About Avi
Categories
- Chronicles (46)
- Community and Society (74)
- Ecology & Environment (7)
- Essays (32)
- Events (25)
- Gourmet (26)
- Info & Biz Technology (252)
- Linux & Open Source (91)
- Linux Journal Index (14)
- Mobility (16)
- Multimedia (9)
- OpenDocument Format (59)
- Web 2.0 (58)
- Linux & Open Source (91)
- Metaphysics (25)
- Misc (5)
- Music & Podcasts (36)
- Podcast: brazilian jazz (8)
- Podcast: general (13)
- Travels (61)
- Central Asia 2007 (28)
- Vegetarianism (9)
Archive for tag “tech:yes”
Subscribe to this tag or categoryCan Open Source Software be more ubiquitous than this ?
A few days ago I was playing extensively with Apple’s iPhone, investigating each sub-menu and little details. There is a section listing legal stuff and software being used with each license. GPL, LGPL, BSD and other Open Source licensed software rule the iPhone.
Some I have noted:
- BSD kernel
- PPPD
- poll emulation by Brian Clapper
- stack_protector by Hiroaki Etoh
- FreeBSD software
- libgcc
- libstdc++
- libm by Sun Microsystems
- libiconv
- ncurses
- FreeType
- zlib
- SHA2 by Aaron Gifford
- AES and SHA2 by Brian Gladman
- SQLite
- JPEG lib by Thomas Lane
- TIFF lib by SGI
- Kerberos, WebDAV, install-sh by MIT
- Spidermonkey by Netscape
- OpenSSH
- OpenSSL
- OSF’s DCE
- libpng
- Eric Raymond’s giflib
- bzip2
- libuuid by Theodore Ts’o
- Perl Compatible Regular Expressions
- libxml2
- tidylib
- WebKit
- ipsec-tools and racoon
Some friends asked so the following is how I encode (rip) DVDs.
Choosing the file format: .AVI, .OGG, .MP4 or .MKV ?
The ripped video file format is a decision you must make. Currently my format of choice is .MKV or Matroska. I’ll explain why.
It is quite idiotic to say that an .MP4 movie has better quality than a .AVI or vice-verse (or any other combination of comparisons). OGG, MP4 (MPEG-4 Part 14), MKV (Matroska), AVI, WMV (or ASF) are just containers, envelopes. Video quality depends on what goes inside it.
“Multimedia” has this name because you have multiple types of media: video in multiple angles, multiple audio options including different languages and channels (stereo, 5.1, 6 channels etc), subtitles in several languages, chapter information, menu etc. Think about a DVD. So this is a graphical view of how things are organized inside a 900MB movie file in a modern format as MKV or MP4:
| Header with tags, track names, chapters info, seek positions | Main Video track (MPEG-4 AVC/H.264) | Attachments as JPG images, documents, scripts or text files | |||||||
| Video segment showing another angle (MPEG-4 ASP/Xvid/DivX) | |||||||||
| Audio track: English Dolby Surround 5.1 (AC3) | |||||||||
| Audio track: Director’s comments stereo (MP3) | |||||||||
| Audio track: Portuguese Dolby Surround 5.1 (DTS) | |||||||||
| Subtitle track: Portuguese (Unicode text) | |||||||||
| Subtitle track: Chinese (Unicode text) | |||||||||
| Subtitle track: English (VobSub) | |||||||||
| byte 100K | byte 100M | byte 200M | byte 310M | byte 420M | byte 530M | byte 650M | byte 780M | byte 895M | byte 900M |
A digital multimedia file format must be capable to contain all this different medias and multiplex them in parallel so you won’t have the video in the first 500MB of the file and the audio on the following 500MB (this can’t work for streaming). And this is exactly what modern file formats as MP4 and MKV do: they carry all your movie-related data together.
This is a comparison of all these file formats based on my personal experience with them (a more formal comparison can be found in Wikipedia):
| .MKV | .MP4 | .AVI | |
|---|---|---|---|
| Industry support | Almost none | Good and increasing, specially on Apple platforms, the mobile scene and Nero Digital ecosystem | Treated as legacy popular format |
| Usage on the web | Very popular on HD or high quality DVD rips | Very popular on HD or high quality DVD rips, supported by Flash Player, YouTube, Google Video | Popular amongst low-quality DVD rips |
| Support for advanced video formats and multiple video angles | Yes. MPEG-4 ASP (DivX, Xvid), MPEG-4 AVC (a.k.a. H.264) etc | Yes. Only MPEG-4 systems and a few others | Problematic and No |
| Support for multiple audio tracks (channels, formats, languages and “director’s comments”) | Yes | Yes. Formats are only MP3, AAC and a few others not very popular | Yes |
| Support for tags (artist, title, composer, etc as MP3’s ID3) | Yes | Can be supported by MP4 extensibility but this is not standardized across authoring tools (iTunes, GPAC etc) and players (Amarok, Media Player Classic, iPod, Windows Media Player etc) | No |
| Support for attachments with mime-types (used to attach movie posters images or other files) | Yes | No | |
| Support for chapter marks | Yes | No | |
| Support for multiple language embedded soft-subtitles | Yes. VobSub (as extracted from DVDs), plain timed UTF-8 text (SRT, SUB) etc | No | |
| Support for naming tracks with human names as “Director’s comments” or “Portuguese subtitles” etc | Yes | No | No |
| Support for menus (as in DVDs) and interaction | Yes through an XML idiom, but unsupported by most players | Yes through SVG, but unsupported by most players | No |
| The container overhead in bytes in the final file | Very small | Very small | Very big |
| Supported by free and Open Source multiplatform authoring tools | Perfect on Linux, Unix, Windows and Mac | Yes, with some intellectual property issues and tools need to mature | Yes |
Personally I believe MP4 is the multimedia file format for the future because since it is getting popular, all these unstandardized features will get stabilized. MP4 is an ISO standard and the increasing industry support can be felt on iPods and portable devices, and most notable on home DVD players capable of playing the 700MB MP4 video file burned in a CD.
