I noticed the market emergence of nano-computers like Android boxes or Raspberry Pi which allow to easily setup services that may have been prohibitely expensive in the past.

So, I decided to pruchase a Raspberry Pi 3 B+ (a rather cheap network little box, with low power consumption, able to stay online permanently, and easily configurable). I wanted to start by deploying the minimal network services to give me maximum agency.

Minimum feature set included:

• A DHCP server (to assign IP addresses on the local network with ability to fix some of them in a static list, for easier management)
• A DNS server providing
  • DNS request cache (to speed up the overall Internet access of my Internet users)
  • Delivery of local network names
  • Capacity to allow future DNS filtering (I don’t care much about adult-content filtering, but I’d like to stop some of the phishers, even if these two activities are technically identical)

In the future, some more services may come handy (nothing of this has been studied here):

• An NTP server (for time)
• A WINS Windows names server

Comparison

As a matter of fact, I noticed that two serveurs seemed able to simultanesouly provide DHCP and DNS: Unbound and dsnmasq.

Unbound highlights:

• Lightweight server
• DNSSEC support
• rather security-oriented
• No DNS authoritative server (but able to handle a local domain)

dnsmasq highlights:

• Lightweight server
• DNSSEC support
• DHCP and DNS are integrated in the same server
• May use /etc/hosts to feed DNS
• No DNS recursive server (only forward to an authoritative/recursive like 8.8.8.8 or 9.9.9.9 or your ISP DNS server)
• No DNS authoritative server (but able to handle a local domain)

I chose dnsmasq, mainly because of the DNS + DHCP integration.

Some surprising discoveries

Première information vite découverte : les serveurs NAS Synology sont tout à fait incompatibles avec le filtrage de DNS de CleanBrowsing. Celui-ci compte synology.me (service nécessaire pour le DDNS de Synology) dans les domaines à risque. De nombreux services du NAS cessent immédiatement de fonctionner.

Je n’ai pas vérifié mais il est probable que de nombreux autres services DDNS (Dynamic DNS) soient black-listés pour les mêmes raisons : devant le nombre de petits serveurs Synology (ou autres) mal configurés, ces DDNS renvoient sans doute vers une forte proportion de domaines qui ont été pris en otage par les hackers.

Il faut donc pouvoir gérer cela plus finement si vous avez vous-même votre propre NAS Synology (et sans doute d’autres marques).

Observations

After a few months of dnsmasq use on Rapsberry Pi, it is time to comment and share my experience.

First, this worked really well. Even if I had one case of locked down DHCP server (no warning, no error, but killed). I tried finding why, but it was far easier to reboot the server box (On-Off switch) to restore the service. Of course, a few minutes of digging into logs did bring me some worried looks from another network user…

The DNS filter setup to remove access to some risky domains work perfectly well. But, I have to admit that nothing seems to have triggered that (except my tests). Since this is not the only security barrier on my network, this may be OK. For the record, here is the filter creation script I use:

#!/bin/sh
#Dated 2020-11-10 1.0 Addition of --quiet to wget (to reduce clutter to /var/mail/pi)
#                     *** STABLE RELEASE ***

cd /var/lib/work

#Get anti-phishing filter lists from Internet
wget -q -O ./isc-low.txt 'https://isc.sans.edu/feeds/suspiciousdomains_Low.txt'
wget -q -O ./isc-med.txt 'https://isc.sans.edu/feeds/suspiciousdomains_Medium.txt'
wget -q -O ./isc-hig.txt 'https://isc.sans.edu/feeds/suspiciousdomains_High.txt'
wget -q -O ./yoyo.dnsmasq.txt 'https://pgl.yoyo.org/adservers/serverlist.php?hostformat=dnsmasq&hostformat=nohtml&showintro=0&mimetype=plaintext'
#Remodel the lists into DNSmasq filters
catcherIP='192.168.1.250'
inputfile="./isc-med.txt"
tmpfile="/tmp/.adlist.$$"
tmpconffile="/tmp/.dnsmasq.conf.$$"
configfile="/etc/dnsmasq.filter.conf"
configheader="/etc/dnsmasq.filter.header"

