DoctorMo's Blog

Today I’m going to talk a little bit about one of the sessions at the Ubuntu Developers Summit, it was a session about AptURL Policy when dealing with Debian repository links and how best to add them.

At the moment in Jaunty the functionality to add PPAs and other repositories from a single click is developed but turned off. The fear that turned it off is that a user could add just about anybody’s repository and install anybody’s software without so much as a security check to see if what they are installing is safe.

So what was the problem? Well a number of staffers at Canonical want to make a white list which gives Canonical or the Ubuntu Technical Board implicit trust on every default installation Ubuntu to favourably select which repositories it considers to be safe. On the other hand some community members are concerned that giving Canonical this power could be easily misused by keeping competitors out or favouring corporate partners more than individual developers. Those on the white list would enjoy one click installation of repositories (including PPAs) and those not on the list would be relegated to the current system of hacking the user’s sources by hand and trying to convince them to add a gpg key manually. To get on the list a repository would need to sign an agreement stating the stability of the packages and so forth (which is not a bad thing IMO).

My position is user centric. Unsurprisingly, while I would be in favour of allowing the user to mess up their own machine if they wanted to, I’m much more concerned with the duplication of yet another trust system and one that would be inflexible technically.

What I would prefer to see is a system of identity trust and qualitative peer review scoring based around GPG keys and some form of open quality system. One where the Technical Board trusts Dell and if I trust the Technical Board, all is well and I can trust Dell with a nice little pop-up box telling me everything I need to know to make an informed choice. What I would not like to see is Dell software installing automagically without ever asking me what I wanted.

On the other hand if I wanted to install something from my PPA, then I should in theory be allowed to express my social trust and technical confidence through the exact same system. I believe in providing the end user with as much relevant information as possible and then handing off ultimate control of their own machine’s to them. While it’s true that lots of users are not well trained on security issues, I would not want to see us give in to the idea that all (or any) users are an incapable idiots who could never be educated and would always click away everything.

The two mockups above are very rough draft, but they are my current thoughts brought to life by glade. the buttons would open up a web page with further information, could be a launchpad account or some other website with nice verbose information.

Update: Jeff has made some very good points below, I’ve attempted to update the post to reflect a more refined view of making sure that qualitative and identity issues are not mixed up. I will use “trust” to refer to identity to mean “I trust that this person/company is who they say they are” and “confidence” to mean “I understand this person is technical and morally able to not ruin my computer”.

Today is the last day of the Ubuntu Developers Summit 2009 for Karmic Koala, I’ve seen some pretty amazing things, boot speeds, data integration, netbook software. It’s all still to come. So now we start growing this next version from our discussions here.

I’ve really enjoyed coming to UDS and if ever any of you get to come, please do, it’s an exciting opportunity to discuss not just technical issues and features but also community management and events. We’ve been discussing just as much about Local Community groups and Education as we have about kernel regressions and xorg bug tracking.

Checkout Carbon 6’s image gallery in DeviantArt.

Today there has been a lot of talk about common functionality that attempts to replace lots of existing replicated functionality.

When you have a problem that everyone has to solve, it’s worth considering making a standard version available which all programmers can take advantage of. For instance, every program can take advantage of files, files are so important that they usually form a core part of many programming languages. But could you imagine a system where each program writes data to the disk in it’s own way?

Common Printing Interface

The Linux Foundation is working on a common printing interface which allows all programs to utilise this single and may I saw awesome interface.  One that will hopefully be used via dbus (most things are going this way) by all applications that want to print, this will move printing up a step in design and coherence.

Common Contacts Data Store

The Canonical Online Services team appear to be heading up a move towards having a local content database using CouchDB. In this they would like to store contacts and discussions today were around all the considerations of the system. Obviously there are already lots of projects attempting to solve these set of problems, some on KDE and some on Gnome; but the hope is that this system will be a unified way of talking to the system of contacts and hopefully reproduce the ease of intergration and functionality available in the Apple system.

The big functionality improvements other than common access to data will be the ability to share your contacts over the online services.

