The Daily Build

Moving Through i3 Workspaces

2012-05-10T18:14:47Z

The default i3 config file only has commands to move to a specific numbered workspace (e.g. mod-1, mod-2). For better or worse, I’m in the habit of “traveling” through the workspace list using Ctrl-Alt-Up and Ctrl-Alt-Down (or Left and Right, if you prefer a horizontal feel for your workspaces). This is trivial to do in your ~/.i3/config:
# Use mod-Control-Up and Down to rotate through the workspace list. bindsym $mod+Control+Up workspace prev bindsym $mod+Control+Down workspace next

# Use mod-Shift-Control-Up and Down to move the selected window to an # adjacent workspace. (This does *not* change your view to that workspace, # it just "zaps" the window there.) bindsym $mod+Shift+Control+Up move workspace prev bindsym $mod+Shift+Control+Down move workspace next

Getting dnsmasq, virtual machines (libvirt), and vpn to inter-operate

2012-05-14T15:22:17Z

Fixing Dnsmasq to Work With Libvirt

There’s a bug written in the Ubuntu tracker (and in Fedora too, I think) about running dnsmasq and libvirt at the same time. Basically, libvirt runs an instance of dnsmasq, and if you install the system dnsmasq it tries to bind to all interfaces by default. The “easy” workaround is to use the interface and bind-interfaces configuration options in dnsmasq.conf. On my machine, I’ve got:
interface=eth0 interface=br0 bind-interfaces

This makes it so that the system dnsmasq only listens on eth0 and br0, and does not bind to the wildcard address. Now you can run two instances of dnsmasq: the system instance, and libvirt’s instance.

Getting The System Dnsmasq to Answer for the VMs

I wish I knew the answer for this: I’d like for my system dnsmasq to respond to queries for “fedora16″ and “winxp” (hostnames of two VMs I use). I tried a couple of things that didn’t work, and settled for a subpar solution.

First, I thought I might be able to use a fake domain “.vm” and tell the system dnsmasq to forward queries for that domain to libvirt’s dnsmasq. This may be a workable solution; it didn’t work when I tried it, but I was fighting other issues with libvirt at the time and I haven’t had a chance to go back and try it again. The problem I ran into is that libvirt’s dnsmasq was receiving queries for “fedora16.vm” but it didn’t have “.vm” configured as a local domain. You can’t monkey directly with libvirt’s dnsmasq config (at least not that I saw), or this would be an easy fix. I tried changing the names assigned in the libvirt XML file dealing with DHCP names and addresses, but didn’t get anywhere. Again, more experimentation here might win the day. (Definitely let me know if you know how to solve this.)

I also flailed around with some other config options trying to get those names forwarded to libvirt’s dnamasq but couldn’t come up with anything clean.

What I finally settled on is adding the names of the VMs to my local host file:
# Virtual Machines; this should match up with the DHCP assignments in # /etc/libvirt/qemu/networks/default.xml 192.168.122.22 fedora16.home.bstpierre.org fedora16 192.168.122.23 winxp1.home.bstpierre.org winxp1 # etc...

This file is referenced by dnsmasq.conf via addn-hosts=/etc/dnsmasq.hosts. It’s not perfect, since I have to remember to enter the addresses in two places (default.xml and dnsmasq.hosts) when I create a new VM, but I don’t do that often so it won’t be a huge burden.

Getting Names from the VPN

When I connect to $DAYJOB VPN, I need to be able resolve names for that domain from the corporate (internal) DNS servers. Dnsmasq has a config option that allows you to tie a certain domain to a certain set of DNS servers:
server=/example.com/172.18.1.1 server=/example.com/172.18.12.1 address=/vpnserver.example.com/169.254.123.210

The first two lines set the DNS servers when I’m on the VPN. The last line makes it so that I have the public address for the VPN server when I’m not yet connected — since the domain matches, dnsmasq will try to forward the request to the internal DNS servers, which is guaranteed not to work. This is slightly clumsy since the address is hardcoded, but it doesn’t change in practice and I can always query it directly from upstream DNS (e.g. dig vpnserver.example.com @192.168.1.1 to get it from my router).

