hpr-knowledge-base/hpr_transcripts/hpr0574.txt

Episode: 574
Title: HPR0574: Interview with Maco
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr0574/hpr0574.mp3
Transcribed: 2025-10-07 23:23:23

---

Packer Public Radio
Packer Public Radio
Packer Public Radio
Packer Public Radio
Packer Public Radio
Packer Public Radio
Packer Public Radio
Packer Public Radio
Are you pretty editing?
Wouldn't you like to know?
I'm pretty.
Wouldn't I like to know?
Water.
Hi everyone.
This is Glad to see you on Mental Health Ethan Express 2010.
And I'm hanging out with Mako from the Kubuntu team now, right?
So you switched to KDE, like sort of officially and publicly?
Yes, I posted on my blog about a year and a half ago that I was a traitor and now using KDE.
But I'm technically not on the Kubuntu dev team yet because I can't upload KDE packages.
So my title is still like Ubuntu developer, which is actually a change from the last time I was interviewed by you.
But that's because I can only upload universe packages, not any of the main packages.
So I did package Amerox for last release.
Oh, did you? That's cool.
Okay, so what easier title last time was bug triage or, right?
Bug control, I think.
Okay.
All developers are members of bug control.
Oh, okay.
There's a hierarchy kind of thing next.
Okay, cool.
So this self, your talk was on, quote unquote, is Linux secure.
And it was a really interesting talk, actually.
And one of the things that I wanted to talk or mention, have you mentioned maybe again for me,
is that the whole desktop thing that has recently changed, I guess?
So it used to be that someone could email you a desktop file, which is any of those launchers you have on your desktop
or in your menu or on your panel.
And you could just double click it.
And whatever's on the exec line is just going to go.
Now, since anybody could put anything they want on the exec line, you get one of these in your email.
That's not very safe.
And this was brought up in a blog post that got quite a lot of dig attention.
I guess it's about a year ago or so.
And the result of that now is that if the dot desktop file is an user's home directory or temporary directory,
and it is not marked with the executable bit, it will not execute.
Right.
Genomen KDE have both implemented ways to inform the user of this, instead of you just double clicking it and nothing happens.
On KDE, what happens is it says this is probably trying to run and it gives you the full command line.
And has they continue button, which will then mark it as executable and run it.
Or a cancel button which leaves it alone.
KDE puts a red exclamation point on the icon to warn you that this is not trusted right now.
What Genome does is it shows it as if it were a text file because they are text files.
And then if you don't click on it, what I saw in both Fedora and Sousa is a pop-up telling you that it's not marked as trusted.
And then with buttons that include launch anyway, mark is trusted or cancel.
In Ubuntu, only the cancel button was there.
And that's because Ubuntu has a policy of not giving long planetary text of why something is bad and then having a but do it anyway.
But while I can understand this, I do take issue with the fact that you've got text that's talking about trusted and the solution is to make it executable.
And there's nowhere in that text that tells you that that's what it means.
Right, okay. I didn't honestly know that the desktop file was with that little launcher that could be put into the Genome bar.
I knew it was an icon on the desktop, but so that's actually the same thing as in the Genome bar.
Yes, okay.
Your menu has all that desktop files.
I mean, the menu is a list of what that's the top file should be in there.
But you know, you click one of the menu and you drag it onto the panel.
Same thing, you click one of the menu and you drag it onto the desktop. Same thing.
Okay, so that's something that I mean, obviously someone would, I guess, download a desktop file or get, like you say, maybe it would be emailed to them or whatever.
What about, I knew that like browser root kind of attacks are, they're kind of the most famous.
You know, I mean, is Linux, I mean, I'm assuming Flash all bets are off anyway.
But I mean, otherwise is Linux pretty healthy in the browser space, I guess?
So if what you're hitting is an exploit directly in the browser, which, you know, could be a buffer overflow or something like that,
and which is not something that you use or has any control over.
Okay, sorry, hold on. What is a buffer overflow?
So buffer overflow is when the programmer assumes you're only going to put this little bit of data in there,
and then the bad guy puts in more, and it overwrites part of the program.
Now, if this is junk data, that's one thing.
If this is data that includes more commands to execute, then all of a sudden you've got arbitrary code running on your system instead of the program that you thought you were running.