#Start with putting our own header
    [ -f "$configheader" ] && cat $configheader >> $tmpconffile
#check if TmpFile could be init'd with header
if [ ! -s $tmpconffile ]
then
    echo "temp fil '$tmpconffile' could not be found or is empty; quitting"
    exit
fi
#Remove list headers
cat $inputfile | grep -v "^#" | grep -v "^Site$" > $tmpfile
#Buid list to DNSmasq format, and add it to the file
sed "s/(.*)/address=\/\1\/${catcherIP}/" $tmpfile >> $tmpconffile
#Move the final list to destination
sudo cp $tmpconffile $configfile

One of the advantages of this server is its speed. I may have been slightly worried (or attentive) before knowing the Raspberry Pi, but there was no reason. Maybe because of the low workload (despite an HTTP server, some distant connexions, and a few local scripts) and because of the good power developed by the CPU, everything is fine and dandy even when a dozen clients are pounding the DNS server (the iPhones are quite insistant in using the netowrk on a continuous basis)).

dnsmasq is perfectly able t manageIPv6 DHCP, and correspondingIPv6 DNS. Documentation about this is terse (if not simply lacking), but it works well and I learned quite a few things. The Raspberry Pi was so reliable that it was IPv6 proxy during some of my tests without any perceptible impact. (I was rightfully impressed).

After initially using dynamic address allocation, I moved the DHCP server into a nearly exclusively static configuration (my own choice in order to have easier local client identification). No big deal, neither in IPv4 nor in IPv6.

Conclusion: Totally positive.

In the future, I may be tempted to deploy more powerful servers for DHCP and DNS for a wider support (maybe or maybe not) and to try a network spy like SNORT or SURICATA. But this is a completely different story. And, in this case, I may be tempted to go to a really powerful solution (I have an Avenger96 under initial trial, but its software support seems to be a real mess).

A few other interesting links

• A few other solutions for a DHCP server:
  • DNSmasq installation (DHCP only)
  • Dragon: DNSmasq installation (DHCP + DNS)
  • Instructables: installation for DNSmasq (DHCP & DNS)
  • ISC-DHCP server on Debian
  • ISC-DHCP server on Ubuntu
  • Tools designed to work with ISC-DHCP
  • Fast instructions for installing DHCP, DNS, and NTP on Raspberry Pi
• Some data about installation of another DNS server:
  • BIND local-mode DNS server on Debian 9
  • BIND authoritative DNS server on Ubuntu
  • BIND “caching” or “forward-only” DNS server on Ubuntu
• DNS filters:
  • THE guide on cleaning DNS from public domain lists
• Setup of a LaSynology NAS or router:
  • Configuration of a DNS server on DSM
• Server comparisons:
  • BIND vs. dnsmasq vs PowerDNS vs Unbound
    
    
    
    

Thanks to Bruce Byfield of Linux Journal, it is now possible to have a relatively fair comparison of the heavy-weight champion of office suites (Microsoft Office or MS-Office) and the young hyper-active challenger (OpenOffice).

Obviously, OpenOffice advantage is that it is cheaper than Microsoft Office: It’s free.

But what are the other ways to compare both? Bruce goes to great lengths (3 pages) to try and give us a balanced comparison around the overall interface, the MS-Word/OpenOffice Writer word processors, MS-Excel/OpenOffice Calc spreadsheet applications, PowerPoint/OpenOffice Impress presentation tools.

Interestingly, and I believe that this is a credit OpenOffice, the differences are really small and the price (free) of OpenOffice will be heavy in the decision.

OpenOffice.org vs. Microsoft Office

By the way, did I mention that I am a strong advocate of OpenOffice? I have been using it both for personal and professional activities, for 10 years now; And it it keeps improving a very good base into an excellent tool (including the full compatibility with Microsoft files).

The program will recognize the shortcut, then automatically replace it with the correct text. Type “win“, see “Windows” appear. Type “HTML” and see a full block of selected HTML code appear (I use such shortcuts to create blocks of HTML code on this site, reducing typing time and avoiding typos).

