Tag Archives: Open Source

My Fosdem 2010

Friday

Björn and I left work on the Friday afternoon and took a flight down to Brussels, Belgium. After having checked in to our hotel, we met up with Frank from the Rockbox project and we headed to the Fosdem beer event that took place on a pub quite nearby to the hotel.

The Beer event was crowded. I mean really really crowded. But we still managed to get seated and we got fine Belgium beers and we had a good time. We met a few other Swedes that turned out to be the first in a long series of Swedes that were there. Petur from Rockbox joined up there as well and together we went over a fair share of their beer selection…Atomium

Saturday

For us tech guys, the Saturday morning had no really exciting subjects and weirdly enough the morning had only one track and the massive amount of parallel tracks didn’t start until after lunch. This gave us an opportunity to go sight-seeing, and we visited the city square and the Atomium before we headed into the FOSDEM premises and squeezed our way in to a presentation.

Peter Stuge from the Coreboot project explained to us that we were by far too many people crammed into that little room so if one of the responsible guys would come around a fair lot of us would get thrown out of there. With that heads up given, he started his talk and gave us insights in what coreboot is, what it does and so on. I’ve heard Peter talk about this topic before, but he’s still a good talker and the topic still is techy and interesting enough to listen to.

Embedded software development best practices by Adrien Ampelas turned out to be a bit boring. Basically we got the feeling that Adrien re-used a company slide show or something and told the audience a lot of things I bet the majority of people already knew. Yes we know we must use version control. Yes we know we should send patches upstream. No we don’t Fosdem Entryagree with you that there never exist any reason not to use git.

Sascha Hauer from the Barebox project (the project that was previously known as U-Boot v2) told us about this U-Boot project and what they’re trying to accomplish. It seems like an interesting approach to fix some of the worst mistakes of U-Boot but still leverage on all the things U-Boot did right. It’ll be fun to see if it gets adoption from board makers and companies in general. I guess there’s a lot of investment in U-Boot so lots of things will probably stick with that for a long time ahead…

Flash enable BIOS reverse engineering by Luc Verhaegen gave us an insight in the x86 based reverse engineering they do in the Coreboot project to figure out how to enable flashes and to make them possible to write to when you want to upgrade them to use Coreboot. It was only a quick run-through, but my general feeling was still that compared to Rockbox-style reverse engineering, their tasks actually seem a lot easier! Still interesting, as Luc is a good speaker.

Sunday

Sunday morning started earlier than yesterday. Interesting talks started right away, and we actually were too slow at breakfast so we missed the first part of the interesting Introduction to RTEMS talk by Thomas Doerfler. RTEMS is a fully open source RTOS that’s been around for ages and that has some very good realtime skills and can get shrunk to a rather small size. A slight downside with it is its slightly odd license, as it is a GPLv2+ license with a rather big exception that is made to allow proprietary applications link with it. It makes it incompatible with regular GPLv2 code.

The RepRap project was presented by Adrian Bowyer and I must admit that these 3D-printers are mighty cool and even more fun to see and witness in the real world than they are to see on tiny pictures on web sites.

Back in the embedded room, Roberto Jacinto told us about apt-get for android – with GUI which pretty much described the Aptoide project. It has nothing in common with apt: it doesn’t do dependencies and it doesn’t use its file formats. It has some pretty significant bugs still, and it generally seemed like a rather immature project that I’m not even sure I agree is on the right track. I’d rather actually see the real apt-get for android, with or without GUI.

The Cross build systems: Present & Future workshop could’ve become interesting. A lot of projects (PTXdist, Buildroot, Crosstool-NG, Openembedded, Emdebian etc) spoke about what they are, what they hope to do and how they’d like to collaborate. Unfortunately it took a bit too long time so by the time all had presented their projects the time was pretty much up. The most controversial and slightly off-topic of them all was Andy Green (formerly involved in Openmoko) who talked about how we all should stop cross-compiling and build directly on the target instead(!) and how booting Linux shouldn’t need a boot-loader and that designing PCBs with NAND is stupid(! again). I didn’t hear anyone agreeing with his ideas.

Next up was my talk on Rockbox. I did it in about 40 minutes and I think I covered a bit of what Rockbox is and how we work when we work with new potential targets. It later struck that I should perhaps have had a slide about what the future holds etc, but hey I think it went pretty smooth anyway! Peter recorded my talk on his n900 so hopefully it’ll soon be available online somewhere. After my talk we met a lot of guys wanting to talk Rockbox, ask about particular players and so on and it was mighty fun and interesting.

Greg Kroah-Hartman did the final talk and he is a very good and engaging speaker that really can catch the big audience in Fosdem’s biggest room. Write and Submit your first Linux kernel patch is his “standard talk” but he’s doing it so good and with such elegance that it is a pleasure to watch and learn from. And I’ll admit I wasn’t aware of the get_maintainers.pl script in the kernel tree. A very useful little thing!

