sun's software, they're under the same proprietary licence.
 
 Why do we need Blackdown's versions then if Sun offers downloads for
 Linux already?

From Google blackdown Sun java comparison linux:




1. http://www.magelang.com/faq/printablefaq.jsp?topic=Linux


Why are there two ports of J2SE for Linux (one from Blackdown, one from Sun)?
Location: http://www.jguru.com/faq/view.jsp?EID=47694
Created: May 11, 2000 Modified: 2000-05-21 17:02:35.591
Author: Alex Chaffee (http://www.jguru.com/guru/viewbio.jsp?EID=3)

According to Sun senior product manager Blake Connell, on a chat on the JDC:

Sun's port is a commercial grade port that is supported by Sun's technical
support programs. Our port is intended for customers who need the backing of
a commerical entity. The Blackdown port is a bit more leading edge (thread
support, multi-processors) and the Blackdown folks can rapidly respond with
changes and modifications and post them on their web site. Sun must run
through a detailed test matrix to release. 


Some recent comments from Sun suggest that Sun will...
Author: Nathan Meyers (http://www.jguru.com/guru/viewbio.jsp?EID=138686),
Oct 29, 2000
Some recent comments from Sun suggest that Sun will take primary ownership
of releasing future Linux JDK ports and Blackdown will concentrate on Linux
ports of extensions, such as audio, 3D, serial port, and such.





2. http://www.linuxworld.com/story/32610_p.htm

You needn't sweat the decision. Sun uses the code from Blackdown as the
basis for its SDK, so the two distributions are very similar. In some
respects, the Sun version is more complete, but Blackdown offers some extra
goodies you won't get from Sun, such as the Java Web Start utility (a way to
launch Java applications from a browser). King Solomon-like, I installed
both. I use Backdown's Java Web Start and Sun's SDK.







-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Richard S. Crawford
On Thursday 30 December 2004 14:06, Richard S. Crawford wrote:

 Weird.  I'm going to contact the sysadmin who maintained this computer at
 the library and see if he had disabled the CD-ROM drive for some reason.

The CD-ROM drive *had* been disabled.  There was a place in the BIOS to enable 
it, but it was hidden.  I found it, enabled the hard drive, and was able to 
mount /dev/hdc to /cdrom.

Thanks for all the help and suggestions.

-- 
Richard S. Crawford (mailto: [EMAIL PROTECTED])
AIM: Buffalo2K / http://www.mossroot.com
You can't depend on your judgment when your imagination is out of focus.
-Mark Twain

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Rick Moen
Quoting Ken Bloom ([EMAIL PROTECTED]):

 Why do we need Blackdown's versions then if Sun offers downloads for
 Linux already?

Are you asking how and why Blackdown's port came to exist in the first
place, or are you asking why a Linux user might favour one over the other?

I'm not exactly Mr. Java Guy[1], but (to take a shot at the first question)
my vague understanding is that the Blackdown Group ported Sun's JDK to 
Linux (with permission) before Sun itself became interested in doing so
-- accounting for the present existence of two releases for Linux.

As to which JDK a Linux user might prefer and why:  I suppose that the 
generally superior packing for Linux (and for various Linux distros) of 
Blackdown's port might be persuasive to some, and the upstream Sun
version's inherently earliest access to new JDK releases would be more
persuasive to others.

The latter would particularly be the case if you're one of those The
hell with package management; I'll just build shiny-new software under
/usr/local or /opt people.  As you'll have guessed, I'm definitely not
one of those.

[1] Not intending any form of criticism, but my personal choice of JDKs,
between the two, is None of The Above.  ;-

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Rick Moen
Quoting Nick Schmalenberger ([EMAIL PROTECTED]):

 Huh. Thanks, I didn't know that. Previously I had the impression that
 Blackdown was a totally Sun-independent implementation of Java, which
 was why it was behind in Java compatibility, but had a more free
 license. So then is more Linux compatibility at the cost of less Java
 compatibility all there is to Blackdown? 

I defer to Pete's scholarly answer on the point -- except to add (and
please pardon the slight repetition) that Blackdown seems to do a much
better job of fully porting and packaging the software properly for Linux
distros.


___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Accessing cdrom from Tom's Root Boot

2004-12-30 Thread Richard S. Crawford
On Thursday 30 December 2004 14:17, Peter Jay Salzman wrote:

 Agreed: wierd.  IDE (at this level) is usually foolproof.  I can't think of
 any way to disable a cdrom.

I think he had disabled the auto-detect for IDE drives beyond the first 
device.  It was set to detect the hard drive, and had options to auto-detect 
another primary drive, and two secondary drives.  Those were all disabled.  I 
set the first secondary drive to auto-detect CD-ROM, and that fixed it.

This computer was originally located in a public library.  I imagine that the 
previous sysadmin had done this (and set the setup password as well) in order 
to protect the computer from being tampered with.