By the way, remember this:
- MP4 is not an evolution of MP3. AAC (MPEG-4 Part 3) is.
- MP5 and MP6 (used to classify portable media players) are things that simply doesn’t exist in the multimedia scene.
- .M4A, .M4V, .MOV and .3GP files can safely be renamed to .MP4. MP4 is the generic standard name.
Meanwhile, MKV wins everything but on the Industry Support category. But this doesn’t really matter, and I’ll explain why. Since MKV is just a container, the large video, audio etc streams can be extracted and repackaged into MP4 and vice-versa in seconds. No transcoding (decoding followed by an encoding into another format) is needed.
So today I store my videos in the most feature rich and well supported by players format: MKV.
OGG or OGM (the container file format) is practically dead in my opinion. They were created as part of the Xiph initiative for a complete open source patent-free multimedia framework, but seems nobody uses it anymore for video. From the same family, Vorbis (the audio codec compared to MP3, a.k.a. .OGG) is very good but also very not popular. Theora (the video codec) is frequently comparable to old MPEG-1 in terms of quality and compression ration so currently, if you want quality and are not concerned about patents, MPEG-4 AVC is the best choice. FLAC, Xiph’s lossless audio codec, is the winner of the family: very popular, massively used, and recommended.
Encoding the DVD
I use HandBrake, the most practical Open Source (and overall) movie encoder. It runs on Linux, Mac and Windows and uses the same Open Source libraries as ffmpeg, mplayer/mencoder, xine, etc. While these programs are generic video handlers (with thousands of confusing configuration parameters to sustain this generalistic status) HandBrake is optimized only for ripping so it is very easy to use, yet extremely powerful.
#!/bin/bash
##
## This is the script I use to make hifi DVD rips including chapter markers and
## subtitles. It uses Handbrake.
## Contains what I found to be the best quality ripping parameters and
## also let me set simple parameters I need.
##
## Avi Alkalay <avi at unix dot sh>
## http://avi.alkalay.net/2008/03/mpeg4-dvd-rip.html
##
## $Id$
##
#set -vx
HANDBRAKE=${HANDBRAKE:=~/bin/HandBrakeCLI}
#HANDBRAKE=${HANDBRAKE:="/cygdrive/c/Program Files/Handbrake/HandBrakeCLI.exe"}
## Where is the Handrake encoder executable.
## Handbrake is the most practical free, OSS, DVD riper available.
## Download HandBrake for Linux, Mac or Windows at http://HandBrake.fr
INPUT=${INPUT:=/dev/dvd}
## What to process. Can also be a mounted DVD image or simply '/dev/dvd'
TITLE=${TITLE:=L}
## The title number to rip, or empty or "L" to get the longest title
#CHAPTERS=${CHAPTERS:=7}
## Example: 0 or undefined (all chapters), 7 (only chapter 7), 3-6 (chapters 3 to 6)
#VERBOSE=${VERBOSE:="yes"}
## Wether to be verbose while processing.
SIZE=${SIZE:=1200}
## Target file size in MB. The biggest the file size, the best the quality.
## I use to use from 1000MB to 1400MB for astonishing high quality H.264 rips.
OUTPUT=${OUTPUT:="/tmp/output.mkv"}
## Output file. This will also define the file format.
## MKV (Matroska) is currently the best but MP4 is also good.
AUDIO=${AUDIO:="-E ac3 -6 dpl2 -D 1"} # For AC3 passthru (copy).
#AUDIO=${AUDIO:="-E lame -B 160"} # For MP3 reencoding. Good when input is DTS.
## Audio parameters. If input is AC3, use it without transcoding.
## If is DTS, reencode to MP3.
MATRIX=${MATRIX:=`dirname $0`/eqm_avc_hr.cfg}
## x264 matrix to use. The matrix file may increase encoding speed and quality.
## This one is Sharktooth's as found
## at http://forum.doom9.org/showthread.php?t=96298
######### Do not change anything below this line ##############
## Make some calculations regarding title and chapters based on parameters.
SEGMENT=""
if [[ "$TITLE" == "L" || -z "$TITLE" ]]; then
SEGMENT="-L"
else
SEGMENT="-t $TITLE"
fi
[[ -n "$CHAPTERS" && "$CHAPTERS" -ne 0 ]] && SEGMENT+=" -c $CHAPTERS"
[[ "$VERBOSE" != "no" ]] && VERB="-v"
# Define args for the x264 encoder. These are some values I found on the net
# which give excelent results.
X264ARGS="ref=3:mixed-refs:bframes=6:b-pyramid=1:bime=1:b-rdo=1:weightb=1"
X264ARGS+=":analyse=all:8×8dct=1:subme=6:me=umh:merange=24:filter=-2,-2"
X264ARGS+=":ref=6:mixed-refs=1:trellis=1:no-fast-pskip=1"
X264ARGS+=":no-dct-decimate=1:direct=auto"
[[ -n "$MATRIX" ]] && X264ARGS+=":cqm=$MATRIX"
# Encode…
"$HANDBRAKE" $VERB -i "$INPUT" -o "$OUTPUT" \
-S $SIZE \
-m $SEGMENT \
$AUDIO \
-e x264 -2 -T -p \
-x $X264ARGS
# Repackage to optimize file size, to include seek and to include this
# this script as a way to document the rip…
echo $OUTPUT | grep -qi ".mkv"
if [[ $? && -x `which mkvmerge` && -f $OUTPUT ]]; then
mv $OUTPUT $OUTPUT.mkv
mkvmerge -o $OUTPUT $OUTPUT.mkv \
–attachment-name "The ripping script" \
–attachment-description "How this movie was created from original DVD" \
–attachment-mime-type application/x-sh \
–attach-file $0
[[ -f $OUTPUT ]] && rm $OUTPUT.mkv
fi
The script seems long because it is fully documented but it actually only collects some parameters and simply runs the HandBrake encoder like this (passed parameters are in red):
~/bin/HandBrakeCLI -v -i /dev/dvd -o /tmp/output.mkv \ -S 1200 \ -m -L \ -E lame -B 160 \ -e x264 -2 -T -p \ -x ref=3:mixed-refs:bframes=6:b-pyramid=1:bime=1:b-rdo=1:weightb=1:analyse=all:8×8dct=1:subme=6:me=umh:merange=24:filter=-2,-2:ref=6:mixed-refs=1:trellis=1:no-fast-pskip=1:no-dct-decimate=1:direct=auto:cqm=~/src/randomscripts/videotools/eqm_avc_hr.cfg
All the rest is what I found to be the best encoding parameters.
