Yuck!!!

[Dave Laird]

Good morning, everyone --- especially James... 8-)

I took my development machine last night and upgraded it from Mandrake
10.0 to 10.1, with the *possible thought* that I might get my hands on
the newest kernel from Mandrake, and perhaps see how their development
of KDE 3.3 has come along. That was a BAD mistake. No, let's use the
proper syntax-- it was a freakin' disaster!

There are serious problems in this latest update, but I suspect the
problem actually goes much deeper than that. You see, as I commented
last month, Mandrake is now Mandriva, and it seems they do not
remember all the lessons they learned from the various releases of the
last five years. Here are some of the more obvious issues:

1. 10.1 crashes the kernel, regardless how you tweak the SIX kernel
releases they ship with 10.1. I've never seen any upgrade, from any of
the distributions send more than one or two kernels with their
updates.

2. Once you get past the weirdness with the kernels (if you must
upgrade, by all means select the oldest kernel release, because it is
the only one that works.) then there are the entire /dev directory is
now a different beast. You get all kinds of /dev errors, and even
after you geld the new /dev development tools, they occasionally pop
up and bite you on the butt.

3. Stable? Did I hear stable? The underlying code that runs KDE is a
real piece of work! Some of the binaries work; some simply lay there
and stare at you from the carpet, which is where they fell when the
system rebooted. I've seen better BETA crap than the KDE 3.3
implementation by Mandriva.

4. Given that you are as persevering as I am, that you endured nearly
five hours of work, getting this piece of crap running on what was
once a stable, reliable back-up system for my main workstation, I had
an unworkable, unusable system that I wouldn't even let me download
the latest updates from the new-and-improved Mandrive sites. Finally,
nearly six hours after I began, I scrapped the new version of Mandriva
and re-installed Mandrake for what is probably the last time.

James, sit up and take notice. First my development box and as soon
thereafter as my busy schedule permits, I am making the leap to Debian
workstations. However, in view of the fact that a certain server you
and I both frequent that runs Debian's latest just got compromised two
days ago, I want to wait awhile before I consider Debian as a
full-time head-on to the Internet server.

One question, and then I go...

Did they fix the Debian installation yet? Which version should I use?

Dave
--
Dave on the Road...

[James Vahn]

However, in view of the fact that a certain server you and I both
frequent that runs Debian's latest just got compromised two days ago,

Do you have any more info? I haven't talked to anyone there since Bob
left.

One question, and then I go...
Did they fix the Debian installation yet? Which version should I use?

http://cdimage.debian.org/pub/cdimage-testing/sarge_d-i/i386/rc3/
sarge-i386-netinst.iso


--

[Dave Laird]

Good morning, James...

On Fri, 6 May 2005 02:25:22 +0000 (UTC), James Vahn

Post by James Vahn
Do you have any more info? I haven't talked to anyone there since Bob
left.

Harry Hanson is the man-in-charge these days, and from what little I
have been able to decipher, it was an Apache web exploit that was at
the root of the compromise.

Post by James Vahn

Post by Dave Laird
One question, and then I go...
Did they fix the Debian installation yet? Which version should I use?

http://cdimage.debian.org/pub/cdimage-testing/sarge_d-i/i386/rc3/
sarge-i386-netinst.iso

Well, I am *somewhat* experienced with Sarge, since I was running it
on the development box for several months. After all the totally
*disgusting* things that have happened in the last few days with
Mandrake/Mandriva I decided this morning to take the plunge, and as we
are chatting here, on the laptop, I am installing X-Windows/KDE/Gnome
on my PRODUCTION workstation. I can immediately see the improvements
to the network installation application, as it is nearly seamless. In
fact, compared to nearly all the systems I have tested at the desktop
level thus far, it is now, by far, one of the easiest and most
forgiving installation program I have seen, bar NONE.