Finally, I don’t want to be making requests to those 172.18 addresses when I’m not on the VPN, so I set up this interface definition in /etc/network/interfaces:
iface tun0 inet manual pre-up ip route delete 172.18.0.0/16 || true pre-up service openvpn start || true post-down service openvpn stop post-down ip route add blackhole 172.18.0.0/16 || true

After the VPN is taken down, this will add a blackhole route for 172.18.0.0/16, which is where those DNS servers live. Just before the VPN is started, it removes the blackhole route so that I can get to those servers once the VPN is ready.

Controlling Audio with i3

2012-05-10T14:00:45Z

As I mentioned in the last post, I’ve switched to the i3 window manager. After fixing the Caps Lock key, the next order of business is getting the audio keys on my multimedia keyboard to control audio output. (It’s nice to be able to quickly mute or pause when the phone rings, for example.)

This turns out to be pretty easy. I used xev to figure out the keysyms for the audio keys, and then added bindings to ~/.i3/config:
bindsym XF86AudioRaiseVolume exec pactl set-sink-volume 0 +5% bindsym XF86AudioLowerVolume exec pactl set-sink-volume 0 -- -5% bindsym XF86AudioMute exec ~/bin/toggle-mute bindsym XF86AudioPlay exec clementine --play-pause bindsym XF86AudioStop exec clementine --stop bindsym XF86AudioPrev exec clementine --previous bindsym XF86AudioNext exec clementine --next

As you can see, I prefer clementine as an audio player. If you have something different that you like, look up the command line method for controlling the player.

The pactl command controls pulse audio. The toggle script is something I threw together because pactl doesn’t support toggling the mute, you have to tell it mute or unmute:
#!/bin/bash

toggle=$((pactl list sinks | grep -q Mute:.no && echo 1) || echo 0) pactl set-sink-mute 0 $toggle

I only have one sink, so if you have more than one, you’ll need to adjust the script.

Making Caps Lock an Additional Control in XWindows

2012-05-10T13:52:31Z

Background: I just built a new computer, and “upgraded” to Ubuntu 12.04. I’ve been a fan of Ubuntu for a long time (first Debian, then Ubuntu because of the faster / more predictable release cycle). But you can add me to the list of people unimpressed with the “Unity” desktop environment, and not terribly impressed by Gnome 3. Since I’m in the middle of an upgrade and learning about new features anyway, I figured I’d make the leap to a better window manager. I’ve settled on i3, which gives me a lot of power over how things are arranged. Of course it also means that I’ve got to configure a bunch of stuff the way I want it, more so than with the default Gnome/Unity/Metacity scheme. This potentially means some short-ish posts here about tweaks & tips for working with i3.

The first item of business is getting rid of Caps Lock. The example config in xmodmap(1) will swap your caps lock and control, which is definitely not what I want. The key to the left of the “A” (which happens to be labeled Caps Lock) should be treated the same as the left Control key. So I created ~/.xmodmap with the following contents:
! ! Make Caps_Lock an additional Control key ! (This is *DIFFERENT* than *swapping* Caps_Lock and Control, as described ! in the xmodmap(1) man page.) ! keycode 66 = Control_L Control_L Control_L Control_L Control_L Control_L Control_L Control_L clear lock add Control = Control_L

Then, in your ~/.i3/config add:
exec_always xmodmap ~/.xmodmap

(Note that if you use the xmodmap commands provided in the xmodmap man page, then restarting i3 will toggle that key between Caps_Lock and Control, which is probably not what you want! It seems that you also lose the swap if you do things like run xev.)

GTK3 Example Code

2012-05-06T03:34:46Z

Over the past year or so I’ve been doing a fair bit of GUI programming — both in ${DAYJOB}s and otherwise. Until just recently most of my GUI experience has been with wxWidgets (and most of that via wxPython). Lately I’ve wandered to GTK.

The documentation for both toolkits is pretty good. I’ve found GTK’s API reference documentation to be very thorough and mostly well detailed. The tutorials are especially good for an experienced programmer who knows his way around a GUI and just needs to learn how the toolkit works.

What I find lacking are a comprehensive set of tightly focused example programs. Take the clipboard example from gtkmm, for instance. It’s supposed to be showing how to access the clipboard, but it’s all cluttered up with irrelevant buttons and signals and stuff. Sure, it’s not that hard to read through the code to pick out the relevant pieces, but why not produce a simple example app that’s all relevant (or nearly all — you can’t avoid some of the boilerplate)?