The resulting video file (/tmp/output.mkv in this case) will contain correctly cropped video and audio quality as good as the DVD (it is almost lossless), and chapter breaks at the same positions read from the DVD.
In a Core Duo machine as my laptop running Fedora 8 or Windows XP, a 2 pass H.264 encoding (2 pass improves quality and H.264 is newer standard MPEG-4 technology better than DivX/Xvid) takes about 4 to 5 hours for a regular 2 hours movie, so leave it encoding while you go to sleep. A Pentium 4 machine running Ubuntu takes about 17 hours for the same rip.
I use to rip one chapter from the movie first (use your preferred video player or lsdvd command to find the shortest chapter), check quality, compare to DVD, fine tune, try again and then shoot full DVD ripping.
After encoding I use to repackage the audio/video stream with Matroska’s mkvmerge (or mmg, its GUI version available on any Linux distribution as “mkvtoolnix” package, and installable for Windows or Mac OS from Matroska’s website) to optimize seeks and to include soft subtitles (that can be turned on and off as on regular DVDs), but I’ll explain that in another HOWTO.
Give Your Ripped Movie a Descriptive File Name
I use to organize my media library in a standard way I invented for myself and which I suggest you to use too.
My movie file names shows everything that the file includes. Some examples:
- Indiana_Jones_and_The_Raiders_of_the_Lost_Ark_IMDB{tt0082971}-Xvid{720×304_23.98fps}+MP3{ENG,POB_VBR}+Sub{ENG,SPA,POB}+Covers.mkv
This is the Indiana Jone’s Raiders of the Lost Ark movie, whose IMDB index is tt0082971 (IMDB{tt0082971}). It was ripped with the old Xvid codec and contains 720×304 pixels frame size at a rate of 23.98 frames per second (Xvid{720×304_23.98fps}). It also contains selectable audio tracks in English and Brazilian Portuguese encoded in variable bit rate MP3 (MP3{ENG,POB_VBR}). In addition, there is also selectable subtitles in English, Spanish and Brazilian Portuguese (Sub{ENG,SPA,POB}). The file also contains the cover images as attachments. - Harold_and_Maude_IMDB{tt0067185}-H264{672×368_3Pass_25fps}+HEAAC{EN}+Sub{POR,EN,FRE}+Chapters+Covers.mkv
The old Harold and Maude movie whose IMDB index is tt0067185 (IMDB{tt0067185}). It is encoded with H.264 in 3 passes and has 672×368 pixels frame size at a rate of 25 frames per second (H264{672×368_3Pass_25fps}). There is only one English audio track encoded in modern HE-AAC (HEAAC{EN}). Subtitles in Portuguese, English and French (Sub{POR,EN,FRE}), chapter information and attached cover images. This is very complete high quality DVD backup. - I_Am_Legend_IMDB{tt0480249}-H264{704×304_23.98fps}+AC3{ENG_5.1}+Sub{POR}.mkv
The I Am Legend movie whose IMDB index is tt0480249 (IMDB{tt0480249}), video encoded in H.264 with 704×304 pixels frame size (H264{704×304_23.98fps}), original 5.1 channels AC3 audio in English (AC3{ENG_5.1}) and subtitles in Portuguese (Sub{POR}).
The advantages of this scheme are:
- It is web safe with no spaces in filenames. All underlines. It is also DOS safe.
- To have the IMDB index let me know exactly which movie this file contains. This is particularly good to avoid ambiguity for movies that have remakes as Ben Hur, or movies that have an official name but are well known by other names or have international titles.
- To know the encoding method, subtitles included and chapters info give me the overall quality of the movie right away.
- Special attention to audio and subtitle languages. Having them on the filename let me know I will understand its content without having to play. Sometimes I can’t play the file because I logged in my home computer remotely.
Playing the Ripped File
To play this advanced Matroska media file that contains such a rich set of metainformation and highly compressed digital content you will need an advanced player too. And happens that the best players are the Open Source ones. So use these players:
- On Windows: the k-lite codec pack with the Media Player Classic (which is not Windows Media Player)
- On Linux: use MPlayer or Xine (or variants as Kaffeine, GMPlayer, KPlayer, KMPlayer) available from your Linux distribution’s package repositories. For example, see the instructions to get them on a Fedora installation.
- On Mac: use VLC Media Player.
These are Media Player Classic screenshots demonstrating how to activate the advanced content inside a Matroska file. Players on other platforms have similar capabilities and menus.
Activating embedded subtitles and languages
The player lets you choose the audio language and subtitles. On MPC for example, this is how you turn on and off and choose the language for subtitles.

As you can see, the player found subtitles embedded in the MKV file in English, Hebrew and Portuguese.