For this, you need to be supported by a small program. I found two interesting ones :

• AutoHotkey (for Windows) allows to write very simple scripts (examples are provided); I use it everyday (it works perfectly on a Windows 7 installation, by the way).
• Some people would prefer to explore Texter and TextExpander, too.
• If you are on Linux, you will prefer to have a look at AutoKey which is freely inspired by AutoHokey (copying is a form of flattery)

New features:

• Faster start-up times
• Compatibility with MS-Office 2007 documents
• Better Compatibility with MS-Office 97, 2000, XP documents, encrypted with a password
• Importation of dynamic tables from Excel
• Comments are now possible in the Impress presentations
• Improvements to the Calc cells handling (cell merging, sorting, etc.)

For Windows, Mac and GNU/Linux.

In the beginning was Google which installed its servers in China in 2006. The “do no evil” company accepted the conditions of the government of the PRC and included heavy filtering and censoring of its search results (looking for Tienanmen will produce wildly different results in and out of China). But in January 2009, Google discovered that some hackers obtained some detailed information out of its own servers at this was targeting both American companies and Chinese political opponents or partisans of free speech in China. Subsequently, Google announced its intention of both lifting the censorship and leaving China.

What is still very unclear:

• Is Google really serious about these two options?
• Is the main reason for its ire, the political chase or the technological spying? (the US government including Hilary Clinton pushed hard with Google)

What is clear:

• The breach of information seems limited (only email subject lines have been breached, not contents).
• The hackers were affiliated to Chinese official bodies and did not only target Google.
• The hackers used some social engineering and security issues present in Internet Explorer and Adobe PDF, which were probably known but not closed by Microsoft and Adobe.

So, when such information appears in wide open channels of the world press, what happens? Most experts started commenting on the security loopholes in Internet Explorer 6 (and about Adobe PDF reader, too). Many people observed that Internet Explorer 6 is rather old and it is unfortunate that so many people still use it despite the known fact that it is a security liability when browsing the Internet. With such a rush, some very official people also asked for replacement of Internet Explorer (mainly v6) to be replaced with more modern browsers. Even representatives of the German, French and Australian governments asked their countries to replace Internet Explorer with something else.

The competition has seen this as a godsend since it created a rush for the other available browsers. For example (see the graph on the side), Firefox saw a brutal explosion of its downloads in Germany (nearly 300,000 Germans have downloaded Firefox in four days): about three times more than usual. It has been true in other countries even if it was not measured as precisely, and it has been observed by the other browsers Opera, Safari, Chrome (currently profiting from heavy advertising in some European countries like France).

This was definitely a good thing since it was bringing better browsers to many computers. It could have stayed there but there were several reaction and parallel events happening at the same time. The first one was that Firefox was preparing a major upgrade to the successful browser (in many parts of the world Firefox is now used by more Internet users than Internet Explorer). Named v3.6, this new version is bigger than what could have been expected from its small number increase (from 3.5 to 3.6 should have been a minor upgrade). This major event accelerated the rush, with people looking for features like:

• Built-in skins, to make it more personalized
• Faster, more stable
• More security conscious with the addition of user-level messages about risks, including reminders about what plug-ins are outdated and must be upgraded.
• Visual tab previews, which show you the tabs when you press Ctrl-Tab
• Aptitude to browse without leaving too many footsteps and traces in your PC (good for clean browsing like when you visit Adult sites)

This version is also appreciated by developers who will find a bunch of little improvements (like CSS gradients).

This is not only a great story to read. This is a great browser and you should consider downloading Firefox 3.6 now!

If you are not completely convinced, you should also consider downloading the newest Opera browser. Opera v10.10 has been available for a few months now and it also offering these advantages, plus some neat features like:

• Opera Unite: to easily share information between Opera users and browsers, without using a web site or a share folder on some social network.
• Opera Turbo: to adapt Opera to very slow Internet connections.
• Speed dial: to get a faster access to some web sites you choose (bookmarks on steroids).
• Mouse moves for faster commands.
• Opera link: to share bookmarks, speed dial configurations between several machines where you use Opera.

