MeeGo Planet

A great deal of useful conversation during Linux Foundation Collaboration Summit 2010 (LFCS2010) earlier this year revolved around what a MeeGo community should look like.  There are of course numerous aspects to this but for now I want to focus on three only: what sort of constituency would best benefit MeeGo, how could the website structure reflect, support and encourage that constituency, and what might this mean for maemo.org.

It might be helpful for the reader to browse through threads under Community Matters at the MeeGo discussion forum, as I will be referring to points raised there.  However, that won’t be necessary for a high-level perspective.  Regardless, a community is actually taking shape so I think it’s time to discuss a few subjects. 

For members only

There’s been some debate amongst maemo.org and MeeGo community members over what actually constitutes a community in general, and more specifically, how a community arising around Maemo/MeeGo endeavors should look.  Opinions range from “every one creating an account is automatically a member” to “only those actively contributing quantifiable work are members”.

I lean toward the latter (with the caveat that not all useful contributions are easily quantifiable).  As an analogy, we can compare a physical neighborhood comprised of home buyers and renters.  Buyers tend to take a high interest in improving the home’s value; renters tend to only reside in any given one a short while and it typically makes no sense for them to invest in that.  (note: this is neither an endorsement nor indictment of either).

Planning and zoning

Quim Gil conducted a very good interactive presentation at LFCS2010 that described the roles, functions and general structure of the emerging MeeGo community.  I tacked onto that recently by drawing up my own interpretation, and then refining that based on community input.  The latest rendition is below:

This was met with a mixed reception and the conversation around it quickly died.  The main hangup was over member groups, a feature of the vbulletin forum software.  Some see value in letting community members strive for and adopt titles that suit their interests.  Others see that as unnecessary or even divisive.  At the very least, the MeeGo Greeters program has found acceptance and I will push for a forum group supporting that activity at the very least.

MeeGo Greeters

At maemo.org we tried a little experiment to see if adding resource links to forum posters’ signatures could help newcomers.  We didn’t quantify the effectiveness of the effort, but participation was enthusiastic and feedback highly positive.

We just recently introducd the idea into MeeGo, where it has also been quickly welcomed.  The MeeGo community is much younger than maemo.org was when we created the concept, but I think that works in our favor now.  MeeGo Greeters will be seen as a natural part of the social structure and we can easily, organically grow the effort as the community grows.

Potential hazards

A highly popular presentation at LFCS2010 was the keynote by Josh Berkus: How to Prevent Community: Making Sure Your Pond Stays Small.  Josh outlined with gently sarcastic humor the sort of mistakes that poison and even kill communities, especially those built around open source endeavors.

The 2600Hz blog riffs on Josh’s theme with an article specific to MeeGo.  I’ll leave it to the reader to judge the validity of the analysis there.

A place for maemo.org

The question of course remains, what is the future of maemo.org?  Unfortunately that’s answered by a great big “it depends”.  It’s too early to close any doors completely, but at the same time, MeeGo has been named as the future so it would only be natural for Maemo to experience a slow fade.

At the same time, though, work continues on a community distribution of Maemo 4 (Diablo) which will ensure that at least the lives of N800s and N810s can be extended.  Harmattan could do the same for N900s (although at this point I question its actual usefullness).  But ultimately, those devices will wear out and their replacements will be designed around MeeGo.  At some point, and it’s difficult to determine when, the Maemo community will shrink to a size too small for Nokia to justify supporting with infrastructure and personnel.  At that time the remaining community will have to find some way to sustain itself or, like so many predecessors, accept a slow fade into the sunset.

Going forward

I’ll conclude on an optimistic note.  There’s been a great deal of buzz around MeeGo’s first international conference to be held November 15 through 18 this year.  The big event will of course be measured against previous examples, especially the energetic Maemo Summit 2009 held in Amsterdam, but it will certainly have its unique aspects that can’t be compared.  The tone will be set by the key sponsors and develop around the accepted talks and myriad attendees.  I’m confident that both Nokia and Intel are going to kick this off in a big way, and can’t wait to see how that manifests.

LFCS2010 introduced the MeeGo community.   The outcome of MeeGo Conference 2010 (MC2010), along with member contributions of course, will go a long way toward shaping it.

Filed under: Great Governance, Mentioning Maemo, Mentioning MeeGo, The Write Stuff, Views and Reviews Tagged: 2010, community, conference, governance, Greeters, Intel, LFCS, LinkedIn, Linux Foundation, Linux Foundation Collaboration Summit, Maemo, maemo.org, MeeGo, membership, Nokia, structure

In two weeks time, at the IBC conference, Amino Communications will be showcasing its Amino Freedom product, a a set-top box powered by MeeGo. It is a hybrid / OTT (Over-the-Top) device, which delivers additional content, via an Internet connection, supplementing the traditional digital (DVB-T) transmissions. It is has the full Internet (including Silverlight and Flash support) access via a browser, acts as a PVR and is able to access a home network (UPnP / DNLA). 