That's, you know, often you'll find cases where it's possible in a situation where you're routes crashes.
But if you've got one of those, and it's across the platform browser like Firefox, Opera, Chrome,
it's probably going to be a problem on all operating systems.
That's what you said in your speech, and I wanted to ask you actually, but obviously you were talking,
how can that work? Because if it's an exploit or whatever, doesn't that, I mean, in order to screw something up,
doesn't it kind of depend on the file system, but Windows and Linux, and even I'm sure probably OS X,
use completely different file systems, right? So how would they, how would the exploit work on all platforms?
Because it doesn't necessarily rely on the file system if you can get the browser to do something different than what it's supposed to.
And of course, and if you're a web developer, you've learned this because you've had to, because Internet 4 is horrible when it comes to rendering.
There's this nice little thing in the browser called a user agent string that the website can read and say,
oh, I see, you're running Firefox on Ubuntu 9.10, and you haven't patched your Firefox in the last three weeks.
Okay, when I go through this buffer overflow, I should acute this code because it's a Linux machine,
or I should acute this other code because it's a Windows machine.
That's really amazing. So I guess...
That's also a problem with, like, drive-by downloads. If somebody wants to just drop an executable that's, you know, malware onto your system,
user agent string, they know which one to give you.
Oh, okay, okay. And so, I don't know, it's sounding like Linux isn't so healthy in the browser space then.
If you're using cross-platform software, if you're using cross-platform software and it exists on Windows,
you don't have the protection, the sort of false protection that comes from being a useless target.
And again, I have to ask, how bad could it be since Linux has all these built-in permissions and, you know,
it's got so much for to... And I mean, how would the browser buffer overflow be executed as root in order to, you know, maybe get through the rest of your files?
Or are you saying it doesn't really have to, as long as it screws up your home directory, it's probably done.
So, a lot of users would say, you script their home directory, well, okay, so the computer in your cache, but my stuff's gone.
But on the other hand, you do have people who run their systems as root.
I mean, your Firefox, you might run Studio Firefox because you wanted to use the built-in update mechanism that's in Firefox,
which requires root because your Firefox is installed outside of your home directory.
Or you might be logged in as root because, well, I don't want it to be asking me for permissions to do things.
I just want it to do them and get out of my way.
And, well, yes, it's one to just do them and get out of your way and it's also going to just do them and get out of your way whenever something bad wants to do something.
Wow, yeah, I never thought of any of that.
Cool. So, are you switching gears from the talk a little bit?
Are you, what would be called a master of the universe in Ubuntu?
Yeah, that's the actual title.
Right. So, you are. You have done that.
Yes, I became a Mo2 back in November.
Okay, cool. And so, you got the whole master of the universe position.
And I guess, what do you see for yourself in the Ubuntu sphere?
Within the next year, I'll certainly be applying to the Kubuntu Dev team,
so that I can just directly upload KDE packages instead of getting packaging done,
and then having to go around and poke Scott and Jonathan and Rich and be like,
Hey, guys, upload it. Please, please, please.
Nice. And so, you've packaged Amarok. Are there any other, I guess, applications that you really, really love that I guess you have your site set on in order to package?
I mean, I know I'm sure a lot of them are already packaged with like...
Well, in the case of the KDE packages, you know, every time there's new KDE release,
the Kubuntu team gets together and everybody marks their name,
that's whatever packages they're going to take, and then they try to do it.
If they hit a someone block that they can't figure out, then, you know,
pass it off to another person, that kind of thing.
Okay.
And so, whenever there was a new Amarok release, I was in charge of updating that one,
but there is a package that I maintain in Ubuntu and co-maintain in Debian,
and it sounds weird to say maintaining Ubuntu whenever we have all team maintainership.
It's just, well, nobody else in Ubuntu has ever touched it.
Okay.
And I don't know when I got it back in through, though.
So, just on the Debian co-maintainer, I'm just going to go with that.
It's called Spin, and it's a package for...
It's a software for running MIPS assembly directly without having to assemble it first.
And the reason I've been taking care of it is the text book for computer architecture class at my school,
and at a lot of schools, has an entire appendix devoted to how to use that software.
And every example throughout the book says, using Spin, dot, dot, dot.
