In April 2011 I moved to self-hosted, newer posts are at blog.al4.co.nz.

The good news is that Unity is undoubtedly a step forward in practical user interface terms. The classic Gnome panel is really showing its age, and doesn’t lend itself to wide screen formats due to having panels on both the top and bottom of the screen. SUSE addressed this by created a start menu like launcher, but it was always a bit clunky and barely an improvement over Windows XP.

So how is Unity different? It is perhaps more informative to talk about how it is similar…

The first thing you notice is the panel on the left – this does bear some resemblance to Mac OSX’s dock and various dock applications for Linux such as AWN and Docky. However it is definitely not as customizable. Launching applications is an inferior experience to both OSX and Windows 7 – there’s little in the way of visual feedback that your command has been acknowledged and I have found myself clicking multiple times.

Mimicking Windows – snappy edges

Enabling this in compiz was an annoying complex hack, Unity does it by default – just drag the window to the left or right of the screen and it will fill that half. Drag it to the bar up the top (I hesitate to call it a task bar), and it maximises. It was a good idea in Windows because it’s so intuitive and I’m glad to see it here, even if it isn’t an original idea.

The windows key now behaves more like it does in windows – pressing it brings up the app launcher and it is also used for shortcut keys.

Speaking of shortcuts – the important compiz shortcuts are there – ctrl + shift + arrows to move the active window between desktops. Winkey+W brings up an expose-like overview of all open windows. You can use the arrow keys to select a Window but they need more highlighting as it’s not immediately obvious which one is selected.

For more shortcut keys see http://www.ubuntugeek.com/list-of-ubuntu-unity-keyboard-shortcuts.html.

Mimicking OSX – application menus

Basically menus behave like OSX. I don’t think people will have any trouble figuring this out, if anything it’s simply a more efficient use of screen real estate which I’m all for (my primary computing device is a 13″ laptop @ 1280×1024). They don’t show unless you hover over or press the alt key, but he general consensus seems to be that this style of menu should go away so de-emphasizing them is probably a good move.

Desktop switching – still better than the rest

Previously I’ve always used a 2×1 layout for virtual desktops. Gnome2 desktops traditionally had a 4×1 layout, I just reduced that to 2 because I don’t like hunting for my windows, and switching from desktop 1 to 3 (or 2 to 4) takes two steps. The 2×2 layout however has me sold – I find it much easier to remember where I placed a window, and while it might be just as many key presses to go from 1 to 4 or 2 to 3, mentally it’s more like 1 step.

This is because you can switch from top left to bottom right very quickly – holding down ctrl and pressing down, right is much faster than ctrl + right, right.

The Bad

It’s not all roses.

• There is no intuitive quick way to see what windows are open at a glance. In Windows 7 the taskbar is always visible, in Unity if you have an application maximised it is not. For small screens this is an acceptable trade off, for large it’s just annoying. I haven’t found a way to change this behaviour, but to be fair I didn’t look long. Winkey+W is your friend.
• Stability. I’ve encountered two crashes of the shell already, and I’ve only been using it for a few hours. Yes it’s still beta… but this close to release I’d be surprised if there’s any material difference in the final.

Verdict

I’m quite positive about it. It’s certainly a step forward, and borrows some of the better ideas from Windows, OSX and previous Linux desktops. And while it might be a bit rough, it’s early days and anything would be better than sticking with the existing Gnome2 panels.

The obvious comparison is Gnome3. The two desktops are quite different but they would do well to borrow more of each others’ ideas. I like how moving the mouse to the top left in Gnome gives you the window layout and application launchers, on Unity it only reveals the launcher bar. Gnome3 also seems a bit smoother and snappier on my machine, but sticking with what appears to be the same legacy systray seems a bit 1995.

Give me Gnome3′s smoothness and app launcher, Unity’s notification area and desktop switching and KDE4′s flexibility (while retaining sensible defaults), and we’ll have a winner.

Personally I’ll be sticking with Unity. It’s good to see innovation on this front even if it is a bit painful in the short term.

What happened was that one of the cables had been bumped, disconnecting one of the drives. Thus the array was running in a degraded state for over a month – not good. Anyway I noticed this when logging in one day to fix something else. The device wasn’t visible so I told Dad to check the cable, but unfortunately when he went to secure the cable, he must have somehow disconnected the another one. This caused a second drive to fail so the array immediately stopped.

Despite having no hardware failure, the situation is similar to someone replacing the wrong drive in a raid array. Recovering it was an interesting experience, so here I’ve documented the process.