Hybrid / OTT set-top boxes look to combine traditional set-top box functionality (digital transmissions and personal video recorder) with additional 'over-the-top' (i.e. over the Internet) functions. These can include catch up services, such as the BBC's iPlayer or Hulu, but may also encompass web video services such as YouTube and Vimeo. All the services are combined into a single electronic program guide (EPG) to create a single seamless offering. 

The base specifications of the Amino Freedom are:

• Intel CE4150 Processor
  
• Hard disk 250 Gb
  
• Flash memory: 512Mb RAM Main memory: 1Gb DDR 3 RAM
  
• HDMI 1.3 Composite Video
  
• Analogue Audio
  
• Ethernet 10/100 BASE-T
  
• 2 x USB 2.0
  

Here's how Amino Communications describe the use case for the Freedom:

Imagine watching what you want, when you want - from wherever you want - on your TV. No more switching from live TV on your digital set-top box to your laptop to watch catch-up services – or turning on the hi-fi to catch a radio show. With the Amino Freedom media centre all of this content – and more – is available through a single device and intuitive interface. All your broadcast TV favourites in glorious HD, plus the best the Internet has to offer and all your music, photos and home videos in one place – the Amino Freedom.

The Amino Freedom, in an earlier development stage, ran on Moblin. However, with the Moblin / Maemo merger in February of this year, it has now been switched to MeeGo. It is one of the first products to fall into the Connected TV MeeGo category. It further demonstrates the flexibility of the platform with MeeGo products now encompassing handsets, netbooks, tablets, connected TVs and in-vehicle infotainment systems.

More information is available on the Amino website.

http://www.meetup.com/SFBay-MeeGo-Network/

Here you can track MeeGo related activities in San Francisco Bay Area. Propose genuine MeeGo meetups or casual meetings after interesting events.

First meetup on September 14 @ San Francisco:

MeeGo Developer Day – The After Meetup

Tagged: community, MeeGo

I’m going to start echoing job listings for projects and companies I am tracking, and that of course includes Ovi, MeeGo and mobile computing in general.  The category, for those wishing to follow via RSS, will be Employing Opportunity.

In that spirit, here’s an attractive one: “Senior Product Manager, MeeGo Operation-PRO00000031“.  The description is as follows:

MeeGo Devices is where Nokia builds mobile computers on Linux. We build leading-edge devices by combining the most powerful hardware and the best open source software technologies. Our ambition is to deliver a superior user experience dedicated for mobile computers with large touch-screens that fit into your pocket. Using agile development methods and engaging with open source communities define our new way of working. Our latest product is the Nokia N900 – a high-performance mobile computer with powerful multitasking capabilities, fantastic web browser, and a rich media experience. Get to know everything about MeeGo at http://www.meego.com

Besides strong personal charisma and ability to influence, success in this role requires excellent leadership skills, strong strategic thinking skills and excellent negotiation and communication skills. With more than 6 years of experience in similar R&D or product management functions already under your belt, you have a proven your ability to execute in a turbulent environment. We also expect you to have experience from Linux-based open source projects. Take your career to a totally new level by applying today!

As a Senior Product Manager in Nokia’s MeeGo.com operation you will be responsible for driving Nokia’s product and software platform agenda in the MeeGo SW platform creation with Nokia, Intel and the community. You will ensure competitiveness of the MeeGo SW platform in a setup where decision-making is essentially based on your ability to sell your ideas and capability to convince others of the benefits for the whole community, rather than on a formal organizational position. You will need to form a consolidated view of MeeGo building blocks and roadmap with the Nokia MeeGo Product Planning team and to agree on that with Intel representatives or other community members. Also, you will execute a set of front-end product processes (e.g. roadmap process) for steering and managing the development of the MeeGo software platform from Nokia’s perspective. You will report to Head of MeeGo Product Planning Operations.

If I were able to relocate and had just a bit more directly-relevant experience this is the sort of position I would target myself.  I’m sure that Nokia will have no trouble finding candidates.

The position is intended for Helsinki, Finland.  For those interested, the listing can be found here: http://nokia.taleo.net/careersection/10120/jobdetail.ftl?lang=en&job=623606

Filed under: Employing Opportunity, Mentioning Maemo, Mentioning MeeGo, The Cat Corral, The Process and Product Frontier Tagged: Finland, Helsinki, manager, MeeGo, Nokia, product

Front Page

In this edition (Download)...

