The Official Release of Lucid 5.25 (Lucid Five Twenty-Five)

[rcrsn51]

Ever since this "feature" appeared, there have been complaints that it has a negative side-effect on some USB devices. However in this situation, the problem may be with the extra searching that is going on.

[rjbrewer]

Ever since this "feature" appeared, there have been complaints that it has a negative side-effect on some USB devices. However in this situation, the problem may be with the extra searching that is going on.

Any version of Wary after 098 is unusable for me, probably because
of this woof modification.
It causes extended modules loading count and a cursor freeze
when using usb mouse.

[rcrsn51]

Regarding the unrelated issue of BootFlash failing because of syslinux: the attached PET appears to solve that problem.

[bigpup]

Regarding the unrelated issue of BootFlash failing because of syslinux: the attached PET appears to solve that problem.

Confirm, this fixed Bootflash for me.
Thanks for the fix!

[RandSec]

Testing as I'm posting.....put a Earth, Wind and Fire cd in the optical drive, the disc showed up as sr0. Clicked the icon and pCD started playing, no problem.

OK, that is how it is supposed to work!

My 3 systems have very similar hardware, and a very similar applications install (before some individual configs). They are all 5.2.5 Live Mulitsession DVD's, and 2 of them have no hard drive. From main DVD PPM we see:
* Xorg_High
* Firefox 3.6.13 (upgraded to 3.6.16)
* Skype 2.1.0
* fontwizard

Perhaps the problem is in something I installed which others did not. So, starting from scratch:
1) The raw ISO plays the music CD.
2) After being personalized for US/Central timezone, still plays.
3) With Xorg_High installed, still plays.
4) With Firefox 3.6.13 (-> 3.6.16) installed, still plays.
5) With Skype 2.1.0, still plays.
6) With fontwizard, still plays.

However, somewhere around (5) I lost the CD icon from the desktop. The icon remained as the drawer was opened, then disappeared when the drawer was closed. I did not know how to recover the icon, so after that I started pCD from the Multimedia > Media Tools selection.

So far no joy, so back to the main system, insert audio CD, click icon, no sound. But as I sat pondering my next move, the music suddenly started up. The delay was about 30 seconds, a suspicious value, and more than long enough to start an experienced user like me clicking on various things to get something to happen, a particularly bad approach here.

On the other configured system, insert audio CD, click on icon, wait, wait, wait, then sound. OK, let us try another selection, so double-click on it. Uh-oh, it shows the next one down, so select the correct one again and double-click. Wait, wait, wait, wait, wait, wait, for something like 60 seconds. It appears to have to finish the first (wrong) command, after delay, before starting the next, after delay.

(There is something wrong about the way the song is selected in the pCD player, since even with the right track highlighted, the one BELOW that is played. So highlight a different track, then hit the Play button: The playing song line briefly flashes the correct selection, then CHANGES to the selection below that, which is wrong. Now we wait about 60 seconds before finally getting the wrong track playing.)

So, I do not see the issue from the raw ISO, even with my apps installed. The good system is, of course, in a different box, but all have the same sort of motherboard, processor, memory, etc. The systems having trouble do happen to both have Samsung writers (one system has a hard drive, one does not), while the working system (from clean ISO) has an LG writer.

OK, so take the main configured DVD, which had problems on the main system with Samsung writer, to the system with the LG writer. Now the player plays. Success (provided one has LG writers)!

So it looks like the Samsung writers (SH-S222A) are a Puppy issue. Downloading, installing and using VLC on the main system (having Samsung writer) plays the CD immediately, with no delay or problem. So that is my fix.

[ASRI éducation]

the attached PET appears to solve that problem.

Thanks rcrsn51, the fix works for me.

[ICPUG]

RandSec

Are your CD problems partly due to the Sound being muted on startup? I noticed on my frugal install that sometimes I would boot up and the icon in the tray at the bottom right of the screen shows the sound muted.

After a while it mysteriously corrects itself and has volume (75% I think).

[RandSec]

RandSec

Are your CD problems partly due to the Sound being muted on startup? I noticed on my frugal install that sometimes I would boot up and the icon in the tray at the bottom right of the screen shows the sound muted.

After a while it mysteriously corrects itself and has volume (75% I think).

My issues are not volume problems, because the player does not interact like it does when working. And videos work. The delays feel deliberate.

[playdayz]

scsijon,

I seem to have a problem Embarassed , i'm missing the hal deamon at /usr/sbin/hald, am I alone?

Not alone. hald is not in Lucid 5.2.5. Ubuntu is phasing it out--or has phased it out and that is one less item of overhead. libhal *is* present because at least one thing needs it. The hal in PPM contains the full package, including hald, but I think you need to search in PPM because there is already the limited hal package installed so PPM won't show it unless you search.

[Jim1911]

Hi playdayz,

I've been away for about a month and so much has happened. Your Lucid 5.25 is the finest yet, it's working flawlessly on my hardware, both frugal and full hd installations. Kudos to you and your team.

Sorry that you are planning on taking a rest break, however it's well deserved, so enjoy the break. It's hard to believe how many releases you have made in such a short time. I've enjoyed the privilege of working with you and hope to do so again.