-- 
Richard S. Crawford (mailto: [EMAIL PROTECTED])
AIM: Buffalo2K / http://www.mossroot.com
You can't depend on your judgment when your imagination is out of focus.
-Mark Twain

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Peter Jay Salzman
On Thu 30 Dec 04,  2:35 PM, Rick Moen [EMAIL PROTECTED] said:
 Quoting Nick Schmalenberger ([EMAIL PROTECTED]):
 
  Huh. Thanks, I didn't know that. Previously I had the impression that
  Blackdown was a totally Sun-independent implementation of Java, which
  was why it was behind in Java compatibility, but had a more free
  license. So then is more Linux compatibility at the cost of less Java
  compatibility all there is to Blackdown? 
 
 I defer to Pete's scholarly answer on the point -- except to add (and
 please pardon the slight repetition) that Blackdown seems to do a much
 better job of fully porting and packaging the software properly for Linux
 distros.
 
Heh.  Don't look at me!  I'm *completely* on your side:
   
   * I bypass package management only as a *very* last resort (like when
  the Debian Yadex package was a _full two years_ out of date.  Even
  then, time permitting, I'll create my own personal Debian package
  and install the software that way (especially if the tarball in
  question uses autoconf).

   * Couldn't care less about Java.  I think slow must have been one of
  the Java design principles...   ;)

Pete (who got suckered to purchase IBM's Via Voice, oh so long ago)

-- 
The mathematics of physics has become ever more abstract, rather than more
complicated.  The mind of God appears to be abstract but not complicated.
He also appears to like group theory.  --  Tony Zee's Fearful Symmetry

GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E  70A9 A3B9 1945 67EA 951D
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: [vox-tech] Installing Java

2004-12-30 Thread Rick Moen
Quoting Peter Jay Salzman ([EMAIL PROTECTED]):

 Heh.  Don't look at me!  I'm *completely* on your side:

Just to make sure I'm clear about this, I thought your reply (with the
two quotations, from the Java FAQ and from Petreley) was excellent, and
quite informative.  Appreciated.

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


[vox-tech] a new GRASS user group in the Davis area ?

2004-12-30 Thread Dylan Beaudette
Hi everyone!

After some thought, and bouncing a couple of messages off of the people in
the official GRASS mailing list - it seems that there may be enough people
in the Davis area to start a user group for the open source GIS and image
analysis platform known as GRASS (http://grass.itc.it/index.php).

However, before anything happens I am curious if anyone in the davis linux
user group would be interested in GRASS, or perhaps if anyone has any
ideas on how this user group should be setup. Specifically, would it be
possible (or even desireable) to have the GRASS group associated (in some
way shape or form) with the davis linux user group.

some of the objectives of the GRASS user group would be:
-installation and setup of the GRASS environment for new users
-examples of how to use the program
-trouble shooting and general advice
-integration of local solutions or bugfixes back into the main source
tree, via the GRASS project leaders
-development of methods and workflow for a fully-functional open source
digital cartography system: composed of GRASS, GM, and perhaps the GIMP
and others?
-anything else that comes to mind!

Any ideas?

thanks in advance!!

Dylan
___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: trusting downloaded code (was: [vox-tech] Installing Java)

2004-12-30 Thread Richard Harke
On Thursday 30 December 2004 11:34, Rick Moen wrote:
 Quoting Henry House ([EMAIL PROTECTED]):
  I've occasionally speculated that it would be really useful for
  distributions to provide a package containing all the public keys used by
  upstram maintainers (e.g., kernel.org) to sign releases. There is no
  guarantee that when I download Foo Group GmBH's latest tarball and PGP
  key from their FTP server, then verify the former against the latter,
  that I have not downloaded a compromised tarball AND conpromised PGP key.
  Thoughts?


 A more _standard_ (extant and functional) way you verify that a PGP/gpg
 key is valid is via signatures in that key (and absence of a revocation
 certificates) in the worldwide web of trust.  Obviously, you would not
 _ever_ want to trust an upstream package _merely_ because it was
 accompanied by either J. Random PGP/gpg key or an MD5 sum, as any halfway
 competent intruder would fake those, too.
For some packages I have downloaded, the signers key is retrieved from a 
different site. I also then check against a key server. This is not foolproof
but it does make the bad guys job harder. Another factor is time. If I use the
same sites over again, I may be able to check against a key I got some
time ago. Presumably, if it would have been compromised, it would have
been canceled and a new key generated.

Richard Harke

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech


Re: trusting downloaded code (was: [vox-tech] Installing Java)

2004-12-30 Thread Rick Moen
Quoting Richard Harke ([EMAIL PROTECTED]):

 For some packages I have downloaded, the signers key is retrieved from
 a different site. I also then check against a key server. This is not
 foolproof but it does make the bad guys job harder. Another factor is
 time. If I use the same sites over again, I may be able to check
 against a key I got some time ago. Presumably, if it would have been
 compromised, it would have been canceled and a new key generated.

Yes, these are both good rules of thumb.  

I don't think that best practices[1] on this subject have been written
about, much.  It might make a good article.

[1] And I don't mean
http://linuxmafia.com/~rick/lexicon.html#best-practices .  ;-

___
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech