Blog en turnkeylinux-blog FLOSS weekly interview with TurnKey's Jeremy Davis <p>Our very own Jeremy Davis was interviewed by <a href="">FLOSS weekly</a> regarding all things TurnKey by Randal Schwartz and Aaaron Newcomb:</p> <p><iframe align="middle" frameborder="0" height="320" scrolling="no" src="" width="640"></iframe></p> <p>Embedded video not working? Go directly to&nbsp;<a class="reference external" href=""></a></p> <p>It goes for about an hour with probably about 40 mins of interview with Jeremy. Speaking of Randal Schwartz - I learned much of my Perl fu from his&nbsp;<a href="">awesome camel books</a>. Thanks Randal!</p> <p>Jeremy was a bit nervous going in but reported back that &quot;all-in-all I think it went pretty well. But please feel free to judge for yourselves. Happy for any feedback&quot;</p> <div> <h2>Interview notes</h2> <ul> <li> <p><strong>Communicating TurnKey values and mission</strong></p> <p>What TurnKey stands for. Why we&#39;re doing this. Where we&#39;re going.</p> <p>&quot;Give information technology superpowers to the little guy by creating secure, easy to use open source solutions.&quot;</p> <p>TurnKey is all about using FLOSS to leveling the playing field a bit by making it easier for those who have information technology superpowers to help make superheros of those that don&#39;t.</p> <p>We should share as much as possible about our ideas for the future, though it wouldn&#39;t hurt to mention that there&#39;s still a lot of work and that we could use all the help we can get.</p> </li> <li> <p><strong>Attitude</strong></p> <p>Just talk freely about the things that get us excited. That will work best. No need to rehearse or think about what to say. Be your authentic self and try to have fun.</p> </li> <li> <p><strong>Focus on the stuff that would add the most value to the audience listening in.</strong></p> <p>For example that TurnKey makes it easy to try out FLOSS software because you can just download an ISO image and boot it live in a Virtual Machine. You don&#39;t even need to install anything on your machine and worry about satisfying all the dependencies to see the app in action and evaluate whether it suits your needs.</p> </li> <li> <p><strong>Advantages of TurnKey development toolchain (AKA TKLDev) for FLOSS users and developers</strong></p> <p>We can talk about how it&#39;s completely generic. You can roll your own Debian based live CDs / VM images. You don&#39;t have to use any TurnKey components and can use it to easily build any Debian based system integration.</p> <p>That it&#39;s a force multiplier. You put together a cool solution to a problem by gluing together off the shelf free software components and you get a ready-to-use solution that not only you can use but that anyone can not only use but build from source and improve. The system integrations are automatically reproducible.</p> <p>That it&#39;s easy to use. TKLDev is packages as a self-contained system you can use to build bootable live CDs/USB solutions from a few clean lines of source code. That it&#39;s simple enough to be used in teaching.</p> <p>For example, Rik Goldman is using it to teach hands-on Linux skills to high-school students in authentic assignments that actually produce something useful - Linux solutions that anyone can use.</p> <p>That it&#39;s easy to maintain. You don&#39;t have to do everything from scratch when the next version of comes out because the build is automatic.</p> </li> <li> <p><strong>User stories</strong></p> <p>Such as how the TurnKey versions of Sahana Eden make it easier to rapidly deploy humanitarian responses in case of crisis. How the TurnKey version of Ushahidi helps crowdsource crisis management. How TurnKey lowers the bar in terms of the IT skills you need to bring to the field to get a solution that works.</p> <p>How small organizations that don&#39;t have a lot of IT skills (e.g., churches) are using TurnKey to more easily deploy FLOSS solutions.</p> <p>Or how a contractor working with FLOSS software might choose LAMP stack as a starting point, setup a private development environment in VirtualBox and then using TKLBAM to migrate all the system configuration tweaks, code and databases to a public server.</p> </li> <li> <p>Maybe talk about the TurnKey Backup and Migration system and the benefits that provides. That the last version was codenamed &quot;give me liberty or give me death&quot;. That it can be installed on any generic Debian/Ubuntu system. That it can now use any storage backend. That it can work completely independently from the cloud. That we added a solo mode in the last version so that you wouldn&#39;t have to use TurnKey&#39;s cloud backup and key service if you don&#39;t want to.</p> </li> <li> <p><strong>TurnKey as an example of FLOSS empowerment</strong></p> <p>That TurnKey is an extraordinary example of how empowering FLOSS can be. Alon and Liraz built TurnKey from the ground up with no funding using only FLOSS components. That wouldn&#39;t have been possible a decade ago.</p> </li> <li> <p><strong>TurnKey as an example of FLOSS developer dedication</strong></p> <p>In some circles there&#39;s this idea that to be highly motivated you need to want to make a lot of money, and that FLOSS is going to be second rate because the developers have to do this part-time or aren&#39;t as motivated. But though everyone needs to make a living, many of the people working on FLOSS aren&#39;t really interested in making a lot of money. For them, money is something you need just enough of to get by, but you&#39;re not a slave to it, it&#39;s not the primary motivation.</p> <p>Alon and Liraz, the founders had this vision and to make it real they lived extremely frugally and burned through most of their savings for a couple of years until the project could pay them minimum wage from donations and TurnKey Hub subscriptions.</p> </li> </ul> </div><img src="" height="1" width="1"/> Wed, 09 Jul 2014 14:58:08 +0000 Liraz Siri 15823 at Standing up for free software, a free Internet and a free society <p>Six years ago, <a href="">in the fall of 2008</a>, Alon and I started TurnKey GNU/Linux inspired by a belief in the democratizing power of free software (free as in speech, not beer), like science, to promote the progress of a free &amp; humane society.</p> <p>Last year&#39;s &quot;summer of Snowden&quot; got me thinking about what sort of role free software software (and by modest extension TurnKey) should play in taking back the Internet from those who would turn it from a tool of freedom <a href="">into a weapon</a>.</p> <p>I realized many of us in the <a href="">free software</a> community had been lulled to sleep due to the tremendous success that free software has had in the past two decades. We won didn&#39;t we? After all the Internet, together with the free software that powers it, is one of the greatest victories for human freedom in history. Great! So nothing to see here, move along...</p> <p>Except we only won a few battles. We didn&#39;t win the war. Our hard earned freedoms are now more than ever under intense attack. Powerful forces are continually plotting new ways of luring us into closed, centralized systems under their arbitrary control, tempting us (to paraphrase Benjamin Franklin) to give up essential liberty in order to purchase a little temporary convenience and safety.</p> <p>This makes free software and the values it embodies more important now than ever lest the very technologies we developed with the dream of creating a better, more open, humane and egalitarian society be turned against us. We the people, have to take a stand.</p> <p>With that in mind we recently began referring to TurnKey Linux as TurnKey GNU/Linux - to symbolically show TurnKey&#39;s solidarity with the core ideals spearheaded by the <a href="">Free Software Foundation</a>, founded by Richard Stallman.</p> <p>Many have criticized Stallman for being too extreme and polarizing. For not bending his values to conform with reality. For being a hopeless idealist. In 1998, several such pragmatists founded the <a href="">Open Source Initiative</a>&nbsp;in order to rebrand &quot;<em>free software&quot;</em> as &quot;<em>open source software</em>&quot; with the idea:</p> <blockquote> <p>To dump the moralizing and confrontational attitude that had been associated with &#39;free software&#39; in the past and sell the idea strictly on the same pragmatic, business-case grounds that had motivated Netscape.</p> </blockquote> <p>To be honest, for many years I viewed this as a non-issue. A pointless semantic storm in a teacup. I considered &quot;<em>open source</em>&quot; and &quot;<em>free software</em>&quot; interchangeable and usually just defaulted to speaking of &quot;open source software&quot; with people who I believed might get confused by the &quot;free&quot; part.</p> <blockquote> <p>No no, free software is free as in free speech, not free beer. It&#39;s about freedom, not price!</p> </blockquote> <p>Using the term &quot;<em>open source software</em>&quot; sidelined the issue neatly.</p> <p>Except it didn&#39;t. Open source was all about utility, a means to an ends. &nbsp;<a href="">Logos</a>&nbsp;-&nbsp;as the greek philosophers would say. What end was being pursued didn&#39;t matter.</p> <blockquote> <p>The mind is a wonderful servant, but a terrible master.</p> </blockquote> <p>Free software on the other hand was all about values. <a href="">Ethos</a>&nbsp;- ethics, character. If you begin from the end, values are what you start out with. Then you set goals. After that you know where you want to go and you need to figure out the best way to get there - that&#39;s utility. Values are the roots, utility the leaves.</p> <p>Richard Stallman does a good job of explaining the difference in his essay &quot;<a href="">Why Open Source misses the point of Free Software</a>&quot;.</p> <p>Values, above mere utility are at the heart of any worthwhile mission. It explains why we care about free software, our vision for the future, and why we&#39;re only just getting started:</p> <p>Quoting from <a class="reference external" href="" style="line-height: 1.5em;"></a>:</p> <blockquote> <p>We want to work and play in a free Internet, under our terms, our rights and liberties intact. They want us depending on a nebulous &quot;cloud&quot; forever beyond our control, under their thumb, playing by their rules, trapped in a virtual panopticon that allows shadowy government agencies to spy and archive our digital thoughts in mass warrantless surveillance programs, turning the Internet from a tool of freedom into a weapon.</p> <p>As renowned security expert Bruce Schneier puts it: &quot;We need to take back the internet, and by we, I mean the engineering community.&quot;</p> <p>A rare minority of would-be heros have the right combination of skills, means and motivation to fight back. Imagine if we could bottle up their IT superpowers and mass produce it into secure, convenient solutions mere mortals could use. Even experts would benefit. Discovering, configuring and testing combinations of free software components can be notoriously challenging, time consuming and inefficient, especially if everyone keeps reinventing the wheel by rolling their own solutions.