Best wishes,
Jim

[James C]

Just manually upgraded the frugal install on my Windows 7/PCLOS box from 520 to 525. No real problems.Had to rerun Alsawizard since this box has 2 sound cards but sound was working immediately.
Nvidia driver and all previously installed apps still working.Easy upgrade.

[maxpro4u]

Clean frugal install on A31 thinkpad. Sound working and volume buttons working well. The wireless card(D-Link G650) working. Fn buttons working. Battery icon working. Installed firefox 4-(BBC world news) flashplayer working smooth.

[bigpup]

Good review of Lucid Puppy 5.25 in Distrowatch Weekly:
http://distrowatch.com/weekly.php?issue=20110418

It does bring up some problems for someone new to Puppy.

[sszindian]

bigpup posted:

Thanks for posting this! Every Puppy Developer Should Read It.

Kind of relates to a few things testers were after in initial development and didn't get huh?

Maybe now a tester will be taken a bit more serious when things are asked for!

The review sure knocks Puppy out of the box for new users I think.

>>>---Indian------>

[rerwin]

Every Puppy Developer Should Read It.

I have, and am very concerned about the reviewer's wireless modem experience.

After admiring the aesthetics, my next mission was to get online, and actually this proved to be more traumatic than I expected. Outside of exploiting the occasional free WiFi spot, my connection to the Internet is almost exclusively via a 3G USB broadband modem. I clicked through the menus and found "Setup --> Internet Connection Wizard" and chose "Internet by dialup analog or wireless modem." While attempting to click my way through the configuration, Puppy suddenly froze on me. The screen was locked, the cursor wouldn't move, and even CTRL-ALT-Backspace wouldn't get me out of this mess. I finally had to do a brute-force reboot by pulling the power cord and removing the laptop's battery.

If anyone reading this thread has a similar experience, please tell me about it. I would hope that the latest "modem-modprobe" update package would prevent the problem. If not, I need all the info I can get regarding that lockup. There is always the possibility that the newer kernel is a factor, but probably not.

I hope some of you can help me out with this. TIA.
Richard

[RandSec]

Good review of Lucid Puppy 5.25 in Distrowatch Weekly:
http://distrowatch.com/weekly.php?issue=20110418

Yes, a good review, and a refreshing change from the general anti-security tone around here. The root user discussion and thoughts about malware were particularly interesting. I especially liked: "Puppy comes with a firewall, and you should of course be using it," and "Though most Flash exploits target Windows users, there's no reason why Linux can't be targeted as well," which is true. Of course, that is hardly the "minute detail and very specific terms" that some here demand. And I also have been told that security criticism is only understandable after the critic has introduced a Puppy with the desired changes already implemented. Critics who do not do that simply have no "influence," apparently. Next we will be unable to criticize a bad steak because we did not raise the cow.

I do not agree with the criticism of the Puppy root user design. Once malware gets into even a restricted user account, it can do anything that user could do, including changing privilege levels. Remember: malware can put an attacker inside your machine in real time via broadband. And when malware owns even a restricted user, everything that user has is already compromised, so limiting the attack at that point is like closing the barn door after the horse is gone. But if potential users THINK that Puppy has a problem, then Puppy DOES have a problem. So we probably ought to have some reasonable answer in the code.

Some other security issues include:
1) The firewall should be on, by default, upon first start, before any network transaction occurs. After that, a whiny user can turn it off.
2) There needs to be a config option to stop Puppy from automatically logging in before the user is ready. In particular, if the user boots from flash, that flash should be removed before the system goes online.
3) When Puppy boots from USB (typically flash but possibly an external hard drive), it needs to allow that USB to be removed after the boot, unmounting it first, of course, as is normal for drives. Removing the boot drive before going online is how we guarantee that new incoming malware does not attack the boot code, and that stops infection.
4) If a boot drive is removed after boot, there will be a need to handle updates. I suggest the boot drive NOT be updated continuously like external RAM (as is now done with flash), but only upon a manual Save command, similar to the LiveDVD. Multiple versions of the same file could exist in different directories, with only the latest loaded on boot. Eventually a flash would fill, and the loaded Puppy could be Saved to a new flash, much like the LiveDVD scheme now.
5) It will inevitably be necessary, sooner or later, to install downloaded code via SSL so we can guarantee that it comes from the approved repository. I suggest making the internal Quickpet a web page, and using a serious modern browser like Firefox for all downloaded code installs. The web page could be updated at will, and so also solve the Quickpet local update problem for LiveDVD users. By moving more of the current package to downloadable code, the .ISO gets smaller and stuff that does not work for some user need not get in their way. (No fewer than 3 included CD players apparently do not handle my Samsung optical drives. So I downloaded VLC, but the other players remain.)
6) When Puppy boots as a LiveDVD, one of the steps is: "Searching for Puppy files in computer disk drives..." Malware will love the ability to drop an infected file into a system and have that come up, perhaps even hidden from the user. There needs to be a way to configure Puppy to NOT do that search.
7) Some work is needed to finalize the great multisession-DVD feature which sets Puppy apart from all other distributions. Writing to optical media simply is not as reliable as writing to a hard drive. Verification after write should be required and automatic, and should it fail, other attempts are required, including requesting a new DVD, to the point of fully recovering however necessary.
8) Voiding the last <n> sessions is another great Puppy feature with issues: I have personally voided the last session on 2 LiveDVD's which then failed to boot. Surely a temporary form of voiding could be made available to load the previous system before making any dangerous changes on the DVD itself. There also needs to be some way to copy multisession DVD sessions from a "bad" DVD and save them. I would like to see the voiding feature also apply to a flash boot drive, just like a LiveDVD.
9) Puppy needs a config option to NOT ask to save at the end of a session, particularly for LiveDVD use. In my experience, the desktop Save button almost always works, whereas the end-of-session save often damages the DVD, and then it is too late to do anything about it.