1. Front Page
   • Community SSU for Maemo 4 is now stable and available to all
   • Nominations open for Maemo Community Council election
2. Applications
   • Chess clock application supports lots of game styles
   • MeBook development continues post GSoC
   • Maevies updates
3. Development
   • When should an email address be suitable as a bug tracker in an Extras package?
   • Running PySide applications in Qt Simulator
4. Devices
   • Accessing N900 contacts from cars' Bluetooth systems
   • Walkthrough of various N900 tethering options
   • Nokia Care seeking more information on users' experiences of N900 USB "defect"
5. Announcements
   • Font Changer allows user selection of theme fonts
   • ringtoned updated to include vibration options
   • Open source Twitter sharing plugin for pictures
   • ...and 3 more

After my post-mortem on the Nokia N900 microUSB failure fiasco I received an interesting offer from Nokia: collect the Care experiences in a clear, objective format, and the situation(s) would be investigated.

An offer I can’t refuse.

To start this off, I am reintroducing the survey that galvanized the maemo.org community.  That survey has closed but had collected a significant amount of data beforehand.  The challenge here is to bring respondents back to the table.  Even more critical, to obtain a reasonably accurate picture of the problem’s scope we really need response from as many people as possible, especially those not having any problems.  More on that later in the article. 

The survey:

View This Poll
Market Research

For those who either encountered unreasonable difficulty getting proper service, or had no success at all, please provide the following in comments here:

• Mode of failure
• Country of purchase
• Months of use
• Did you file off and/or compress male connector prongs?
• Care center(s) involved
• Details of Care experience (number of service attempts, escalation, if satisfaction survey was sent to you, etc)

Please limit responses to objective descriptions to make reporting and analysis easier.  I will also be collecting what I can from previous postings.

Now, I can’t promise a positive outcome for everyone currently frustrated by service difficulties or outright refusal, but I can guarantee nothing will improve without trying.  Hopefully Nokia is serious about addressing the inconsistent and often poor N900 customer support experience so far.

You can of course help: spread a link to this post far and wide.  Tweet and retweet the message.  The more people respond, the more accurate and useful the data can be.

On a broader note: I wasn’t surprised to learn this issue is affecting other companies such as HTC.  Any manufacturer who elects to use a surface-mount connector for charging and/or data transfer is asking for trouble in my educated opinion.  Interestingly, leaked photos of the Nokia “N9″ indicate through-hole mounting for its microUSB port (far right side of linked picture).  This may well turn out to be an instance of one company learning from its mistake, and setting itself apart from competitors in an unglamorous but highly useful way.  This will be critical as Nokia seeks to retain current customers and gain new ones.  There’s been a lot to forgive.

Additional resources and references:

Nokia discussion thread where issue is formally acknowledged

Filed under: Addressing Retention, Delivering Quality, Mentioning Maemo, Mentioning MeeGo, The Write Stuff, Unusability, Ways of Rocking Tagged: CARE, customer, customers, failure, N900, Nokia, poll, service, survey, usb

(First, an apology in advance, this is a bit of a braindump, and as such, isn't very well structured.)

I've recently been diving into SQL support in Qt, provided by the QtSql module. Specifically, I've been looking into providing IPC on top of QSqlTableModel.

(For those of you who aren't too technically oriented, I'm trying to have multiple processes have the same basedata store, and know when another process modifies the data in some way, to keep all processes in sync).

While I won't go into details on that now, as it isn't complete, it has been an interesting journey, and I think I've found yet another few things I want to add to my todo list. You see, QSqlTableModel is a great class, but it has a number of shortcomings.

It can't be used in a tree

This one is pretty obvious. It is, after all, a table - not a tree. However, making it represent a tree wouldn't be all that difficult I think (a customised implementation of QAbstractItemModel::parent() method looking at e.g. the 'parent' column of a table and returning a QModelIndex to the appropriate row or similar).

I don't believe that this can be solved in the current implementation, though, as QSqlTableModel inherits QSqlQueryModel which inherits QAbstractTableModel - meaning there's a non-trivial amount of tableness about the current implementation.

For some data (think a task manager: you might have subtasks under a task), this is an annoying limitation.

Incremental fetching isn't always supported

I'm actually not positive on this point, but it looks like incremental fetching is left up to the database driver, meaning that on some database types, you won't have incremental fetching.

On a large database containing thousands of rows (or gigabytes of data) this could be a very bad thing if I am correct.

Partial updates aren't really supported

If you delete a row from a database table, what would you expect the client to do after deleting that row?

I know I certainly wouldn't expect it to re-run the query to refetch the data, yet that's exactly what QSqlTableModel seems to do. Not nice.

This also happens on any other conditions of alteration to the data, which strikes me as being rather inefficient.

Furthermore, it isn't really possible to update values on the fly; this proved to be quite an annoyance when implementing IPC notifications of updates. QSqlQueryModel internally contains a QSqlQuery. QSqlQuery has a ::value() method, to retrieve a QVariant containing the data in a given row of a result set. It doesn't, however, provide any method to change that data (even in memory), meaning that once again, a full reload is the only real solution to something else changing the data out from under you.

This isn't really so unexpected, as it's a bit of an odd use-case, but it has made my implementation trickier than I'd wish.

Conclusion?

I wish. I don't know what to do, yet, but I suspect it's going to involve writing code.

Thoughts welcome.

We've been working on a GUI wrapper for testrunner-lite for the past few weeks in MeeGo QA-tools and now it's gotten to a point where we can demonstrate it. Demo highlights are test execution from the UI with real time test results and the graphical user interface itself. Enjoy.

Kudos to Kyösti.



Direct youtube link for those who can't see the embed video above: http://www.youtube.com/watch?v=-MBOiVb-2Z4

TAT (The Astonishing Tribe), a company specialising in the creation and licensing of mobile user interfaces, believes that "tablets as a radically different type of device" and that this has important implications for user interface design. They have released a video showcasing their Velvet UI, a "playful cloth shader concept UI for MeeGo tablets", which has been developed in conjunction with Wind River. 

The area of user interface and user interaction on tablets is set to become a very hot topic in the next few years as more tablet products emerge. While MeeGo Tablet will offer a default UI, the touch UI framework is extendible and, in common with the rest of the platform, open source. This means it is very likely we will see a number of tablets running on MeeGo, but with customised UIs, especially on tablets designed for small vertical niches.

Device manufacturers will look to differentiate from their competitors by providing a custom UI. Operators will look to extend and encourage the take up of their multi-play offerings, by creating customised services and applications, for which UI and ease of use will be a very important element.

From the TAT blog:

On one hand we have companies that scale phone UIs to tablets. On the other hand we have companies offering the full blown desktop experience scaled down to tablet size. We believe that both of these approaches will result in crippled user experiences. For example, the tablet form factor is perfect for media consumption and this could be manifested in the UI. TAT recognizes tablets as a radically different type of device - personal and mobile yet powerful and creative. We are now on a quest to design fantastic UIs that are optimized for this device space.

TAT's Velvet UI demonstration video:

Does a re-scaled UI for mobiles or PCs make a good tablet UI? We think tablets are radically different types of devices that require new and unique UIs. Velvet is a playful cloth shader concept UI for MeeGo tablets by TAT and Wind River. With full support for 3D graphics and shaders, TAT Cascades enables astonishing UIs on MeeGo, Android and other tablet OSs.

 

 

Yesterday Nokia and Intel announced the establishment of a joint research centre, based at the University of Oulu (Finland). The lab, which will have around two dozen researchers, will focus on mobile user experiences, with a particular emphasis on 3D experiences and technology. Likely research areas include 3D virtual worlds, 3D user interfaces and immersive gaming. 

3D virtual worlds on a 2D screen (sometimes referred to as 2.5D, think and Second Life and most '3D' games) is an area that will be explored early on. 3D virtual environments could be used to more closely link the digital and real world, an area which holds great interest for Nokia. Such environments could, in time, be global in scope, but may start as something simpler, such as as a way of controlling objects in a home automation system.

A key question will be how such environments will work on a mobile device; there are questions around how to deal with the inherent physical limitations (power, size and resource constraints), how immersive such environments can be in the mobile context where continuous partial attention is the default mode of operation, and, perhaps most importantly, how we will interact with such environments. For a truly intuitive experience i seems likely something beyond touch or simple point and click will needed.

However 3D mobile user experiences can encompass many forms: from multi-layered 3D user interfaces and immersive 3D experiences, to 'true' 3D holograms and related technology. The holographic communication technology (help me Obi-Wan!) may seem to be in a galaxy far, far, away, but is exactly the sort of area that could explored in a future research project.

At this stage it is too early to be specific about research areas or potential products. Moreover research projects do not, generally, lead directly to commercial products, but rather result in research prototypes, which form the basis for a commercial application, service or technology development program. However it is clear that both Nokia and Intel see 3D mobile experience as very important area for future product development. The work done in the lab in the next few years could result in paradigm shifts in the way we use and interact with mobile devices.

It is clear that the genesis for Intel and Nokia's collaboration in the new lab has grown out of the two companies joint activities around the MeeGo software platform. The majority of the research will be done on top of the MeeGo software platform (netbooks, tablets, handsets), using Qt based development tools and technology. However any results produced are likely to have broader applicability and could be seen in any number of platforms or products. 

The lab will also share the open philosophy of the MeeGo platform. All the parties involved have made a commitment to ensure that research is open and that results will be published on and open source basis. The lab's host, the University of Oulu, is already well known for its research in Internet experiences, 3D virtual environments and future telecommunications, which makes it an ideally suited to host the new joint research laboratory. 

As an example the Unversity of Oulu, in conjunction with a number of local companies, has and continues to develop realXtend. realXtend is an open source virtual world platform that can be used by individuals and companies to build services, content and applications running in an interconnected 3D virtual world. realXtend currently focuses primarily on a PC based usage experience, but extending this to mobile is one area that the new lab is likely to look at.