And some topics are not covered at all — like accelerator groups, where the API documentation says “you won’t usually need these”. But sometimes you do, and then it’s hard to find an example of correct usage. (Yes, I figured it out, and it didn’t take too long using the API reference, but a 25-line example program would have saved me some time.)

Don’t misunderstand the point of this post: I’m not complaining about the state of the documentation, which is better than the docs for 98.3% of FOSS projects. Instead I’m proposing a collection of ultra-focused example programs for the breadth of the API. This will be a complement to the tutorials and reference docs.

It will ideally be against multiple language bindings (though I’ve found that an example in the C API is informative on how things should work in the Python or C++ binding, and vice versa). I’ve already got a few examples (C only so far) in the GitHub repository, and if life doesn’t get in the way, I’ll be adding more on a regular basis. In my dreams, I’ll post some of the examples here with more explanation, but we’ll see how that goes…

If you’d like to contribute a tightly focused example on some GTK feature, send a pull request on GitHub. If you’d like to request an example, open an issue ticket there.

User Interface Hall of Fame

2012-05-06T02:38:05Z

A long, long time ago, I talked about a poor user interface. This is the follow-up “good user interface” post that I promised.

I’d like to talk about Anki, which is a flashcard program. The user interface is well done for several reasons:

It is uncluttered: in the main screen you are presented with the flash card decks that you have downloaded. You can open a deck (i.e. to study the deck) by clicking the button right next to the deck. The number of cards that you have “due” to study today is shown right there.
When you’ve opened a deck, you are presented with the “Study Options” screen. At this point, the main thing you want to do is review your cards. Again, this is a big “review” button, and it is selected/highlighted by default so you can just press enter/spacebar to move into review mode.
- (I will note that the Study Options screen might be overcomplicated. There are a number of options here, and some information presented that does not seem essential. I’d say it’s a minor fault that does not detract overall from the simplicity of this application.)
When reviewing, you are presented with one “face” of a flashcard and a “Show Answer” button. Again the button is selected/highlighted by default so you can just press spacebar to see the answer.
Once the answer is revealed, you click a button to say if you got the answer correct, and how easy it was for you to know the answer. So, for example, you’re studying a French->English deck, and the face of the card is “non”. Well, that’s an easy one, it’s “no”. So when asked, you press the Very Easy button. Or, in a nice interface touch, you press “4″, since the buttons are mapped to the first four number keys: “Again” (meaning incorrect) is 1, “Good” is 2, “Easy” is 3, and “Very Easy” is 4.
- Because of the layout of the buttons, the UI can be driven very quickly and easily from the keyboard: see a card, say the answer, press space to show the answer with the thumb, press 1-4 with one of the fingers, and then the next card is shown.
Unobtrusive status information is shown in the bottom left statusbar. It shows the number of failed cards that you need to review, the number of cards awaiting review, and the number of new cards today. It also shows the amount of time that it expects you have remaining to study, based on your average time to answer each card and the number of cards remaining. And then there are small graphs that indicate by color and size whether you’ve done well (green, >80% correct) or poorly (red, <50% correct).

Anki also has a facility for editing cards, but I’m not going to review that. The primary study feature is really the key piece of the application, and it deserves a spot in the UI Hall of Fame.

User Interface Hall of Shame

2012-02-21T17:09:50Z

I’m taking MIT’s 6.831: User Interface Design and Implementation through their free OpenCourseWare website. One of the homework assignments is to find two examples each for the “UI Hall of Shame” and the “UI Hall of Fame”. This post is for shame — and since the nominee has so many things to discuss I’m only doing one; I’ll follow up with fame in another post.

My nominee for the UI Hall of Shame is gmusicbrowser, which has a number of UI problems. I used this app for a while last year because it has a couple of neat features that I liked, but I got frustrated by it (and it doesn’t tie into my multimedia keyboard play/stop/forward keys), so I moved on to something else.

