Firewalls and per-network sharing

Firewalls

Fedora has had problems for a long while with the default firewall rules. They would make a lot of things not work (media and file sharing of various sorts, usually, whether as a client or a server) and users would usually disable the firewall altogether, or work around it through micro-management of opened ports.

We went through multiple discussions over the years trying to break the security folks' resolve on what should be allowed to be exposed on the local network (sometimes trying to get rid of the firewall). Or rather we tried to agree on a setup that would be implementable for desktop developers and usable for users, while still providing the amount of security and dependability that the security folks wanted.

The last round of discussions was more productive, and I posted the end plan on the Fedora Desktop mailing-list.

By Fedora 21, Fedora will have a firewall that's completely open for the user's applications (with better tracking of what applications do what once we have application sandboxing). This reflects how the firewall was used on the systems that the Fedora Workstation version targets. System services will still be blocked by default, except a select few such as ssh or mDNS, which might need some tightening.

But this change means that you'd be sharing your music through DLNA on the café's Wi-Fi right? Well, this is what this next change is here to avoid.

Per-network Sharing

To avoid showing your music in the caf, or exposing your holiday photographs at work, we needed a way to restrict sharing to wireless networks where you'd already shared this data, and provide a way to avoid sharing in the future, should you change your mind.

Allan Day mocked up such controls in our Sharing panel which I diligently implemented. Personal File Sharing (through gnome-user-share and WedDAV), Media Sharing (through rygel and DLNA) and Screen Sharing (through vino and VNC) implement the same per-network sharing mechanism.

Make sure that your versions of gnome-settings-daemon (which implements the starting/stopping of services based on the network) and gnome-control-center match for this all to work. You'll also need the latest version of all 3 of the aforementioned sharing utilities.

(and it also works with wired network profiles :)

iDevice tablet hints

As some of you know, I purchased an iPad some time ago, and I've been using it to read articles and papers away from the computer (which definitely makes for a nice change on week-ends).

It's also started to find its place as an online encyclopedia (thanks Wikipanion) next to the sofa, and a YouTube client when friends are around (along with jeers from my N900 wielding housemate).

Getting Books

Plenty of locations to get those. I've been using Project Gutenberg, because it allowed me to get some classics in French. EPubBooks.com has a similar collection, but better formatted, if you only want the English versions.

For comics, I recommend Tintin Revolution (in English and French), with a definitely left-leaning Tintin, out of a job and on the dole. You'll also find some very old school comics on Golden Age Comics.

Reading books

I use Stanza for PDFs and ePubs and ARCReader for comics. Note that ARCReader is supposed to handle PDFs, but it failed to import any of the files I put on there.

Getting the books on the iPad

The version of the iPhone OS on the iPad is different from the one on the other devices (for now), and doesn't allow easy access to the application documents. All the documents live in the application's directory, and a new protocol is used to get and put documents within each app. This isn't working just yet within Linux, so if you don't want to use iTunes, here are a couple of work-arounds.

One way is using ideviceinstaller. It's painful, especially for large files, but it would at least allow you to get your documents back, or on the iPad, even on a non-jailbroken device.

You would need to list the apps:

$ ideviceinstaller -l | grep -i arcreader

org.fieldman.arcreader - ARCreader 1.1

Get an archive of the application onto your computer:

$ ideviceinstaller -a org.fieldman.arcreader -o copy=./

Unpack the IPA file (it's a zip file), add your documents to the Documents subdirectory, repack as a zip file, and push the IPA file back onto the device.

YMMV, I was having some problems with archiving myself.

The second option is using the afc2 jailbroken filesystem. Once jailbroken, and with the afc2add package installed, you can mount the complete filesystem using nautilus-ideviceinfo (right-click on the device, select Properties, then Details, and select "Browse jailbroken filesystem"). The URI is afc://UUID:2/ if you want to mount it by hand using gvfs-mount or nautilus.

Then you can browse to /var/mobile/Applications/Application UUID/Documents add add documents there. Note that free space stat()'ing is broken (I saw 300 megs free when I have nearly 30GB of free space), and you might break your device using the jailbroken filesystem.

The final option would only work with Stanza, we'll come back to this in a second.

Offline reading

I wanted a way to mark articles as "to read later" in my desktop web browser, and be able to read them when more at ease later on. The bare minimum, which I was using until a couple of days ago is the Offline Pages application, a web browser that'll allow you to download full pages for later reading.

Much better for my usage was the Readitlater application, along with its high-quality javascript bookmarklets. The service has nice APIs, so it would be nice to see more integration in feed readers and web browsers (brownie points for the person who makes an Epiphany extension for it).

Getting the books on the iPad, part #2, Stanza

When launching Stanza, you might see a "Computers sharing books" section in the Get Books/Shared section. This will look for computers on the local network exporting a Stanza service via Zeroconf.

Calibre has an implementation, but it's a bit too heavy duty for me. I tried implementing a proof-of-concept version, and it turns out it's not too complicated, though would need more integration into the desktop.

The protocol used is HTTP, with ODPS data. Implementing things like search and categories was not my prime concern either.

First, I launched a web browser, using the little script I use in Totem for my web-based streams tests:

./launch-web-server.sh --remote start

Then publish it via Avahi:

avahi-publish-service "Stanza export" _stanza._tcp 12345

Right, it shows up in Stanza, and the access_log shows me it's trying to get '/'.

It copied a PDF inside the root directory of my web server, and created cover and thumbnail images for it:

evince-thumbnailer -s 512 'foo.pdf' cover.png

evince-thumbnailer -s 512 'foo.pdf' thumb.png

Finally, I create the smallest possible Atom/ODPS file to advertise my PDF file (saved as index.atom):

<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:dc="http://purl.org/dc/terms/"
xmlns:opds="http://opds-spec.org/2010/catalog">
<entry>
<title>My PDF</title>
<link type="image/png" rel="http://opds-spec.org/cover" href="cover.png"/>
<link type="image/png" rel="http://opds-spec.org/thumbnail" href="thumb.png"/>

<link type="application/pdf"
rel="http://opds-spec.org/acquisition"
href="foo.pdf"/>
</entry>
</feed>

And redirected the index file to index.atom:

$ cat .htaccess

DirectoryIndex index.atom

Retry access from Stanza, and voila.

This should be fairly straight forward to implement in gnome-user-share, the only hard part being the metadata extraction for the PDFs, and other file types. If somebody fancies taking this on, drop me a mail, and I'll point you in the right direction.

PS: Found out about vim's TOhtml function. Neat.

Too many modules

Today I released GNOME 2.28.0 versions of:

- totem-pl-parser and totem

- gnome-bluetooth

- gnome-media

- and gnome-user-share

I also released a new nautilus-sendto, with a revised GNOME-ish version number.

Both gnome-bluetooth and totem are also due 2.28.1 releases to fix a couple of buglets.

gnome-bluetooth nearly dead

After the fun time debugging, I started implementing ObexPush in gnome-user-share, pretty much as planned. Code's in SVN. Next up are notifications, and asking whether to accept transfers for each session.

My little transfer just got started

I also committed the new goom visuals to gst-plugins-good. Better visuals, MMX, SSE2 and Altivec optimisations (I think). Get it from CVS while it's hot!

Hot chips, yummy