Opera is clearly my preferred browsing solution (even if I need to test my web sites on everything I can find, Opera is the central hub of my Internet browsing). Go and download Opera v10.10 now.

And, if you are not sure yet, I can also offer the small and fast browser from Google: Chrome. Since it all started around Google and China, it was worth mentioning, of course.

All this has been going so fast that Microsoft needed to do something. Of course, they have a newer version of Internet Explorer (IE8 is included in Windows 7 and can be downloaded freely. But this was not enough, too many people were starting to complain that Microsoft may wait about a month before updating IE6 in the normal update cycle. Even worse, some experts started telling the world that Microsoft actually was aware of this flaw in IE6 for many months. In such conditions, not doing anything usually turns out to produce a public relations nightmare and prepares for bad wind.

So, Microsoft rushed an out-of-band update to IE6 and Windows Update is now offering the correction to all Windows users still using IE6 (of course, you still have to use Windows Update and it is well known that too many people do not have this configured or do not accept the proposed updates – this is wrong and one the reasons so many PCs are infected with Trojan horses, virus and adwares). Now, if you did not move to a later Windows version and if you did not take advantage of the much better IE7 or IE8, it’s time to upgrade your old hag.

We can expect to see a few more updates to this story in the future, but there is a lesson to be learned (by Google, and most Internet users):

Always keep your browser up-to-date and refrain from clicking on any link in a mail message you did not expect.

Additionally, there is a lesson for Microsoft:

Sorry! but even the older software has to be kept alive when you are or have been the near-monopoly on this technology. This comes with responsibilities.

Version 1.7 of Cygnus is now available that supports Windows 7 (but drops support for Windows 95, 98 & Me).

As if this was not enough, this version also has the capability to configure IPv6 (if you are already attracted by this solution) or supports multiple installations.

Cygnus v1.7-1.1 new release.

You can notice that these images being free of copyright will allow to produce impressive posters if you agree not to make it a commercial venture. Idea?

There are few things that you can do to significantly improve the speed of your Internet connection. Of course, you can switch to another Internet Service Provider, but it’s a mess. On the opposite, it is easy to have an sub-optimal connection because of the response time of the DNS server of your Internet Provider. This server offers a translation service a domain name (for example, www.roumazeilles.net) into its equivalent numeric IP address (the only one that the web browser really understands and needs).

But all DNS servers are not born equal and if those offered by your Internet Service Provider (ISP) have an advantage (they are nearer to your own computer), they are not always the fastest ones. NameBench gives you the opportunity to easily and automatically check what DNS server is the most efficient (and to compare it with your own current DNS configuration).

In my own personal case, I just reduced DNS times by 50% (no less!) while I thought I had a rather good configuration. As a matter of fact, Neuf Telecom servers are faster that those from Free…

This works on Windows, MacOS as well as GNU/Linux.

By the way, for those of you who may be wondering, Yes! I included the all new Google DNS as one of the tested options and it was far slower than most of the other freely available possibilities.

• PDF-XChange (Windows, Basic: free, Pro: $34): loads real fast (much faster than the Adobe viewer), has all the basic options (annotations, graphic annotations, etc.) and the Pro version allows to reorganize the pages of a document or to extract text from it.
• Foxit (Windows/Linux, Basic: free, Pro Pack: $39.99): loads even faster, allows annotations (but only the Pro versio does it without watermark).
• Sumatra PDF (Windows, free): is even simple; everything is done for sheer speed.
• Apple PDF Preview (Mac, free): is very powerful (and it’s free, remember) and included in the MacOS offering; annotations, extraction, reorganization, all is available

But if you consider that this is not the right thing, you could thing a more organized (but less readable) description of LDAP: “Basics of LDAP” which is also very much Linux-oriented, of course.

SSD drives are those disk drives that are not using rotating platters with data stored magnetically, but that are based upon a set Flash memory components (so, without any mobile part, and with a performance that has nothing to do with even the fastest magnetic hard disk drives). SSD drives are expensive but, with costs are plummeting, the most expert and demanding users are starting to look at them dreamingly.