A minor point, but the “About” dialog is not on the Help menu, it’s on “Main” (which is nonstandard; it’s where you’d normally find a “File” menu).
There isn’t a “Help” menu.
The two (three? four?) icons below the menu are confusing at best. None of the following behaviors are what you’d expect, and not everything is consistent.
- To the right of the icons is a pair of numbers, like “4972/6158″. This represents the sequence number of the playing song and the number of total songs in the currently displayed playlist. Nothing wrong with this — but we’ll come back to this in a minute.
- The first icon can be clicked to toggle between in-order and weighted-random modes. By right-clicking you can get a context menu to adjust the in-order mode (e.g. Artist/Album or Path/Track#). The selection for weighted-random mode is on a submenu of that same context menu.
- When you select a mode, that menu item gets a little indicator dot. It might be my desktop color scheme, but white-on-gray is hard to see with a dot that small. Firefox, for example, uses a checkmark which is easier to see even though it’s still the same low contrast.
- Choosing a weighted-random mode changes the icon to dice.
- You can choose “Shuffle” from the menu, in which case the icon changes to playing cards.
- Clicking (left-click) on the dice or cards icon changes it back to the arrow icon and sets the mode to an in-order mode.
- Clicking on the arrow icon changes it to whichever random/shuffle mode was previously in use.
- The second icon starts as a book. I’m not sure what this is supposed to mean. When you hover over it, it says “Playlist Filter: All”. Again you can right click for a context menu of filters to apply to the playlist, in which case the icon changes to a funnel. (And if a song is playing, it will abruptly change to whatever is first in the selected filter.)
- Clicking (left-click) on the book icon doesn’t seem to do anything.
- Clicking on the funnel changes it back to a book (and the “All” filter?).
- Not that it would make much sense, but for consistency I’d expect a left click on this icon to toggle between “All” and the last selected filter.
- Next to the book/funnel icon is a blank space… that becomes an arrow/triangle (“play button”) icon when you hover, with the tooltip “Queue empty”. And when you move your mouse off the icon, it disappears.
- If you enqueue a song, that queue icon appears. And the pair of numbers mentioned above is replaced by the text “1 song in queue”. But the playlist doesn’t change! If it’s still got 50 songs, you’re still listening to, say, 12/50.
- Clicking on the queue icon… empties the queue! Which is very much not what you’d expect. Of course, since the queue is empty, the icon disappears and we get back our “NNN/XXX” text mentioned in the first bullet above.
- Now let’s say you’ve got 5000 songs in your collection, but you’re listening to a playlist that has 10 songs. You see, say, 2/10 in the indicator, and you’ve got the funnel icon (not the book). Just for fun, you enqueue a song using the main browser window. After the current song is playing, your queued song will play — and the funnel icon will switch to the book icon: your selected filter has been cancelled.
- There are more unpredictable behaviors buried in these icons, but what all of this boils down to is that there are too many modes, they are not orthogonal, it’s too easy to accidentally change from one mode to another, it’s not easy to know what mode you’re about to switch into, and it’s really easy to lose work — by accidentally clearing a bunch of queued songs.
Just below those icons are a mostly standard set of back/stop/play/forward icons… and a volume control that is really hard to use. Clicking the volume icon pops up a slider that disappears as soon as you release the mouse button. If you hold down the mouse button, the slider stays displayed, but you can’t move the slider thumb. Double clicking the icon (which I discovered accidentally) makes the slider stay, and then you can move the thumb — as long as you don’t accidentally move the pointer outside the slider, in which case it disappears again. Right clicking toggles mute, which isn’t intuitive, but if you really want to tie a behavior to right clicking on that icon, I suppose is reasonable. For mute, however, it’s totally unusable: that icon is too small of a target, and when I want to mute, I’m usually trying to do it somewhat quickly — so I can answer a ringing phone, for example. The mute button on my “multimedia” keyboard is a much easier target to hit quickly.
The main browser window is a mystery to me. Starting at the top, there are two tabs: Library and Context. The only thing in the Context tab is a checkbox for “Follow Playing Song”; I’m not really sure what this does. Assuming it does something meaningful, it would make much more sense to put this on a menu somewhere.
The Library tab is where you can browse your music library. There are three listboxes at the top of the window, each with the same set of tabs. Those tabs change the listbox contents so you can choose various filters. Selecting a filter in the leftmost box (e.g. clicking on an album name after you’ve clicked the Album tab in that box) filters the contents of the left two listboxes. In this way you can drill down by choosing up to three filters. E.g. “Rock” in the left list from the Genre tab, then 1988 in the middle list from the Date tab, then Money for Nothing in the right list from the Album tab. This is kind of a clumsy approach to filtering, but in practice you don’t need more than three filter selections to narrow even a large library significantly. The filters are a clumsy but reasonable approach. The difficulties start with the bells and whistles. You can right click on any of the three listboxes for a context menu.
- There’s no other way to access the features in the context menu except by right clicking on the list. But right clicking on the list selects the list item where you clicked — a minor annoyance.
- One of the menu options is “Show Buttons”, which makes a toolbar appear below the listbox. Seriously? Why not just show the toolbar all the time?
- A minor point: one of the buttons is a broom icon for “Clear Selection”. When you click this, the selected item in the listbox above is deactivated. But the item is still selected. The selection should instead be removed.
- The buttons that are displayed depend on which tab is selected. This is nonstandard: normally you disable a button instead of hiding it if the functionality is unavailable for the current mode.
- There’s an “Intersection Mode” toggle button. I haven’t been able to figure out what this does; nothing meaningful as far as I can tell.
- There’s an “Options” button that displays a menu of display options.
- There are a confusing array of display options, all of which depend on the currently selected filter tab. When looking at the Date tab, for example, you can choose between a standard list or “cloud” mode. (I’ll admit that having cloud mode available is kind of nice — I can see 30+ years all at once instead of having to scroll.) If I switch to the Album tab, there are many more choices: six different sort modes; optionally displaying year, song count and running length of each album; five choices for showing album pictures and size to show; and the choice of cloud or “mosaic” mode. Mosaic mode is like “Icon View” in Nautilus — albums are listed left-to-right with art shown where present and text where no image is available.
- I won’t get into all of the behavior here, but the bottom line is: too many modes, which are not orthogonal, and your options disappear depending on mode — without having a clear path to getting back to the option you were using.
Just below the listboxes (and optionally the listbox-specific toolbars) is another toolbar with a filtering control, a few buttons, and some menus. The menus don’t belong here: they belong in the app’s main menu bar.
The “Saved List” feature is completely unusable. There’s a menu option “Save current list as” that can only be found on the Saved tab in the filter listboxes — but you have to be careful to click on the “Saved Lists” item in that list, because it’s the only place you can right click that won’t alter the filter contents displayed in the main window. I don’t know if the feature is buggy or what, but clicking on a saved list doesn’t consistently display the contents of that list.
Overall, I’d put it down to a bad case of featuritis. I don’t think there’s a widget that hasn’t been used in the UI, things are in nonstandard places, features are hidden in context menus, and there are way too many unexpected behaviors.

