Serious Android Flaw

Just a brief post to direct anyone who has or is considering buying an Android device to an article detailing a rather shocking security glitch. It turns out, probably due to a botched debug code cleanup, that the devices run with a terminal in the background capturing any and all keystrokes!

When the phone booted it started up a command shell as root and sent every keystroke you ever typed on the keyboard from then on to that shell. Thus every word you typed, in addition to going to the foreground application would be silently and invisibly interpreted as a command and executed with superuser privileges. Wow!

Be careful what you type in your text messages or URLs otherwise you might end up with a trashed software stack…

Android G1 : Hands on review

Since the first mobile running on Google’s Android software platform was announced, I have been eagerly awaiting it’s release here in the UK. Well this week it finally happened, so yesterday I went into a T Mobile shop to have a play with one. Unfortunately it is a bit of a mixed bag, whilst looking quite stylish (it looked a bit ugly from the photos) there are a number of bad points about the G1 which unfortunately terminally let it down.

First off, the slide. I actually rather like this part, despite being highly dubious about overly elaborate mechanisms, the G1 screen slides up and to the right cleanly and locks into place with a fairly reassuring click. The problem is the G1 is not comfortable to hold in the horizontal position, and I found the keyboard buttons to be inadequate for any serious use. However the most serious problem with this was that the screen was not fully locked into place. Given that it is a touch screen the fact that the whole screen section flexes backwards and strains against the sliding mechanism, even the smallest amount of force is exerted against it, is very worrying.

The touchscreen itself worked quite well and Android has definitely incorporated several design elements that Apple initially came up with. However it feels like Google were as eager to incorporate finger swiping functions as they were not to look like they were copying Apple and as such there are two different ways of scrolling through icon menus like the ‘desktop’ and the application menu which just feels silly and inconsistent. The overall layout and design of the menus and functionality felt poor and counter intuitive. This was felt especially in the web-browser which, whilst working well ( and really showing how nice the screen was) felt clunky and unfriendly to navigate and use. There was also an issue with flash plugins but I am assuming that would be fixed by an update.

Overall, the G1 very much feels like the unfinished article. The black one looks surprisingly nice in the person, but an inconsistent GUI / navigation system lets it down as well as the quality of the screen sliding retention mechanism. Still, thankfully this is not the Android phone, but the first version running the software platform. I have high expectations of future phones and can only hope that meager sales will not put off other companies from adopting this platform.

Ubuntu 8.10 Intrepid Ibex MD5 Checksums

Well Ubuntu 8.10 has finally been released! I have been tinkering with prereleases for the past couple of weeks but now I am looking forward to trying out the release version on a machine! Once again however canonical have been a bit cryptic about providing good links to their iso MD5 hashes (or checksums), so as before, here are the MD5s for Ubuntu, Kubuntu, Edubuntu, ubuntustudio, Mythbuntu, and Xubunutu 8.10:

ea6d44667ea3fd435954d6e1f0e89122 *ubuntu-8.10-alternate-amd64.iso
f9e0494e91abb2de4929ef6e957f7753 *ubuntu-8.10-alternate-i386.iso
f9cdb7e9ad85263dde17f8fc81a6305b *ubuntu-8.10-desktop-amd64.iso
24ea1163ea6c9f5dae77de8c49ee7c03 *ubuntu-8.10-desktop-i386.iso
8d35fea8c16597a6f4dd07f8e18e2166 *ubuntu-8.10-mid-lpia.img
e3028a105a083339be8e5af5afbe7444 *ubuntu-8.10-server-amd64.iso
a2ec9975a91e1228c8292ed9799dc302 *ubuntu-8.10-server-i386.iso
2796c696ab368415a30fddc8278e08b0 *wubi.exe

4dc5bad5ee18648cd9dfbb87d86880b5 *kubuntu-8.10-alternate-amd64.iso
04a2c5c8f394175e6d6579e626995c7a *kubuntu-8.10-alternate-i386.iso
b054fd985294c80dcd6400fede533c72 *kubuntu-8.10-beta-desktop-i386.iso
824de6bea59d41637a41f17c00d33f7d *kubuntu-8.10-desktop-amd64.iso

45c572d3bc95db05ed8ab37bae75b750 *edubuntu-8.10-addon-amd64.iso
7944aaaaf645571dd6e0a9db700394e9 *edubuntu-8.10-addon-i386.iso