When I was declaring my default drives, those existing drives I didn't
want to format or destroy, I deliberately gave the same mount points
(/Workspace1 and /Workspace1) to two different partitions. Debian not
only caught the error, but allowed me to *gracefully* back track and
correct my deliberate error. Very smooth, very intuitive and once the
correct entries were made, it recovered nicely and allowed me to
continue as if nothing happened. ;-)

According to the installation program, I have 1 hour 12 minutes left
before it will have completely installed a working X-Windows desktop
for me. Of course, with 5 Meg DSL circuit, which was recently upgraded
from 1.5 Meg DSL, your times may differ. However, in Debian's defense,
it should be noted that there is little to no lag time at their end;
any slowdowns I perceive, I am sure, are because I am taking a full
news feed at the moment. I would HATE to think of trying to install
Debian over the network using a dial-up connection.

So, look to the East. When you see the rising sun, I'll be there
shortly.

Dave
--
Dave On the Road

[James Vahn]

Post by Dave Laird
Harry Hanson is the man-in-charge these days, and from what little I
have been able to decipher, it was an Apache web exploit that was at
the root of the compromise.

It's hard to even speculate. Could be something like a user leaving his
password taped to a monitor where he works. Difficult to say. What sort
of compromise was it?

Post by Dave Laird
I would HATE to think of trying to install Debian over the network
using a dial-up connection.

About 4 hours to install a minimal system with a 28.8 modem. Still, it's
better than downloading full CDs that other distributions have us do.
That would take weeks.

I maintain a partial mirror made from upgrades, a package called "mondo"
can put it on 2 CD's and make things less painful if for some reason it
needs to leave the house.

Nice program, btw. Mondo creates a series of *bootable* CDs for backup
purposes. You could use them to clone a system. :-)


--

[Dave Laird]

Good morning, James...

Post by James Vahn

Post by Dave Laird
Harry Hanson is the man-in-charge these days, and from what little I
have been able to decipher, it was an Apache web exploit that was at
the root of the compromise.

It's hard to even speculate. Could be something like a user leaving his
password taped to a monitor where he works. Difficult to say. What sort
of compromise was it?

It apparently was an Apache compromise, and judging by what I have read on
it over the last 48 hours or so, it was a well-established exploit using
virtual web page design, where you chroot a user's web page to their user
name. Unfortunately, in the version of chroot being used at the time, one
or more users figured out how to drop to increased permissions, and
started changing some system binaries, such as top and a handful of
others. However, they weren't able to gain access to full root
permissions; otherwise the server would be completely down, not just
walking wounded.

Post by James Vahn

Post by Dave Laird
I would HATE to think of trying to install Debian over the network
using a dial-up connection.

About 4 hours to install a minimal system with a 28.8 modem. Still, it's
better than downloading full CDs that other distributions have us do.
That would take weeks.

Yup. Been there, seen that, and once even done that (RedHat 6.0) 8-(.

Post by James Vahn
I maintain a partial mirror made from upgrades, a package called "mondo"
can put it on 2 CD's and make things less painful if for some reason it
needs to leave the house.
Nice program, btw. Mondo creates a series of *bootable* CDs for backup
purposes. You could use them to clone a system. :-)

REALLY? Tell me more. <huge grin>

Dave
--
Dave Laird (***@kharma.net)
The Used Kharma Lot / The Phoenix Project
Web Page: http://www.kharma.net updated 05/01/2005
Usenet News server: news.kharma.net
Musicians Calendar and Database access: http://www.kharma.net/calendar.html

An automatic & random thought For the Minute:
Suspicion always haunts the guilty mind.
-- Wm. Shakespeare

[James Vahn]

Post by Dave Laird
It apparently was an Apache compromise, and judging by what I have read on
it over the last 48 hours or so, it was a well-established exploit using
virtual web page design, where you chroot a user's web page to their user
name.

Well-established and there's no fix for it?

