Open Source Hardware Today

The spirit of open source software means providing access to the source code, friendly licensing models and community support (documentations, forums and social gatherings). Computer and electronic hardware have always been proprietary as it involved large sum of money and required access to specialised machines and technology in order to design and build hardware.

In October 2016, it is announced by Open Source Hardware Association the rollout of Open Source Hardware Certification Program (read more). Hopefully it will help to address the long time conflict of patent law with OSS licenses in regards to hardware. That's right, OSS relates to copyright laws in almost all cases I know, but when it comes to hardware, most of it refer to patent law.

The most well known license for open source hardware is the European Organization for Nuclear Research (CERN). CERN list their licenses, hardware repository and projects that use their license at http://www.ohwr.org


More projects on hardware can be found at
Makezine
Olimex
Raspberry Pi
Adruino

With the certification coming out, a growing list of open source hardware vendors and project, looks like the stars are shinning for open source hardware enthusiast and business.

Faces of Clouds

Cloud is a big thing these last few months. Just to clear some terms that is of interest and where even so called IT experts are not able to agree on. This means, that its my personal view based on resources published by industry experts.

3 items are of interest. The first, is naming of a cloud based on its deployment. Second, clouds can further be classified based on services it provide to users. And lastly, a case study. Think of your plan to build a cloud and how it would be shaped.

A) A cloud is named based on its location or deployment.

1. Public - Applications, storage and services made available to the general public for free or for a fee.
2. Private - For a single organisation and decisions made centrally on resources.
3. Community - Shared infrastructure having several organisation with specific interest that is managed internally or by a 3rd party.
4. Hybrid - Combination of either Public, Private or Community, or all three.

B) A cloud can then be named based on its services.

1. IaaS (Infrastructure-as-a-Service)
1. Users install own operating system and maintain its own patches, IP addresses. - Rackspace, Amazon EC2.
2. Users can leverage resources to sell as a service provider to their clients.
2. PaaS (Platform-as-a-Service)
1. Run your own application on a provider's platform
2. Develop on a provider's platform - Google AppEngine, Oracle Cloud Platform, OpenShift.
3. SaaS (Software-as-a-Service)
1. Full web application - E.g. Googledocs, SalesForce, Gmail
2. Web services (consumed by other web application) - GoogleMaps API, PayPal

C) A case study

How would you shape a cloud based on above (A) and (B) for following situation?

Lets say a government wants to setup a TeleHealth cloud. It allows any application for hospitals, clinics and government. Some of these applications are built and some bought. Geographically users are very dispersed throughout the country. 

A) Community

Why? Organisations apart from the Ministry of Health, clinics and hospitals would also include 3rd party resources for pharmaceutical, research, assets, payments.

B) PaaS

1. By providing one or two standard platforms, all development can be better managed. Deployed applications can be made to meet security and other standards set.
2. Many new applications/web services can be introduced by users. 

What you should not do for your online portal

At any time if you have launched a portal accessed publicly, its a bad idea to have links showing Minta Maaf.

Just found this on the Malaysian Road Transport Department Portal on  5 Jan 2013.

If its not ready, no need to put it online, right? Just my Opinion.

The link kept directing to http://www.jpj.gov.my/mintamaaf for most of the options I picked.

Linux security checklist

The Anonymous is announcing an attack on www.malaysia.gov.my, which is a central portal to reach all other Malaysian Government portals. This is reported by F-Secure Corporation and theStar, 14 Jun 2011. Makes you wonder why Anonymous would want to do that.

Follow up from my previous post, I realise that many Linux Admins out there do not have a Security Checklist for their web application. I am sharing the following checklist here as it provides a standard security consideration for almost all web application on Linux or LAMP stack. It is by no means the only security guide, please apply all other security concerns specific to your needs and you can then sleep better at night.

Check List for Web Application (deployment)

Category	Item	Notes
Logins
A.1	Operating system -Administrator password is secured and recorded as only accessible by ONE administrator -All login's are done as normal user -Normal users with access to Administrator priviledges are recorded. Access should be via SUDO. -All logins are recorded
A.2	Application -All users to have secured logins -Administrator logins are assigned to specific individuals and listed -Web based self registered user must have email and spam prevention facilities -Lock down on Web server's user/application access -Default access and password for all administrator applications must be secured. This includes the main application, phpmyadmin, firewall.
A.3	Database -Each application to have a specific user and password access. This user cannot access other databases. -Administrator access is with secured password. Assignment to specific individuals must be recorded.
Services
B.1	Disable unnecassary services -Firewalls must be enabled to restrict external access to only the approved application (via port numbers). -Identify every services running. Disable those not in use. -Remote access must be via encrypted protocols -Disable local email server (e.g. sendmail) from runnin/listening continuously. Or use external email server. -Email servers controlled to allow access to specific application and directories. -Anti-virus if implemented, must have patches and pattern updates kept to the most recent.
B.2	Create a base point of security -A penetration test must be carried out. The type and complexity is based on the specific application. -Establish an integrity check point
B.3	Tell them you do not allow access -Place warning messages to all points of access. E.g. motd and issue.net
B.4	Logging -Log activities to separate files for operating system and application. -Make logs available to a centralised log server.
B.5	Backup -Establish a backup plan. -Implement a backup process
B.6	Create a boot disk and rescue of the Linux
B.7	System updates -Disable the automatic system updates. Updates should be installed only after it is verfied working with the application. -Periodically check with security issues, respective application security notices and update as needed.
Physical
C.1	Physical Access -Ensure only authorised personel can access to the server. -A record of physical access is maintained.
C.2	Storage Media -All storage media is tagged. -Storage location and transportation is secure and recorded.
C.3	Security Policy -Ensure the document is readily available to authorised users.

Checklist for Web Application (Deployment) by Nicholas A. Suppiah is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
Permissions beyond the scope of this license may be available at http://www.blogger.com/profile/06749525177696246387.

How many Linux do I need?

When a person wants to use Linux as a desktop or server, the most common questions will be

• Which Linux should I use?
• Why isnt there a policy for a single Linux distro?
  

These age old questions are asked when there are consistent differences and dependencies in applications, drivers and protocols used between Linux. Have you felt that you needed to learn Linux all over again when encountering another Linux distro. Well, you wont be alone in this. Even application vendors will worry if they need to write different Linux versions for each of their application.

An article from Linux.com mentioned about the comings of Linux Standard Base (LSB) Desktop Project. What does this mean? Anyone can choose their own Linux desktop and still work with others in the same environment.

In 2008, we have LSB 3.2 that allows portable applications among the Linux distributions.
As a guide to which Linux distribution, refer to only those found at https://www.linux-foundation.org/lsb-cert/productdir.php?by_lsb

Following is a list of those already LSB certified. Try to look out for the LSB Certified trademark.

• LSB 3.1
• RHEL 5
• SUSE Linux Enterprise 5
• Ubuntu 6.06

One last example of what this standard means:
Desktop

1. Bitmap images - uses PNG
2. Compressed photo - uses JPEG
3. Fonts - uses Freetype2 (2.1.10)
   
4. Cryptographic - OpenSSL
   
5. X graphics renderer - uses X version 11 release 6.4
6. Desktop menu directory - uses Desktop Menu specification 1.0
   

Core

1. Executable and Linking Format and part of ISO/IEC 23360
   
2. Required user and group names include root, bin and daemon
3. Software installation is in RPM or LSB conforming installer