<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Open Source Security &#187; olpc</title>
	<atom:link href="http://www.ratliff.net/blog/category/olpc/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.ratliff.net/blog</link>
	<description>A blog about open source and security and open source security</description>
	<lastBuildDate>Tue, 10 Aug 2010 00:22:41 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>OLPC Child&#8217;s Play</title>
		<link>http://www.ratliff.net/blog/2007/12/21/olpc-childs-play/</link>
		<comments>http://www.ratliff.net/blog/2007/12/21/olpc-childs-play/#comments</comments>
		<pubDate>Sat, 22 Dec 2007 03:35:59 +0000</pubDate>
		<dc:creator>Emily Ratliff</dc:creator>
				<category><![CDATA[olpc]]></category>
		<category><![CDATA[open source]]></category>

		<guid isPermaLink="false">http://www.ratliff.net/blog/index.php/2007/12/21/olpc-childs-play/</guid>
		<description><![CDATA[When my daughter saw the OLPC, her face lit up. &#8220;What is that?&#8221; She immediately wanted to play with it. At 3.25 years old, she is well below the targeted age range, but she still loved the look and feel of it. She enjoyed the paint program although it is a little challenging still. She [...]]]></description>
			<content:encoded><![CDATA[<p>When my daughter saw the OLPC, her face lit up. &#8220;What is that?&#8221; She immediately wanted to play with it. At 3.25 years old, she is well below the targeted age range, but she still loved the look and feel of it. She enjoyed the paint program although it is a little challenging still. She really got into the picture books at the OLPC library. And she was totally thrilled by the Recorder. I got a great clip of her singing her ABCs. She also really got into TamTamMini and had great fun making noise. She is a great stress tester because her approach is to hit all of the buttons and see what happens. This has caused some interesting desktop configurations under KDE and Gnome. For the most part, Sugar took everything she threw at it and shrugged it off, but she was able to crash TamTamMini by typing random characters in the Activity name field. It didn&#8217;t actually crash, it just stopped making music (noise). </p>
<p>It looks like there are enough activities to sustain her interest for quite some time to come.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ratliff.net/blog/2007/12/21/olpc-childs-play/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The OLPC has arrived!</title>
		<link>http://www.ratliff.net/blog/2007/12/20/the-olpc-has-arrived/</link>
		<comments>http://www.ratliff.net/blog/2007/12/20/the-olpc-has-arrived/#comments</comments>
		<pubDate>Thu, 20 Dec 2007 06:24:54 +0000</pubDate>
		<dc:creator>Emily Ratliff</dc:creator>
				<category><![CDATA[olpc]]></category>
		<category><![CDATA[open source]]></category>

		<guid isPermaLink="false">http://www.ratliff.net/blog/index.php/2007/12/20/the-olpc-has-arrived/</guid>
		<description><![CDATA[Yay! The OLPC XO laptop arrived today. My husband called me at work to let me know that it is here. It is awesome, of course. I added a page with more pictures of it than anyone could possibly want to see: OLPC pics. Initial impressions &#8211; very small box that FedEx somehow managed to [...]]]></description>
			<content:encoded><![CDATA[<p>Yay! The OLPC XO laptop arrived today. My husband called me at work to let me know that it is here. It is awesome, of course. </p>
<p><img src="http://www.ratliff.net/blog/images/DSCF0632-1024.JPG" alt="OLPC XO Laptop" width="100%"/></p>
<p>I added a page with more pictures of it than anyone could possibly want to see: <a href="http://www.ratliff.net/blog/index.php/olpc-pictures/">OLPC pics</a>.</p>
<p>Initial impressions &#8211; very small box that FedEx somehow managed to poke a hole in. Inside, very little extra packaging. It come in 3 pieces &#8211; the laptop itself, the battery and the power cord. There are 2 plastic bags and 2 stabilizers that look like they are made out of recycled paper/cardboard. It seems very rugged, but not rubbery as I was expecting. Under normal use by kids, I expect that the white will very quickly become dirty, but the thing looks awesome out of the box. As I&#8217;ve heard is common in adults, I didn&#8217;t initially get how to open it. As soon as I got it, it seems obvious. The display&#8217;s ability to completely swivel is cool. The fact that the USB, microphone, and headphone ports are covered by the antenna ears when closed is a sweet design point. It seems odd that the power port isn&#8217;t similarly protected. The keyboard is small and rubbery. People who like the old IBM clackety keyboards are destined to be disappointed &#8211; it is much like a normal laptop keyboard, only smaller, solid (protected from spills), rubbery, and green. </p>
