Amarok Blog

SeeqPod and LibriVox

nospam@example.com (Lydia Pintscher) — Thu, 28 Aug 2008 12:41:32 -0400

Be seeing you, originally uploaded by Olivander.

Amarok 2 has two scripted services that are really cool. For one SeeqPod, that lets you search for any kind of music on the web and listen to it in Amarok. And the other one is LibriVox, that integrates the LibriVox service. LibriVox offers free audiobooks of public domain books. Both services are great and definitely deserve to be in Amarok 2.0.

The problem is that they were written a few weeks ago in Ruby. Now they need to be ported to QtScript as that is the only scripting language we allow for internal scripts to reduce the headache of script dependencies especially keeping the Windows and Mac releases in mind.

Among all the stuff that needs to be done before the release of Amarok 2.0 those two scripts were kinda forgotten until now and really need some love. If you want to help us get those two scripts back please let me know. Free cookies and hugs included

"Absence," Akademy and Devices

nospam@example.com (Alejandro Wainzinger) — Mon, 25 Aug 2008 22:32:02 -0400

So I apparently haven't blogged in a month. Sorry about that, it's not that I have nothing to say, just that I'm usually busy doing that I don't really take the time to talk about it. That said, I'll still keep this short as I myself like to read short blurbs from people who aren't well-known.

Akademy. Awesome. Of course I got to meet a good amount of the Amarok people I often talk to, which was the highlight of the trip for me really. It's one thing to discuss over IRC, and quite another to have breakfast together, chat about things non-Amarok as well as Amarok in person, and in general hang out. I also got to meet a lot of other people, like Will Stephenson who donated an MTP device for development (who I met while waiting in the waffles line) [p.s. thank you so much again for it].

Most exciting stuff non-Amarok: Gallium3D... just wow, that's all I can say. Step was pretty awesome too, though my physics is really bad. Marble is exciting stuff, but in Openstreetmap there remains much to be mapped so it may be a while before it becomes truly amazing. There's more, but these are the ones that stuck out most in my mind right now.

So, Media Device Status Report. As you can see, I haven't blogged so obviously nothing has happened. Lies. MTP playing off the device is now supported, a bunch of random bugs have been fixed, and an applet is under way to deal with configuration etc. of devices. Don't worry, this is only for connect/disconnect and options and whatnot, the configuration of devices will still be almost entirely automated. I'm trying to figure out a way to make it more obvious that for media devices you need only plug in your device essentially, for it to just work. I think that I'll try to push for the Media Devices applet to be one of the initial defaults loaded, and it'll show a text like "plug in media device to play from it" or something.

Why have I been so slow at coding? The truth is I've been held in Guantanamo for the last couple of weeks. And.... again, lies. No, between random life, then Akademy in Belgium (which I spent most of my time bugfixing and socializing), and now I'm in Japan where it's hard to stay on the computer too long, I haven't been that able to. But I'll be back in the USA Sept. 2, so starting then things should pick up a bit more hopefully.

On that note, cheers from Japan!

Nerrivik released

nospam@example.com (Lydia Pintscher) — Fri, 22 Aug 2008 07:54:54 -0400

The Amarok team is proud to announce the first beta of Amarok 2.0, codenamed Nerrivik.

Please digg it and enjoy the release notes.

FrOSCon!

nospam@example.com (Lydia Pintscher) — Wed, 20 Aug 2008 15:37:48 -0400

If you want to meet some KDE folks, want to see KDE 4.1 in action or if you have questions about KDE FrOSCon in St. Augustin is the place to be this weekend.

Come and say hello at the KDE/Amarok booth and in our dev-room.

We have interesting talks for everyone in our dev room:

Saturday:

11:15 KDE Edu (Frederik Gladhorn)

16:30 KDE Community - How to get involved (Alexandra Leisse and Lydia Pintscher)

Sunday:

11:15 Amarok 2 (Sven Krohlas and Lydia Pintscher)

15:15 Kubuntu

16:30 KDE Grill - Ask questions about KDE you always wanted us to answer (KDE dream team )

And on Saturday 15:15 Sebastian Kügler will talk about KDE 4.1 in his talk “Don’t look back” in the main track.

Hope to see you there.

Oh btw: Last year’s social event = best social event of 2007. Let’s see if they can beat Akademy this year

Surviving a week with Amarokers

nospam@example.com (Seb Ruiz) — Wed, 20 Aug 2008 13:42:57 -0400

I should have blogged much more from Akademy, but having hardware which insisted on frequently overheating made life a little difficult. I’m still in Belgium - in Bruges actually, blogging from my N810 courtesy of Nokia. More on that later.

I’ll start by saying that l think we had very productive week, getting lots of design and development done towards our goals for Amarok 2.0. We focused heavily on critiqueing the user interfaces of the major components in our GUI: the playlist, context view and each of our sidebar browsers. In between hacking hours, Mark, Leo and myself hosted design and release-breaking-issue sessions. These have provided valuable direction and motivation to all of our developers, so you can look forward to some exciting progress as we gear up to an imminent beta (and eventually final) release!