Gathering information

The information you’ll need should be contained in the superblocks of the raid devices. First you need to find out which drive failed first, with the mdadm –examine command. My example was a raid5 array of 4 devices, sdb1, sdc1, sdd1 and sde1:

root@server:~# mdadm --examine /dev/sdb1
mdadm: metadata format 01.02 unknown, ignored.
/dev/sdb1:
Magic : a92b4efc
Version : 00.90.00
UUID : 87fa9a4d:d26c14f1:01f9e43d:ac30fbff (local to host server)
Creation Time : Mon Oct 11 00:13:02 2010
Raid Level : raid5
Used Dev Size : 625128960 (596.17 GiB 640.13 GB)
Array Size : 1875386880 (1788.51 GiB 1920.40 GB)
Raid Devices : 4
Total Devices : 3
Preferred Minor : 0

0 0 8 17 0 active sync /dev/sdb1
1 1 0 0 1 faulty removed
2 2 8 49 2 active sync /dev/sdd1
3 3 0 0 3 faulty removed

Look at the last part. Here we can see that this drive is in sync with /dev/sdd1 but out of sync with the other two (sdc1 and sde1) – the data indicates that sdc1 and sde1 have failed. These drives are the two in the external enclosure… but I digress.

Performing an examine on sdc1 shows “active sync” for all the other drives, clearly this disk has no idea what’s going on. Also note the update time of February 5 (it is now March!!):

root@server:~# mdadm --examine /dev/sdc1
[...]
Update Time : Sat Feb 5 11:22:29 2011
State : clean
Active Devices : 4
Working Devices : 4
Failed Devices : 0
Spare Devices : 0
Checksum : 7105b39b - correct
Events : 218

0 0 8 17 0 active sync /dev/sdb1
1 1 8 33 1 active sync /dev/sdc1
2 2 8 49 2 active sync /dev/sdd1
3 3 8 65 3 active sync /dev/sde1

This indicates that it was the first drive to be disconnected, as the drives were all in sync the last time this drive was part of the array. That leaves sde1:

root@server:~# mdadm --examine /dev/sde1
[...]
Update Time : Sun Mar 20 23:53:07 2011
State : clean
Active Devices : 3
Working Devices : 3
Failed Devices : 1
Spare Devices : 0
Checksum : 713f30d1 - correct
Events : 3904

0 0 8 17 0 active sync /dev/sdb1
1 1 0 0 1 faulty removed
2 2 8 49 2 active sync /dev/sdd1
3 3 8 65 3 active sync /dev/sde1

When this drive was last part of the array, sdc1 was faulty but the other two were fine. This indicates that it was the second drive to be disconnected.

Scary stuff

Despite being marked as faulty, we have to assume that the data on /dev/sde1 is crash-consistent with sdb1 and sdd1 as the array immediately stopped upon failure. The original array won’t start because it only has two active devices. But we can create a new array with 3/4 of the drives as members and one missing.

This sounds scary and it should. If you have critical data that you’re trying to recover from this situation I would honestly be buying a whole new set of drives, cloning the data across to them and working from those. Having said that, the likelihood of permanently erasing the data is low if you’re careful and don’t trigger a rebuild with an incorrectly configured array (like I almost did).

Important information to note is the configuration of the array, in particular device order, layout and chunk size. If you’re using defaults (in hindsight probably a good idea to lessen the chance of something going wrong in situations ilke this), you don’t need to specify them. However you’ll note that in my example the chunk size in 512K, which differs from the default of 64K.

Creating a new array with old data

Here is the command I used to recreate the array:

root@server:~# mdadm --verbose --create /dev/md1 --chunk=512 --level=5 --raid-devices=4 /dev/sdb1 /dev/sdd1 /dev/sde1 missing
mdadm: metadata format 01.02 unknown, ignored.
mdadm: layout defaults to left-symmetric
mdadm: /dev/sdb1 appears to be part of a raid array:
level=raid5 devices=4 ctime=Mon Oct 11 00:13:02 2010
mdadm: /dev/sdd1 appears to be part of a raid array:
level=raid5 devices=4 ctime=Mon Oct 11 00:13:02 2010
mdadm: /dev/sde1 appears to be part of a raid array:
level=raid5 devices=4 ctime=Mon Oct 11 00:13:02 2010
mdadm: size set to 625128960K
Continue creating array? y
mdadm: array /dev/md1 started.

Oops.

Can you see what I did there…. I created the array with the missing drive at the [3], when in actual fact the missing drive is [1] (the device numbering starts at 0). Thus when I tried to mount:
root@server:/# mount -r /dev/md1p1 /mnt -t ext4
mount: wrong fs type, bad option, bad superblock on /dev/md1p1,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

!!