<p>The software is neat. The extra keys on the keyboard really improve the software experience over trying the live ISO image or using a virtual machine image. They make switching between programs much easier and faster. The links back into the OLPC library allow the kids to listen to a couple of music samples, read nine picture books online (in English, Spanish, Portuguese, Farsi, and Croatian), and browse Wikipedia. The picture book interface is top notch and I hope they are able to populate the library with a few more books (initially you only see two, but once you start reading one, you can access another seven). I could really envision children as young as mine delving into this activity. I would have liked to see a link to Project Gutenberg. The science section starts off with only biology listings. I expect the OLPC library will grow dramatically over time.</p>
<p>The browser doesn&#8217;t automatically start Flash animations, but rather shows an outline with the designation: &#8220;Flash [[Click to play]]&#8221;. I tried a few of the Flash games on Noggin and gnash seems to not be able to really deal with most of them. For some, the screen gets so cluttered that the game becomes unplayable (which is a problem with Noggin&#8217;s site design rather than with the laptop) and others render but very slowly and seem to get stuck unable to accept input. </p>
<p>Pippy is a neat, small IDE preloaded with code snippets interesting enough to get older children motivated to try it. It takes me back to my early days of Basic programs generating annoying beeps. There is a cool distance measuring program (Acoustic Tape Measure) that requires two laptops to share the activity and then reports the distance between them.</p>
<p><img src="http://www.ratliff.net/blog/images/DSCF0657-1024.JPG" alt="OLPC XO Laptop Terminal" width="100%"/></p>
<p>On the security side, the SELinux tools and libraries are installed, but getenforce says that SELinux is disabled. I was prompted for my name when the machine booted for the first time and I selected an XO image with custom colors, but the second time I booted, neither were required. I haven&#8217;t quite figured out yet how to turn the microphone off and the microphone indicator has been lit for quite a while. </p>
<p>I&#8217;ve played with it for a couple of hours and barely scratched the surface. It is very fun. It will be interesting to see what my children make of it.</p>
<p>If you have read all the way to this point, you are an OLPC fanatic, so I highly recommend that you read the following two reviews. The first is by a 12 year old and is very well written. It talks about some of the more interesting activities that I haven&#8217;t had a chance to try yet, like Etoys and TamTamJam: <a href="http://www.freedom-to-tinker.com/?p=1206">http://www.freedom-to-tinker.com/?p=1206</a><br />
The second review is by the father of a 9 year old: <a href="http://news.bbc.co.uk/2/hi/technology/7140443.stm">http://news.bbc.co.uk/2/hi/technology/7140443.stm</a></p>
<p>Also extremely cool, is the interview with the guy (Don Hopkins) who ported the original SimCity to the OLPC and is now releasing it under the GPL as Micropolis. I can still remember staying up all night in college playing SimCity in the 24 hour lab when I should have been sleeping (or working): <a href="http://www.linuxworld.com/news/2007/121107-simcity.html">http://www.linuxworld.com/news/2007/121107-simcity.html</a> Head&#8217;s up &#8211; he says that there are cheat codes documented in the source. <img src='http://www.ratliff.net/blog/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' />  What a great way to get kids to read the source code. This will definitely be one of the first things that I load.</p>
<p>There is still a little time left to get one. I highly recommend it, it is a sweet little machine. But even more, as the letter confirming the expected arrival date of the laptop said: &#8220;You are part of something big. As a participant in Give One Get One, you have become a member of an international educational movement.&#8221; And that alone is worth every penny. <a href="http://www.laptopgiving.org/en/index.php">http://www.laptopgiving.org/en/index.php</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.ratliff.net/blog/2007/12/20/the-olpc-has-arrived/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>OLPC vs. Classmate</title>
		<link>http://www.ratliff.net/blog/2007/11/26/olpc-vs-classmate/</link>
		<comments>http://www.ratliff.net/blog/2007/11/26/olpc-vs-classmate/#comments</comments>
		<pubDate>Mon, 26 Nov 2007 15:30:41 +0000</pubDate>
		<dc:creator>Emily Ratliff</dc:creator>
				<category><![CDATA[olpc]]></category>
		<category><![CDATA[open source]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://www.ratliff.net/blog/index.php/2007/11/26/olpc-vs-classmate/</guid>
		<description><![CDATA[This combination of stories makes me crazy: Just as Good as Windows isn&#8217;t Good Enough [1] Choice quotes: &#8220;In the end, if all else is equal, Windows get the nod because it is a safe choice. &#8221; and &#8220;In this scenario, TCO does not come into play because ongoing support will be local and will [...]]]></description>
			<content:encoded><![CDATA[<p>This combination of stories makes me crazy:</p>
<p><a href="http://education.zdnet.com/?cat=65">Just as Good as Windows isn&#8217;t Good Enough</a> [1]<br />