</p> </blockquote><img src="" height="1" width="1"/> free software freedom fsf gnu values Wed, 09 Jul 2014 13:28:07 +0000 Liraz Siri 15821 at Enabling Debian 6.0 LTS Security Support <p>This announcement is for Debian 6.0 (AKA Squeeze / TurnKey 12) users who have not yet upgraded to Debian 7.0 (AKA Wheezy / TurnKey 13):</p> <pre> ~# cat /etc/ Debian GNU/Linux 6.0 </pre> <p>Support for security updates to Debian 6.0 officially ended on Saturday May 31 2014.</p> <p>As you may have heard, for the first time Debian is experimenting with a five year Long Term Support (LTS) program that will extend support until Feb 2016:</p> <p class="rteindent1"><a class="reference external" href=""></a></p> <p>Good news for procrastinators. The catch is that if you&#39;re still using Debian 6.0 you have to manually enable your system to receive LTS updates.</p> <p>If you don&#39;t do that then the next time there is a remotely exploitable security vulnerability your system could get compromised.</p> <p>For example, the previous version of TurnKey (TurnKey 12.X ) based on Debian 6.0 no longer receives <a class="reference external" href="">automatic security updates</a>. Those of you that still have systems running Debian 6.0 have three options:</p> <ol> <li> <p>Manually enable LTS updates on your Debian 6.0 system:</p> <pre> ~# apt-get install debian-keyring debian-archive-keyring ~# cat&gt;&gt;/etc/apt/sources.list.d/security.sources.list&lt;&lt;&#39;EOF&#39; deb <a href="" title=""></a> squeeze-lts main contrib non-free deb-src <a href="" title=""></a> squeeze-lts main contrib non-free EOF ~# apt-get update ~# apt-get upgrade </pre> Check which packages on your system are not supported: <pre> ~# apt-get install debian-security-support ~# check-support-status </pre> </li> <li> <p>Use TurnKey&#39;s backup and migration system (<a class="reference external" href="http:/">TKLBAM</a>) to migrate your data and configurations from a TurnKey 12 based system to an equivalent TurnKey 13 based system, which is based on Debian 7.0.</p> <p>The advantages:</p> <ul> <li> <p>If anything breaks you don&#39;t have to fix it in place and you still have the original system up and running. Less pressure.</p> </li> <li> <p>Forces you to test your backups.</p> </li> </ul> <p>TKLBAM is built into all TurnKey systems. If you&#39;re using plain old Debian you can install TKLBAM with this one liner:</p> <pre> wget -O - -q <a href="" title=""></a> \ | PACKAGE=tklbam /bin/bash </pre> </li> <li> <p>Upgrade Debian 6.0 in place to Debian 7.0:</p> <p><a class="reference external" href=""></a></p> <p>You can upgrade TurnKey 12 based systems to Debian 7.0 the same way you would upgrade any other Debian system. Remember that under the hood TurnKey is just a preconfigured, customized version of Debian with a few extra packages (e.g., like TKLBAM).</p> </li> </ol><img src="" height="1" width="1"/> legacy lts security squeeze Mon, 02 Jun 2014 16:43:24 +0000 Liraz Siri 15692 at And then there were three... <p>Hi all! This is my virgin TurnKey blog post. Many of you on the forums would have come across me in your travels no doubt. I have been a volunteer serial poster on the forums now for many years. I have even had the privilege of having a <a href="">blog post</a> written about me by Liraz (one of the core TurnKey devs).</p> <!--break--> <p><img alt="jeremy" src="" style="width: 200px; height: 200px; float: left;" />Those that pay attention to the &#39;karma&#39; stats (see bottom of the <a href="">forums page</a>) may have noticed that whilst I still retain the &quot;Most awesome of all time&quot; crown I&#39;m not in the &quot;Most awesome this month&quot; list, despite my posting frequency still being quite high. Forum regulars may have also noticed a subtle change in the way that I have been writing my posts lately. I feel like I write with a little more authority now. And that is for a very good reason!</p> <p>Earlier this year I had the incredible honour of being asked by Alon and Liraz to join the TurnKey team on a full time basis! I have felt like part of the team for quite some time now, but to be formally asked to quit my job and come on board with TKL full-time blew my mind! But it also scared me a little bit too!</p> <p>Never the less, I sucked it up and gave notice at my old job and started work on TurnKey part time almost straight away (I had a few lose ends to tidy up before leaving my old job). So here I am, the latest TurnKey Linux developer (in the loosest sense of the term); joining forces with the dynamic duo that is Alon and Liraz!</p> <h2>So what does it all mean for TurnKey?</h2> <p>So what will this mean for TurnKey Linux? Well from the outside, probably not a lot really. I will still be posting on the forums and on GitHub but I will be doing other (more behind the scenes) stuff too! :D</p> <p>One of the most important roles will be to talk with people from other organisations, like hosting providers (to encourage them to <a href="">partner with TurnKey Linux</a> and host TurnKey appliances on their cloud/VPS platform) and to start some of the discussions with upstream developers; especially Debian (to seek to contribute TKL code back upstream and develop ideas such as <a href="">upstream usage of TKLDev</a>).