Upon realising this I looked at mdstat then stopped the array:

root@server:/# cat /proc/mdstat
Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] [raid10]
md1 : active raid5 sde1[2] sdd1[1] sdb1[0]
1875386880 blocks level 5, 512k chunk, algorithm 2 [4/3] [UUU_]

Number Major Minor RaidDevice State
0 8 17 0 active sync /dev/sdb1
1 8 49 1 active sync /dev/sdd1
2 8 65 2 active sync /dev/sde1
3 0 0 3 removed
root@server:/# mdadm --stop /dev/md1

I then recreated the array with the missing drive in the correct position:

root@server:/# mdadm --verbose --create /dev/md1 --chunk=512 --level=5 --raid-devices=4 /dev/sdb1 missing /dev/sdd1 /dev/sde1
mdadm: metadata format 01.02 unknown, ignored.
mdadm: layout defaults to left-symmetric
mdadm: /dev/sdb1 appears to be part of a raid array:
level=raid5 devices=4 ctime=Mon Mar 21 02:00:54 2011
mdadm: /dev/sdd1 appears to be part of a raid array:
level=raid5 devices=4 ctime=Mon Mar 21 02:00:54 2011
mdadm: /dev/sde1 appears to be part of a raid array:
level=raid5 devices=4 ctime=Mon Mar 21 02:00:54 2011
mdadm: size set to 625128960K
Continue creating array? y
mdadm: array /dev/md1 started.

And examined the situation:

root@server:/# cat /proc/mdstat
Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] [raid10]
md1 : active raid5 sde1[3] sdd1[2] sdb1[0]
1875386880 blocks level 5, 512k chunk, algorithm 2 [4/3] [U_UU]

Device Boot Start End Blocks Id System
/dev/md1p1 1 233475 1875387906 83 Linux
Warning: Partition 1 does not end on cylinder boundary.
Command (m for help): q
root@server:/# mount -r /dev/md1p1 /mnt
root@server:/# ls /mnt
Alex Garth Hamish Jenny lost+found Public Simon
root@server:/# umount /mnt

Phew!

So despite creating a bad array I was still able to stop it and create a new array with the correct configuration. I don’t believe there is any corruption as no writes occurred, and the array didn’t rebuild.

Adding the first-disconnected drive back in

The array is of course still in a degraded state at this point and no more secure than RAID0. We still need to add the disk that was disconnected first back in to the array. Compared to the rest of the saga this is straightforward:

root@server:/# mdadm -a /dev/md1 /dev/sdc1
mdadm: metadata format 01.02 unknown, ignored.
mdadm: added /dev/sdc1
root@server:/# cat /proc/mdstat
Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] [raid10]
md1 : active raid5 sdc1[4] sde1[3] sdd1[2] sdb1[0]
1875386880 blocks level 5, 512k chunk, algorithm 2 [4/3] [U_UU]
[>....................] recovery = 0.0% (442368/625128960) finish=164.7min speed=63196K/sec

unused devices:

Here we can see a happily rebuilding RAID5 array. Note that you will need to update /etc/mdadm/mdadm.conf file with the new uuid, the line can be simply generated with:

root@server:/# mdadm --detail --scan
mdadm: metadata format 01.02 unknown, ignored.
ARRAY /dev/md1 level=raid5 num-devices=4 metadata=00.90 spares=1 UUID=7271bab9:23a4b554:01f9e43d:ac30fbff

You can keep an eye on the rebuild with ‘watch cat /proc/mdstat’.

I see these all the time, but the execution of this particular attack struck me as unusually slick however, hence the blog post.

The email

The ANZ email subject was “Please remove your Online Banking Limitation! Last warning!”, whereas the ASB email was titled “Online banking suspension warning!”. Both are clearly designed to panic the user into clicking the link and entering their banking details. The ANZ subject has a hint of ESOL and the grammar in the emails is sub-standard, I suspect the origin is a country where English is not the first language.

The first point of interest is the fact that the emails got through to me at all – Google’s spam filtering is second to none. As best I can tell they used hacked legitimate mail servers, and sent the emails one at a time. Below are the headers from the ASB email:

Delivered-To: my@email.com
Received: by 10.100.215.9 with SMTP id n9cs87086ang;
Thu, 17 Mar 2011 16:50:07 -0700 (PDT)
Received: by 10.227.172.193 with SMTP id m1mr389850wbz.201.1300405806261;
Thu, 17 Mar 2011 16:50:06 -0700 (PDT)
Return-Path:
Received: from mars.servers.rbl-mer.misp.co.uk (mars.servers.rbl-mer.misp.co.uk [188.65.116.66])
by mx.google.com with ESMTPS id k6si3701648wbc.86.2011.03.17.16.50.05
(version=TLSv1/SSLv3 cipher=OTHER);
Thu, 17 Mar 2011 16:50:06 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of squiddyc@mars.servers.rbl-mer.misp.co.uk designates 188.65.116.66 as permitted sender) client-ip=188.65.116.66;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of squiddyc@mars.servers.rbl-mer.misp.co.uk designates 188.65.116.66 as permitted sender) smtp.mail=squiddyc@mars.servers.rbl-mer.misp.co.uk
Received: from squiddyc by mars.servers.rbl-mer.misp.co.uk with local (Exim 4.69)
(envelope-from )
id 1Q0MxA-0008N3-F7
for my@email.com; Thu, 17 Mar 2011 23:50:04 +0000
To: my@email.com
Subject: Online banking suspension warning!
From: ASB Bank
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Thu, 17 Mar 2011 23:50:04 +0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - mars.servers.rbl-mer.misp.co.uk
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [827 823] / [47 12]
X-AntiAbuse: Sender Address Domain - mars.servers.rbl-mer.misp.co.uk