Choice quotes: &#8220;In the end, if all else is equal, Windows get the nod because it is a safe choice. &#8221; and &#8220;In this scenario, TCO does not come into play because ongoing support will be local and will come from other funding sources.&#8221;</p>
<p><a href="http://online.wsj.com/article/SB119586754115002717.html?mod=home_we_banner_left">A Little Laptop with Big Ambitions</a> [2] (WSJ so no idea how long this will be available.)<br />
Choice quotes: Last sentence in the article: &#8220;Just who would provide support a few years from now, he said, was &#8216;a frightening question.&#8217; The students, he said, will need &#8216;to do as much maintenance as possible.&#8217;&#8221; and &#8220;Nigeria, for example, so far has failed to honor a pledge by its former president to purchase one million laptops.&#8221; and &#8220;It recently inked deals to sell hundreds of thousands of Classmates in Nigeria&#8230;&#8221;</p>
<p>and (though almost completely unrelated)<br />
<a href="http://biz.yahoo.com/ap/071126/software_watchdog.html?.v=2">Software Group Targets Small Businesses</a><br />
Choice quotes: &#8220;Of the $13 million that the BSA reaped in software violation settlements with North American companies last year, almost 90 percent came from small businesses, the AP found.&#8221; and &#8220;The letter demanded $67,000 &#8212; most of one year&#8217;s profit &#8212; or else the BSA would seek more in court. &#8216;It just scared the hell out of me,&#8217;&#8221; and and &#8220;some employees had been unable to open files with the firm&#8217;s drafting software, so they worked around it by installing programs they found on their own&#8221; and &#8220;&#8216;It was basically just a lack of knowledge and sloppy record-keeping on my part,&#8217; said Gaertner, who ended up with a settlement that cost him $40,000.&#8221;</p>
<p>First off, it really bugs me that none of the articles pick up on the educational opportunities of having the source code available and the OLPC feature of actually showing the student the code that is running at the moment. I guess this is just too geeky to be considered relevant to the politicians and journalists.</p>
<p>But really, there are three issues at work in these articles: support, piracy/TCO/license management, and security/safety.</p>
<p>On support, the WSJ article cites OLPC support as lacking, emphasizing the importance of this point by ending the article with it. Yet, there is no discussion on Classmate support and the ZDNet blogger posts that Classmate support will be &#8220;local&#8221; which doesn&#8217;t sound much better to me than the OLPC support. Plus teaching the students how to support the OLPC (both hardware and software) provides another educational opportunity for the kids.</p>
<p>On piracy (and the cost/complexity of managing software licenses), while I don&#8217;t expect the BSA to go after school kids worldwide, it wouldn&#8217;t really shock me if they did and they would conceivably be within their legal rights to do so. Who will manage the licenses for the software installed on the Classmates to ensure that they don&#8217;t run pirated software? Will the schools be responsible? The governments? The parents? The children? Will they implicitly allow piracy on the student laptops, training them to disregard the issue and then smack them down once the children grow up and start their own small businesses?</p>
<p>And finally, on security, while Windows is mentioned as being perceived as the &#8220;safe choice&#8221; (and while I hate to pick on Nigeria here), it just makes me cringe to imagine hundreds of thousands of Windows laptops out there with none of the thoughtful security improvements of the OLPC that will prevent them from becoming spambots. </p>
<p><BR><BR><BR><br />
[1] http://education.zdnet.com/?cat=65<br />
[2] http://online.wsj.com/article/SB119586754115002717.html?mod=home_we_banner_left<br />
[3] http://biz.yahoo.com/ap/071126/software_watchdog.html?.v=2</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ratliff.net/blog/2007/11/26/olpc-vs-classmate/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OLPC &amp; Security</title>
		<link>http://www.ratliff.net/blog/2007/11/13/olpc-security/</link>
		<comments>http://www.ratliff.net/blog/2007/11/13/olpc-security/#comments</comments>
		<pubDate>Tue, 13 Nov 2007 22:07:12 +0000</pubDate>
		<dc:creator>Emily Ratliff</dc:creator>
				<category><![CDATA[design]]></category>
		<category><![CDATA[olpc]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://www.ratliff.net/blog/index.php/2007/11/13/olpc-security/</guid>
		<description><![CDATA[So, the One Laptop Per Child Get One, Give One program [1] started this week and I ordered one for my kids. I can&#8217;t wait to get it and try it out and see what my kids will do with it. I downloaded the ISO earlier this year and tried it out and it seems [...]]]></description>