It was removed from Debian and Ubuntu back in 2008,
because nobody was taking care of the package anymore.
And, well, when I realized I couldn't install it to the school, I put it back.
Very nice.
So, what's your involvement with Debian?
Is that the extent of it, or is there more?
Yes, so far, just co-maintaining that package.
I'm thinking about going to DebCon, which is Debian developer conference this summer.
Where is that?
New York City.
Oh, yeah, totally.
At Columbia University.
Oh, cool.
Do you guys talk a lot about the Ubuntu package maintainers and the Debian package maintainers?
Yeah, there's...
First off, there are a lot of people who are both Debian developers,
or Debian maintainers, and Ubuntu developers.
Okay.
There's also tools that we've made for pushing patches up to Debian,
such as Submit to Debian.
It's the name of one of the scripts, and you just tell it to patch,
and you tell it what bug number in Debian it's for, and it just goes.
Nice.
There's also...
Well, actually, statistics are generated from that too,
saying, you know, like, how many patches get forward in each release,
and things like that.
There's also...
There are a lot of Debian developers who subscribe to their package
within LaunchPatch, which is Ubuntu's bug tracker,
so they can know whenever a bug is where in Ubuntu,
because Ubuntu has newer software,
a lot of times, versus...
Yeah, of course, versus Debian, of course.
Ubuntu has so many users,
and often such newer packages that we do end up getting a huge number
of bug reports, thousands of bug reports open in Ubuntu,
that are...
You know, a lot of them are upstream ones,
and it's very...
It's come very valuable for a lot of the upstreams to get their newest version
into Ubuntu, because it means they're going to get the testers they need.
Gotcha.
One of the projects you mentioned to me earlier was this...
This fine-language program that you're actually developing,
that you're doing on Pike KDE or Pike U,
or something.
What, tell me more.
It's called Galley, which is after...
It's the nickname for Gallaudet, which is Thomas Gallaudet.
He founded the first, I think, only,
liberal arts universities for the deaf in the world.
Okay.
Definitely in the US and I think in the world.
Cool.
And so it's called Gallaudet, which is a nickname for him
and for the school which is Gallaudet University.
Okay.
Right now, it's year-to-five beta.
So far, what it does is you can go through different lessons within,
at the moment, just ASL, American Sign Language.
Right.
And you can go through and it will show you different signs and a description of them,
including things like how to make the shape in case you can't see the image as well,
or...
And also things like, by the way, this sign is similar to this other sign.
Don't get them mixed up.
Right.
And I implemented last week where you can have translations of those explanations
in the XML files that define the lesson.
And in KDE, you can configure your hierarchy of languages you want to have chosen
and it will pick the right one in the right order for you.
But it's still only American Sign Language, correct?
Yeah.
At the moment, it's only American Sign Language.
So if you were French-speaking, once you learned ASL, you could.
Okay.
Right.
For version 1.0, which I hope to have done by August.
Cool.
Because of when Ubuntu Future Freeze is and when KDE 4.7.
Have been Future Freeze?
Seven.
Six.
Six, 4.6.
Yeah.
4.6 or 4.7 because of when Ubuntu Future Freeze is and things like that.
I want to have 1.0 done in August.
And that version would have where you can install other languages,
like other sign languages, language packs,
into lesson packs, into your.kde, or into user-share-kde, whatever.
Whatever the pack is.
And so the goal then, in Ubuntu 10.10,
will be that there will be a package for you to install the interface for it.
And there will be packages to install lesson packs for different sign languages.
And when you install the packages for them,
they'll go into user-share-kde,
or you'd be able to install the lesson pack yourself into your.kde.
And hopefully also using KDE's get hot new stuff protocol.
Right.
Be able to just pull them down and have them automatically be dropped into your.kde for you.
That would, but actually both of those solutions are cool.
But I personally love that get hot new stuff,
because it just makes it so easy to get cool new KDE stuff.
That you can trust, speaking of security.
What about like, because I know that probably,
I mean, I don't know a whole lot of sign language,
but there is some sign language that involves actual motion.
You know, and usually if you look it up in a book,
there's just like a little arrow drawn on, you know,
like here, move your hand from here to there.
Are you thinking about doing some kind of like animation?
So, you know, something?
