ApacheCon 2009 ended recently – and like other good conferences, there were a number of announcements of interest.

One of the interesting announcements was on 4 November 2009, when the Subversion project (currently hosted at Tigris.org) announced that they would become absorbed under the Apache Foundation umbrella as part of the Apache Incubator. (Subversion has an excellent online book available).

There doesn’t seem to be any licensing change. It should not affect other projects based on Subversion; most notably for this author is SVNKit, the Java-based client library – which, in theory at least, will run under OpenVMS with Java.

There is a very interesting article over at the Columbia Journalism Review about how U.S. Supreme Court Justice Antonin Scalia was misquoted, and the diversity of reactions by the various media outlets (including old school and new school) that had to correct their words.

What makes this even more interesting is the article by Mike Masnick over at TechDirt: he views blogging as a conversation between the blogger and the readers. This caught my attention, since I have a strong interest in journalism in general, including blogging.

I’ve often thought about this – correcting articles – and what the style of my corrections should be. Unlike Mike in his article, I view this endeavor (and others like it) as a form of journalism: thus, small edits will crop up in my articles from time to time. Large edits (or additions) warrant an appropriate journalistic notification: I use the word “Update” (in bold) to expand an already written article.

To me, the conversation is about the article and takes place in the comments – which conversation has proven valuable more than once. I view each article as a journalistic piece and try to fix any errors as they show up without a lot of fuss (except for giving thanks to whoever might have pointed an error out).

Google has revealed a new protocol – SPDY – that has been part of a research project to speed up the HTTP protocol that makes up the Internet. The speed increase is amazing – and sorely needed.

There is already a development version of Google’s Chrome browser available that supports SPDY; the branch is code-named Flip.

This new protocol requires a modified web server; this will be forthcoming from Google in the future. This is an exciting development that bears watching.

Bruce Schneier wrote today about a paper that describes something it calls laissez-faire security: the idea that tight role-based security (RBAC) will lead to situations where the security prevents people from doing what they need to do for their jobs, which subsequently leads to normal people finding ways to circumvent (and weaken) security.

The proposal presented in the paper Laissez-faire Security (by two researchers from Columbia University and two from Microsoft) suggests that rather than tightening things down, one should audit strongly instead. One of the authors, Steven M. Bellovin, is a luminary steeped in the history of the Internet, in the security arena, and one of the founders of Usenet.

The results of RBAC can be seen by every administrator sooner or later – many times, experienced personally. SELinux is a perfect example: despite its acknowledged security benefits, it is commonly disabled or left in an “advisory” state only because of the problems in implementing such a restrictive policy.

From a user perspective, there are numerous examples of people bypassing security in efforts to share data or to utilize tools to get work done.

Laissez-faire Security is about letting users select the appropriate security rules within a framework of policies – which they can ignore (after notification and auditing) – at their own peril. The policy violations can then be handled outside of the computing environment in other ways if needed.

The paper compares computer security to an economy and to the workings of the free-market economy in particular. This paper is very interesting reading and would be worth reading for any security-minded administrator.

The DNS service has been in the news recently, most specifically when ICANN held the 36th ICANN Conference in Seoul, South Korea and decided to allow internationalized country code top-level domains (abbreviated as ccTLDs). The Russians and the Chinese have been after ICANN to do this for some time – and not with any real resistance from ICANN either. Over at the CircleID blog, they have a nice recap of the meeting.

The biggest problem was technological, and over the last several years ICANN and the DNS powers-that-be have worked diligently to implement a method of supporting Unicode domains – the approved method was the Internationalizing Domain Names in Applications (IDNA).

The biggest problem – which unfortunately hits the Russians and other users of the Cyrillic alphabet hardest – is that some of the domains will look like Roman (alphabet) domains. The most prominent example is the counterpart to the current .ru domain; the equivalent cyrillic example would be .py (which is the Republic of Paraguay). Of course the computer has no problems – the letters are different – but the human user could confuse the two, making a new angle to phishing attacks.