</p> <p>I will also be taking up the &#39;level one support&#39; role. So chances are if you contact <a href="">TKL Support email</a> it will probably be me politely suggesting that you post in our <a href="">forums</a> :D (unless of course it is the sort of question that should be handled via email...).</p> <p>Also I will be pondering questions about the community (with Alon and Liraz) regarding such things as <a href="">how to build a better, bigger but sustainable TurnKey library</a>, if and how to build in <a href="">financial</a> <a href="">rewards</a> and other such exciting ideas!</p> <p>Most of all though, my role will be to make sure that any important TKL business (whether from community members, hosting providers, upstream developers, general users or anyone else really) gets taken care of and that Alon and Liraz are up to speed with what is happening without needing to take too much time out from development. Hopefully this will mean that the core devs do more core deving but also issues that I don't know how to answer can get their attention quicker!</p> <p>So let the fun begin...! :D</p><img src="" height="1" width="1"/> announcement community developers news Fri, 18 Apr 2014 22:25:31 +0000 Jeremy 15392 at What's the best way to do free software bounties? <p>First, I&#39;d like to thank Joey, Noah and Jeremy for providing much needed feedback on a <a href="">related blog post</a>. Thanks guys. It really got me thinking. What if instead of a contest we figured out how to do community funded bounties? Wouldn&#39;t an open, continual system of <a href="">free software</a> bounties be much a better idea than doing another contest?</p> <p>In contrast to a contest, bounties would open up both the funding and the funded goals to the community. Everyone could vote with their wallets for specific goals they&#39;d like to see accomplished. Rather than dictating from above Alon and I could participate in the process on the ground level (e.g., starting new bounties or supporting community created bounties).</p> <p>There wouldn&#39;t have to be be winners and losers. If multiple people or teams collaborate on a solution to a bounty we could divide it amongst them.</p> <p>To be frank the more I think about it the more my enthusiasm for TurnKey sponsored contests diminishes. The main problems with contests is that they&#39;re <strong>top down</strong> (I.e., funding and direction is dictated from the top) and <strong>reward competition instead of rewarding collaboration</strong>. You get what you reward.</p> <p>By not rewarding the right thing, a contest would discourage rather than encourage the spirit of win/win collaboration that is critical for the long-term success of TurnKey as a true free software project.</p> <p>Sure, figuring out how to do The Right Thing may be more difficult than going for the low hanging fruit but it would pay off in the long term.</p> <p>Something about this idea really excites me.</p> <p>What do you think? What would be the best way to implement a system of free software bounties?</p> <h2>Backstory</h2> <p>For those of you who haven&#39;t been following developments, last year we squeezed our build infrastructure into a <a href="">single self-contained system image</a>. We want to see more people in the Debian / free software community using this because we believe it could do a lot of good, not just for TurnKey based solutions but for any Debian based project.</p> <p>In fact, we&#39;d like everybody who could find this useful to know about it and use it, even if they don&#39;t contribute anything back to TurnKey: <a href="">what if all Debian/Ubuntu based dists used TKLDev?</a></p> <p>Note that this is what Alon and I actually use to maintain all 100+ apps in TurnKey. Without all of the automation in our build system that wouldn&#39;t be remotely possible. Nobody could pull it off. There&#39;s just way too much work. But the system we&#39;ve developed makes maintaining a ready-to-use Debian system template as easy (sometimes easier) as maintaining a single Debian package.</p><img src="" height="1" width="1"/> community free software tkldev Fri, 11 Apr 2014 08:44:19 +0000 Liraz Siri 15377 at TurnKey 13 critical security issue (Heartbleed / CVE-2014-0160) <p>Without action, your TurnKey 13 installations may remain vulnerable to the critical&nbsp;<a href="">Heartbleed</a>&nbsp;OpenSSL attack (<a href="">DSA-2896-1</a>&nbsp;<a href="">CVE-2014-0160</a>). This is not a theoretical attack. A remote exploit <a href=";field_exploit_type_tid=All&amp;field_vulnerabilty_id_value=&amp;field_operating_system_tid=All">already exists in the wild</a>.</p> <p><span style="font-size:12px; line-height:1.5em">TurnKey installations are configured to </span><a href="" style="font-size: 12px; line-height: 1.5em;">install security updates automatically</a><span style="font-size:12px; line-height:1.5em">. Unfortunately, according to our testing installing the update is not enough.&nbsp;</span></p> <p><span style="font-size:12px; line-height:1.5em">For the fix to take effect y</span><span style="font-size:12px; line-height:1.5em">ou&#39;ll need to either:</span></p> <p><span style="font-size:12px">1) Reboot your system:</span></p> <pre> /sbin/reboot</pre> <p><span style="font-size:12px">2) Individually restart any service </span>(e.g., webserver, shellinabox, webmin, etc.)