Basically as close to legitimate as you can get, the only clue is the spoofed “From” header, but this is trivial. The ANZ email came from mail.gpschile.com, which appears to belong to a legitimate company in Chile. Misp.co.uk appears to be owned by UK Webhosting Ltd. Given that these attacks are usually done in a macro fashion, they are probably legitimate mail servers that have been compromised.

Certainly, this is not your run-of-the-mill spam run.

The Link

I’ll use the ANZ email for analysis here as it’s the one still going at the time of writing.

The link from the email points to a server which immediately redirects you to another server as can see in the curl transaction below:

The reason for the redirect is to defeat phishing filters. When a site is reported as a forgery it is almost always going to be the redirected url and not the url from the email because users will click “help > report web forgery” and submit the page from there. This however still leaves the domain in the original link off the black list, so once the site is blocked the attacker is free to redirect to a new domain that is not yet blacklisted, increasing the window of attack for each email that is sent.

This makes the server performing the redirects quite interesting – it is likely that it is owned by the attacker or totally compromised (basically rooted).

The domain was registered by proxy just 7 days ago:

Registrant:
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
[...]
Created on: 13-Mar-01
Expires on: 13-Mar-13
Last Updated on: 09-Mar-10


The anonymous registration, age of the domain, and lack of evidence of any legitimate use, all support the notion that this machine and the domain name are paid for and controlled by the attackers.

Not much there…

The Site

Next we have the server hosting the phishing site itself. Hard to tell if this is compromised server or not – it appears to be with a dedicated hosting provider called theplanet (now softlayer). The OS and Apache installations seems different from the redirect server, but what is interesting is that mod_auth_passthrough is installed.

I would appear that mod_auth_passthrough is used to pass the authentication details that the user enters through to the bank’s actual web site. I did a test of this (with dummy credentials obviously), and got an error page from the bank. This means that on entering their details correctly, a victim will probably be logged in to the real site, thus they are less likely to be aware that they’ve been phished, and also less likely to phone the bank because they couldn’t log in.

It should also mean that the bank has a clear method of identifying users that have been phished – look through the logs for a referrer (or lack of). The banks could probably help mitigate this particular attack by checking the cookie to make sure that the user actually visited the login page before the credentials were entered, and warn them if they arrived from an unknown login page, or even lock the account immediately.

A screenshot of what you’d see in a web browser is below:

Basically, a copy of the bank’s site as you’d expect.

Summary

This is a well organised and sophisticated attack. The phishers clearly have a whole swathe of compromised domain names, mail servers and web servers under their control in addition to control servers performing redirections. Spam filters and phishing blacklists aren’t doing much to help here, the best defense, as always, is common sense.

I have emailed the owners of all compromised domains that I know of notifying them that their domain is hosting a phishing site. One got back to me about 18 hours later and I notice that the domain now redirects to a helpful page about phishing and how to spot web forgeries. At least that’s one batch of phishing emails that no longer work, but it could have caught a lot of people in 18 hours, and I’ve no reason to doubt that other domains will last longer.

The problem is that the usual response of reporting each site to Google or Microsoft doesn’t really work here. I don’t even know if a redirect server qualifies as a “web forgery” by their definitions. The best way to take them down seems to be talking to the admins of the compromised domains and getting them to remove the fraudulent entries.

Update

12 hours later and it’s still there…

Update 2

Now receiving emails purporting to be from Trademe with an almost identical MO. Either this is an off-the-shelf phishing solution or the group responsible is casting a wide net!

Subjects so far:

• Please restore your account access!
• Please restore your account access! Last warning!

Anyway, I’ve been having a bit of fun getting our server template uploaded to it, which is only 11GB compressed – not exactly large, but apparently large enough to be inconvenient.

In my experience the datastore upload tool in the vSphere client frequently fails on large files. In this case I was getting the “Failed to log into NFC server” error, which is probably due to a requisite port not being open. I didn’t like that tool anyway, move on.

The trusty-but-slow scp method was also failing however. Uploads would start but consistently stall at about the 1GB mark. Not sure if it’s a buffer or something getting filled in dropbear (which is designed to be a lightweight ssh server and really shouldn’t need to deal with files this large), but Googling didn’t turn up much.

So I went down the track of splitting up the file into smaller chunks, easily done using the split tool. Except I didn’t know about the split tool and used dd.