I expect (although I’m being totally speculative) that if the contacts development is successful that the system will be expanded to include other databases. I’d like to see meta data, calendar and note systems being brought into a shared infrastructural system.

Thoughts?

Today I attended a session close to my heart, user content management on the desktop.

The project I have proposed my Central Services project (formally User Data Services) to meet the needs and supply access to all content library features to the very core of Ubuntu.

First I will explain the problem. Every media and content system has library programs, editing programs and viewing programs. Sometimes their all in one, for instance Rythembox is a good library and viewer of audio content. But the core features that you want to find in all these applications is the same:

• Listing and Opening
• Metadata and Tagging
• Indexing and Searching
• Event Logging
• Online Service Support
• Hardware Device Support

The only thing that separates these generic features is the content type and the kinds of applications that will display the content. It seems natural then that we should aim to get content library infrastructure in place so programmers don’t have to re-invent all of these things (some of which are none-trival), these are some content type examples:

• Images / Galleries
• Audio / Albums
• Contact / Address Book
• Event / Calendar

Imagine a time when you no longer have to hunt around for a picture to attach to your email but instead select a “pictures” tab and are presented with all images availble even if they are on your Google Picassa account or on your ipod without having to first sync them, imagine being able to access your contacts from facebook, gmail and your blackberry all from the same application and then deciding for yourself how they should be sync’ed (it at all).

I think it would be awesome and I’m trying to complete the implimentation details for the metadata and indexing, working with the Zeitgeist project and learning from the mojito moblin (intel) who are also hear and trying to solve a similar set of problems.

Breaking news from the summit of Ubuntu geeks currently being held here in Barcelona. The supply of coffee, the drug that keeps many geeks going throughout the morning, has dried up with the swift removal of all coffee dispensing machines.

Landscape Dev Mourns

It happened on a warm May day at 9:30, half way though the first morning’s UDS sessions. Buoyed by the day’s early supply of coffee all was going well. Until tragedy struck for all those hoping to get a second or third cup before the second session line-up. According to sources the summit venue is rather strict with coffee and only the persistent demands of Clair Newman could persuade them to deliver much needed coffee relief at all. But instead of this wonderful bean drink persisting, it instead was swiftly removed shortly after being put out causing many sad faces and some on the verge of tears as they looks mournfully into their empty cups.

Without the much needed drink the morning’s sessions will likely be slower and perhaps filled with the sounds of gentle snoring. For the love of improving Ubuntu, bring back the coffee for these souls!

Although this reporter only drinks Tea, so isn’t so bothered by all the fuss.

Update: 10:17am the coffee has returned, only the continued demands and sad, grey faces in the halls could have prompted this 180 degree policy change. Rejoice for the coffee is back.

The Community is Now Happy

Today’s UDS (as promised to Jono) will be recorded here in my blog.

Each LoCo team has to as some point run events, it’s a natural part of what Local Community teams do to reach out, promote, teach and connect their local users together. So it seems fitting that a LOT of LoCo team people were at UDS today to talk about how we can make organising events and global co-ordination better.

First on the list is the Bug Days and how the general ideas can be coordinated and how we can use best practices to organise and execute days that everyone will be organising. This also includes translation-days and my suggestion, marketing days. Think of a single day where every LoCo team in the world decided to market in a public way, hand out flyers and CDs, hold placards and have some fun.

We also talked tools, using the existing sprint functionality in launchpad it might be possible to expand to make it handle local community events, both those that we organise and those of other groups that we attend. This way our team’s data is available via a standard API with standard authentication, community tools can then be built to automagically add things to google calendar, facebook events and other awesome community awareness.

We also talked about making sure other LoCo teams are aware of what is going on in some other LoCo teams. For instance, did many of you know that the Massachusetts LoCo team organised a team spirit event to watch the new Star Trek film at the iMAX picture house? A very good event that was not well publicised outside of our LoCo and some other people were expressing their lament that they could have joined in the fun themselves and had a whole load of LoCo teams attending on the same day.

There is also work going on in the teams-db world, data is going to be removed from the wiki and we’re going to have a website which will hopefully handle the team information in a much more cohesive way.

That’s it for now, Beunos Nochos.