It actually uses either a JPEG for a sign that doesn't move.
Right.
You just take a photo of yourself.
Or I have a viewer of videos.
Oh, nice.
For removing signs.
And actually, I did this as part of my senior design project was making this.
Okay.
And that I finished at the end of April.
And it's, you know, the first, the second week of June right now.
And I have already had one person send me changes to one of the ASL lessons.
Okay. Cool.
And have she, her name is Tara.
She and another guy have said that they will make more lessons for it,
because one of them is mute and one of them is deaf.
Okay.
And so they rely on ASL.
And so they're, they're right there and they're going to help,
because I'm not fluent.
Okay.
And also I mentioned translation in the lesson pack within a day of,
you know, within 12 hours of completing that translation feature.
I had French and German translation submitted to me.
Wow.
That is really cool.
So tell us the glory, developer details, like what did you,
what K-develop, a cute creator, them, like what did you use,
and what's it written in, and all that other good stuff.
So it's, I was going to write Python from scratch,
only I'm not, this is the first time I've ever used Python in like a big,
object-oriented way.
I've used Python as, well, it needs to be more advanced than Bash.
And, you know, I don't really want to use Pearl regular expressions
to parse XML, so I'm going to use Python to come out on.
And so this is the first time that I actually wrote a full program
using Python.
I'm going to write it from scratch, and then I talked to Jonathan Riddle,
who is one of the Kublin2 developers, and he said,
oh, go use K-App template.
What, what is this?
And it turns out to be really awesome.
You're on K-App template, and it says, so would you like ASL plus
plus cute application?
Would you like ASL plus KDE application?
Would you like a Python cute application or a Python KDE application?
And if you have other options or variations on those,
and then it just spits out, you know, here's your main,
you know, what do you want it to be called?
And it spits out your main thing that's .py,
and it gives you a .ui file, and you open .ui file in cute designer,
and make your interface look how you want it to.
Wow.
Then, you know, you write all the actual interaction code in the,
you write your .py file.
Okay.
And it spits out to read me that's like, by the way,
to get the UI file into a Python file that will be imported automatically,
because I already filled in the boilerplate.
And it says import.
Okay.
I'll put that UI file.
Run PyKDE, UIC4, minus O,
filename, minus O, the .ui file.
And it just does it.
Nice.
So, it took a few hours to figure out how to use cute designer.
Just a few hours.
Well, and makes the UI.
I mean, it would probably take me two weeks.
Maybe four.
I think it's about eight hours total to get a decent UI,
including the part where I had to figure out how to use cute designer.
I've used Glade before, which is the GTK version,
like the GTK program for this kind of thing.
And at first, because I was more used to how Glade works,
I was really confused with Glale in KDE or in cute designer.
And then I realized, oh, in cute designer,
I can just select some objects and say,
these go horizontally, and they will.
Whereas in Glade, I would have a table that has a bunch of columns
and I'd put something in each column to get them to line up horizontally.
And then, if I decided I wanted them to vertically,
I'd delete them all, get rid of the tables of vertical columns,
put in a table of horizontal columns, and put them all back.
Wow.
This is probably a weighted question and probably very highly controversial.
By the way, I can tell.
So this might not even be a proper question,
because I don't know anything about this kind of stuff.
But is cute for more advanced flicker than GTK right now?
I had this explained to me a while back,
and it seems to be true that the way GNOME works is you build an application,
and the next time you have to build an application that does something similar,
you go, oh, we should turn that part into a library.
And the way KDE works is you go,
what could people possibly want to do?
Let's make libraries for that.
And so when you go to write a KDE application,
you sit down and go, hey, look, I've got like 15 libraries,
and I just plunked them together, and magic happens.
And in GNOME, you go, hey, I want to write something,
and in the process, I can turn it into a library,
kind of the opposite direction of working.
Why is that the culture, or is that the way that the development environments are built,
or I mean, like...
I'm not entirely sure.
I think part of it has to do with the fact that cute head commercial backing.
And so you had troll tech making cute and going,
all right, we want to get proprietary software developers to pay us to use it.
So we'd better make it really easy for them.
Okay.
And so they wanted it, you know, they wanted to have lots and lots of special features
and libraries and cute that make it really simple for developers to just go...