&nbsp;<span style="font-size:12px">that uses the OpenSSL library:</span></p> <pre> <span style="font-size:12px">/etc/init.d/apache2 restart</span> /etc/init.d/nginx restart /etc/init.d/lighttpd restart /etc/init.d/shellinabox restart /etc/init.d/webmin restart</pre> <h2>Your private SSL key may already have been stolen</h2> <p>Fixing this vulnerability only protects you from future attacks. An attacker can use this attack to read arbitrary chunks of server memory containing private keys, sensitive login credentials or supposedly encrypted communications. The implications of this are profound.</p> <p>If an attacker has already exploited heartbleed to to steal your SSL private key she can decrypt all past and future encrypted traffic even after the vulnerability has been fixed.</p> <p>If this concerns you, you may want to seriously consider issuing new private keys and passwords for all effected services.</p> <h2>Are your servers vulnerable?</h2> <pre> Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4 (vulnerable) Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14 (not vulnerable)<span style="font-family:verdana,sans-serif">&nbsp; &nbsp;</span></pre> <p>TurnKey 12.x solutions (based on Debian Squeeze) are NOT vulnerable to&nbsp;Heartbleed, as they shipped with a version OpenSSL that is not affected.</p> <p>TurnKey 13.x solutions (based on Debian Wheezy) ship with a version of&nbsp;OpenSSL that IS vulnerable.</p> <p><span style="font-size:12px">Additionally, the appropriate steps need to be taken for potentially&nbsp;leaked primary key material, secondary key material, protected content&nbsp;and collateral.</span></p> <h2>What about new deployments?</h2> <p>New deployments should not be affected as security updates are applied before the services are started.</p> <h2>Testing for vulnerability</h2> <p>You can use either the online or CLI utilities to test for&nbsp;Heartbleed:</p> <ul> <li><a href=""></a></li> <li><a href=""></a></li> </ul> <h2><span style="font-size:1.7em; line-height:1.25em">Further reading</span></h2> <ul> <li><a href=""></a></li> <li><a href="">Free Software Foundation statement on Heartbleed vulnerability</a></li> <li><a href="">&lsquo;Heartbleed&rsquo; OpenSSL Bug Left HTTPS Servers Vulnerable For Two Years</a></li> <li><a href=";field_exploit_type_tid=All&amp;field_vulnerabilty_id_value=&amp;field_operating_system_tid=All">Commercial exploit for Heartbleed</a></li> </ul><img src="" height="1" width="1"/> announcement security Wed, 09 Apr 2014 11:45:45 +0000 Alon Swartz 15354 at What if all Debian/Ubuntu based dists used TKLDev? <p>Imagine if <a href="">every Debian distribution in the world</a>&nbsp;in the world was using TurnKey&#39;s build chain and collaborating with us on its development instead of limping along with various inefficient ad-hoc tools?</p> <p>TurnKey currently doesn&#39;t get as many contributions back from the <a href="">free software</a> community as we&#39;d like (our fault). I think there are two main reasons for that:</p> <ol> <li>We too started out with an ad-hoc development process and it took us too long to clean up our act, rework everything and fully open up <a href="">the development process with TKLDev</a>.</li> <li>We haven&#39;t done enough targeted outreach</li> </ol> <p>I&#39;d love for that to change and I think promoting more people to use TKLDev is key to that. It would be really good for TurnKey, good for the Debian community, and good for free software innovation.</p> <p>So far we&#39;ve been thinking mainly of convincing people who would never otherwise develop a Linux distribution to use <a href="">TKLDev</a> to do that, but isn&#39;t that a much harder sell than say ... the people who are already developing Linux distributions?</p> <p>We wouldn&#39;t need to convince them to do something they haven&#39;t done before but rather improve the way they&#39;re doing something that they are already motivated/committed to doing.</p> <p>So I think it would be a really good, high-leverage idea to compile a list of contacts for all Debian/Ubuntu based dists and get a dialogue going with the intention of educating them to the benefits of using TurnKey&#39;s 100% free software build system and encouraging them to collaborate with TurnKey.</p> <p>I mean, what better way to bolster TurnKey&#39;s standing in the community than by helping out the many free software projects who are already developing Debian based distributions and share our values?</p> <p>It will be a win-win. TurnKey gets exposed to more developers, increases its prestige in the community and increasing the likelihood of getting contributions back.</p> <p>Developers accelerate development of their own projects and maybe join forces on some level and contribute improvements back to TurnKey. I bet most of those we convince to try it will realize it is better than whatever they are currently using, especially once we add in a few more specialized features such as deterministic builds.</p> <p>What do you guys think?</p><img src="" height="1" width="1"/> community debian developers tkldev Wed, 02 Apr 2014 06:42:18 +0000 Liraz Siri 14934 at The pros, cons and alternatives to financial rewards in an open source project <p>Here&#39;s another blog post that started life as a response to a private email Jeremy Davis (JedMeister on the forums) sent me regarding various things we could try to recruit more developers as TurnKey contributors:</p> <blockquote> <p>Just a random thought that I&#39;d like to put out there. I noticed some time ago that SourceForge have forums on both <a class="reference external" href="">Projects requiring developers</a> and <a class="reference external" href="">developers looking for projects</a>.