3539726b4aa58801427578bb66da5fd1 *xubuntu-8.10-alternate-amd64.iso
db016f2f55ea2109b787a191b8115c67 *xubuntu-8.10-alternate-i386.iso
4153396adde6b210c07ef7d7ccb14231 *xubuntu-8.10-desktop-amd64.iso
53c50ff06f4ad659f0abf6474b58c8e6 *xubuntu-8.10-desktop-i386.iso

3231c37e95a4facf4106ddb6ed560981 *edubuntu-8.10-beta-addon-amd64.iso

82c02dc7386dfb6858a9ec09a5059e1e *kubuntu-8.10-desktop-i386.iso

c578db9752b22247100657bb70bf66de *mythbuntu-8.10-alternate-amd64.iso
077c387c1eaedc697dfd2c0039c92911 *mythbuntu-8.10-alternate-i386.iso

30de5bbfde9fee17b871c016fb35dc44 *ubuntustudio-8.10-alternate-amd64.iso
c721eee448b455ed19bd2a11f38a416e *ubuntustudio-8.10-alternate-i386.iso

Intrepid Ibex Beta

Ubuntu 8.10 “Intrepid Ibex” will be released soon! If you can’t wait or want to help out, download the latest beta / release candidate from canonical and get an early preview. Be warned though that this is beta software and as such potentially requires more than the usual amount of patience to get running properly as I found out whilst tinkering with Kubuntu 8.10 beta KDE 4 remix. Although I am sure the problems I was having had as much to do with the poor hardware compatibility with Linux as with buggy beta software.

T Mobile G1 Android Emulator

T Mobile launched the first mobile based on the open source Android platform earlier this month. Although from a design prospective I am less than impressed with the device, I am extremely excited that this hitherto academic project is starting to gain mass market traction. Open source projects all too commonly go the route of the GP2x, OpenPandora or OpenMoko- accruing a loyal fan base but never really breaking out into the main stream. (I highly recommend taking a look at some of those projects.)

The fact that there is now a mass market device running the Android software stack is very encouraging, however with an industry behemoth like Google behind it, there was no way this project was going to roll over and die quietly. So, until it launches here in the UK (and wherever you may be in the World) you can try out a emulated version on T-Mobile’s website.

Chrome EULA Update…

.. and I’d like to think its as result of the angry email I sent to google as I uninstalled their new open source browser Chrome, based on the WebKit engine, two days ago. Back then, part of the EULA (End User Licensing Agreement) explicitly stated that by using the browser, anything you type into it (i.e. search queries, comments and presumably blog posts) becomes the exclusive property of Google.

Old Section 11 of Chrome EULA

11. Content licence from you

11.1 You retain copyright and any other rights that you already hold in Content that you submit, post or display on or through the Services. By submitting, posting or displaying the content, you give Google a perpetual, irrevocable, worldwide, royalty-free and non-exclusive licence to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content that you submit, post or display on or through the Services. This licence is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services.

More worryingly, section 11.4:

11.4 You confirm and warrant to Google that you have all the rights, power and authority necessary to grant the above licence.

After The Register broke the news, many people just like me, promptly uninstalled Chrome. Google yesterday responded apologetically saying that they had never intended for the EULA to be interpreted in such a way, and issued an update.

11.1 You retain copyright and any other rights that you already hold in Content that you submit, post or display on or through the Services.

This rapid turn around is welcome, but it does make me wonder… if Google had any intention of enforcing the content appropriation their initial EULA made way for, by simply updating the EULA and not issuing updated binaries is the purported functionality still present? I guess only in-dept analysis of the code will tell, it is an open source project after all.

Mesh Networking (or 802.11s) comes to Linux

Since kernel 2.6.22 there has been a huge drive to rework and update the entire wireless networking stack in Linux. Back in July, 2.6.26 was released with over 600 wifi specific changes including :

• mac80211 now supports draft mesh networking (802.11s; thanks to the open80211s project
• mac80211 now supports more optional HT (802.11n) features
• mac80211’s monitor interfaces can now be configured more precisely, “cooked” monitors were added
• mac80211’s IBSS implementation now supports IBSS merging and received various bugfixes
• mac80211 now has an in-kernel documentation book, help welcome!
• b43 now has support for PCMCIA devices and QoS/WME

The following have been removed.

