Entries in Life

I’m a little frustrated that when I talk about manageability, people get confused. Manageability makes it simple for system administrators to deploy desktops and for users to share data.

This isn’t just about setting up servers. Ubuntu, based on Debian, is great as a server OS.

This isn’t just about automating tasks. Landscape or puppet can help out here, but that only goes so far. They’ll take care of monitoring, package updates, and automating tasks.

A sysadmin of an office or an IT group for a larger organisation still needs some central management interface for all his users. He needs to make it easy for people to share data across a network and have unified, secure credentials for login, email, and web access. If a user’s login account isn’t the same as their email account — if they can’t use the same address book in their desktop mail client as they do in webmail — then you have a management problem.

There is a known solution to this problem. Kerberize your apps and make them speak LDAP. Many applications already have this capability. The manageability problem that Ubuntu has is not really a lack of capability, it is one of integration. System and Network administrators tend to understand the problem better than developers of desktop or server software, but most of them already have their hands full managing their own organisation and don’t have time or, often, the capability to start integrating all the software and configuration into something that anyone can deploy easily.

And so, Microsoft continues to win on the desktop. Not because an individual PC running Windows is easier for most people to use, but because its easier to set up Active Directory to work with Outlook and Exchange than it is to roll your own directory service with the tools available out of the box on Ubuntu. Bug #1 will never be solved until directory services and authentication are integrated into every aspect of Ubuntu.

Now, as frustrated as I am that most people don’t seem to understand the problem when I talk about it, I am pleased to see that others are aware of the problem, and have actually put some effort into planning out an approach to solving it.

The best example of this would be the EDUbuntu people. Their EDUbuntu User Managment blueprint is a great outline of exactly what needs to take place to solve this managability problem.

But they created this blueprint over four years ago and almost nothing has happened on it.

Launchpad is littered with similar blueprints (below) that show other people’s aborted efforts to solve part or all of the problem. Unfortunatly, no one group has really tried to spear-head this and so most of these efforts (at least when I did my survey a few months ago) are dead or dying.

I’d really like to get this problem solved so that setting up an Ubuntu-based directory service would be as easy — easier, even — as setting up Active Directory.

Look over the blueprints below, find a place you can help. Let’s get this moving forward!

• Turnkey identity management
• Identity management reference/test config
• Default LDAP DIT for user and group management
  
• implement simply DIT for Ubuntu server
• Make Ubuntu authenticate against Network Authentication services
• Single User Interface to Join and Participate in Microsoft Active Directory Domains
• Architecture of a directory infrastructure
• Enable user login to leverage a directory infrastructure
• Identity management and network authentication in Hardy
• Integrated Active Directory Logon
• 389 Directory Server Inclusion in Karmic
• Directory service included in Ubuntu Server
• Configuration of services to integrate with a directory
• Enable services to leverage a directory infrastructure
• Open Directory Service package
• Integrate OpenDS in Jaunty
• Search for a published printer in an Active Directory
• EdubuntuUserManagement
• Easy active directory integration for EDUbuntu
• An integrated directory server for Ubuntu-server
• LDAP Integration
• Ubuntu Server MS Integration Proxies
• Seamless integration into a Windows domain environment (Active Directory)
• Make a LDAP Server as easy to install as a LAMP Server
• Managing the directory
• System Security Services Daemon for Ubuntu
• Make LDAP the default configuration backend for Ubuntu
• Create new tasksel tasks for common server use cases
• Free Identity Policy Audit infrastructure for Ubuntu as the freeipa.org project
• Authentication/Authorization/Access control/Accounting/Auditing services in the cloud
• Extend mail stack in Ubuntu-server
  

(This is a copy of the message I sent to the UbuntuNGO mailing list.) As a system administrator for several years (I got my first sysadmin job back in ‘97), I’ve been frustrated with the lack of manageability of Linux systems. To reduce the cost of managing desktop systems, directory services that provide single-sign-on and centralized management capabilities are needed. Sure, there are things you can cobble together, there are ways you can integrate Ubuntu into an AD network (see this article on “Seamless Smartcard login” for an example), but these things are more complicated than they need to be. And, while I don’t think the goal should integration with AD, when Microsoft provides tools to easily manage computers throughout an organization, the cost of supporting Microsoft systems is going to be less since the cost of licensing is nothing compared to the cost of paying for the increasingly complex IT support Ubuntu requires without Directory services support built in. No, this isn’t a specifically NGO goal, but it is integral to the goal that UbuntuNGO has of getting NGOs to adopting Ubuntu on the desktop. I went through Launchpad looking for blueprints pertaining to management and directory services and found a number of initiatives. The problem, though, is the hodgepodge of efforts and lack of focus. Directory services integration is absolutely vital to getting NGOs and others to adopt Ubuntu on any sort of scale. Canonical and Ubuntu have done a great job of providing an excellent out-of-the box experience for the individual user, but scaling that up to groups of non-technical users needs work. We can make management of Ubuntu systems on a network just as easy as the use of a Ubuntu itself is, but it will take some work and we can’t expect that a great desktop experience will solve all problems. I’m interested in your thoughts.