So if you’re reading this you probably want to use split, but if for some reason you need to do this on an environment that doesn’t have split and does have dd (like ESXi), this could help:


#!/bin/bash

SKIP=$(( $SKIP + $CHUNKSIZE ))
done


Afterwards:

scp ./*.part* user@host:/vmfs/datastore/

Then at the other end you simply concatenate them together. I generated a list of files with `ls -tr1 *.part*` and simply pasted that into a script. Obviously the order is critical, but reverse sorting by time (which is what the r and t options do) gives the correct order.

#!/bin/bash

for F in $FLIST
do
cat $F >> $OUTPUT
done

• RSS support – not just via Google Reader
• Ethical developer – i.e. supports the app and doesn’t demand excessive permissions for advertising purposes
• White text on black background (for better battery life on AMOLED)
• A decent user interface (NewsRob is great)
• Offline cache, configurable sync schedule – I don’t want it to update constantly during the day and chew my battery, just download articles twice daily before I jump on the tube.
• A reasonable price (yes I am prepared to pay)

Seriously if anyone can find one that fits these criteria please enlighten me, because I sure can’t. The ones I’ve considered so far:

• NewsRob
  • The current frontrunner. Ad-supported and paid versions, user interface is nice and clean. I’m currently using the ad-supported version (gasp), until I find another. The problems? No black background (discovered the pro version actually does have a night theme), sync is partially configurable but can’t set specific times, based on Google Reader.
• Feedr
  • Looked perfect and was apparently one of the better ones, but is no longer updated. Rumour has it that the developer is also behind RssDemon…
• RssDemon
  • From what I can gather from the reviews on the marketplace, the developer of this app prefers to release a new app so everyone has to buy it again rather than improve the original. The app demands location permissions which is totally unnecessary for a news reader, and according to one reviewer purchasing the elite license does not properly remove the ad components. Strike.
• BlueRSS GR
  • Developer seemed to have a good thing going with BlueRSS then inexplicably threw all that away by removing the old version and starting again with a new “GR” version that is not getting good reviews. There is no option for a black interface, but I didn’t like it anyway – 3D icons very 1998. Absolutely zero reasons to use this over NewsRob.
• eSobi
  • Poor reviews, expensive (free is only trial), bloated, too many permissions. Again, zero reasons to use this over NewsRob.

Yes I’m picky but this seriously should not be that hard. News reading on Android – fail.

In a moment of weakness I went and signed up to a 24-month contract on O2 a month ago, with the main attraction being the “free” Nexus S that was part of the deal. I did the math, and assuming my current rate of £15 per month spent on pre pay would continue, it worked out cheaper than buying the phone outright by a significant margin. Even after the post-xmas price drop.

My previous device is a Nokia N900, with the result that my standards for usability are rather low, but my standards for functionality are extremely high. There really is nothing the N900 can’t do with enough knowledge, but compared to the Nexus S it is slow and unwieldy for even the most basic functions such as email and calendaring.

As per usual, in this review I make no attempt to provide a complete or even unbiased review. These are my impressions, nothing more, and the review will be of most interest to you if you’re currently an open-source friendly N900 user in their 20s living in London. Yeah, it’s basically the comparison that I would have wanted to read before I switched.

On with the revie… er.. comparison.

Hardware

First impression of the hardware is good. It’s light, but then the N900 is a brick. It also feels lighter than my mate’s Nexus One, yet apparently they’re 1g different. Weird. It’s much thinner then the N900 too. I no longer have a brick in my pocket.

The screen blends seamlessly into the front. It appears to be durable as I’ve already dragged it off the table via charger cable onto a linoleum floor and there are no discernible marks on the body anywhere. Plastic may not look or feel as nice but it is certainly light and durable, and these are arguably more desirable attributes.

It’s comfortable to hold in the hand and I love the curved screen. If I had any complaints, one would be the lack of a texture to grip, it’s like a bar of soap at times. The screen edge is also very close to the sides, I’ve had a few accidental touches register when merely gripping the phone. This was solved by a silicone case which I’ll mention again later.

What I do miss is the physical keyboard, and I knew I would even before I bought it. But phones with hardware keyboards aren’t nearly as pocketable, so I’ve resigned myself to making do without one. Swype seems like a fairly good replacement, however soon after installing the beta (along with Handsent SMS), the phone started doing the reboot thing.

Unfortunately uninstalling them both didn’t have any effect, and the phone still occasionally reboots to this day so I have to chalk it up to coincidence and wait for the fix from Google. Handsent won’t be getting reinstalled however, it struck me as bloated, ugly and just felt “spammy”, so I don’t think I’ll be going back.