			<content:encoded><![CDATA[<p>So, the <a href="http://www.laptopgiving.org/en/index.php">One Laptop Per Child Get One, Give One program</a> [1] started this week and I ordered one for my kids. I can&#8217;t wait to get it and try it out and see what my kids will do with it. I downloaded the ISO earlier this year and tried it out and it seems pretty awesome. My secret hope is that early education (pre-k) software will really take off on Linux once more these have been distributed. </p>
<p>This occasion has prompted Jon Espenschied to write a very nice article called <a href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&#038;taxonomyName=hardware&#038;articleId=9046361&#038;taxonomyId=12&#038;intsrc=kc_feat">Security and the One Laptop Per Child sensibility</a> [2] with his plea for improved security through simplicity. While I really love this article pointing out the problems associated with software becoming ever more complex, I think he has missed that the OLPC has added some radical new security features to help secure the laptop. </p>
<p>If you have a spare hour to dedicate to OLPC, I highly recommend listening to Ivan Krstic&#8217;s Google <a href="ttp://video.google.com/videoplay?docid=-4285568518538296189&#038;q=olpc+%22Google+Tech+Talks%22+duration%3Along&#038;hl=en">Tech Talk on the OLPC</a> [3]. Ivan is the lead for OLPC security. This Tech Talk was primarily about technical details about OLPC in general. He lays out the best arguments for the project (to refute the common complaint about why laptops rather than food). He points out that a primary motivation for the project is to encourage kids to retain active learning (which is their primary learning mechanism up until they enter school). He says that one of his interview questions was &#8220;Can you make 100 million laptops secure?&#8221; His answer (in collaboration with Simson Garfinkel) is Bitfrost. Jonathan Corbet did his usual excellent job describing <a href="http://lwn.net/Articles/221052/">Bitfrost: the OLPC security model</a> [4] back in February and the <a href="http://wiki.laptop.org/go/OLPC_Bitfrost">specification</a> [5] can be found on the OLPC wiki.</p>
<p>It starts off with some very interesting requirements based on their target audience: &#8220;No reading required&#8221; and follows up with some classics &#8220;Open design&#8221; (aka Principle of Open Design) and &#8220;Unobtrusive security&#8221; (aka Principle of Psychological Acceptability). They set a goal for no user passwords which is audacious in its simplicity. There is a clear owner of each laptop established at first boot and the ability to wipe the owner information and all personal documents before transferring the laptop to a new owner. Untrusted programs are severely bandwidth limited to make the laptops unattractive targets for draft into a botnet army. They establish a &#8220;per-program permission list&#8221; which is created when a new program is installed &#8211; this is a whitelist of the permissions that the program needs for its normal operation (similar to AppArmor). The microphone and camera have LEDs which light up when they are activated (interestingly, this is also a FISMA requirement). Most controversial appears to be the anti-theft detection &#8211; it is a call home mechanism which causes the laptop to deactivate if it can&#8217;t successfully reach home within 3 weeks (apparently configurable). They plan to (or maybe have) integrate OpenID. The specification is quite engaging and readable with deep thought behind their anticipated threats and the protections to counter the threats. The outcome is quite simply good security and I&#8217;ll be eager to look at the detailed design and implementation of some of the key security features when I have a little more time at my disposal.</p>
<p>One curiosity about the whole security model is its reception by its users and the open source development community. So far the reception has been quite positive, despite utilizing some of the same security concepts that have been the source of continuous criticism for Trusted Computing. Some people have even defended Bitfrost using some of the same arguments used by pro-TC advocates, for example in <a href="http://lwn.net/Articles/221306/">this interesting argument</a> and <a href="http://lwn.net/Articles/221339/">response</a> [7] posted as comments to the LWN article. </p>
<p>All I really need to say is Yay! OLPC &#8211; I can&#8217;t wait to get mine &#8230; I mean I can&#8217;t wait until my kids get theirs.</p>
<p><BR><BR></p>
<p>[1] http://www.laptopgiving.org/en/index.php<br />
[2] http://www.computerworld.com/action/article.do?command=viewArticleBasic&#038;taxonomyName=hardware&#038;articleId=9046361&#038;taxonomyId=12&#038;intsrc=kc_feat<br />
[3] http://video.google.com/videoplay?docid=-4285568518538296189&#038;q=olpc+%22Google+Tech+Talks%22+duration%3Along&#038;hl=en<br />
[4] http://lwn.net/Articles/221052/<br />
[5] http://wiki.laptop.org/go/OLPC_Bitfrost<br />
[6] http://lwn.net/Articles/221306/<br />
[7] http://lwn.net/Articles/221339/</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ratliff.net/blog/2007/11/13/olpc-security/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