Working on free software projects isn’t easy. Just because you’re giving away your work for anyone to use doesn’t mean that anyone is going to take it, no questions asked. Take my MediaWiki work as an example. I am being paid for the work, but it is freely licensed and I’m learning about the standards of quality that the community has formed around the code. Frankly, before becoming involved in such a serious PHP-based project, I didn’t have a very high opinion of PHP. Even Rasmus (creator of PHP) doesn’t seem to live in a pure php world and, as a result, thinks of systems where PHP is merely the web frontend instead of almost the entire system. So working with others who have been neck-deep in PHP for years, building one of the top-10 sites on the net entirely in PHP, and gaining intimate familiarity with the quirks of PHP, has been a wonderful experience. But MediaWiki isn’t the only free software project I’m involved in. I also contribute to Emacs occasionally. (For those not so familar with Emacs vs Vi, let’s just say this is like the social situation between Republicans and the Democrats or the Roman Catholics and Southern Baptists: You live next door to them, but you know they’re going to hell.) And it is my most recent commits to Emacs that have gained me noteriety. Yesterday, I was catching up on some blog reading (Planet Emacs, thankyouverymuch) and came across a nifty use of loccur.el. But it used defadvice instead of a hook (and hooks are better — no this is different than emacs vs vi, I swear). I looked at the code and thought, “Hey, I can make a tiny little contribution to Emacs here!” So I made a couple of small changes. Little did I know what a problem that was going to be. Óscar Fuentes used my commit message as an example of how not to write a commit message. This was not the first time I’ve been so honored. Three weeks ago, I made a mistake committing to the bzr repository for emacs and was again used as an example for the Emacs-devel community of how not to make a commit. There are two reasons I’m such a stellar example for the other Emacs developers. First, I’ve been using bzr for a couple of years while working on the iHRIS Suite. This experience (2 years more than most Emacs developers) naturally made me think I had things under control. So I didn’t bother reading over Bzr for Emacs Devs. Second, Emacs recently switched its source-control system (after much debate and some effort on speed the bzr side) from the ancient, worn, CVS to bzr. So people are still adapting their work flow. I just happened to make some commits that were particularly egregious and ended up being great examples of what people should avoid. So, yes, Free Software is a great thing, but that doesn’t mean the developers don’t take it seriously. And being reprimanded in public isn’t the most pleasent experience. But at least I can blog about it!

Everyone loves a good apocalypse. Whether that apocalypse is Y2K, 2012, Financial Collapse, Peak Oil, Global Warming, or the being Left Behind, we love being scared. We can take any problem, and make it seem insurmountable and inevitable. In our darker moments, we become fatalistic about it. Before we understood anything about genetics, we saw our fate in the stars, the bumps on our heads, the creases on our hands, or the lay of the the cards. Now that we have genetics, we look at that superstitious thinking and laugh. Instead of saying “It’s in the stars” we say “It’s in my genes.” This apocalyptic fatalism means the end keeps coming — but it ain’t here yet. We live in with visions of impeding doom — What will I do when the oil runs out? when the oceans flood? what if I am left behind? — or we convince ourselves there is nothing to worry about, putting our faith in Man’s ingenuity, assuring ourselves that the science is junk, or simply believing our belief makes us immune. Its a wonder our civilization has kept going for so long — that we haven’t all gone mad already. I suppose its the competing visions of apocalypse that keeps us whole. As long as we don’t all believe the same thing, we can keep asking “Is the end here yet?” And the answer will continue to be “Not yet.”

(I went to Haiti in 1987 as a teenager. I’ve been interested in what’s been going on there ever since. My brother asked me what I thought about the most recent disaster. I spent enough time on the reply, that I thought I might share it with a larger audience.) I haven’t really been following what’s been going on. Not closely. Following the news out of Haiti is pretty depressing. Following just one man, Aristide, from 1987 onward gives some idea of the what is happening in Haiti.

• 1987 – My missions team had to leave 2-3 weeks early because of the violence. Aristide, a Roman Catholic priest, is told to stop preaching political sermons and is re-assigned.
• Elections stopped in November 1987 because of violence.
• 1990 – Aristide is elected, endorses “necklacing” (i.e. execution) his opponents
• 1991 – Aristide ousted, ends up in the States.
• 1991-1994 – Aristide embezzle’s money from Haiti’s international telecom revenue.
• 1994-1996 – Aristide leaves the priesthood, marries. With U.S. military help, he is re-instated as president. His term ends in 1996.
• 2000 – Aristide elected with 10% of the populice voting.
• 2004 – Rebellion, Aristide is forced out and ends up in Pretoria, South Africa. (Aristide claims he was kidnapped by the U.S. military although it looks like he would have died had they not shown up.)