Woops, looks like we’ve already moved on to;

Software

I don’t think I’m in much of a position to comment on Gingerbread vs previous versions of Android as other than a crap-pad running Android 2.1 I haven’t used any of them extensively, so my focus is more on the comparison with Maemo. The reality though is that there really is no comparison. The resources that Google has poured into Android make 2.3 a much more polished and fluid OS, and it works very well.

Speed is critical on a mobile device. Whereas it would take ages to open the email app and download my email on the N900, with the Nexus S I don’t even have to open email and download – because it’s already pushed to my phone as soon as it’s received. Yes the N900 can autosync but it’s still a pull sync and chews battery. Simply opening your inbox can take 5-10 seconds, with Gmail on Android it’s basically instant.

The biggest paradigm shift coming from the N900 is the way that applications are managed. Maemo behaves basically like a desktop OS. Open an app and it stays open, and is fee to do whatever it likes, sleeping requires the app developer to tell their app to sleep when it’s not in focus. On Android, this is all managed by the system.

After using Google maps and going back to the home screen, the GPS turns off, and from that point on it will use no more battery than if you had never opened maps in the first place. The exception is if you’re using something like Google Latitude or another app that tracks your location. Some ad-supported apps will demand permission to send your location to advertisers, and along with the privacy implications, this will also drain your battery faster.

If you don’t use maps for a while and open some apps, Android removes maps from memory to make room for them. And that’s the difference – the N900 required you to be smart about what apps you left open, Android is smart enough to do it for you. There is simply no need to close background apps and manage what’s running manually as you’d be wasting battery power if you have to reopen them.

I will say that I preferred the N900′s app switching mechanism. All you had to do was press on the top left and you got the task switcher. With Android you press home to go back to the desktop, and if the shortcut isn’t in front of you, you have to hold down the home button again for a couple of seconds to get to the recent apps screen. Or go digging through the menu.

The Gaps

What DOES annoy me about Android is the obvious holes in the OS that Google seemingly (and unnecessarily) leaves to third party developers. A few examples are;

• The music player. It’s ugly and featureless, I preferred the N900′s.
• The lack of a sync scheduler. Apparently Google assumes that if you setup a work email account on your phone you’re going to want to receive notifications 24/7 or control it manually.
• The lack of a file browser.

The N900 by comparison has Mail for Exchange which has had peak / off-peak sync scheduling capabilities for as long as I can recall. It’s an essential feature. The music player is admittedly simple but strikes me as an honest attempt to write something people will want to use.

I could forgive the absent file browser if this was a feature phone not aimed at enthusiasts, but given the target market it’s a bit baffling.

While I’m ranting about the built-in apps, the Gallery is also quite bad. First impression is “ooh shiny”, then you realise that the shinyness is masking software with a few rough edges. While it looks nicer than “Photos” on the N900, it’s actually less functional and just as frustrating to navigate. As per usual it also picks up all the album art from my music folders. Can’t we be smart and omit folders with “music” or “audio” in the path, or at least have the option to exclude them manually?!

Battery Life

Shite about sums it up.

My worst run is just 8 hours from charger disconnection to forced shutdown, and for 4 of those hours it was basically idle. Syncing and Latitude were enabled though, and for the last 4 hours I was walking around London and on the tube using maps heavily. I also listened to an hour or so of music but I would still expect better than this.

What it means for me is that a second battery is essential, and really it shouldn’t be.

If I have navigation off, latitude off, syncing on and listen to music for 2 hours a day I can eke it out for about 36 hours but it’s basically dead at the end. The N900 did this on a smaller battery and with more left in the tank – I could get 48 hours with light use but I’m pretty sure the Nexus S would be dead even if I didn’t use it at all for 2 days.

Some notes on Android Apps

I suffer from an aversion to advertising (somewhat ironic given the industry I now work in), but here are some of the more useful paid and truly free apps I’ve come across. I should note I have no problem paying for good apps, but I do have a problem with ad-supported apps on a mobile platform.

First of all they’re not really free if you have to give up your location, personal information and submit to targeted ads. Many (actually most) applications scream “FREE!” and do not disclose that they are ad-supported in the description. Secondly, mobile phones are a resource constrained environment, particularly in terms of bandwidth and screen real estate. And thirdly I’m already bombarded with enough ads throughout the day – I don’t need that crap on my dam phone!

Anyway here are some good honest apps that have remained installed on my phone. Either they declare upfront that they are ad-supported and don’t do dodgy stuff such as location tracking, are genuinely free software, or are paid without ads.