This is from a year and a half of experience with the LiveDVD form. Surely other issues have revealed themselves to others.

[James C]

Now for a complete change of subject......

Dug an old test box out of the closet and upgraded a full install from 235 (that was a while back) to 525.Actually doesn't appear to be any problems....upgrade went really well.

[Luluc]

Of course, that is hardly the "minute detail and very specific terms" that some here demand.

"Some"? Who else besides me?

Once malware gets into even a restricted user account, it can do anything that user could do, including changing privilege levels. Remember: malware can put an attacker inside your machine in real time via broadband.

What have you been smoking? I want some of that too!

PROVE what you're saying. If you can't do it yourself, fine, just point us to any page that describes the necessary steps to achieve this kind of magic of which you speak so often. Is that asking too much? Just prove it, dammit!

[wuwei]

Luluc wrote:

PROVE what you're saying. If you can't do it yourself, fine, just point us to any page that describes the necessary steps to achieve this kind of magic of which you speak so often. Is that asking too much? Just prove it, dammit!

+1

Yes, pleeeeaaaase. One concrete example. ONE only!

[RandSec]

Once malware gets into even a restricted user account, it can do anything that user could do, including changing privilege levels. Remember: malware can put an attacker inside your machine in real time via broadband.

What have you been smoking? I want some of that too!

PROVE what you're saying. If you can't do it yourself, fine, just point us to any page that describes the necessary steps to achieve this kind of magic of which you speak so often. Is that asking too much? Just prove it, dammit!

Prove? What is there to prove? If you have never heard the term "bot" with respect to malware, you have some homework to do.

As I have tried to share repeatedly, security is not about particular responses to particular exposed threats. That is the Microsoft way, and despite having vast fortunes to spend and enormous resources applied to monthly patches, Windows malware continues to increase, both in quantity and virulence. Windows malware results thus stand as PROOF that the correct approach to security is NOT to await attacks and then patch them. PROVING that an attack exists thus has been shown to NOT be the path to security.

Puppy simply will not have resources for effective detection, analysis and patching, so if that is to be the security strategy, even the first sustained attacks will mark the end of the online Puppy platform for many people. That is of course my opinion, not PROOF, but it does reflect how I would act.

Security is the state of being safe. Achieving security means being pro-active to stop attack possibilities before they occur. Most people do have doors, and locks, and they use them to provide some level of physical security against known threats. Online, we have a continually growing and changing threat landscape which prevents us from knowing the threats or being confident in even basic safety.

For online systems, typically we seek to have a "layered defense," where a failure in one layer is backed up by different strength in another. The very first step to achieving security in an existing system is to find basic uncovered holes, and close them up. Standing back and saying: "Nobody could do anything with that," has been shown to be wrong, time and time again. The people who attack are smarter than us, and trickier, and can leverage openings in completely unexpected ways. Just because we cannot see the way to their success does not mean they will not hurt us.

The correct approach is to find some basic security truths and leverage those into SECURITY PROOFS FOR US. The first truth is that malware CAN get in and run, even in Linux (although it may be running in Flash or Java). The next truth is that, to "infect" future sessions, malware needs to change some code (or data leading to code) which will be executed by the future session. That PROVABLY can be prevented by not allowing code change, which is the usual province of LiveDVD operation. Notice that a writable drive cannot be protected in this way, because running malware cannot PROVABLY be prevented from changing stored code on the boot drive.

In practice, browsers frequently need security updates, so practical secure LiveDVD use requires some way for users to change code yet not allow malware to change code. We can approach that (not quite to absolute PROOF, but close) by infrequently and manually allowing code changes immediately after boot until browser changes are done, saving the result, then using physical action to prevent further saves.

Being strong against unknown future attacks is particularly important in systems like Puppy, which have no tool to find and expose infection. Because infection is dismissed out of hand, there is no trained cadre to detect it, analyze it, and work out a patch. Because infection is not found, the very concept is thought to not exist.

Because infection seems unbelievable, Puppies can be infected without the owner or user knowing. That is not a surprise and needs no PROOF beyond knowing what bots do. Those who have been paying attention KNOW that bots hide.

Now it is necessary for those who believe that Puppy cannot be infected in any way whatsoever to PROVE their case, and then to address the consequences of that being wrong.