If the MKV file contains many audio tracks (as different languages, director’s comments etc) this is how to select it:

And to jump directly to a specific chapter on the movie, if the MKV file contains this kind of information:

Improving audio volume
If you ripped the movie without reencoding the audio, the final file will contain DVD’s original AC3 audio tracks in 6 channels (5+1). This may sound with a lower volume when played in a 2-speaker system as your laptop, iPod, etc because 4 channels are simply not being played. To remediate this the player will have to downsample the audio. In other words, it will remix the 6 channels into 2 stereo channels while playing. The Media Player Classic options should look like this:


I remember the days when I was configuring DNS and DHCP for a small home network with only 2 or 3 computers.
This is not needed anymore since the invention of Zeroconf. As Wikipedia says, “is a set of techniques that automatically create a usable IP network without configuration or special servers. This allows inexpert users to connect computers, networked printers, and other items together and expect them to work automatically.”
Zeroconf got my attention when I installed Ubuntu Linux in one of my home PCs and it automatically started to show hostnames instead of IPs of my other home computers on the same DNS-less network. On my other Fedora Linux hosts, I had to manually install the avahi-tools and nss-mdns packages and I got the same functionality — as described in the Fedora Post-Installations Configurations.
Still without a local DNS server, each host can be pinged, SSHed, browsed, SMBed, etc using the hostname.local model, not the their IP anymore. So the machine with hostname floripa broadcasts itself as floripa.local. The same happens for all machines.
But I still missed this functionality when using my laptop booted on Windows. This OS was unable to understand the Zeroronf broadcasts until I installed the Apple implementation for Windows called Bonjour that can be downloaded from here.
To have a better, visual understanding of what Zeroconf can do for you, the Avahi website (Zeroconf implementation on Linux) provides a series of screenshots of regular applications discovering services in the LAN. Most notable is Konqueror — KDE’s file manager — using the zeroconf:/ URL to browse LAN services.
Now I finally know that my home doesn’t need things like Bind/DNS anymore.
I am sort of away this days because I got a new laptop. Check it out.

My previous laptop was a IBM Thinkpad T40, Pentium M, 512MB RAM, 1024×768 screen size, CD-RW, Cisco WiFi/b, no bluetooth. Served me well for 4 years.
The new one is a Lenovo Thinkpad T61, Intel Centrino Pro (dual core), 2GB RAM, 1440×900 screen size, DVD-RW, Intel WiFi/g (see this comment to make it work), bluetooth, integrated SD/Memory Stick/xD/etc card reader, Firewire interface. Much better. Details on Smolt.
I am writing this while Fedora 8 (including some Livna packages) is being installed over the network, as you can see.
There are some situations you may want to manually change (or hack) the category numbers of your WordPress.org blog. Here is how.
Supose you have posts category named “Wine” with ID 15 and you want it to become 1015. You probably already have some posts categorized as “Wine” too and you want to make the number change reflect in their metainformation.
You’ll have to execute some SQL commands in 2 tables: wp_categories and wp_post2cat. Have access to WordPress.org blog MySQL database with PHPMyAdmin or even the plain mysql command and execute this steps.
- Don’t trust your eyes or memory because if you forget something or mistype a number, you will make a mess in your blog database. Write in a paper a note for yourself with the category name, previous ID and new desired ID:
Wine: 15 ➔ 1015
- Change the category number from 15 to 1015 in the master categories table:
UPDATE wp_categories SET cat_ID=1015 WHERE cat_ID=15 LIMIT 1;
- Renumber all posts categorized as 15 (old Wine category number) to 1015 (new category number) in the posts metadata table:
UPDATE wp_post2cat SET category_id=1015 WHERE category_id=15;
- WordPress.org also uses the same wp_categories table to classify the links on your blogroll (or sidebar), so you’ll have to change the records associated with the Wine category too, if some:
UPDATE wp_link2cat SET category_id=1015 WHERE category_id=15;
There is no visual change for the readers of your blog, everything will look the same. This is only for you, if you want to organize categories in ranges while WordPress.org naturally creates them in a sequence.
(This is a shared personal note, suggestions are welcome.)
Create a Subversion repository for a project, say The SVG Blog Icons:
- Create the repository on the hosting panel with a project name (e.g. Blog Icons) and project ID (e.g. blogicons).
- Import the files:
bash$ cd src/ bash$ ls blogicons bash$ export EDITOR=vi bash$ svn -m "First import" import blogicons http://svn.alkalay.net/blogicons/trunk
- Start over with a fresh copy:
bash$ mv blogicons blogicons.old bash$ svn co http://svn.alkalay.net/blogicons/trunk blogicons
- Create a repository for pointers to official releases and register the official release the files imported represent:
bash$ svn -m "Links of official releases" mkdir http://svn.alkalay.net/blogicons/tags bash$ svn -m "Official 20070518 version" cp http://svn.alkalay.net/blogicons/trunk http://svn.alkalay.net/blogicons/tags/20070518
- Check how it looks pointing the browser to http://svn.alkalay.net/blogicons/
Manage project files:
- Add files
bash$ cd blogicons bash$ svn add newfile.svg bash$ svn add newfiles.*
- Remove files
bash$ cd blogicons bash$ svn rm oldfile.svg bash$ svn rm oldfiles.*
- To embed the file’s meta information in itself as a comment
bash$ cd blogicons bash$ echo "<!-- $Id$ -->" >> file.xml bash$ echo "/* $Id$ */" >> file.c bash$ echo "// $Id$" >> file.cpp bash$ echo "# $Id$" >> file.sh bash$ echo "# $Id$" >> Makefile bash$ svn propset svn:keywords Id file.xml file.c file.cpp file.sh Makefile
Every time changes and commits happen, the $Id$ tag will be replaced as this examples:
<!-- $Id: file.xml 148 2007-07-28 21:30:43Z username $ --> /* $Id: file.c 148 2007-07-28 21:30:43Z username $ */ // $Id: file.cpp 148 2007-07-28 21:30:43Z username $ # $Id: file.sh 148 2007-07-28 21:30:43Z username $ # $Id: Makefile 148 2007-07-28 21:30:43Z username $
People use to put the $Id$ tag in the beginning of source files. The example show how to put in the end, but that’s because it is easy to represent it here in the documentation. You should put $Id$ tags in the beginning of the file.