If I were going to implement a similar music player with advanced, highly flexible filtering; playlist construction; an ad-hoc queue; and flexible playback sequencing (e.g. in-order with various sorts, or weighted random according to various criteria) I would:

Make three explicit playback modes: queue, filter, or playlist. You can edit any object regardless of which is playing, but, for example, changes made to the queue don’t affect playback in playlist mode. This makes it easier for the user to figure out what he’s currently working with — and would actually enable new features like “save current queue to playlist”.
Similarly make three explicit editor/browser modes. You’re editing a specific (i.e. named) filter or playlist, or you’re modifying the queue.
The player and the browser/editor would be distinct. Changes in the browser don’t implicitly change what’s happening in the player (except for the queue — which you expect to make fluid changes to the player). If you’re editing the actively playing playlist, you have to explicitly save your changes to the playlist for them to take effect. There are no editing controls in the player (e.g. moving songs up and down in the list).
Retain some of the context menus where they apply to the selected object (e.g. “Song Properties” when you click on a song in a list), but I would move many options into the main menu.
Use a more familiar UI for building filters. Something like what you see in the “Rules” window for email clients, for example — AND/OR selections along with different filter rules. This would let the user build filters just as complex as gmusicbrowser allows but easier to navigate (in fact, gmusicbrowser has a window with this sort of interface).
Retain (and expand) the status information: song index, total song count, total play time, remaining play time, etc. Probably in a status bar, but possibly in the header of the player.
I didn’t mention it above, but I’d retain the awesome bulk modify feature with some tweaks for usability. (Feature is cool, usability in gmusicbrowser is fair to poor.) This feature allows you, for example, to rename a whole batch of files according to a template, e.g. “<ALBUM> – <TRACK#> – <TITLE>.mp3″. It also allows you to make bulk changes to the ID3 tags on a bunch of files all at once.
Integrate with mmkeys.
Minimize to the tray, and possibly have a shrunken player window that just shows a standard set of stop/play/pause/forward/backward icons, title, etc — instead of needing a big library browser and/or playlist window open all the time.