• Firefox
  • Yep it’s Firefox mobile, 4.0b4 at the time of writing. It’s much faster than 1.1 was on the N900, but this is probably not a fair comparison as the Maemo version is lagging.
• Flickr free
  • Uploads to and browses your Flickr account. Has a paid version available which is basically a donation, if I used it more I definitely would but Flickr is really only for my real photos – cell phone pics only go on Facebook.
• Facebook
  • If you use Facebook you’ll probably want to install this app.
• Barcode Scanner
  • Also allows you to scan those QR codes you see around the web which direct your phone to Android apps. Free, no ads, appears to respect privacy.
• NoLED
  • Helps make up for the Nexus S’s lack of notification LEDs by lighting up parts of the screen when you receive a message, missed call etc. Quite configurable, I have it set to notify only on phone calls and text messages which I wouldn’t receive elsewhere.
• Dimmer
  • Reduces screen brightness below the default minimum of 30%. The screen is really bright in the dark, and 30% is plenty bright indoors so I have this on most of the time.
• Dropbox
  • I switched to Ubuntu One for file syncing when 10.04 came out but I regretted it. Firstly there is an Android client for Ubuntu One but you have to pay $4 USD per month to get access to it. Dropbox on the other hand offers their Android client to free users as well. Given how mature Dropbox is and its support for OSX and Windows as well it’s a no-brainer really – sorry Canonical, I’m switching back. And if I ever do need more than 2gb of data synced online it will probably be Dropbox that gets my business.
• Poweramp
  • Not free in any sense, has a trial version (I prefer this model to ad-supported). Poweramp is actually a really good music player, and I would recommend it as a worthwhile purchase. It seems to be the best replacement for the built-in player, and is streets ahead of anything on the N900. Has a nice black theme (perfect for AMOLED screens), and a graphic EQ. Also love its lock screen widget which allows control without unlocking the phone. It supports the headset’s built-in skip/pause button, and starts/stops when the headset is plugged in/unplugged. I do miss the N900′s virtual playlists though (e.g. playlist of unplayed songs).
• RemoteDroid
  • Remote control your PC using your phone as a touchpad. Nice idea, useful for a media PC if your usual remote fails for some reason.
• GPS Status
  • Ad-supported, but there is a donation app available for purchase which removes the ads so I bought it.
• Wifi Analyzer
  • This is a good app, in fact WifiEye on the N900 was modelled after it. Unfortunately it’s ad-supported and the developer claims it will always be free. By my definition it is not. The N900 version by comparison is properly free.
• Aldiko
  • Best vendor-neutral e-book reader I’ve seen. Has all-important night mode and can import any PDF. Also check out Amazon’s Kindle app if you’re a Kindle user or purchase e-books from Amazon.
• MyTracks
  • Written by Googlers, this app maps your path and gathers distance and speed stats. Can upload tracks to Google maps. Useful when going running, cycling etc.
• WordPress
  • Open source, GPL. Alarmed me at first that it wanted location permissions, but it has a legitimate reason, no ads, and if I really wanted to I could look at the code.
• And for Londoners…
  • Tube Chaser
    • Open source client for the London Underground. Quite well polished, but it’s only useful if you know where you’re going because  it doesn’t route and doesn’t include a tube map due to license cost. But the latter is covered by the next app…
  • Bublmap london tube
    • Basically a jazzed up zoomable tube map, with the difference being that zone 1 is geographically accurate. Does what it says on the tin, it’s free and doesn’t display ads.
  • London (www.zuti.co.uk)
    • An interactive tube map which does routing, it was pretty cheap so I paid for it. Unfortunately it’s tube and overground only however, so I’m still looking for a good app that does everything the TFL site does.

Accessories

Being a relatively popular phone, there are more options compared to the N900, but it still pales in comparison to the iDevices range. What I would really like is a docking station!

Batteries

This caught me out. I searched for the model number (AB653850CU) on eBay, and bought the cheapest Samsung-branded battery matching it. I did notice that it was for another phone, and had 60mah less capacity, but the model number was the same so it must fit right?

Unfortunately the 1440mah battery used by the Omnia and 1500mah battery used by the Nexus S appear to be slightly different. This could mean that the battery I bought was a fake, fitted to a mould which fits the Omnia only, or it could mean that Samsung is boneheaded enough to use the same model number for different battery casings.

I did actually manage to get it in but had a bit of trouble getting it out again so I wasn’t comfortable leaving it in there. If you’re buying a spare battery for this phone (and it needs one), make sure it’s designed specifically for the Nexus S.

Cases

The only type I’m interested in are the silicone ones. I had a flip-case for the N900 and it got in the way, and the hard casings are too bulky and ugly. With the Nexus S I regard a silicone case as almost essential because the plastic is so smooth that it can be easy to lose your grip. With the screen so close to the edge I also found that accidental touches were common, a problem which the silicone solves.