With such research labs there is always a secondary aim of creating links with local companies and research organisations (so called technology hotspots). Nokia, in the last few years, has increasingly aimed to carry out its research activities in the framework of open innovation, which calls for greater external activities and co-operation. In Nokia's case the primary driver for this has been through deep research collaborations with world-leading institutions such as the University of Cambridge. Clearly an open innovation research philosophy helps promote the creation of technology hotspots.

Technology hotspots are good for the local economy and help amplify research activities. In the case of Oulu there is already a vibrant technology ecosystem, thanks, in part, to Nokia existing research and development activities in the area. The Nokia-Intel joint research laboratory, which is receiving some government funding, will be able to both tap into this and reinforce its potential for growth.

 

Rafe Blandford, August 24th 2010

Further information is available in this press release and at Nokia Conversations. Additional reporting and information from briefing call and launch presentation.

Nokia has been proudly touting some impressive statistics of its Ovi store recently, and on the surface they do seem promising.  Given their global cell phone sales numbers, that shouldn’t be surprising.  Even though Nokia has hit a rough spot, the company still manages to crank out more devices per year than any competitor.

However, looking into the details exposes some disturbing aspects. 

• Nokia was slow to recognize the needs of independent developers.  This has improved somewhat.
• Official support for programs developed using alternative languages like Python has been slow in coming.  Qt/C++ are certainly the way to go in general, but Python is popular, powerful and has a low barrier to entry… at least on the coding side.
• Ovi Store has been buggy, frustrating many developers.  Getting bugs fixed has been difficult and slow.
• Interestingly, the N900 doesn’t show up in any of the metrics on the statistics page linked in the first sentence above.  Given the poor support for the device, that isn’t surprising.  What might this ultimately say for MeeGo?

Nokia, despite the numbers, Ovi Store still needs a lot more love.  Your slowness to embrace entreprenurial developers says that you still don’t see where you stand to differentiate yourself from your competitors.  Granted that gateways for quality assurance and security need to be in place, but that can be done and still accomodate independent developers.  You need to cultivate a large army of fiercely loyal coders to fill Ovi Store’s virtual shelves.  That will mean some creative solutions above and beyond what you’ve implemented so far.  There’s plenty of potential… so fulfill it!

I said a while back I would work on a more positive tenor here, so let’s end this on a constructive note.  My suggestion: you need to beef up your developer engagement staff in Ovi.  I recommend the following:

• Developer Outreach Manager.  This role would focus on developer engagement at a high-level, working to clear legal and bureaucratic roadblocks within Nokia that are hampering developer acceptance of Ovi.  The role would be empowered to break down walls.
  • Developer Engagement Specialists.  A global team reporting directly to the above, with regional presence in all the important areas for Ovi Store.  Yes, I’m going to include the US in that.  These folks would act as liaison between developers and Ovi Store entity,  gathering feedback and driving improvements within the organization.
  • Application Quality Assurance.  You can’t have too many people testing applications.  This activity tends to be a bottleneck, so make the neck as wide as possible.

Maybe these roles, or something similar, are already in place… but given the lack of a formal presence at maemo.org, I have to assume they may not exist at all.  I’ve been hearing that Ovi suffers a lack of resources in general, and this is difficult to process– Nokia isn’t exactly hurting for cash, and in this downturned global economy there are plenty of candidates to expand the staff.

So no more excuses, Nokia.  You’ve said Ovi was the future of the company, and the Store is an important component of that strategy.  Let’s now see some more support for that.  And for those interested in being part of the solution, check these job listings.

Filed under: Delivering Quality, Into Outreach, Mentioning Maemo, Mentioning MeeGo, The Write Stuff, Unusability, Views and Reviews Tagged: developers, Maemo, maemo.org, MeeGo, Nokia, Ovi, Ovi Store, Python, Qt, statistics

Kicking off this blog with a status update on what I've been doing for MeeGo QA-tools for the past few weeks.

The goal of the work that I've been doing is to enable test automation in MeeGo context. I started by bringing the tools needed to automate test execution. The tools have been developed inside Nokia and have been recently open sourced. Basically the tools are testrunner-lite and testdefinition. Testrunner-lite is a generic test execution utility that reads the planned tests from XML and testdefinition is XML schema used for validating these test plan XML files.

I addition to packaging these tools enabling test automation requires a set up that allows the tests to be executed from a test control pc. So I needed to create a set of packages that configures the device under test and the test control pc to enable host based test execution. In host based test execution testrunner-lite is running on the control pc and executes tests over shh in the device under test.

Short video demonstrating host bast test execution. The tests are executed from a test control pc (Fedora 13 box in this case) through ssh on Nokia N900 running MeeGo.



Direct link to the video in case you're not seeing it: http://www.youtube.com/watch?v=K3ezzmnXAB4

Sorry for not being able to do a video with commentary. Would've been nice but my throat disagreed with that idea.