Post by Dave Laird

Post by James Vahn
Nice program, btw. Mondo creates a series of *bootable* CDs for backup
purposes. You could use them to clone a system. :-)

REALLY? Tell me more. <huge grin>

http://www.mondorescue.org/


--

[James Vahn]

Post by James Vahn
http://www.mondorescue.org/

On second thought, we can do better than that..!

apt-get install dwww mondo-doc

When the wheels stop turning, point your web browser to
http:/localhost/dwww

and at the top is a link to the "/usr/share/doc" directory. Look for
mondo-doc and away you go.


--

[Dave Laird]

Good afternoon, again...

Post by James Vahn

Post by James Vahn
http://www.mondorescue.org/

On second thought, we can do better than that..!
apt-get install dwww mondo-doc
When the wheels stop turning, point your web browser to
http:/localhost/dwww
and at the top is a link to the "/usr/share/doc" directory. Look for
mondo-doc and away you go.

Damn, but that is COOL! I had a similar routine built into my Mandrake
box, but it wasn't nearly so pretty nor half as functional, either. This
allows me to read the docs like they were *supposed* to be read. Hehehe...

Dave

[Dave Laird]

Good afternoon, James...

Post by James Vahn

Post by Dave Laird
It apparently was an Apache compromise, and judging by what I have read
on it over the last 48 hours or so, it was a well-established exploit
using virtual web page design, where you chroot a user's web page to
their user name.

Well-established and there's no fix for it?

Post by Dave Laird

Post by James Vahn
Nice program, btw. Mondo creates a series of *bootable* CDs for backup
purposes. You could use them to clone a system. :-)

REALLY? Tell me more. <huge grin>

http://www.mondorescue.org/

INSTALLED
TESTED

I LIKE it!! My CD-Burner is getting a workout!

Dave

[Dave Laird]

Good evening, James...

Post by James Vahn

Post by Dave Laird
Did they fix the Debian installation yet? Which version should I use?

http://cdimage.debian.org/pub/cdimage-testing/sarge_d-i/i386/rc3/
sarge-i386-netinst.iso

Well, earlier I gave the short version of my conversion. Now here is the
longer version, including how I overcame several situations where I didn't
quite know for certain what to do or how to proceed to achieve certain
objectives.

INSTALLING DEBIAN:

Nothing really prepared me for the ease of use of the new install CD which
I downloaded from the link James gave me earlier. I downloaded it, burned
it to CD and simply rebooted. What was even more beautiful, from an
end-users perspective, is that the entire process is intuitive, and
allowing for a fast DSL or cable connection, actually installing and
configuring Debian from scratch would take you less than an hour and
one-half, start to finish. It defaults to KDE AND Gnome desktops, but
there is plainly the opportunity to download and configure other desktops
in addition. What the heck, I say. Nobody needs more than KDE and Gnome,
anyway. 8-)

What really *impressed* me, however, was not the ease of use. Since I was
at it, I decided to deliberately make several key mistakes, any one of
which could cause trouble during the install/configure cycle, by
themselves. In each case, Debian caught my mistake(s), stopping the
install process long enough to ask me to please correct my errant ways,
and then proceeded on with the installation without a hitch.

As you may recall, several months ago I tested nearly *all* the mainstream
Linux distributions and wrote brief overviews of my impressions of each
distribution I tested. One of the "features" I specifically tested for was
the ability of installation applications to detect (and correct) user
errors. At that time, Debian didn't really have a really strong
installation program, and like ALL the rest, couldn't detect most errors.
They have since fixed the installation program, and I, for one, LIKE it.

CONFIGURATION READY TO RUN...

Again, I had to test one of my pet peeves, during the actual configuration
process, when the installation application begins configuring things. One
of the absolute WORST mistakes you can make is to mis-configure X-Windows,
regardless of which Linux distribution you use. So, rather than take a
chance of crashing the whole bootleg operation down around my ears, I
deliberately set my ATI-TV card to 800 by 600, a much lower resolution
than I have ever used in my entire life.