</p> <p>I personally think that we have nothing to lose, but I also think that timing is important. Not much use in recruiting before we are really ready to get them into it, it will only serve to turn them off... Be interested in what you guys think.</p> </blockquote> <p>Looking for help at various watering holes where other people who are looking to help might come to is an excellent idea and definitely worth a shot. We don&#39;t have much to lose. Even if it doesn&#39;t work we are likely to learn something from it.</p> <div> <h2>Should we wait for TKLDev &quot;in the cloud&quot;?</h2> <p>I don&#39;t think so. Sure, we can make the development process easier (e.g., TKLDev in the cloud) but if contributors use <a class="reference external" href="">TKLDev</a> to develop a new appliance that meets our standards of quality (e.g., uses inithooks to set default passwords) we already have the ability to accept it into the library with little additional work. The importing process is now almost automatic.</p> </div> <div> <h2>Pros and cons of doing another contest</h2> <p>To be honest up until now we haven&#39;t given enough thought to actively recruiting developers beyond doing a contest, which we announce on the newsletter, and hoping those interested come to us and sort of stick around.</p> <p>I guess that&#39;s our focus because up until very recently we were so overloaded by work that we didn&#39;t dare seriously consider more resource intensive ideas. Plus the first <a class="reference external" href="">TurnKey development contest</a> is the only thing we have experience with so far that worked. Well sort of, we did discover it was still very labor intensive to turn TKLPatches into fully fledged appliances, but that was before <a class="reference external" href="">TKLDev</a>.</p> <p>The downside to recruiting with contests:</p> <ul> <li> <p><strong>Money comes, money goes</strong>: Developers that are motivated by the financial reward may leave after the contest ends.</p> </li> <li> <p><strong>Money comes, volunteers leave</strong>: developers that are not motivated by financial rewards might externalize their motivation to the financial reward instead of contributing for the instrinsic joy of creating something cool and useful.</p> <p>Granted right now we don&#39;t have too much to lose because we don&#39;t really have that many regular open source contributors to demotivate but still...</p> </li> </ul> </div> <div> <h2>Contests don&#39;t solve the scaling problem</h2> <p>That doesn&#39;t mean a contest wouldn&#39;t be very useful. If we define our quality standards carefully enough we&#39;ll probably be able to expand the library with many good submissions. It will be more work to evaluate the quality of submissions and hence forward to maintain the new appliances internally. But right now if we double the size of the library, our maintenance overhead will nearly double as well. It can be useful, but it&#39;s not infinitely scalable.</p> </div> <div> <h2>Alternatives to financial rewards?</h2> <p>Most open source contributions are not driven by direct financial incentives. Paid developers may form the backbone of a project but in the most successful projects the community contributes far more, at least in aggregate.</p> <p>Otherwise open source projects would only work when companies decide to pool resources.</p> <p>Projects like Debian, which TurnKey is based on, prove that you can do open source, even on a lage scale without any financial incentives by invoking other aspects of <a class="reference external" href="'s_hierarchy_of_needs">Maslow&#39;s hierarchy of needs</a>.</p> <p>Instead of money contributors are motivated by:</p> <ol> <li> <p><strong>self fulfillment</strong>: doing things for their intrinsic rather than extrinsic rewards. Creating something for it&#39;s own sake. Because it&#39;s beautiful. Because it solves an important problem and you enjoy helping others, etc.</p> <p>This is the highest form of motivation which leads to the highest levels of mastery and accomplishment but it rarely comes into play unless the other levels of motivation below it are satisfied.</p> </li> <li> <p><strong>esteem / reputation</strong>: a non-tangible form of capital that can easily lead to tangible benefits (e.g., a better, more fulfilling higher paying job) and intangible benefits (e.g., respect, self confidence)</p> </li> <li> <p><strong>learning opportunities</strong>: contributing to an open source project is a great way to get &quot;on the job&quot;, hands on experience and gain skills that make you more valuable in the marketplace. You get the guidance of experts, and pay with your time and contributions rather than with tuition fees.</p> </li> <li> <p><strong>love &amp; belonging</strong>: their desire to belong to a desirable group of peers.</p> </li> </ol> <p>Translating this into the field is a challenge and building a Debian style community isn&#39;t easy under the best of circumstances.</p> <p>I think many open source projects face a catch 22 when considering whether or not to develop commercial offerings.</p> <p>On one hand, you&#39;re pushed to commercialize because if you can&#39;t make a living working on something, that puts a strict upper end on the amount of time and energy you can put into it. Unless you are already so rich that money is no object, you can&#39;t work full time on an open source project that doesn&#39;t pay the bills - you&#39;ll end up homeless before long.