Reflections

Some conclusions and general thoughts about the event:

Lack of gaps – there’s a problem when all talks in all rooms are made gapless. It makes people get up and leave 5-10 minutes before the end of each talk so that they will get in time to the next talk that will start on the full hour in another room. It causes pretty much all question-sessions towards the end to fail since the questions (and answers) can’t be heard.

Hard to find people – it is such a huge event and lots of people I have no idea what they look like, so trying to meet friends and people I’ve only emailed with or chatted with on IRC is very hard. Name tags would be really cool. I did have some benefitsHaxx from using my shirt with a big Haxx logo on the back since a fair amount of people recognized it and approached me!

Audio systems – the quality of the different rooms varied a lot (not only sound-wise but the sound was what bothered me). Unfortunately for me, the embedded room was one of the worst ones when it came to audio. It was a big room sure, but the biggest room had an excellent audio system and thus proved size is not what matters. In this case, I think a lot was to blame on the actual microphone we had there.

Phone apps – having phone apps with the entire schedule and a little map for each room etc was a great service. The app also reminded us when a talk you had marked as “favorite” was about to start. It was a bit strange though how the android and n900 versions of the app differed. The n900 version was buggy and slow, but it did offer the schedule in a time-based view while the android version only allowed us to view the schedule based on rooms.

Next year – yes. I think it was great fun and I will really try to attend next year again. Hopefully other friends will too, since meeting friends at the place really doubles the fun! Thank you all for a nice event!

curl talk at foss-sthlm

I’m now scheduled to do a short talk on curl and the project on the foss-sthlm meeting in Stockholm on February 24th! As you can see on the site, there’s also a set of other fun subjects around Free and Open Source Software.

The material on the site is all in Swedish and all talks are expected to be mostly in Swedish.

Our merry foss-sthlm effort has really taken off in a great way and more than 50 persons have already signed up to show up at the meeting and we have 5 other speakers apart from myself lined up. The program isn’t really fixed yet, but it certainly looks like it’ll end up at least mostly the way it currently looks.

If you are in the area and have an interest in FOSS, consider showing up!

Oh, and my brother Björn is scheduled to talk about Rockbox at the same event.

My open source TV

For Christmas this year I decided to surprise my wife with a new TV. To sum it up: hiding a 42″ TV in the closet was hard.LCD TV

Oh well, the model I got for her is a Philips 42PFL7404H. It’s really nothing magical about it, it’s a rather standard LCD TV.

What did make me smile however, was the little paper I found next to the manual (which is done in 30 languages!) and the quick-start guide, a two-sided legal-sized paper that lists all the open source products they’ve used in the TV as well as the GPL and LGPL licenses spelled out in their entirety. Anyway, the products this TV claims to use are:

Linux kernel, Flash Eraseall, Nandwrite, Helper Application, Libc, Librt, Libm, Libpthread, libgcc, libstd++, Diet libc, libgphoto2, vsnprintf, GIF reading routines, base64.

I find it noticeable that there’s no shell or busybox in that list, which in my book is a rather unusual embedded Linux setup.

Going Fosdem 2010

Oh what the heck, we plan to bring every single employee of Haxx over to Fosdem 2010. Yes, that means all two of us!

I hope we’ll manage to join up with fellow Rockbox hackers then and it would be great fun to meet other friends from other projects and open source activities too.

I’ve not been to Fosdem before, and I’ve offered to do a talk there but so far I’ve not gotten a response from the responsible guy in the “embedded dev room”. We’ll see how that ends.

FOSS-sthlm

Me and Claes Jakobsson had a talk in #curl the other day about how we rarely meet Open Source people in the Stockholm Sweden area outside of our own little circles and friends.

In that moment we decided we’d try to arrange a meeting. Free Sofware and Open Source people in the area. In one place. Possibly involving beer. And why not some talks by some clueful people? We’re aiming for it to happen already during early spring 2010, but no date has been set yet.

We’ve already sent out a few mails to people, and we’ve posted about this idea at a few places and now I’ve setup a dedicated mailing list for this purpose. The foss-sthlm mailing list.

Do you want to participate at a meeting like this?

Do you want to help arranging the meeting and get the word spread in all the communities that we would like to get the word spread to?

Do you have any experience in arranging a meeting of this sort? We currently have no idea if people are interested enough, or if we get people interested how many we might be able to attract!

Do you by any chance have connections or friends at companies that would be interested in helping out with sponsorships or similar? My company (Haxx) will certainly make a contribution.

Don’t be shy. Join in and help us get some fun going.