- Commit changes to repository
bash$ cd blogicons bash$ svn -m "Changed color to red on icon A, moved the circle shape to left on icon C" commit
Use descriptive comments favoring WHAT changed on files and not which files changed.
So looks like some people are having problems to configure LEAP in their Nokia E-series phones as E61i or others. This is a guide:
- Go to Settings->Connection->Access Points
- Create a new access point with any name you want
- Use the following configuration:
- Data bearer: Wireless LAN
- WLAN network name: the SSID of your WLAN which is found by a WLAN scan of provided by your sysadmin
- Network status: it is probably Public, but my company’s WLAN name is not broadcasted, so I need to select Hidden
- WLAN network mode: Infrastructure
- WLAN security mode: although some people report WPA/WPA2 work for them, 802.1x is the only option that works for me
- Enter the WLAN security settings subpanel
- WPA/WPA2: EAP
- EAP plug-in settings: leave only EAP-LEAP enabled/checked using the Options menu
- Put the cursor over EAP-LEAP and select Options->Configure
- User name: Put the user name they gave you, in my case is my e-mail address
- Prompt password: I use No
- Password: your password (for LEAP use a very complex password for security reasons)
- Homepage: http://avi.alkalay.net/2007/08/leap-nokia-e-series.html so you will have bookmarked the source of this information
With this configuration I am able to connect to my company’s WLAN, which uses Cisco routers and access points. By the way, EAP-LEAP is a proprietary WLAN authentication protocol created by Cisco, and looks like it is considered obsolete.
I also noticed that if the GSM SIM chip is not inserted (offline mode), the phone behavior of getting connected is more difficult. It does not recognize a Hidden WLAN and I had to force the connection. With a GSM SIM chip inserted everything works nicely and as expected.
Looks like only Nokia E-series phones (E61, E61i, E70 etc) running the S60 platform can connect to LEAP WLANs. Same generation Nokia N-series phones (N73, N80, N95) can’t, because they were not designed for business environments — the kind of environments that uses Cisco’s EAP-LEAP.
I noticed Oded’s blog was attacked which makes me remember some things:
I was once invited to analyze a Linux machine that was invaded. I ended up writing an article about it to the brazilian Linux Magazine.
The problem with the machine was a VERY weak root passw0rd. We could also find the tools they used to break that machine, cause they have installed them there to attack other machines.
We could see a file containing about 18000 user+password combinations, a modified SSH client and a script that runs it all based on an IP range. We saw also IRC bots and other stuff.
In tha case of that machine, the attack was silent. They just wanted to use the machine to attack other machines. Pretty stupid.
Its easy to learn about this attacks. Just connect to the Internet a machine with a plain Linux installation and “passw0rd” as the root’s password, wait 1 or 2 weeks and your machine will be attacked. One way to verify the crackers are already in is to reinstall the netstat command (because they’ll modify your previous one) and see if there is some connection to IRC ports (around 6667).
If you investigate this IRC bot you’ll able to connect the IRC server, find the chat room, and actually talk to the cracker. I did this once and was not very funny.
More information in Attacks to GRC.com by Steve Gibson.
- See also Fedora post-installation configurations.
- I documented this procedure a few years ago, in portuguese, in a
broader article about Java on Linux.
Just to make more generic and to simplify Liquidat’s good howto about this topic, here is a better way to install Sun, IBM or BEA Java/JVM/JDK on any modern Linux RPM-based distribution as Fedora 7, Red Hat 5, SUSE, Mandriva, etc:
- On the JPackage non-free repository, look for the package named java-VERSION-PROVIDER-*nosrc.rpm and download it. For this example, I used IBM JVM. Procedure is the same for Sun’s or BEA’s.
- Check the package information with the RPM command as shown bellow:
bash# rpm -qpi java*nosrc.rpm Name : java-1.5.0-ibm Relocations: (not relocatable) Version : 1.5.0.2.3 Vendor: JPackage Project Release : 3jpp Build Date: Tue 15 Aug 2006 Install Date: (not installed) Build Host: tortoise.toronto.redhat.com Group : Development/Interpreters Source RPM: (none) Size : 395165271 License: IBM Binary Code License Signature : (none) Packager : Thomas Fitzsimmons URL : http://ibm.com/developerworks/java/jdk/linux/download.html Summary : IBM Java Runtime Environment Description : This package contains the IBM Java Runtime Environment.
- We visited the URL above to find IBM’s JVM binary for Linux. Chose the 1.5 SDK in tgz format and copied all this way:
bash# cd /directory/where/binary-SDK/was/downloaded bash# cp ibm-java2-sdk-50-linux-i386.tgz /usr/src/redhat/SOURCES bash# cp ibm-java2-javacomm-50-linux-i386.tgz /usr/src/redhat/SOURCES
In SUSE, copy to /usr/src/rpm/SOURCES.
- And built the final installable packages this way:
bash# cd /directory/where/nosrc.rpm/was/downloaded bash# rpmbuild –-rebuild java*nosrc.rpm
- When finished, all final packages are under /usr/src/redhat/RPMS/. Install them all this way:
bash# cd /usr/src/redhat/RPMS/i*86 bash# rpm -Uvh java*rpm
and the JVM is installed.
(All but step 5 may be done as a regular user instead of root, but explanations would be longer and more complex)
Later, you may also want to install the javaws package to have Java Web Start integrated on your browser.
By the way, JPackage Project has standarized how Java software should be packaged on Linux. And they are doing it with RPM (but the concepts may be ported to other packaging systems). It is such a great and well done standard that all RPM-based distributions such as Fedora, Red Hat Enterprise Linux, SUSE, Mandriva, etc are using it for their own Java works. It all starts with a package named jpackage-utils, probably already installed on your fresh system.