</p> <p>On the other hand, you&#39;re pushed away from commercialization because it&#39;s harder to get unpaid developers enthusiastic about contributing when there is a commercial sponsor behind the scenes that is perceived to benefit from their contributions. This may shift the perception of potential contributors from &quot;gift economy mode&quot; (non-zero sum, everyone wins) to &quot;rational capitalist mode&quot; (zero sum: winners and losers).</p> <p>A few ideas on how to create a social structure that isn&#39;t based on financial incentivse:</p> <ul> <li> <p><strong>Reward contributors with satisfaction</strong>: the satisfaction of a cool thing they&#39;ve created, an important problem they&#39;ve solved.</p> </li> <li> <p><strong>Reward contributors with reputation</strong>: acknowledge and celebrate contributions, give credit where credit is due, make users of products aware of the developer[s] behind it (e.g., finish installation routine with a credits screen), etc.</p> </li> <li> <p><strong>Reward contributors with knowledge</strong>: tell the stories of other people who were empowered by contributing to TurnKey / open source.</p> </li> <li> <p><strong>Reward contributors with association and belonging</strong>: this requires some kind of in-group to be formed that outsiders must aspire to belong to and that there is some process (e.g., mentorship) that benefits the community in which they transition from outsider to insider.</p> <p>Examples: Debian membership and <a class="reference external" href="">mentorship</a> process.</p> </li> </ul> <p>Come to think of it a mentorship program might be a cool thing to explore.</p> <p>Existing &quot;masters&quot; teach &quot;grasshoppers&quot; the skills of putting together an appliance. Grasshoppers prove their skills by creating at least one new appliance that passes TurnKey&#39;s standards of quality. In return they get:</p> <ul> <li> <p>Some sort of official membership / mastership status (e.g., a email address and a listing/link/badge on an official web page/database that shows off the quantity and quality of their contributions hall of fame style.</p> <p>What apps do they develop/maintain? How many downloads/deployed instances do these apps have?</p> <p>How many masters have they they mentored?</p> <p>Maybe we&#39;ll want a cool tongue in cheek name for this group (e.g., TurnKey Ninjas, Samurais, etc.) but that&#39;s an optimization for later. I propose just calling them team developers and maybe asking around to see what they think of a new &quot;cool&quot; name.</p> </li> <li> <p>Credits for developing and maintaining the appliance on the appliance page + credits in the last screen of the installation process (e.g., think TurnKey product was built and maintained by Jeremy Davis).</p> </li> <li> <p>An invitation to join virtual (and later real-life) meetups where we introduce new members and new contributions, discuss formally and informally all things TurnKey, do hackathons, and enjoy our&nbsp;</p> </li> </ul> </div><img src="" height="1" width="1"/> community contest developers maslow rewards Wed, 19 Feb 2014 10:32:56 +0000 Liraz Siri 5652 at Building a better, bigger TurnKey library <p>This blog post started out as a response to a private email discussion between me and contributing developer <a class="reference external" href="">Eric (tssgery)</a> whom recently developed <a class="reference external" href="">TurnKey Observium</a>, one of TurnKey&#39;s top ten downloads. Observium is very popular for a newly hatched appliance. It has the same number of downloads as Redmine, which we&#39;ve supported for a few years now!</p> <p>Eric wrote:</p> <blockquote> <p>TKL has two big issues as I see it:</p> <ol> <li>Marketing. You&#39;re the best kept secret of the internet.</li> <li>Testing. Too many appliance/products to be supported.</li> </ol> </blockquote> <!--break--> <p>Eric is right on the both counts.</p> <ol> <li> <p>TurnKey is severely undermarketed. We&#39;ve been pouring all of our time and energy into development. I&#39;m pretty sure there&#39;s a huge community of potential users that would find TurnKey very useful - except they don&#39;t know about it, or their cloud provider doesn&#39;t offer it as a deployment option, etc.</p> </li> <li> <p>There&#39;s definitely room for improvement on the QA / testing front, as evidenced by the <a href="">recent issue with TurnKey ClipBucket</a>.</p> </li> </ol> <p>Testing is not only the limiting factor in the quality of the appliance library, but also its size.&nbsp;If it comes to that, and often it does, then like Eric I&#39;d rather see TurnKey do a better job on fewer appliance solutions than an increasingly worse job on an ever expanding roster of solutions.</p> <p>Luckily, I believe TurnKey has more levers to fiddle with than just the number of solutions in the library. Here are our main ideas on how it might be possible to improve the quality of the library while growing, rather than shrinking the number of supported solutions:</p> <ul> <li> <p><strong>More community involvement</strong>: development labour is the key bottleneck, so it&#39;s very important we get more developers from the community on board. For this to happen we not only have to do a better job of encouraging community development but also make it as easy as possible for developers to get involved. Which brings me to the next points...