Maintaining “Privacy” Under the New Google Privacy Policy

2012-02-02T19:39:39Z

I put “privacy” in quotes, because under the scheme below you’re still giving up a lot of data, but you can (I think) still maintain “silos” of data so that, for example, your search data isn’t correlated with your YouTube or GMail data.

See What Actually Changed in Google’s Privacy Policy from the EFF for a good description of the substantive changes in Google’s new privacy policy.

Here’s what I’m doing to try to preserve some of my data in silos. This is based on my understanding of the way the new privacy policy works, which could be faulty. Remember that you’re still giving up your data by using these services.

In Firefox, I’ve installed Bing as a search engine, and I use it as the default. I’ve been using this for a couple of weeks now, and it doesn’t suck. As far as I can tell, it’s on par with the results I used to get through Google. This keeps your search data away from Google. I don’t (knowingly) share anything else with Microsoft (my house is all-Linux), so this keeps my search data in a silo.
In Firefox, I’ve installed Ghostery. This blocks all kinds of trackers, including Google Analytics.
I’ve switched from using the GMail web UI to a desktop client. Google still sees all my email, but I don’t have to remain logged in to that account in the browser. (See #4.) This effectively makes the mail account a silo; none of the data is used elsewhere. I occasionally have the fantasy that I’m going to move my domain off Google Apps and go back to self-hosting, but that’s unlikely to happen in the near future.
When I’m browsing, I’m logged into a second Google account that is disconnected from my primary mail account. (See #3.) This means that, for example, videos that I watch on YouTube aren’t correlated to the content of my mail.
In Firefox, I’ve installed Adblock Plus. This cuts down on tons of ads; which might avoid leaking your data to advertisers.
I haven’t done it yet, but I plan to find a desktop RSS reader that doesn’t suck and delete everything from Google Reader.
I’ve stopped checking in at Google News. Instead I pick one of CNN, News360, BBC, or other news outlet.
I’m not sure what it would be, but if I’m browsing stuff that I don’t want tracked, I’ll fire up a Chrome Incognito session and proxy everything through Tor. (The only reason for using Chrome is that I typically don’t want to interrupt a Firefox session to drop into Private Browsing mode there.)

It’sworth noting that I don’t use G+, so I’m not doing anything specific to maintain a silo there.

As noted above, most of this doesn’t vastly enhance your privacy. You’re still handing out a lot of data every time you browse the web; it’s a fact of life. And it is, after all, very convenient to have access to your search history — I often find myself trying to figure out what that thing was that I found during a search a couple of weeks ago but can’t remember the terms I used. But I’m hoping that it cuts down on the amount of data correlation between my various online activities.

Turning Photos to a DVD Slideshow

2012-05-06T02:37:53Z

The task: take a bunch of photos from my digital camera and burn them to a DVD that would play the photos as a slideshow in any DVD player. (Actually, the task was to figure out how to do this in the simplest possible way, and make a set of instructions for an unsophisticated user to follow.)

The result: several hours of fighting with a dozen different applications before I actually had photos displayed on my TV. And this post.

I don’t understand why what seems like a fairly simple task is so complicated.

This is what I found to be the easiest recipe on a stock Ubuntu 11.10 installation. Fair warning: this is quick & dirty, you don’t get special effects, you don’t get music, etc.

Required software (load through the software center, or via apt-get): imagination, devede, brasero.
Open Imagination. Click the import photos icon (it is a terrible choice of icon — there’s no clue that you should want to click on the black square to import photos) and choose your photos.
Export video. Choose DVD for output; to keep it organized, drop the video file in the Videos directory in your home directory. This can take a while if you have a slow computer and/or a lot of photos.
Open DeVeDe. Configure the title. Import the video you just generated.
Generate the DVD ISO image; again save the image to your Videos folder.
Insert a DVD in the drive. Open your Videos folder. Right click on the ISO image and choose Write to Disc.

Some notes, in no particular order:

If you want to tweak the slideshow, imagination will let you play around with transitions, slide duration, etc.
If you want to import video clips, use Openshot instead of Imagination. It’s harder to use (and overkill) compared to Imagination if all you want to do is produce a static photo slideshow. But if you want to do any video editing, it’s a good combination of power and ease of use.
If you want music, Openshot might also be your best bet. I didn’t look at adding music via Imagination or DeVeDe.
Don’t try to use the Brasero application directly. I experienced crashes/lockups while using it, but it worked well when all I did was right click the ISO and choose Write to Disc. (It’s also an ugly, hard to use piece of junk.)