Update: we now have web site monitoring our progress.

How to get involved in Open Source

I had a fun chat with Anthony Bryan a while ago on the topic of how to get involved with Open Source. What projects generally need, what you can do, how you can help and things like that.

The recording/podcast was originally posted over at knowledgecaps.com, but the 22MB file is also available from my site. I’m not sure why, but when I play this in my audacious I get the chipmunk version (ie far too fast playback). So I haven’t yet listened to it myself!

A related article I wrote ages ago: What Can I do for Rockbox when not Programming?

I won it! You guys are the best.

I am happy and very proud to mention that I was just this evening awarded the Nordic Free Software Award 2009 and I share the award with my good friend and hacker extraordinaire Simon Josefsson.

Thank you jury. Thank you mates all over who by your positive feedback makes it a joy to work in the open source and free software community. Thank you to all you fellow hackers and contributors who work hard and tirelessly and therefore enable me to do what I want to do and do these things I today got awarded for.

Getting recognition from actual fellow peers within my own community is just the best.

And you know what? I will continue to work hard and I will continue to do open source and free software intensively and with my strengthened beliefs of what I think is right.

Thank you.

The motivation quoted from the above mentioned site:

The other winner is awarded for his long term contributions to free software.This winner have been developing free software for at least 15 years, and is a prominent contributor to at least 10 different projects.

This winners most spread contribution is the program Curl and the library libCurl which both has an enormous installed base. Libcurl has bindings in more than 40 different languages and they are both deployed all over the world as a key components in software that people and businesses rely on every day. In addition to these projects the winner is also a key developer in Rockbox, c-ares and libssh2.

15K commits and counting

Almost two years ago I blogged about me reaching 10K commits as counted by ohloh.net.

Just a few days ago their counter counting my commits surpassed 15K and right now it says: 15005 commits and 46 kudos – ranked #69 of 273705. I think more of my projects have found its way there since then rather than me actually having committed 5000 times since then!

On sourceforge I’m now member of 19 projects (most of them are stalled). The latest addition is pycurl, which I’m basically a member of in order to try to help getting more people involved.

(The image is dynamically generated so when you read the old blog post it looks a little funny since it says the current numbers now…)

First month on my own

Yeah, it’s already been a month since I took off and started working for Haxx full time. Starting a company (even though the company already existed in the legal sense) certainly involves a lot of paperwork and talking to banks, insurance companies and getting arrangements with partners etc. A lot of that of course being just an initial phase, but some of it will be a more integrated part of my day now when I don’t have a well-oiled team of admins hired that deal with such matters.

I’m happy to say that I have had a whole slew of good talks with existing and potentially new customers, and I’m already cooperating with a few companies in very constructive ways – so that I can help others succeed with their undertakings. Several things that happened during this month involved open source (although I’m not able to talk about them in public), and I feel really good when my work and my beliefs can go hand in hand!

This said, I’m always ready for more and new missions. If you’re in need, you know where I am!

null-prefix domino

dominos

At the end of July 2009, Scott Cantor contacted us in the curl project and pointed out a security flaw in libcurl (in code that was using OpenSSL to verify server certificates). Having read his explanation I recalled that I had witnessed the discussion on the NSS list about this problem just a few days earlier (which resulted in their August 1st security advisory). The problem is basically that the cert can at times contain a name with an embedded zero in the middle, while most source code assumes plain C-style strings that ends with a zero. This turns out to be exploitable, and is explained in great detail in this document (PDF).

I started to work on a patch, and in the mean time I talked to Simon Josefsson of the GnuTLS team to see if GnuTLS was fine or not, only to get him confirm that GnuTLS did indeed have the same problem.

So I contacted vendor-sec, and then on the morning of August 5 I thought I’d just make a quick check how the other HTTPS client implementations do their cert checks.

Wget: vulnerable

neon: vulnerable

serf: vulnerable

So, Internet Explorer and Firefox were vulnerable. NSS and GnuTLS were. (OpenSSL wasn’t, but then it doesn’t provide this verifying feature by itself) (lib)curl, wget, neon, serf were all vulnerable. If that isn’t a large amount of the existing HTTPS clients then what is? I also think that this shows that it would be good for all of us if OpenSSL had this functionality, as even if it had been vulnerable we could’ve fixed a busload of different applications by repairing a single library. Now we instead need to hunt down all apps that use OpenSSL and that verify certificate names.

Quite clearly we (as implementers) have all had the same silly assumptions, and quite likely we’ve affected each other into doing these sloppy codes. SSL and certificates are over and over again getting hit by this kind of painful flaws and setbacks. Darn, getting things right really is very very hard…

(Disclaimer: I immediately notified the neon and serf projects but to my knowledge they have not yet released any fixed versions.)