Front Page

In this edition (Download)...

1. Front Page
   • Community release of hildon-desktop, and promise of Maemo 5 community SSU
   • Community Council election time again
2. Applications
   • tweetgo.net looking for new maintainer
3. Development
   • Nokia-led development of hildon-desktop stopped
   • MeeGo Touch Framework (MTF) documentation now online
   • Qt Mobility APIs now available in Python
   • New PulseAudio package to solve audio stuttering on N900
4. Devices
   • Maemo, on N900, running MeeGo Handset UX
   • Images of Nokia MeeGo (Harmattan)-running "N9" apparently surface
   • Increase N900 FM transmitter frequency range and power
5. Maemo in the Wild
   • Researching face verification/tracking with N900
6. Announcements
   • Fast London Tube Map viewer
   • Advanced Interface Switcher for turning on & off wireless radios
   • SMScon for remote N900 control via SMS

The Nokia N9 was leaked this morning on Baidu from China. It looks like a miniature Macbook! From the photos, we see a 4-row QWERTY keyboard, BV-4D battery, dual-LED flash, and Meego OS. No other info is available. What kind of camera? When will it come out? How much will it cost?

Twitpic from James Burland

Nokia World is just around the corner, so we might find out more information about this device soon. The photos above were originally posted here. How do you feel about the Nokia N9 so far?

If you enjoyed this article, you might also like...

• Meego Handset UI Guideline Revealed. Includes Hints of WebOS & Android
• Nokia N8 Releasing September 23rd in the UK, 1 Week Before Anyone Else
• Nokia C7 Hands-On Photos Leaked Yet Again
• First Nokia Meego Device May or May Not Be Released This Year

The security of your box goes over the firewall, or the fact that you are running a platform where all binaries are trusted. Even on that case, is still possible that vulnerabilities of some software or library could be exploited by a malicious party.

The idea behind the NX bit, No eXecute, is to segregate the areas of the memory in two (lets keep it simple ) big sets, the code execution area and the storage area. According to Wikipedia (http://en.wikipedia.org/wiki/List_of_Intel_Atom_microprocessors), the Atom family has the capability to handle such bit.

Adding this feature and a Linux kernel, is possible to avoid the execution of code in the data area, protecting the system against buffer overflows attack. However some marks should be placed on ELFs to archive such protection, these marks are made in the ELF construction and they can mark the ELF to have or not an executable stack. In the second case the executable flag has no effect, is useless.

The marking can also be made on a library (it is also an ELF, duh!) and when this happens, the software which loads that library will be also allowed to run code inside the data segment, disabling again the protection against buffer overflow.

To check the executable marks of your ELFs, you can use the pax-utils (http://www.gentoo.org/proj/en/hardened/pax-utils.xml). Running the tests on a daily MeeGo image (2010-22-07) the following results were archived:


[root@localhost ~]# scanelf -lpqeR
RWX --- --- /usr/lib/libmono.so.0.0.0
RWX --- --- /usr/lib/paxtest/getmain2
RWX --- --- /usr/lib/paxtest/getheap2
RWX --- --- /usr/bin/mono


This means that libmono and mono, for some reason, are expected to run code on the data segment of the memory. In Fedora the mono is marked as RW, I dunno why it is marked as RWX in MeeGo, further investigation should be done.

Mono’s GNU_STACK on Fedora:

(zimmerle@burbs)-(~/core/meego)$ readelf -l /usr/bin/mono | grep GNU_STACK
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000


Is acceptable to have some process without such kind of protecting, for example Java. Java depends on the executable stack to work. It is also acceptable to have some other binaries like: getmain2 and getheap2. These are used to test if the Machine is handling well the NX bit.

To check if your platform has handled well the support of the NX bit, you can use the pax-test, really nice utility that allows us to check the protection against various kinds of exploration. Tests were also made on the same release used above.

kidde mode:

PaXtest - Copyright(c) 2003,2004 by Peter Busser Released under the GNU Public Licence version 2 or later

Writing output to paxtest.log
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003,2004 by Peter Busser Released under the GNU Public Licence version 2 or later

Mode: kiddie
Linux localhost.localdomain 2.6.35~rc6-131.2-netbook #1 SMP PREEMPT Tue Jul 27 14:34:50 UTC 2010 i686 i686 i386 GNU/Linux

Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Vulnerable
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Executable stack (mprotect) : Vulnerable
Anonymous mapping randomisation test : 12 bits (guessed)
Heap randomisation test (ET_EXEC) : 13 bits (guessed)
Heap randomisation test (ET_DYN) : 16 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (ET_DYN) : 10 bits (guessed)
Shared library randomisation test : No randomisation
Stack randomisation test (SEGMEXEC) : 19 bits (guessed)
Stack randomisation test (PAGEEXEC) : 19 bits (guessed)
Return to function (strcpy) : Vulnerable
Return to function (strcpy, RANDEXEC) : Vulnerable
Return to function (memcpy) : Vulnerable
Return to function (memcpy, RANDEXEC) : Vulnerable
Executable shared library bss : Killed
Executable shared library data : Killed
Writable text segments : Vulnerable


blackhat mode:

PaXtest - Copyright(c) 2003,2004 by Peter Busser Released under the GNU Public Licence version 2 or later

Writing output to paxtest.log
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003,2004 by Peter Busser Released under the GNU Public Licence version 2 or later

Mode: blackhat
Linux localhost.localdomain 2.6.35~rc6-131.2-netbook #1 SMP PREEMPT Tue Jul 27 14:34:50 UTC 2010 i686 i686 i386 GNU/Linux

Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Vulnerable
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Executable stack (mprotect) : Vulnerable
Anonymous mapping randomisation test : 12 bits (guessed)
Heap randomisation test (ET_EXEC) : 13 bits (guessed)
Heap randomisation test (ET_DYN) : 16 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (ET_DYN) : 10 bits (guessed)
Shared library randomisation test : No randomisation
Stack randomisation test (SEGMEXEC) : 19 bits (guessed)
Stack randomisation test (PAGEEXEC) : 19 bits (guessed)
Return to function (strcpy) : Vulnerable
Return to function (strcpy, RANDEXEC) : Vulnerable
Return to function (memcpy) : Vulnerable
Return to function (memcpy, RANDEXEC) : Vulnerable
Executable shared library bss : Killed
Executable shared library data : Killed
Writable text segments : Vulnerable


As you can see, we are protected against code execution in any other area than that intended for this purpose. We don’t have randomization on libs due the fact that we are making use of the prelink, subject for another post

The pax-utils and pax-test pacakges can be found on my security MeeGo repostiory, at:

http://meego.zimmerle.org/repo/security/

If you are interested in testing it by yourself, you can download my ks file here.

That kind of protection is very important almost mandatory, modern system still been hacked by such kind of attack class, when they opt to not provide such protection, the case of Xbox, for example which is exposed to a vulnerability in the 007: Agent Under Fire (http://en.wikipedia.org/wiki/Agent_Under_Fire_(video_game)).

Front Page

In this edition (Download)...

1. Front Page
   • Registration now open for the first MeeGo Conference
   • talk.maemo.org gets formal rules/code of conduct
2. Applications
   • Game Gripper review for better experience playing classic games
   • KISStester lists on device installed applications which are in extras testing queue
   • Disappearing Contacts plugins
   • ...and 4 more
3. Development
   • Building Qt debs "the easy way"
   • What's the status of the Maemo licensing change request queue?
4. Community
   • Qt Ambassador Program launches
   • Usefulness of Maemo Community Council questioned, and definitively answered
5. Devices
   • MeeGo on non-SSSE3 x86 Hardware
   • Small update on status of MeeGo-Harmattan (and its N900 "Hacker Edition")
6. Announcements
   • QPlaylist - music playlist editor
   • Wifi Assistant helps getting online with connections which require browser interactions
   • Mobile Firefox roadmap, including next version

On Monday MeeGo made available the second update for the MeeGo 1.0 Core Software Platform and Netbook User Experience project release (the version of MeeGo designed to be run on netbooks). The updated version, 1.02, resolves several email and media player issues, updates syncevolution and connection manager and has more than 70 bug fixes. Read on for further details.

Existing users will be automatically notified about the availability of the new release, but, if necessary, can 'force' an update by going to Applications > Systems Tools > Update System. New users can download the first MeeGo release and then run the update process to get to the current version.

MeeGo 1.02 update

MeeGo 1.01 Netbook Update

Here is the summary of the update from MeeGo.com:

This update is recommended for all users running MeeGo 1.0 Netbook UX. It includes general operating system fixes that enhance the stability, compatibility, and visual quality of your devices, including:

• Resolved several email client issues
• Resolved several media player issues
• Updated L10N translation
  

MeeGo 1.02 Core Update

Here is the summary of the update from MeeGo.com:

This update is recommended for all users running MeeGo 1.0. It includes general operating system fixes that enhance the stability, compatibility, and security of your devices, including:

• Updated to latest syncevolution with many bug fixes
• Updated to latest connection manager with many bug fixes
• Fixed several CVE issues
• Updated L10N translation

Registration for the MeeGo Conference 2010 is now open. Registration for the conference, which takes place between November 15th and 17th, is free and is available via the MeeGo conference website. A discounted hotel rate (from €105 per night) has been organised at the nearby D4 hotels, at which a number of additional networking opportunities will take place. 

As well as keeping an eye of the MeeGo Conference website you can follow @meegoconference on Twitter for short status updates.

The conference venue, the Aviva Stadium, has room for around 600 attendees; given the popularity if previous MeeGo and Maemo events that could quickly fill up, so those wishing to would be well advised to register in good time.