Of course, you could easily claim that Aristide is just one corrupt ruler in a line of corrupt rulers. But I think the problem is much deeper than Haiti’s corrupt leadership. Another way to look at Haiti and get an idea of just how bad things were before the earthquake is to look at the border between Haiti and the Dominican Republic. On the west side of the border, where Haiti is, you can see there are fewer trees than on the east side. People in Haiti have been using up the natural resources — in 2007, less than 1% of their forests remained. Which means they end up finding it very hard to produce anything. Two years ago, stories started popping up about people in Haiti resorting to eating clay “cookies”. (Eating dirt isn’t unusual, but making it the primary source of nutrition is.) For as long as I’ve been aware of Haiti, it has been on the brink of disaster. The earthquake is just another disaster on top of the countless ones that came before it. Its amazing how much poverty and political violence and unrest continues to exist in a country just an hour and half flight away from Florida. Of course, this isn’t a problem that money is going to solve. If money solved problems, Haiti would be able to bounce back from this and its other problems really quickly. And we wouldn’t have ongoing “hostilities” in the Congo or Sudan. There wouldn’t be pirates in Somalia. North Korea wouldn’t have concentration camps. So, while the problem in Haiti is systemic, I’d hesitate to over-spiritualize it as, say, Pat Robertson has by claiming this is all because Haiti made a deal with the Devil. And I’d hesitate to say that this earthquake is going to lead to dramatic change in Haiti. It could, true. But any number of the crises in Haiti’s past could have led to dramatic change. I’m mostly frustrated with disaster voyeurism that we in the States seem to delight in. I applaud people who try to do something with their lives to help others. And we even need, to a certain extent, disaster “tourists” who help out whenever there is a disaster. But I’m still frustrated. And part of that is because I have done so little and there is such a great need all over the world for help.

Christ is Born! Glorify Him! This year, we gave our kids their major gifts early: a Wii and a TV after spending most of the year without one. And, other than those two items, we told them this would be a Chrstmas of hand-made gifts. And this year, since I had been out of work since the beginning of November, it made a lot of sense. I didn’t know what to expect for Christmas morning. The kids dragged me out of bed, we read Luke’s narrative of the Nativity, sang a couple of Christmas carols and then headed to the tree to open the gifts our children had given. Like I said I didn’t know what to expect: I had pretty much forgotten that we had told the kids they would be making their own gifts. And, as I found out later, Alexis didn’t remind them of their responsibilities. So it gave me a great deal of pride to see the gifts and their response. Our oldest daughter had knitted a cap for the youngest. The other daughter wrapped up some sugar cookies she had made earlier in the week. My wife wrapped up some Ferrero chocolates that we had bought. I remember how I would have reacted had this been my Christmas as a child. Barely any gifts under the tree — you could still see the treestand, after all — I think the disappointment would have been only too visible on my face. So when my son was overjoyed with the chocolates, when my daughter demonstrated the knit cap, I was almost bursting with pride. My children were happy with, even thankful for, practically nothing. (Sure, they had a new Wii and we had a new TV, but these were not the focus of their Christmas morning.) When I see my children showing more maturity and thankfulness than I remember posessing when I was young, it makes me think that at least this one thing is right.

So, the non-profit (which shall henceforth remain anonymous) that had me all excited called today and let me know that they had hired someone local. Oh well. I’ll just have to work on my consulting.

I’m still waiting to hear from them: Do I or do I not get the job? Pins and needles!

I’m in San Francisco for the day. Last night I had a great time with danlyke of Flutterby fame. Since right now is the the Advent Fast, he took me to Café Gratitude, a raw Vegan restaurant where every one of their dishes is an affirmation. I couldn’t help but giggle when they handed me my coconut curry soup as they said the mantra “You are Thankful!” I would imagine that The Secret has done better here than in Lancaster County. “But, Mark,” I can hear you not asking, “What the heck are you doing in San Francisco?” About a month ago, a non-profit here contacted me about a position they’re trying to fill. They need an open-source person to be, essentially, their community liaison for code contributions to their open source project. At the time, I was still working for IntraHealth, so I told them I wasn’t interested. But the following Monday, I found out I was not going to be working at IntraHealth any longer. A new (but smaller) round of funding came through and they just didn’t have room for me in the budget any more. With this new-found freedom from obligations, I called the HR person back and told him, “Guess what? I am interested after all!” In the meantime, this has been one of the more productive periods of transition I’ve ever had. Friends of mine who freelance have tossed a couple of gigs my way and I’ve spent a little more time with my kids. Only once have I glimpsed into abyss of fear and self-doubt that the recently jobless can end up in — the rest of the time I’ve been excited about the opportunities. So, here I am in a San Francisco hotel room early in the morning. My body is still on Eastern time and I can hear the city slowly coming to life around me. I plan on scoping out Berkeley this morning and then, after my interview (during which, in my fantasy, they offer me the job on the spot) I’ll go see how far CalTrain will take me.