Things I tried and rejected:

K3b: After Brasero failed miserably twice, I tried K3b. Rejected it in favor of not pulling in a bunch of KDE infrastructure that I wasn’t using anyway, and also in favor of the simplicity of just directly burning the file without having to explicitly open a separate app.
dvd-slideshow: This command line app does appeal to my inner geek, but I can’t recommend it for users who want a GUI. (Even the inner geek appeal isn’t enough to make me want to use it when the combination outlined above works well.)
Mistelix: As good as Imagination, and I would have selected it if I had quickly found a way to rotate a photo from within Mistelix. Photos that showed up auto-rotated in other apps showed up sideways in Mistelix and I didn’t see an obvious rotate button. Imagination did the right thing.
Bombono: Junk. Don’t bother with it. I opened it, saw that the tabs were overlapping the menus, couldn’t figure out how to import any photos, and purged it from my system.
Videoporama: Development is dead. It wasn’t immediately obvious that it was going to be easy to use for the simple task of creating a DVD from a set of photos.

The software stack above would be 10x better if Imagination implemented a feature to export a DVD ISO. It would be 100x better if it had a “Burn DVD” button that spit out a shiny disc that I could drop into a DVD player.

(To be fair, the whole video situation is 1000x easier than it was 5 or 6 years ago when I tried to do something similar, realized how much work it was going to be, and walked away in frustration. The tools have come a long way.)

Tightening UFW Firewall Rules to Limit SSH Access

2011-12-08T13:55:21Z

The auth.log on one of my servers (really, on all of the servers I have access to) is full of stuff like this:

Dec  8 03:19:33 localhost sshd[4718]: User root from 10.1.2.3 not allowed [...]
Dec  8 03:19:35 localhost sshd[4721]: Invalid user db2inst1 from 10.1.2.3
Dec  8 03:19:38 localhost sshd[4723]: User root from 10.1.2.3 not allowed [...]

fail2ban is configured to (temporarily) block these after a certain number of attempts, but they keep coming back. One particular IP address was hitting ssh constantly (except for the ban periods) for several days, so I added a rule to drop everything from that address — but this strategy isn’t scalable.

The simple, obvious solution is to only allow access from known hosts. It would be very rare that I need to access this server from anywhere except a small number of addresses. I started with a ufw (Ubuntu’s “uncomplicated firewall”) ruleset like this:

% sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
Anywhere                   DENY        10.1.2.3
Anywhere                   DENY        172.16.99.88
22                         ALLOW       Anywhere

To avoid getting locked out, I added (temporarily) a crontab entry for root:

*/15 * * * * /usr/sbin/ufw allow ssh

This will allow access to ssh from any un-banned IP address (the current policy) every 15 minutes. Then I inserted a rule that allows access to ssh from my home ISPs netblock. (You can figure out the netblock by doing a whois lookup on your external IP address; you may need to add multiple netblocks if your ISP has several allocated. Be careful: it’s no fun to get locked out!) This action is safe because I have not yet removed global ssh access. Note that I’m using “insert 3″ to add this rule at a specific position in the list.

sudo ufw insert 3 allow proto tcp from 10.9.8.0/18 to any port 22

And I added a rule to permit access from another server with a fixed IP I have access to (for the rare case where I need to access this server when I’m not at home):

sudo ufw insert 3 allow proto tcp from 172.17.101.102 to any port 22

Now my ruleset looks like:

Status: active

To                         Action      From
--                         ------      ----
Anywhere                   DENY        10.1.2.3
Anywhere                   DENY        172.16.99.88
22/tcp                     ALLOW       172.17.101.102
22/tcp                     ALLOW       10.9.8.0/18
22                         ALLOW       Anywhere

So far, so good, but ssh access is still permitted from anywhere — because of that last rule. This is the dangerous part… you could get locked out if you haven’t set the rules correctly. (You set up that crontab entry, right?)

sudo ufw delete allow ssh

Wait for the prompt… hooray, I’m still connected! After checking that I can access ssh from home and the other server, I know it’s safe to remove the crontab job. (If the cron job has already fired, you’ll need to rerun the ufw delete allow ssh command.)

At this point I can delete the first two rules that ban specific IPs, since they’re outside my netblock and won’t be allowed anyway.

Now I can enjoy quieter logs without all those access attempts from China and Croatia!