The presence of new internationalized domains may make a difference to you if your company is international – especially if it is located in another country. Countries such as France and Canada and Mexico won’t be affected, but many others will be – Japan and China and many Middle Eastern countries come to mind (with Japanese, Chinese, Arabic, and Hebrew domains coming to mind).

Getting a new international domain will mean making sure that all programs can handle the internationalized domains – such as mail clients, mail servers, local DNS servers, and more. Unless a complete conversion is mandated, it can be done alongside of the current working DNS service. Make sure that you brainstorm and work with as many affected individuals as possible to make the new DNS domain work; this becomes especially critical during a total conversion.

On the heels of the wrap-up of the meeting in Seoul is Paul Vixie’s article in the ACM Queue entitled What DNS is Not. He talks about how DNS is not a policy-making protocol, but rather an expression of facts (mapping names to addresses).

There was a test done many years ago by David Boyes, an engineer working out of Virginia.  The test was simply to run as many Linux servers on one IBM zSeries mainframe – and to keep adding them until something broke.

The test hit the limit at 41,400 Linux servers – and nothing ever “broke.” This project was widely reported at the time, though it seems to be forgotten now. However, the test caught my fancy. That’s a lot of Linux machines.

As was mentioned, this report was widely reported: Linux Journal had an article on 1 June titled The Penguin and the Dinosaur from Adam Thornton.  That same day, Daisy Whitney authored an article, Linux on Big Iron – possibly in Datamation. Scott Courtney (the Technical Editor for Internet.com) wrote S/390: The Linux Dream Machine on 23 February and wrote It’s Official: IBM Announces Linux for the S/390 on 17 May. What really stands out?  All of these articles reporting on the S/390 and on Test Plan Charlie occurred nine years ago, in 2000.

Scott Courtney followed his articles up with an interview with David Boyes in 2001.

There is one more thing about David Boyes: following Test Plan Charlie, he went on to create Sine Nomine Associates and showcased OpenSolaris running on the IBM zSeries in November of 2007 – with attendant press releases from IBM. Certainly, David is not one to sit idle – and is a figure to contend with in the IBM zSeries arena. IBM has, since the original announcement nine years ago, pushed Linux on zSeries with vigor.  One irony: Test Plan Charlie was part of a study for an IBM customer that was deciding whether to use their existing S/390 or whether to use a new Sun set up.

There is even an open source IBM mainframe emulator called Hercules, which allows the rest of us to try it out and see what happens – even though you won’t be able to run under z/VM, as that is an IBM product.

Update: there was a nice set of updates about OpenSolaris on zSeries over on DancingDinosaur: Here comes (and goes) the Sun (12 April 2009) and Slow times for OpenSolaris on System z (21 July 2009).

Powered by ScribeFire.

The book Green IT: Reduce Your Information System’s Environmental Impact While Adding to the Bottom Line by Velte, Velte, and Elsenpeter is extremely interesting. Unlike some other books that might go in this direction, this is not a book of theory, nor of political change, nor of persuasion. This is a book for IT staff about how to create a “green” data center and more.

Because of the nature of IT, going “green” can mostly be summed up in one word: electricity. A vast amount of what makes an IT department “green” consists of using less electricity wherever possible. This includes such areas as the corporate data center, the corporate desktops, and much more.

However, the book also gives significant attention to the other big environmental impact of computing: paper. There are a lot of ways to reduce paper use, and this book seems to cover all of them.

The book is in five parts: part I explains why to implement conservation in IT; part II talks about consumption; part III discusses what we as IT users can do individually to help the environment; part IV covers several corporate case studies; and part V expounds on the process of becoming “green” and how to stay that way.

It would have been nice to see more information about how the authors exemplified their suggestions during the creation of the book. The only hint of any environmentally sound practices is the recycled paper logo on the back cover (100% post-consumer fiber). That leaves more questions: did they use thin clients? Did they work from home? Did they use soy ink? Perhaps lastly, where is the e-book?