As soon as KDE was up and running (it was a simple menu-driven
configuration that caught me by surprise) I started looking for how to get
X-Windows running in something more reasonable, say 1024 by 768 or higher,
as my video card goes all the way up to 1200 by 1200 (too small for my
sight, even with thick reading glasses). It was there, right in the man
pages, right where everything I ever needed, was neatly organized for me.

Unlike Mandrake, RedHat, and a handful of others, ALL my pet widgets, such
as Kweather, came up running just fine, once I rebooted into KDE. It
actually took less than two hours, start to finish, before I was sitting
down at the keyboard and transacting business-as-usual. Not bad, not bad
at all. Jack, are you listening in? Start reading the web pages for
Debian. <huge grin>

PLUS getting new applications is a whiz, as I knew from my previous
experiences with Debian, thanks to James. I'm through tweaking stuff for
now, although I have to undo Postgres SQL and install the latest version
of MySQL, which wasn't even available from Mandrake, the last time I
looked. Then, of course, because I am in Debian, I can also grab Knoda,
which is a NEW but vital application for databases. Whew! This is way
cool, James.

My thanks to all who participated and cheered when I brought KDE up this
afternoon. Your anonymity will be protected... hehehehe...

Dave
--
Dave Laird (***@kharma.net)
The Used Kharma Lot / The Phoenix Project
Web Page: http://www.kharma.net updated 05/01/2005
Usenet News server: news.kharma.net
Musicians Calendar and Database access: http://www.kharma.net/calendar.html

An automatic & random thought For the Minute:
Q: What's the difference between a Mac and an Etch-a-Sketch?
A: You don't have to shake the Mac to clear the screen.

[James Vahn]

Post by Dave Laird
one-half, start to finish. It defaults to KDE AND Gnome desktops, but
there is plainly the opportunity to download and configure other desktops
in addition. What the heck, I say. Nobody needs more than KDE and Gnome,
anyway. 8-)

Sounds like you used the task selector.. For whatever reason, they
didn't split gnome and kde away from each other. It's fairly easy
to avoid doing this though, but never mind-- Gnome has some good apps
and eventually ends up being installed anyway.

Post by Dave Laird
of the absolute WORST mistakes you can make is to mis-configure X-Windows,
regardless of which Linux distribution you use. So, rather than take a
chance of crashing the whole bootleg operation down around my ears, I
deliberately set my ATI-TV card to 800 by 600, a much lower resolution
than I have ever used in my entire life.

Write this down: dpkg-reconfigure xserver-xfree86

You can reconfigure X at any time. Note that if you make any changes with
an editor that the md5sum won't match and your changes will be safe from
auto-upgrade disasters. There's a program called "configure-debian" that
you might want to look at too.

Post by Dave Laird
looked. Then, of course, because I am in Debian, I can also grab Knoda,
which is a NEW but vital application for databases. Whew! This is way
cool, James.

Try installing "wajig" for extra coolness. It replaces apt-get and a lot
of other things. It even has a search function for packages not in the
offical archives. Kinda neat:

~$ wajig unofficial knoda
Lines suitable for /etc/apt/sources.list
deb http://http.guadalinex.org/repositorio muflon guada
deb http://download.gna.org/praksys praksys/
deb http://download.gna.org/praksys praksys-testing/
2 sites and 3 packages matched. Search took 10.137 seconds.

Read up on "man apt_preferences" before adding sites to sources.list,
else you may experience unpleasant suprises. Like ending up with Ubuntu
instead of Debian, for example.


--

[Dave Laird]

Good morning, James...

Post by James Vahn
Sounds like you used the task selector.. For whatever reason, they
didn't split gnome and kde away from each other. It's fairly easy
to avoid doing this though, but never mind-- Gnome has some good apps
and eventually ends up being installed anyway.