• the bcm43xx driver
• the old ieee80211softmac code

A while ago I discussed the deprecation of the bcm43xx driver so I welcome its official removal from the kernel as this means less time wasted disabling this legacy kernel module prior to installing / activating b43 on every new install. The mesh networking (draft specification designated 802.11s) support is largly thanks to the open80211s project however it is only in the fairly early stages. Support is not consistent across all the Linux wifi drivers but full support is progressing. I do wonder whether mesh networking will take off, it is however, an exciting concept. Imagine the following scenarios:

1. A dense build up urban area, where multiple nodes (flats / homes etc) could connect via one or two Internet connected nodes.

2. A neighbourhood which contained a lot of like minded PC users each connecting as a node in a local mesh network to create an ‘instant’ LAN/WAN or gaming network. Imagine being about to connect Xbox 360s / PS3 / PSP or even PC gamers wirelessly to your neighbours without using the Internet services.

3. A sparse, less developed environment where multiple nodes are greatly spread out and Internet access is rare.

The possibilities are endless, however with all such technologies, a lot of people need to jump on the bandwagon, particularly with ad-hoc technologies such as these.

8.04.1 MD5 Checksums

Just a brief note to say that I have updated my original post on the MD5 hases of all the *buntu (ubuntu, kubuntu kde3 and kde4, edubuntu xubuntu) builds to include the ‘revision 1′ 8.04.1 cd images. Everything should now be up to date again.

Ubuntu on the A1650

Despite some rather exciting progress made of late getting Linux to work on the Fujitsu Siemens Amilo A1650, regretably after three weeks of using it, I am back to Vista. The reason for this is my conclusion that running Linux (more specifically, Ubuntu) on the A1650 is a painful process due to the maturity of hardware support. Its (finally) possible to get all the hardware working, unfortunately doing so feels cumbersome and unnatural. The biggest culprits are the graphics card (an ATi x200m) and the wireless (Broadcom 4318 mini PCI) card.

The ATi graphics card has long been criticised as being ‘defective by design’. Getting any hardware accelerated graphics on this laptop formerly required running XGl with a long series of complicated hacks and even then it was not possible to run desktop compositing effects like Beryl or Compiz. Eight (or so) Months ago, that changed with a redesign of the X Server (in X.org 7.0) when XGL back rendering was no longer required for hardware accelerated rendering. More than that, it greatly simplified the process meaning even the most inexperienced Linux user could have beautiful desktop effects, in some cases, out of the box. However, due to an annoying glitch somewhere, the ATi restricted drivers caused diagonal tearing whenever a window rapidly refreshed itself.

It says something about the maturity of hardware support under Linux when Vista, commonly (and unjustly) thought of a resource hog, runs better. Anyway, this is all academic now as I have retired my Amilo A1650. Its been a great laptop but after three years it was time to move on. I will play with Linux on my new laptop soon and post the results.

Move over EEE PC, Say Hello to the EBOX

Well, thanks to a leak covered by both electronista and the Inquirer, we know a little more about the ASUS PC that I blogged about back in March. I will be called the EBOX and still bares a remarkable similarity to a Nintendo Wii. Apart from this not much has changed, we have no new release images nor any concrete facts about the CPU. It is likely to be an Intel Atom based on murmurings surrounding the series 900 second revision (or possibly third generation EEE PCs) which would make sense. Apart from this, the unit is rumoured to contain a healthy 2Gb of RAM and a traditional spindle hard disk drive with purportedly 160Gb storage. All of this will run ASUS’s custom flavour of Xandros. Given that this is the same tailored OS that ASUS have used in the EEE PC laptop range, it is likely we will see a similar GUI / interface for the EBOX.

I am a little puzzled as to why ASUS would move away from solid state disks for the EBOX. Whilst power considerations no longer have as much importance on a desktop platform, the EBOX is unlikely to attract the ‘one pc’ crowd as it will not replace the traditional computer in the home. I think it could potentially fit very well as a satellite computer in a kitchen or other room in the house were basic surfing / computer usage is required, but this only reinforces the question, why did ASUS go for a traditional hard drive? Satellite systems are typically that, lightweight machines which almost act like thin clients for other machines or storage or services on the home (or office) network. As such and given the EBOX PC is not designed to be portable, space is not as important a commodity as it is on the EEE PC laptop.

Well enough supposition for now, official release / preview is apparently scheduled for the 3rd of June, I daresay all questions will be answered then.