You may find many Java software as JBoss, Apache Geronimo, Ant, Eclipse, etc packaged in JPackage web site.
Inspired by an old post by Rui Moura, I’ll maintain here the plain commands needed to setup a freshly installed Fedora or Red Hat system, to include essential softwares they don’t ship by default due to legal issues.
These instructions are currently optimized for Fedora 8, but most of it works for Fedora 7 and modern Red Hat Enterprise Linux too. Good suggestions provided as comments bellow will be added to this guide.
Terms highlighted in red should be changed to match your system.
Permissions Setup
This step will allow you to issue some administrative commands without having to be all the time logged in as root — the system administrator.
bash# echo 'your_plain_loginname_here ALL=(ALL) ALL’ >> /etc/sudoers
Note that this is the only command throughout this guide that shows a root prompt (bash#). All other commands are indicated to be run as a regular non-root user (indicated by bash$).
After configuring sudo, every time you execute an administrative command with its help, a password is requested. This is your password (the regular user’s password), not the root password.
Keeping System Updated
After all the steps bellow and from time to time, update all software installed on your system with the following command:
bash$ sudo yum update
Repositories Setup
Livna and FreshRPMs are repositories of many essential multimedia and general purpose software for Fedora and Red Hat systems.
bash$ sudo rpm -Uvh http://rpm.livna.org/livna-release-8.rpm
Install Adobe Flash Player Globally
bash$ sudo rpm -Uvh http://linuxdownload.adobe.com/adobe-release/adobe-release-i386-1.0-1.noarch.rpm bash$ sudo yum -y install flash-plugin
Restart your browser to activate the plugin.
For reference: Flash Player for Linux home page.
Access LAN Hosts by Name Without a DNS Server
You can access servers and machines on you LAN by name, instead of using their long IP address using the Zeroconf standard (implemented as Avahi in Linux). This is so useful and works out of the box in Ubuntu. The setup in Fedora is easy too, but not automatic.
bash$ sudo yum -y install avahi-tools nss-mdns
Now, instead of accessing local hosts by their IP, you can use the .local domain appended to their names. Just like this:
bash$ ssh 10.0.0.5 # stop using the IP address of dbserver bash$ ssh dbserver.local # start using its hostname
Tip grabbed from Fedora Project wiki.
Keep Date and Time Correct and Precise
Your system can have 100% correct time and date everyday, synchronizing with atomic clocks across the Internet.
bash$ sudo yum -y install ntp # install time sync tools bash# ntpdate 0.fedora.pool.ntp.org # make the first time sync with a Fedora clock mirror bash# chkconfig –level 2345 ntpd on # enable the synchronization service to run on every boot bash# service ntpd start # run the service so you don’t need to reboot
Read more in the official Linux Time Precision HOWTO.
Dramatically Improve Fonts
bash$ sudo yum install freetype-freeworld
Logoff and login again your graphical environment to this update take effect.
To understand why you need this update read this section on the Linux Font HOWTO.
The freetype-freeworld package uses a technique described in this bug report.
Install Web Standard Fonts
These packages include popular fonts as Arial, Times New Roman, Tahoma, Verdana, as well as new Windows Vista and MS Office 2007 fonts. Learn more.
bash$ sudo rpm -Uvh \ http://avi.alkalay.net/software/webcore-fonts/webcore-fonts-3.0-1.noarch.rpm \ http://avi.alkalay.net/software/webcore-fonts/webcore-fonts-vista-3.0-1.noarch.rpm
Then, configure your desktop as described in the Linux Font HOWTO, for KDE or Gnome.
MP3 Support
For Gnome and GStreamer:
bash$ sudo yum -y install gstreamer-plugins-ugly libmad libid3tag id3v2
For KDE:
bash$ sudo yum -y install kdemultimedia-extras-nonfree id3v2
Amarok: The best audio player for Linux
bash$ sudo yum -y install amarok-extras-nonfree
DVD Player
bash$ sudo yum -y install vlc
General DVD and Movie Player and Browser Plugin
bash$ sudo yum -y install mplayer mplayer-fonts mplayerplug-in
General Digital Video Authoring and Editing tools
bash$ sudo yum -y install mencoder mkvtoolnix mkvtoolnix-gui ffmpeg avidemux
Correctly install Java
Fedora 8 includes what will be the new Sun Java 1.7 JVM that was open sourced in late 2006.
This JVM (codename Iced Tea) is still beta and may not fulfill all your needs, but it is now extremely easy to install:
bash$ sudo yum -y install java-1.7.0-icedtea # installs the JRE only
Other subpackages you can install with similar command are java-1.7.0-icedtea-devel (JDK), java-1.7.0-icedtea-plugin (browser plugin), java-1.7.0-icedtea-demo, java-1.7.0-icedtea-src, java-1.7.0-icedtea-javadoc.
If the 1.7 does not fulfill your needs, I wrote another similar tutorial on how to correctly install traditional Java that will become obsolete as soon the Iced Tea project is final, but may be enlightening about how to install other Java related libraries and packages.
Access Windows NTFS Partitions From Linux
bash$ sudo yum -y install ntfs-config
Then run the ntfs-config-root graphical tool and configure your partitions to be writable and mountable.
bash$ sudo /usr/sbin/ntfs-config-root
An example of my system:

After you configure the tool and quit, your NTFS partitions will be mounted in the specified place. In my case /media/Windows and /media/Work.