So the developers and things are going, well, we could use GTK,
but then we have to write a lot from scratch,
or I guess we could just pay for a cute license,
and then we can just plug these little pieces together and be good.
And, you know, nowadays, the case of cute,
I don't know if you're aware of the licensing changes,
but nowadays with cute licensing, it's, I think, GPL, or LGPL?
I think it was going to be GPL version 3.
That's what...
At the Google event...
Okay, the GPL.
But it's not, I think it's LP, GPLP.
LGPL.
Yep.
I'm not sure.
Which one is GTK?
It's the other one.
Yeah, the other one.
No, no, no.
GTK and cute.
One of them is GPL.
One of them is LGPL.
I don't know which is which.
I think cute is GPL.
That way, if you want to write them for software, you're good.
And if you want to write proprietary software, you're paying.
And it puts a really good incentive on people to open-source their software
because if they want to do it cheap, they have to do it open-source.
Whereas with GTK, it's LGPL.
And if they want to do it cheap and proprietary,
well, you're just linking against it.
Go ahead.
Right, right.
Okay.
So in your opinion, because I was actually just talking just less about this too,
in your opinion, is it important for everyone cute being the cross-platform thing that it is?
How important is it for an application to be a cross-platform run on everything?
So, I'm with two minds about this.
On the one hand, you've got, well, if it runs on Windows,
you can get people used to their own Windows.
And then later on, go, you know, you could switch to Linux and still use this.
It wouldn't, you know, require you relearning.
On the other hand, if our killer apps are cross-platform,
they're not killer apps anymore.
You've got somebody going, oh, gee, that program for Linux looks really, wait,
I can run on Windows too.
Well, never mind.
Right.
It's going to depend on the software and what point is that.
I think, I think when it gets to the point where it's a flagship application
where you're saying, we have this, and we are special because of it,
then you don't want to be a cross-platform app.
You want to be something where it's incentives to switch.
So I guess it probably depends on the size of the project, maybe?
I don't know.
I mean, I guess if you literally did that, they're...
That's how much better it is.
Right, yes.
It's a degree of how much better.
You know, the percentage of...
You did the application you said.
Like, open office is, you know, it's not really better.
It's not really worse than the word.
And it's...
It's a trend.
It's kind of compatible.
It's just like the straight alternative.
And so you get people who use it on Windows, they can switch.
It's fine.
Whereas, for example, Amorock, there is no application on Windows or Mac,
second piece of Amorock.
It does not exist.
Yes.
And so whenever you've got something that is above and beyond like Amorock is,
you don't port that to Windows.
But isn't that?
I mean, that's extremely political.
That's really biased and motivated for all the wrong reasons.
I know.
I guess that's why we like it so much.
All right, so one last question.
Tell me about, because I know you're...
I think heavily involved in this as well, is you boom to women.
What is it?
What's it all about?
What are the goals of it?
So back in 2002, study was done and they found that within developer communities
was open source software, there were two percent of developers were women.
How many?
Two percent.
Wow.
As in, there's a single digit there.
Right, okay.
And about the same time, some EU commission released a study saying that in software development
in general in commercial software, you had 28 percent.
Oh, wow.
It's a return of 14 times difference.
Yes.
And that led to a study that was called Flopples, where they surveyed women who were involved
in open source software.
And a bunch of developers, right?
And said, so have you seen sexism?
Have you seen this sort of thing happening?
And the answer to get from the women and men differ greatly.
Right.
Yeah.
And it launched sort of a more of an interest in finding out, well, how can we fix the communities?
Something that's sort of happening then with different districts have women groups.
And there's also Linux Shicks, which I'm also involved in.
Okay.
But the goal of deep into women project is to encourage and help more women get involved in the community
and it involves, you know, in whatever capacity, whether it be programming or translating
or testing or documenting or unbreaking the kernels.
We have, you know, there's leaflets.
Yes.
I do have a patch in the internal channels.
There's Leanne on the kernel team who she just seen rolls through bugs.
Yeah.
What we found a few months ago started, about six months ago, started counting.
There's a status within a group to call a group to member.
And if you've had a sustained contribution to Ubuntu, and that contribution could be,
programmer could be documenting or it could be advocacy or any of those things I mentioned before.