The organisers note that:

We have booked a block of discounted rooms at the D4 hotels right around the corner from the Aviva Stadium where we will be holding sessions. At the hotels we will have 24hr networking opportunities and more: book your hotel here. The logistics page has more details about traveling to and around Dublin and other information for the event.

We will also provide sponsored travel to a limited number of community contributors to the event. If you would like to be considered, please check the "Travel Assistance" box on the signup page.

As described in an earlier post the program of the conference is currently a work in progress:

The content of the conference is currently being arranged. Those wishing to speak are encouraged to submit session proposals (default to 30 minutes) by August 23rd. There will be a later call for lightning talks (5 minutes in length) at a later date.

All proposals are welcome; there are four general categories (hardware support, platform development, application development, MeeGo project, process and progress), but areas that fall outside these will also be considered. Proposals from the community, Intel, Nokia, the Linux Foundation and all other will be given equal consideration.

More information is available on the call for proposals pages.

Last month International Syst announced the formal release of Metasys MeeGo, an operating system based on the MeeGo netbook experience software platform. It is designed to support the 'didactic requirements of the educational process' and to be 'used in the new generation of Intel powered convertible classmate PC'.

Extract from the press release:

The Metasys MeeGo is an operating system specifically created to support the didactic requirements of the educational process and the new generation of Intel-powered convertible classmate PC, an exciting, cost-effective education solution designed by Intel and produced and sold by an extensive network of local manufacturers and vendors supporting sustainability and local economies.

The new operating system has an innovative youth-focused user interface optimized for social media interaction. Designed to support 1:1 e-learning, Metasys MeeGo allows students to work together, exchange information, consume and create learning materials in a collaborative way.

Metasys MeeGo includes significant feature additions and improvements, including enhanced browser functionality and plug-in support, user interface enhancements, support for data connections, Bluetooth device management, an integrated application installer, and an educational media installer with greater performance and stability.

"It is with a huge pleasure and after a tremendous effort and commitment that we are launching the new Metasys MeeGo. The Metasys MeeGo is a revolutionary and totally new interface focusing in usability, entertainment and social networks. Besides this, the major challenge is to provide something different that can catch the students and the youth in general, providing them everything that they need in a unique and friendly interface, expanding their learning horizons.", said Paulo Neuenschwander Maciel, CEO of International Syst.

Now it’s possible for power testers to install and run MeeGo 1.1 unstable in the Nokia N900. MeeGo Handset is not yet in shape for users of any kind. If you find the instructions complicated and unfriendly it’s simply because MeeGo is being sincere with you: stay away from it and come back later. 

Running MeeGo Handset UX in the N900 has been possible (technically) since few weeks ago, but now the N900 hardware adaptation team has started releasing full raw images containing some essential hardware related binaries. The result is a simpler installation process for patient power users and a more functional software as a reward.

The simplest way to run MeeGo in the N900 without loosing Maemo 5 and all your data is to boot from Micro-SD. Nice simple dual-boot is supposed to come at some point but it’s too hackish at this point. In the meantime you might want to do this:

1. Download the latest raw image and kernel from the Nokia server.
2. Install the raw image in a Micro-SD card of 2Gb or more (Linux and Windows instructions).
3. Insert the card to your N900.
4. Load the kernel to your N900.

E voilà! MeeGo should be booting in your device, starting with the Tux and a booting log like in the old good times. Give it some more time and a MeeGo homescreen should appear, with MeeGo characters at the front, the Qt powered MeeGo Touch Framework operating in the back, a task launcher, settings, device lock… and little else at this point:

• Pictures, People and SMS have some functionality in place. Testing and feedback is definitely welcome here.
• Browser and Phone seem to be there but I couldn’t boot them.
• The rest of apps are placeholders in this week’s version. This is the current list of apps (maybe there is a way to take a screenshot already, will try in future versions). Don’t pay too much attention to the list, I guess there will be changes before MeeGo 1.1 final:
  • First screen: SMS, Clock, People, Chat, Camera, Pictures, Music, Videos, Maps, App-Up, Help, Calendar.
  • Second screen: RSS Reader, Stocks, Trailers, Lock, Fortune.

This is MeeGo Handset 1.1 unstable today. Note that a month ago stevechippy showed in a video a slightly better experience with an Aava prototype, therefore some of the problems found in the N900 might be related to the specific adaptation to this hardware. There are still some weeks to go after the planned feature set before the feature freeze arrives.

Have a look, pick your preferred area to test, find bugs to report (Hardware = “Handset”, Architecture = “ARM”)… Have fun while the battery lasts (power management for the N900 is supposed to be implemented soon). As said, the MeeGo experience in the N900 is very rough at this point. Yet exciting for some people. See you in the download queue of the next unstable release!

Tagged: MeeGo, MTF, N900, testing, unstable