What can I say? I've been in situations where KDE wouldn't start, because
of DCOP errors, and I simply hopped over to Gnome, fixed the errors and
went back to work. I like what I can do with KDE's desktop, the slide show
for the desktop background, and the confusing way it creates the user menu.

Post by James Vahn

Post by Dave Laird
of the absolute WORST mistakes you can make is to mis-configure
X-Windows, regardless of which Linux distribution you use. So, rather
than take a chance of crashing the whole bootleg operation down around my
ears, I deliberately set my ATI-TV card to 800 by 600, a much lower
resolution than I have ever used in my entire life.

Write this down: dpkg-reconfigure xserver-xfree86

I found that right in the man pages. <grin> And I completely overhauled my
X-Windows settings several different ways with no uncontrollable crashes.
Not one! I see where some of the minor glitches in the X system have been
fixed, as well. No "squiggles" in the corner of my high-resolution monitor
when the TV is on. 8-)

Post by James Vahn
You can reconfigure X at any time. Note that if you make any changes with
an editor that the md5sum won't match and your changes will be safe from
auto-upgrade disasters. There's a program called "configure-debian" that
you might want to look at too.

I grabbed it, but I haven't read the documentation yet.

Post by James Vahn
Try installing "wajig" for extra coolness. It replaces apt-get and a lot
of other things. It even has a search function for packages not in the
~$ wajig unofficial knoda
Lines suitable for /etc/apt/sources.list
deb http://http.guadalinex.org/repositorio muflon guada
deb http://download.gna.org/praksys praksys/
deb http://download.gna.org/praksys praksys-testing/
2 sites and 3 packages matched. Search took 10.137 seconds.
Read up on "man apt_preferences" before adding sites to sources.list,
else you may experience unpleasant suprises. Like ending up with Ubuntu
instead of Debian, for example.

I've been hearing about Ubuntu, including some comments that it is the
"next generation" of Linux open source software. Matt Wood even muttered
something to me about it the other day. What have YOU heard about it?

Dave
--
Dave Laird (***@kharma.net)
The Used Kharma Lot / The Phoenix Project
Web Page: http://www.kharma.net updated 05/01/2005
Usenet News server: news.kharma.net
Musicians Calendar and Database access: http://www.kharma.net/calendar.html

An automatic & random thought For the Minute:
Q: How do you catch a unique rabbit?
A: Unique up on it!

Q: How do you catch a tame rabbit?
A: The tame way!

[James Vahn]

Post by Dave Laird
I've been hearing about Ubuntu, including some comments that it is the
"next generation" of Linux open source software. Matt Wood even muttered
something to me about it the other day. What have YOU heard about it?

Not much, but apparently Ubuntu is a mixed system- some of theirs and
some of Debian's. Unfortunately, Debian is inadvertantly being asked to
debug the Ubuntu OS because the @debian.org addresses appear as Ubuntu
maintainers. Debian wants Ubuntu to maintain their own OS.


--

[Dave Laird]

Good afternoon, James...

Post by James Vahn
Not much, but apparently Ubuntu is a mixed system- some of theirs and
some of Debian's. Unfortunately, Debian is inadvertantly being asked to
maintainers. Debian wants Ubuntu to maintain their own OS.

SNORT!! I'll tell you what, I'll develop a new system, call it Laird's
Folly, using all the Debian packaging, develop branding for all the
applications for my ego's sake, and since it all will be composed of
Debian stuff, maybe they would support it for ME? Why, SURE. Why not?

Dave
--
Dave Laird (***@kharma.net)
The Used Kharma Lot / The Phoenix Project
Web Page: http://www.kharma.net updated 05/01/2005
Usenet News server: news.kharma.net
Musicians Calendar and Database access: http://www.kharma.net/calendar.html

An automatic & random thought For the Minute:
Hell is empty and all the devils are here.
-- Wm. Shakespeare, "The Tempest"