It’s almost impossible to tell which is the best though so I brought the two which appeared to be the most common ones on Amazon:

1. Qubits Soft Silicone Skin cover - £1.99The Qubits one arrived first. The Qubits range appears to basically be generic sort of stuff that’s acceptable quality and not absolute junk, and I think that’s what I got here. It did occasionally remove itself from the phone when I jammed it into my pocket in a hurry though, and dust and lint seemed to be very attracted to it. Overall it felt decent, did the job, and I thought it was good value for £2.
2. Amzer Silicone Skin - £4.99The Amzer arrived much later but turned out to be the better case. It’s less “sticky”, so it’s (marginally) easier to slide in and out of your pocket and doesn’t attract dust and lint quite as much. It also stays on better, due I believe to being more rigid. So a higher price is definitely warranted but I don’t know about 2.5x higher. When you’ve spent £450 on a phone though, who’s going to quibble over £3 for a case.

So technically the Qubits is better value for money, but really not the smarter choice.

Verdict

After reading this you’d probably be thinking I hate the thing, but to be fair this review has dwelled on the negative because it’s more interesting. You can find any number of glowing reviews of this phone and Android all over the web, and you probably already know about the features you’ll like.

The short of it is that the speed and polish of the Nexus S is way ahead of the N900. It does the basics much better, particularly email (even web browsing if you ignore the lack of a stylus), and beyond the basics there is probably going to be an app for that if you submit to ad companies tracking your every move and allow popup Starbucks ads whenever you happen to walk past one of their stores…. OK so that doesn’t quite happen yet but how far away do you think it really is?

I am ignoring the reboot bug. Yes it’s annoying, it happens every couple of days or so, but apparently a fix is in testing as I type and it should be resolved soon. It’s not the kind of bug that can be left unfixed.

In the end I would have to say that if you really care about your privacy, an Android phone or an iPhone is a really bad idea. Advertising and tracking is almost impossible to avoid unless you don’t install any apps, don’t use the web browser and don’t use any Google services. But then you may as well get a Nokia 1100.

The same is true anyway if you sign in to any Google services, or even use the web with cookies enabled, so welcome to the brave new world of information marketing.

Basically, I’ve sold my soul for a gadget. But what a sexy gadget.

-Al

The system in this case was an old Ubuntu 9.10 server using Likewise Open 5. After some patching and an update to the current vmware tools it started failing to authenticate domain users, so I decided to upgrade to the latest version. However after the upgrade I was getting an error when trying to join the domain:

Error: ERROR_FILE_NOT_FOUND code 0×00000002

The obvious solution is to remove all likewise packages and purge the config, however that didn’t seem to work either. What DID work, was removing & purging the config, manually removing a few directories that were not empty, purging a few other seemingly related packages which were marked as no longer required after the uninstall, and finally reinstalling.

The sequence of commands to resolve the error was thus similar to the following (assuming the system is in the state of having the Likewise supplied packages install but unable to join the domain):

apt-get remove –purge likewise-*

For some reason a couple of packages weren’t removed the first time and I had to do this twice.

After that I had a few messages similar to the following:

dpkg: warning: while removing likewise-open5-libs, directory ‘/var/lib/likewise-open5′ not empty so not removed.

Thus:

rm -rf /var/lib/likewise-open5 /var/lib/likewise /var/lib/likewise-open

Purging no-longer-required packages that are probably dependencies of Likewise:

apt-get remove –purge krb5-user krb5-config libkadm5clnt6 libgssrpc4

After that I was able to sh ./LikewiseOpen-6.0.0.8305-linux-amd64-deb.sh, run domainjoin-cli, and all worked perfectly.

The only 3rd-party solutions I could find open the results in a web browser, which isn’t really what I wanted. So I wrote a REALLY ugly one-line script, but it works for me, so why not share. Maybe it will inspire someone with more talent!

It requires curl and vilistextum which aren’t in a default Ubuntu install, for more barebones OS’s you may need to install awk as well.

#!/bin/bash

curl -A "Mozilla/4.0" "http://www.google.com/search?q=$1%20$2%20$3" | vilistextum -k - - | awk 'NR > 23' | less


Then chmod +x it, install the script in /usr/bin and you can search from the commandline by typing [nameOfScript] [search terms]. e.g. to search for “testing 123″ I type:
g testing 123

Yes there’s a lot wrong with this, for a start if you want more than 3 search terms you’ll have to add another argument (%20$4) after the q= string. I’m sure there’s a more elegant way of doing it by using $@, or $# to get the number of arguments and combining them all in a loop. But then it becomes a 5-line script rather than 1.

Also the result is not exactly pretty, but if you use a graphical terminal such as gnome-terminal all the links will be clickable and will open in your default browser.

Alternatively you could pipe the result to lynx, which actually parses html properly, but then any links would open in lynx which is not what I wanted:

#!/bin/bash

curl -A "Mozilla/4.0" "http://www.google.com/search?q=$1%20$2%20$3" | lynx --stdin


.

There are no new major features that I’ve noticed, so of PR1.2 was a feature release, PR1.3 is very much a fine-tuning release. And despite what the few whiners on the maemo forums might say – that is not a bad thing!

More at the Nokia conversations blog and pocketables.net.