I'm not upgrading to Ubuntu Lucid

At least not yet. I'll probably do it in two or three weeks. Why?

Because official release date doesn't magically make the distro stable. It does, however, make thousands of people install it and report bugs. I've been using Lucid beta for weeks and I've seen a few bugs. Granted, not as much as with Karmic. LTS releases take their packages from Debian Testing instead of Debian Unstable, which greatly improves quality. Still, I don't think Lucid is ready for production use.

Now, don't get me wrong, I'm all for installing early version to report bugs and help improve the software. I do a lot of work in a Lucid VM. I've reported some bugs on Lucid and commented on the others. But my main machine needs to be stable and I'm not going to take a risk. Not after going through the painful process of downgrading a few months ago.

Related articles by Zemanta

• Lucid Lynx fights 'major' X-Server memory leak (go.theregister.com)

Xen 4 released

Version 4 of opensource Xen hypervisor has been available for a few days now. This release brings up some interesting features:

New kernel for dom0 - instead of ancient 2.6.18, we get a new subsystem built on PVOps interface of new Linux kernels. Currently 2.6.31.13 is supported, but porting it to a new version is now trivial compared to the old approach. Finally Xen gets a decent support for new  hardware and running a modern distribution in dom0 is way easier.

Blktap2 - new disk I/O system. This almost deserves a separate post. Virtual block devices (hard disks) can be backed by files, partitions, LVM volumes or even network devices. VHD, the native format of Microsoft virtualization systems and a de-facto industry standard (VirtualBox and VMware can read it too) is now supported. Advanced disk formats such as copy-on-write (run multiple VMs from the same image initially and only copy the blocks that changed), sparse images, on-the-fly encryption and compression are easier and faster then before. Disk images can be accessed from outside the VM. But the real killer feature is live snapshot.

Copy-on-write RAM. VMs can now share memory. The scalability is also improved: by default Xen supports 1 TB RAM and 128 CPUs, limits can be increased.

Improved PCI passthrough - PV guests still use old mechanism by default cause it doesn't require hardware support. If your CPU and chipset combination support IOMMU, you have to enable the new way manually, see http://wiki.xensource.com/xenwiki/XenPCIpassthrough

Many other improvements. Updated Pygrub, certified PV drivers for Windows guests, disk resize without reboot, libxl - new userspace Xen management API, improved networking, physical CPU and RAM hotplug, support for Smart NICs with multi-queue and SR-IOV (one physical Ethernet card appearing as multiple PCI devices)

Related articles by Zemanta

• Xen 4.0 adds Remus fault tolerance (go.theregister.com)
• Xen.org Brings New Level of Performance to the Enterprise and Cloud with Xen 4.0 Hypervisor (eon.businesswire.com)

Qubes: secure Xen-based desktop OS

Security researcher Joanna Rutkowska of Blue Pill fame is back with a new project. Qubes OS is a system that proposes an interesting approach to security:
- Applications HAVE and WILL HAVE security flaws.
- The holes eventually WILL be exploited.
- The best we can do is isolate, so an intruder won't get access to all the data.

This is already done in the server world. Nobody runs an all-purpose server if one can avoid it, dividing between multiple machines (physical or virtual) makes life easier. It doesn't work that well on the desktop.

Let's say you use Firefox for your casual browsing. Even if you are cautious and use a non-Windows OS, you can't completely rule out a possibility to get it infected with malware. Then you use the same browser for online shopping or banking. Next day you notice your money was transfered to a Nigerian bank. How about using another browser for banking? Better, but not 100% proof. Another process can still read or alter other app's data. OK than, another browser from a different user account? Much better, now you're safe... unless an intruder already got a root access.

VMs add another layer of security at the same time adding complexity. I admit I considered using this approach on my personal machine. To have my data and important apps on one VM, use another for potentialy dangerous activities (that includes web browsing, email and pretty much anything that has to do with network or removable media) and another for high-security stuff. But it'd be too much hassle. Say I found a PDF document I'd like to keep. I'm supposed to open it on a "dangerous" VM, see if it's OK (how can I be sure anyway?), then move it to a "work" VM. How long before I do something in a wrong VM, either by mistake or out of laziness? And how long it'd take me to setup such system anyway?

Here's how Qube OS does it (or aims to do - it's an early development release and some of the features are only planned). Lightweight Xen-based VMs are spawned transparently. They all run an X server but without any desktop environment. Only one privileged VM runs a desktop environment. All VMs share the same screen, start menu, system tray etc. With one click, you start a Firefox in a "work", "banking" or "personal" VM, their windows are distinguished by a coloured border. Networking stack runs in another, unprivileged VM. Yet another one, not connected to a network, is a secure storage. You can copy/paste text and copy files between VMs, but it requires confirmation and can only be initiated from a priviliged VM. The VMs share system files, so you upgrade all of them at once.

That takes away about 90% of the hassle. The remaining 10% is still too much for the average user. But if your security requirements are higher than average, Qube OS is worth a look. A modern CPU with VT-d and IOMMU is required to use all features and you'll need plenty of RAM.

If you think it's too complicated and decide to stay with one machine for everything, just use a separate browser for banking. Please.

See also: article on virtualization.info

Ubuntu Lucid window controls

I've been playing around with Ubuntu 10.04 Lucid Lynx inside a VM for a few weeks. Like many people I was annoyed with the decision to move window controls. Fortunately, it's easy to move them back where they belong. Fire up a terminal and paste the following lines:

gconftool-2 --set /apps/metacity/general/button_layout \
                   --type string "menu:minimize,maximize,close"