</p> </li> <li> <p><strong>TKLDev as a cloud service</strong>: improve the build infrastructure further so that it is even easier for community developers to build and test up-to-date versions of new appliances. TKLDev is great, but I think we can do better. For example, one idea we&#39;ve been toying with is turning TKLDev into a cloud service and tying it together with community repos on GitHub.</p> </li> <li> <p><strong>Built-in regression testing</strong>: build automated regression testing into the TurnKey build infrastructure. One of the &quot;secret&quot; reasons we&#39;ve been working on <a class="reference external" href="">deploying TurnKey on top of LXC</a> is that it will make it easier for us to implement this.</p> <p>Imagine if instead of manually testing appliances you just run:</p> <pre> make test </pre> </li> </ul> <p>TKLDev could leverage LXC to run an instance of the built appliance, check that all the ports are open, access the web applications and make sure they are working (e.g., return 200, non-zero pages, no &quot;error&quot; or &quot;exception&quot; in the HTML, etc.) and use an automatic tool to screenshots a human could scan for errors in quick batches.</p> <p>The design is pretty straightforward. Just extend how <a class="reference external" href="">fab</a> works with the other elements in the product design (e.g., conf, overlay, removelists).</p> <p>In each product tests.d would contain a bunch of test scripts that would be run against appliance inside a container. For code re-use purposes these scripts would get executed with common/tests/bin in their PATH.</p> <p>Similar to other elements instead of implementing a test in tests.d we could just point to a test via COMMON_TESTS variable, or to a group of common tests (e.g., COMMON_TESTS := turnkey.d in such as checking that all the ports in WEBMIN_FW_TCP_INCOMING are open.</p> <p>What do you think?</p><img src="" height="1" width="1"/> promotion qa testing tkldev Sun, 12 Jan 2014 23:12:50 +0000 Liraz Siri 5633 at Using iso2usb to boot a TurnKey ISO from USB flash drive <div id="cke_pastebin"> <strong>Q</strong>: Why would you want to?</div> <div> <strong style="line-height: 1.5em;">A</strong><span style="line-height: 1.5em;">: Flash drives are faster and re-usable. You don&#39;t have a CD drive.</span></div> <div> &nbsp;</div> <div> <span style="line-height: 1.5em;">There are several tools available that are designed to &quot;install&quot; an ISO image to a USB flash drive, although I&#39;ve never used any of them.</span></div> <div id="cke_pastebin"> &nbsp;</div> <div id="cke_pastebin"> A few years ago I wrote a somewhat <a href="">ugly script</a> to install an extracted ISO to USB together with syslinux. Recently I tried using it but hit issues related to changes in isolinux.</div> <div id="cke_pastebin"> &nbsp;</div> <div id="cke_pastebin"> I did some research and it turns out that syslinux now supports the creation of &quot;isohybrid&quot; images. These images are special as in addition to the normal CD-based ISO9660 filesystem, they also contain a valid-looking DOS-style partition table. If you simply &quot;raw&quot; copy an isohybrid processed image to a USB flash drive, the BIOS will boot the image directly.</div> <pre> isohybrid image.iso dd if=image.iso of=/dev/sdX</pre> <div id="cke_pastebin"> &nbsp;</div> <h2> iso2usb</h2> <div id="cke_pastebin"> <span style="line-height: 1.5em;">The &#39;dd&#39; command has always scared me. One wrong keystroke and you can overwrite the wrong hard disk.&nbsp;</span><span style="line-height: 1.5em;">To make things a little less scary and safer, I wrote <a href="">iso2usb</a>:</span></div> <pre> Syntax: iso_path usb_device iso2usb: Create a bootable USB flash drive containing ISO image Arguments: iso_path Path to ISO (e.g., product.iso) usb_device USB device path (e.g., /dev/sdc) Options: --force Not implemented, interactive confirmation required </pre> <div> &nbsp;</div> <div id="cke_pastebin"> iso2usb will do its best to verify that the usb_device is actually a USB device, and prompt for confirmation with device information before doing anything dangerous:</div> <pre> # turnkey-core-13.0-wheezy-amd64.iso /dev/sdc **************************************************************************** iso: turnkey-core-13.0-wheezy-amd64.iso (hybrid: False) usb: disk/by-id/usb-SanDisk_Cruzer_Blade_200601650311ADD19323-0:0 (/dev/sdc) **************************************************************************** Is the above correct? (y/N):</pre> <div> &nbsp;</div> <div id="cke_pastebin"> Additionally, iso2usb<span style="line-height: 1.5em;">&nbsp;will check whether the ISO image has been pre-processed with isohybrid, and if not it will process the image before writing it.&nbsp;</span></div> <div id="cke_pastebin"> &nbsp;</div> <div> Once completed, t<span style="line-height: 1.5em;">he USB flash drive should now boot directly, showing exactly the same bootup screen as if you&#39;d written the image directly to a CD.</span></div> <div id="cke_pastebin"> &nbsp;</div> <h2> The future</h2> <div id="cke_pastebin"> <span style="line-height: 1.5em;">All future TurnKey ISO&#39;s will be </span><a href="" style="line-height: 1.5em;">pre-processed with isohybrid</a><span style="line-height: 1.5em;">, making it that little bit more TurnKey for installing ISO&#39;s to USB flash disks.</span></div> <div id="cke_pastebin"> &nbsp;</div> <div id="cke_pastebin"> &nbsp;</div> <div id="cke_pastebin"> &nbsp;</div><img src="" height="1" width="1"/> tkldev Wed, 08 Jan 2014 03:59:26 +0000 Alon Swartz 5460 at