But everything shows that the SSD drives are not all equal (there is still an intense competition at this apex of performance). We see many a product recommended, often without all the technical arguments.

The “A look at SSD performance in Windows Vista – The more things change…” article from Geoff Gasior (The Tech Report) is definitely full of little gems because of that: It comes after a large number of tests (and many articles on the same subject) and compares finely the most representative products of the market.

Without telling it all (read the article. It’s worth it and you will learn many things), there are a few important conclusions drawn:

• Initial performance is usually much reduced after some time and some even light use,
• X25-M from Intel is probably the best drive around, the most well-balanced (recommended for a purchase in the short-term),
• The OCZ Summit is the faster in write operations (Intel is an ace of reading),
• the differences between suppliers come more from the controller used (Intel, Samsung Indilinx) than from the the brand.
• The arrival of Windows 7 (with its TRIM feature support) will probably change the situation (all the more because TRIM support is not yet certain from Intel) and, if you can wait, you will be better being patient and hope for Windows 7 and the new products and new firmwares made just for it.

Look at the full set of the Windows 7 wallpapers. This is the upcoming version of Windows (after Windows Vista, it seems that Microsoft intends to switch back to a numbering scheme). Most of them may be colourful, but with very smooth surfaces where your icons will be appearing quite neatly and they offer a nice contrast.

So, I was quite interested when I stumbled upon the collection of pictures taken by the HiRise (High Resolution Imaging Science Experiment camera installed on board the Mars Reconnaissance Orbiter). Shooting photos of Mars surface, this photo camera brings extraordinary color images that provide nice patterns to be used as background for your Windows desktop (or even Linux or Mac desktop) and can be renewed quite regularly: Their catalog is available on the University of Arizona web site.

Furthermore, they provide an enormous resolution for their images which is a very good way to extract any size you may need for your extra-high-resolution background or to cover your 2- or 3-LCD display. Or even more. If you feel that there own selection of wallpapers is not enough:

• 800×600
• 1024×768
• 1152×864
• 1280×960
• 1440×1080
• 1600×1200
• 1920×1440
• 2048×1536
• 2560×1600

You can still stick to the original size (JPEG-2000 format images range between 0.5GB and 3GB).

And the good news is that there is no copyright restrictions, so you could do pretty much what you want with them: Really free desktop wallpapers.

• On Windows, it’s enough to use the bootable CD-ROM of Ophcrack which is available as Open Source. Reboot and watch the software program find the Windows Administrator password…
• Ophcrack also works on Mac (and Linux) but with OSX10.4, it’s enough to use the Apple installation CD and to choose “Utilities” to run “Reset the password”. On OSX10.5, you’ll have to reboot, press Command+S, then type the following at the prompt:

fsck -fy
mount -uw /
launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist
dscl . -passwd /Users/UserName newpassword

• If on Linux, if boot is controled by GRUB, it’s enough to press ESC during the boot sequence to choose ‘Recovery Mode’ which will will start you as root without even knowing the password. Just change it now…
• But even better (or worse), on Linux again, here is a list of 10 ways of resetting a lost linux root password

Plus ou moins inspiré de JoeTech.

From GraphJam.

1. TCO (Total Cost of Ownership): Linux is less expensive in an enterprise because of the high cost of per-seat licenses.
2. Desktop: Nowadays, Linux is as easy as Windows for most entry-level users.
3. Server: So many servers are now running on Linux.
4. Security: Windows progressed a lot recently, but is still the target of a lot of malware, virus, Trojans, etc. that Linux has avoided by immunity through faster problem fixes.
5. Flexibility: Linux is amazingly able to adapt itself to various applications and environments.
6. Package management: Installation of new applications in Linux is years ahead of the dinosaur Install-Software solution of Microsoft.
7. Community: Not that the Linux community would be larger, but it is so much more active and willing to support all kinds of users.
8. Interoperability: Windows works well with Windows. For the rest, just go to Linux if you want to interoperate with Apple OS X, various Unix systems, various Linux distributions, OS/2, PlayStations, PDAs, and… Windows.
9. Command line: You may not need to use it, but when times come for it, Linux command line is worlds better than Microsoft mock-up.
10. Evolution: Do you remember the feel of going from XP to Vista? Do you remember how many times Microsoft forced you to upgrade machines? Linux is much more adaptable and provides a proven smooth path to newer, better versions.