Configure text console in high resolution and smaller fonts
This tip is for the text console.
bash$ sudo echo 'SYSFONT="lat0-08"' >> /etc/sysconfig/i18n # set a ISO-8859-15 font
bash$ sudo echo 'fbset 1024×768-60‘ >> /etc/rc.d/rc.local # set console resolution to 1024×768 @ 60Hz
These settings will take effect after a reboot, but you can test them before rebooting executing the following commands:
bash$ sudo setfont lat0-08
bash$ sudo fbset 1024×768-60
Note that you can set different resolutions than 1024×768 if you have a video card and monitor that will accept it. A full list of modes can be listed with the command:
bash$ grep "mode " /etc/fb.modes
Resolvi aderir ao meme (alguém sabe onde começou?).
floripa:~$ history|awk '{print $2}'|awk 'BEGIN {FS="|"} {print $1}'|sort|uniq -c|sort -rn|head -20
222 ls
140 cd
136 ls
52 rsync
43 dmesg
35 mv
35 gmplayer
24 sudo
23 ps
23 df
19 mkvinfo
18 rpm
15 mkdir
14 cat
11 mkvextract
11 less
11 ffmpeg
10 mmg
9 ping
9 kill
Resolvi dobrar o tamanho da lista para dar a chance das pessoas conhecerem novos comandos, menos populares, como mkvextract, mmg, mkvinfo, ffmpeg.
Queria lembrar que essa lista é uma fotografia do meu uso atual, e tenho manipulado muito vídeo últimamente. Em outros carnavais, iriam aparecer coisas como java, ssh, etc.
SOA é um estilo de arquitetura que tenta alinhar melhor processos de negócio com a TI.
Apesar de os frabricantes de TI — como a IBM — serem os que mais falam sobre isso, ingressar em SOA significa primeiro modularizar seus processos de negócio para depois mapear isso aos módulos de aplicações e infra-estrutura.
Grid é um conceito meio obsoleto. Como conceito, mas não como tecnologia. O conceito é obsoleto porque sua atuação é extremamente estrutural e muito complexa. Toda a terminologia relacionada a Grid tem caráter técnico, difícil de explicar e de nada adianta uma empresa pensar em Grid se seus processos de negócio e aplicações que os implementam não estiverem modularizados.
Por isso inventaram SOA. Para que provedores de TI pudessem ter um discurso mais ameno e acessível ao vender a idéia para gestores em seus clientes. E também para atacar o problema do excesso de complexidade da TI do cliente em sua raiz: na modelagem de seus processos de negócio.

E Web Services, onde entra? Dividindo em camadas, o conceito de SOA mora na fronteira entre negócios e TI. Na hora em que os processos vão se materializar em software e aplicações, a boa prática sugere usarmos certos padrões de desenvolvimento, de integração entre módulos. Esses padrões foram agrupados juntos nas especificações de Web Services, e se preocupam em definir como se faz chamadas a serviços (métodos) remotos, como um serviço encontra outro, etc. Então, nessas camadas conceituais, Web Services encontra-se logo abaixo de SOA.
E Grid está logo abaixo de Web Services. Ocupa-se dos mesmos problemas e soluções, mas com abordagens mais operacionais. Grid nasceu em um ambiente científico e WS em um ambiente de aplicações de negócios. Reinventaram a roda um do outro diversas vezes. Mas nos últimos anos têm juntado esforços para limpar os overlaps a fim de produzir um único conjunto de métodos e boas práticas.
Tudo isso é Virtualização
Se a virtualização de hardware (Xen, VMWare, z/VM) divide um equipamento em vários pedacinhos, SOA, WS e Grid dividem a aplicação em vários pedacinhos funcionais.
A virtualização de software (SOA, etc.) é mais difícil de fazer. Mas é também muito mais poderosa que a de hardware. Traz benefícios mais consistentes, mais abrangentes (porque tiveram que arrumar a casa dos negócios antes) e de mais longo prazo.
Tudo isso tem a ver com a Web 2.0
Explicar Web 2.0 está fora do escopo agora, mas sua arquitetura tem muito a ver com SOA.

Ao invés de feeds, podcasts e APIs JavaScript da Web 2.0, SOA tem serviços, provedores de dados e de funcionalidades. Equivalente ao HTML, capaz de juntar funcionalidades e dados de diversos sites, SOA tem a Linguagem de Execução de Processo de Negócio (BPEL, que é XML) que define a ordem e dependências ao juntar Web Services para formar uma aplicação maior. O papel das tags e folksonomy da Web 2.0, é exercido pelo UDDI no contexto de Web Services.
Mashups da Web 2.0 (experimente o iGoogle) são as Aplicações Compostas do SOA (veja também na Wikipedia).
E o Enterprise Service Bus do SOA (também na Wikipedia) tem o Browser como seu equivalente na Web 2.0. Sim, porque ambos tem a missão de materializar as conexões lógicas definidas pelo DHTML ou BPEL.
Web 2.0 é a Arquitetura Orientada a Serviços global.
Andei estudando tecnologias de compressão de vídeo e é um mundo fascinante. Tudo sobre Linux.
DivX e Xvid são compressores ainda bons mas de gerações anteriores. O mais moderno e avançado é o H.264 também conhecido por MPEG-4 AVC, padrão ISO. Uma das melhores implementações desse compressor é livre: o projeto x264.
E sobre containers, um dos mais completos hoje em dia é o MP4. Um mesmo arquivo MP4 pode conter uma trilha de vídeo, outra de vídeo em outros ângulos, outra de audio em inglês, outra de audio em português, e outras de legendas em várias linguas, em Unicode, menu como o de um DVD, informação sobre capítulos etc. Isso é um significativo avanço em relação ao container AVI da Microsoft que não suportava nada disso. Pode-se fazer um backup de um DVD para um arquivo MP4, incluindo toda a sua interatividade, menus e capítulos.
Apesar do nome sugestivo, MP4 não é a evolução do MP3. Afirmar isso é como dizer que .gif evoluiu para .tar, coisa que não faz sentido. A evolução do MP3 é AAC e HE-AAC. MP4 (um formato de container) pode conter streams MP3 (um formato de audio), como fiz abaixo, mas o mais natural e moderno é um MP4 conter streams AAC.