And went through the entire list of Ubuntu members, all 500 in some odd, 523 at the time, I think, and counted up.
All right.
Which one through all the women?
What percent are they?
4.5 percent at the time, and it fluctuates months to months by about, you know, 0.1 percent.
Okay.
I think that's at 4.4 right now.
Okay.
But trying to see, you know, what percent is the involved people within the group?
Right.
Two of our women.
Okay.
So, yay.
It's double what overall source was eight years ago.
On the other hand, that's still a really small number.
Okay. And so it sounds like you put a fair amount of thought into this.
Why do you think that is?
I mean, surely it can't just be because of sexism, or maybe it can be.
But, like, sexism here and there, like, sexist comments or, you know, inappropriate comments and iris here,
are women not coming to the door at all to knock on it?
Or are they knocking and then getting, you know, like turned away?
I mean, what's the...
I mean, it's going to be a mix of things.
I've recently been reading the book Unlocking the Clubhouse Women in Computing.
Okay.
It's about, you know, the leaky pipeline.
You've got girls being knocked out of computing when they're, like, 10 years old, just by it being...
It's not girls.
It's not girls stuff.
That's that boy stuff.
And then getting knocked out in high school whenever they go into, you know, my first programming class was in 10th grade, I walked in.
And I heard somebody say, what's a girl doing in here?
Yeah.
Things like that.
And you hear them in a pimes and eventually at some point, you just go, maybe I'm not supposed to be here.
Yeah, I imagine there's got to be a point where you...
The straw that breaks the camel's back, right?
Or that it doesn't, right?
I mean, is there, like, a point where you, like, have to decide whether you're going to fight for this or if you think too much work is too much trouble or anything?
Yeah, and I think a lot of that has to do with your support network.
Like, like, I'm with Linux Chicks.
I'm with Ubuntu Women, with Debbie and women too.
And one of the first things that happened when I started using Linux, I mentioned to one of my my space friends, Valerie.
Hey, I just started using the Ubuntu thing.
And she goes, oh, you join Linux Chicks.
I'm like, what's that?
She's like, oh, here's how you get SCRC channel.
And she explained to me how to use Xchat and all that.
Right.
And, you know, through that and through having...
They've been like mentors for four years that I've been using Ubuntu.
It's been, you know, if I have a question, I know I can ask them, and I'll get an explanation, including more background info than just, like, oh, it's a pd entry, what a given me.
Yeah, yeah.
Like, you know, everything I need to know, and it's so useful when it turns into, like, I have a younger cousin in, like, 4th or 5th grade.
And she hasn't had Ubuntu laptop.
And last year, I was explaining Ada Lovelace Day to her, and why one of my computers is named Ada.
And one of them is Betty, which, if you don't know who, I mean, by Betty, then go look at the eniac women to a number named Betty.
And the one that I'd given her was named Grace Hopper.
Oh, okay.
And I was explaining her what an interpreter was, what a compiler was.
Wow, okay.
How, you know, punch cards, all that stuff, and about how, you know, eniac they had to re-flug wires and everything.
And, like, nowadays, there are some people who think that computers are boy stuff, and that girls can't do it.
But, you know, we'll show them.
And she says, yeah, we'll show them.
Cool.
So that, I guess that is, that's what those groups are doing.
They're the support network that prevents the person from saying it's not worth it.
I'm not going to bother anymore.
Right.
You've got, someone's got your back, and you've got other people showing you that, no, really women can do this stuff.
So people who say that they can't are completely wrong.
I mean, if women couldn't do this, like, Valerie Aurora, I met her at Elinix Chick event back in October 2006.
I mean, she's responsible for RelA time option in AXC3.
She's responsible for massive performance improvements in AXC2 and AXC3.
She helped design ZFS like...
Yeah, I read her blog a couple of times.
And it's so far...
Yeah.
I literally...
I was just like, no, this is not...
I don't belong here.
This is maybe on me.
But yeah, that's pretty cool stuff.
Okay, well, thanks for talking to me, Mako.
That was really, really informative.
Right.
Thank you for listening to AXC3 public radio.
HPR is sponsored by Carol.net.
She'll head on over to C-A-R-O dot N-E-T for all of her TV.
Thank you.
Thank you.