There is a web site that is set up for the book, but the current breadth of the site is disappointingly anemic. Some of the best web sites for Green IT would be Dell Earth, Intel, as well as IBM’s Green IT and Energy, the Environment, and IBM web sites.

It was interesting to note that HP’s Eco Solutions web site is “heavy” compared to the others – that is, it requires much more processing power to display, and requires a lot more time to download – which translates into more power consumption to view the web site. In addition, IBM and HP are the #1 and #2 in Computerworld’s list of Top Green-IT Vendors – whereas Dell is #6… HP also topped Newsweek’s 2009 list of Greenest Big Companies in America (along with IBM, Intel, and Dell in the top 5).

As a programmer, I have found that system administration benefits from a lot more programming than most people realize. Scripting languages are not limited to just the UNIX shell – nor to Perl.

There is a new blog, a sister blog to this one, entitled Programmagic! which will focus on programming. It will focus on lesser used languages like Lua, Scala, LISP, Smalltalk, and many others.

Recent posts are on Scala; there are many more to come. Why not come visit?

The first thing I do when I log into a system, including Solaris, HP-UX, FreeBSD, and Linux is exec ksh. Whatever for?

Consider this fact: the root shell on FreeBSD defaults to C shell; HP-UX defaults to the POSIX shell (without history); Linux almost everywhere defaults to bash. All of these shells are different in various ways. It is possible you might log into three separate machines and get three separate shells with three different ways of handling things.

Using Korn Shell means that all of these systems will be standardized on one shell, and every system will act the same when you interact with it. There will be no surprises – and surprises at the root command line often translate into disastrous errors.

On HP-UX, using ksh has the additional benefit of enabling history for root – although the security risks of this make this a dangerous benefit: best to erase history after you log out and to make sure that history is independent for every root shell.

What makes this possible is that the Korn Shell is available virtually everywhere, including FreeBSD, Linux, Solaris, and HP-UX – whereas other shells are not (which includes C shell, Bourne shell, and bash).

One of the things that may affect any clusters you have – or other systems – is that management does not want to spend enough to handle any possible load.  With a cluster, this means that you may not be able to handle a fail-over because there is not enough spare processing power to handle the extra load when it happens.

HP’s Instant Capacity (“capacity on demand”) is an answer to this dilemma.  The base idea is that you have extra hardware already in the data center that is not available for use until it is necessary.  The switch that will enable this expanded capacity can be automatic or manual; when some portion of the extra capacity is enabled, you pay for it and it can be used from then on.

Yet, Instant Capacity (iCAP) is more flexible than this.  The capacity may be enabled only temporarily instead of permanently – this is known as TiCAP (temporary iCAP).  Thus, you can save even more by buying extra hardware but enabling only a small portion of it.  During the recent HP Tech Days that I attended in San Jose, California, a situation was described where an HP Superdome could be purchased with a large amount of the hardware already in place – but only a small amount of the hardware enabled.  When the extra power is needed, for example, a cell in the Superdome could be enabled until such time as the power is no longer necessary.

There is also Global Instant Capacity (GiCAP) which even allows the movement of power from one system to another.  For example, if a CPU on one system is underutilized and another system needs the resource more – then the CPU resource can be “logically” moved from one system to the other through GiCAP.  Alternately, if one system dies and another system needs its power, the dead system’s resources can be used by the active system by moving them through GiCAP.

iCAP and TiCAP are available for HP-UX (on PARISC and Itanium) and for OpenVMS (only on Itanium). GiCAP is only available for HP-UX. 

I find iCAP and TiCAP to be very interesting.  From a cost perspective, you pay only a minimal amount to keep the resource; when it is enabled, you then pay for it for the duration – or buy the hardware outright for permanent use as needed.

Powered by ScribeFire.