Converti um vídeo de 53 segundos que fiz com minha câmera. Veja a comparação:
| Original.avi | Comprimido.mp4 | |
| Geral | 53s, 15.077 kb/s, 640×480, 30 quadros por segundo | 53s, 2.495 kb/s, 640×480, 30 quadros por segundo |
| Tamanho | 100.326.316 Bytes | 16.639.145 Bytes |
| Trilha de vídeo | 99.697.780 Bytes, compressão Motion JPEG | 15.952.188 Bytes, compressão H.264 |
| Trilha de audio | 586.888 Bytes, formato PCM mono 11,024 Hz | 657.699 Bytes, compressão MP3 mono 22,05 Hz 64kbps |
| Overhead do container | 41.648 Bytes ou 0.04% do tamanho do arquivo | 29.258 Bytes ou 0.18% do tamanho do arquivo |
Há duas discrepâncias aqui:
- O tamanho relativo do container deveria ter diminuido.
O overhead do container MP4 é bem menor que AVI, mas como o tamanho do vídeo diminuiu muitíssimo, isso distorceu a relação do tamanho do container com o do arquivo. Se transferíssemos sem recomprimir os streams de audio e vídeo do AVI p/ MP4, veríamos uma significativa queda de overhead do container. - O tamanho da trilha de audio aumentou.
O fato é que tive sérios problemas para compactar o audio. Minha câmera grava som em formatos tão baixos que tive que aumentar a freqüência do sinal para o arquivo ser aceito pelo LAME. E ai usei bitrates talvez altos de mais para a compressão. Mas ganhei tanto com o H.264 que nem vou esquentar a cabeça.
O vídeo final é de alta qualidade (comparado com o original), e não consegui perceber diferença entre eles. Olhei várias vezes, com muita atenção.
Eu ainda fiz questão de alta qualidade, e mantive o bitrate em 2495 kbps. Poderia ter diminuido mais ainda o tamanho se fizesse compressão em 2 passos. Filmes em formato Xvid (MPEG-4 ASP) que se baixa da Internet, em boa qualidade, tem aproximadamente 850 kbps. É esperado que se dermos só 850 kbits para o H.264 trabalhar 1 segundo de vídeo, obteremos resultados melhores comparados ao Xvid.
- Publicado na Linux Magazine, edição de dezembro de 2006 (que só chegou nas bancas em fevereiro de 2007 !!!).
- Arquivo original em formato ODF e PDF.
- Mais artigos
Qualquer administrador de firewall pode observar em seus registros que uma máquina conectada à Internet não fica um minuto sequer, 24 horas por dia, livre de tentativas de invasão. Tem sempre alguém fazendo uma varredura, tentando algum tipo estranho de conexão, requisitando URLs inseguras aos servidores web, enfim, batendo na porta. Parece que as pessoas têm se protegido bem já que não lembro de ter ouvido histórias detalhadas sobre um ataque efetivamente acontecendo.
Tive a oportunidade de analisar um computador que foi invadido e vou relatar aqui as evidências que os crackers deixaram para trás, como as descobrimos, e o que lhes interessava naquela máquina. Vou usar nomes fictícios e mascarar alguns IPs para resguardar a privacidade de todos.
Vamos chamar os invasores de crackers, porque hackers somos todos nós que respiramos tecnologia, “fuçadores” (tradução da palavra hacker), exploradores, pessoas curiosas. Somos todos hackers porque usamos nossas mentes poderosas para resolver problemas, ganhar dinheiro licitamente, enfim, fazer o bem. Um cracker por outro lado, usa seu conhecimento para invadir, deteriorar, tirar vantagem, e dar trabalho aos hackers administradores de redes. Um cracker é um mau hacker, e um bom hacker pode impedir a ação de um cracker.
Os Rastros Deixados pelo Cracker
O servidor em questão era uma máquina de testes internos na empresa A, que em determinado momento foi deslocada para um novo teste conectada à Internet, sem uma reinstalação. Tudo começou quando, poucas semanas após estar conectada à Internet, uma empresa que chamaremos de B, enviou um e-mail para P (provedor do link físico para a máquina atacada) informando que detectou uma tentativa de ataque, e requisitou um retorno. P encaminhou o e-mail para A, e esse continha alguns logs com a prova da tentativa de invasão:
Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:36:27 sshd[PID]: refused connect from IP.IP.IP.IP Feb 22 12:26:27 sshd[PID]: refused connect from IP.IP.IP.IP
Eles mostravam que o IDS (Intrusion Detection System) de B acusou que a máquina atacada (cujo endereço IP está representado por IP.IP.IP.IP) tentou se logar várias vezes sem sucesso em seu serviço SSH (sshd). Reparem que o instante de todas as tentativas, até os segundos, é o mesmo, o que leva a crer que não é um ser humano, e sim algum software que muito rapidamente está testando várias combinações de usuário e senha ao mesmo tempo.

Fui chamado para dar explicações porque havia fornecido informalmente por telefone algumas dicas de como proteger a máquina. Primeiramente, era necessário dar subsídios ao provedor P para responder ao e-mail de B, dando uma satisfação formal. Isso é uma atitude de responsabilidade de um bom administrador de rede, e demonstra a preocupação em manter o nível de serviço da Internet o mais alto possível.
A máquina foi colocada em quarentena, desligada da Internet e começamos a analisá-la. Tratava-se de um Red Hat Enterprise Linux 3 Update 5. Não estou dizendo que o Red Hat Linux é menos ou mais seguro. Isso não é muito intuitivo de se entender, mas segurança não tem quase nada a ver com o software. Segurança não é um firewall, não é criptografia, nem um conjunto de produtos que tem proteção como objetivo. Segurança é um processo que deve ser seguido conscientemente por administradores de redes. Se um ataque acontece, toda a responsabilidade é do administrador, e não do sistema operacional, seja ele qual for, e do fabricante que for. O administrador precisava agora descobrir como o cracker invadiu para, corajosamente, assumir a falha