Newsrooms are full of weird coincidences. For example, we just learned that  two products often presented as direct competition were launched this Fall. To my right, here is Adobe with its boxing champion, Photoshop, loaded up to version CS4. To my left, Linux and its community of free developpers pushing the challenger on the ring, version 2.6 of The Gimp.

I am still convinced that this is not an even fight (and Photoshop is favored by bookmakers, for those still doubting it) but both announces are interesting and should be reviewed shortly.

Photoshop CS4 is a new step forward based on the award-winning user interface that made it a best seller and on top-level performance. To this market reference product, Adobe adds the following image-edition-oriented features:

• Accelerated computation using the modern graphic cards coprocessor and the Windows 64 features (when available, of course), and many tools needed to support a 3rd dimension in graphics design (painting on top of 3Dmodels, 3D compositing, etc.)
• Several new tools
• Adobe Camera Raw v5 is improved again to include complementary tools applicabel to RAW photo files (local editing, gradual correction filters, etc.)
• Bridge CS4 is notably accelerated

On the other side, The Gimp is now available as version 2.6. Here again, improvements are notable, even if a little smaller:

• A number of improvements to the user interface (but I still thing that this is the weak point of this software program; Recommendation: Look into GimpShop which is a hack to The Gimp in order to make it appear similar to Photoshop)
• Improvements to the selection tool
• Improvements to the drawing brush
• 32-bit GEGL data management (perfectly adapted to keep maximum quality in 12- and 14-bit RAW files)

All this will probably start again comment wars supporting one or the other solution. But remember that The Gimp is simply free. On the contrary, Photoshop CS4 (even if getting the upgrade license and despite the many available options) will still be very expensive (Master Collection at $2,499).

How could we ignore the launch of Chrome, the new browser from Google? Every is babbling about it, everybody tried it (it can be downloaded here).

But after one test run, I believe that I should explain something. Yes, this is a marvellous browser because it takes most of the good things from FireFox, Opera or Safari (all IE competition). I immediately noticed:

• No space is lost in useless graphical waste, everything is concentrating on user display,
• The good tab management,
• The impressive performance,
• The name-completion in the address bar.

Some will also have noticed the more technical features like:

• The separation of applications running in different tabs,
• The very small footprint (including for the Javascript).

But, all this is hiding a very critical reality: Google did not even try to make a mere browser (it even lacks a simple RSS feed manager). They are more interested in doing more than Internet Explorer competiton. Much more.

The impressive advantage of this browser is elsewhere: it will fight against Microsoft applications allowing to work online in the best possible conditions. Chrome is nearly an Operating System competing with Windows. Yes, because where Windows offered a vehicle to sell Microsoft Office, Chrome will allow Google to develop a wider range of online tools in the path opened by the Desktop applications and GMail.

It will hurt Microsoft real bad. Chrome is obviously the best browser to support this approach. Rock solide, fast (very), reliable and able to support application crashes.

Wine is there to solve the problem. It runs many games and it runs Photoshop CS2 and CS3 from the box (I did not test it myself, though). It was the plain objective of Google when they allocated money and developers to support this project. They reached their goal.

It is probably the right time to try OpenSuse 11.0 (one of the best new Linux distributions) with Wine.

See also: Run Windows Apps in Linux with Wine 1.0.

This is why, while the Internet Engineering Task Force (IETF) was preparing a night without IPv4 to reach the largest possible public, Google launched a version of its search engine reserved to IPv6: ipv6.google.com (If you are like almost everybody, you will not see anything at the end of the link).

Now, we all have to switch as soon as possible.