We also brainstormed a number of post 2.0 ideas such as interface adjustments to enhance your application experience, including, but not withstanding, mobile and embedded devices. Yes, that’s right folks, before too long (hopefully) you’ll be able to run Amarok on your favourite (maybe) small form factor device. The main use case would be for remote collections and streaming, but we’re not going to shut out users who like carrying 8GB of music on memory cards.

All this talk of small form factor devices is making me drool over my N810 as I write this. Some observations: all this very slow and awkward typing makes me much more coherent; leeching off random wireless to blog has never been easier; and, the inbuilt GPS has already proven invaluable to the Amarok crew as we used it to find our restaurant when we got lost cycling through the mid-west of Belgium. Note: never cycle 15km immediately after eating a huge meal, and never let Casey on a bicycle.

Finally, a big thanks to all that made Akademy so great: the organisers, the participants, the speakers, the boffers, the paparazzi, and all the people that were responsible for either brewing, frying or coating things in sugar.

Akademy / Summer of Code survey

nospam@example.com (Lydia Pintscher) — Sun, 17 Aug 2008 16:31:38 -0400

Finally back at home. Less tired after sleeping in my own bed again. Missing everyone. Caught up on stuff. Laundry still piling up

Akademy was great. Very big THANK YOU to Wendy, Bart and their team. You did an amazing job.

Akademy was quite productive. Talked to lots of people about lots of stuff. Wait for some interesting things to happen in the next weeks and months.

I took the time to talk to some of our Google Summer of Code students about their experience. I wanted to find out where we as a community are doing very well and what we can improve in their opinion. Of course it wouldn’t be of much use if only I knew this so let me share it with you:

Everyone seemed to agree that KDE is a great community and that they felt welcome in our community. Akademy was seen as a great opportunity for the students to get to know people and it seriously helps in turning some of the students into contributors outside of GSoC. (Note to self: Find out how many of them are still committing code in 6 months.)

Documentation!!! The Amarok team seems to be doing a bad job here :( (Not really sure about the rest of KDE.) I need to find ways to improve this. Suggestions welcome.

The Big Picture: This seems to be missing. Mentors should try to give an overview of the code and community and how it fits together at the beginning. Some of the students felt lost at the beginning and it took them a lot of time to get used to everything. For Amarok I created a wiki page with all the important links to websites and mailing lists for the students. Unfortunately the code overview part of it did not get finished.

Blogs: The Amarok students were encouraged to blog about their work every week and post it on Planet Amarok and Planet KDE. Same goes for some of the students that worked on other parts of KDE. Everyone seemed to agree that this was a good thing. The feedback they got was encouraging and helpful. They felt pushed to produce something worth blogging about at the end of the week which was seen as positive and motivating. It also showed that people are interested in the work they do and that their progress is monitored.

Branches: Working in a SVN or Git branch outside of trunk was seen as a problem. Code did not get reviewed and tested enough before it hit trunk. Those students worked too much in their own little world. Immediate testing and code review by other developers would have been preferred and a lot of problems would have been avoided. (I know there are reasons for branches but something needs to be done about this.)

Timezones: Timezone mismatches between mentor and student made students switch their sleep/wake times by several hours. I got a few complains about this but it was always seen as a minor problem. I don’t think it is too healthy though. So maybe this should be considered next year when matching students and mentors.

Gurus: Every single student was very thankful for having very knowlageable people in our community they could ask when reading manuals didn’t help. Even if their questions from time to time weren’t the most clever ones they got help. You rock!

Mentor being away: Some mentors left for a week or more on very short notice. This should be avoided or a backup mentor in place.

Students liked that they were mostly free to do what they want, i.e. solve problems the way they want and work on their own schedule.

Mentors in general seemed to have done a good job. You rock!

Thanks everyone who had a chat with me about their GSoC. If I didn’t find the time to talk to you at Akademy or if you were not there feel free to ping me on IRC. I will make sure your feedback gets heard.

I hope a lot of our students stay with KDE after GSoC. You have done an amazing job. Rock on!

PS: Thanks to everyone who signed my Moleskine at the social event. I considered doing nasty stuff to Sebr when he took it away from me but I have to reconsider this now since it is the BEST THING EVAR and will be reminding me of Akademy for years to come.

*hug*

About Help, Wikis and Firefox Qt

nospam@example.com (Harald Sitter) — Sun, 17 Aug 2008 15:05:00 -0400

Busy days, like really busy....

First things first.
KHelpCenter looks less awkward:

It now uses the help-browser icon instead of the old crystal one. The style templates are fixed, glossary now also comes with KDE 4 style and the old introduction stuff got removed completely.
Kicker applets stuff was removed in favor of Plasma (which also got an icon . In general all icons are now fixed (well, some quirks with the main items are still remaining).
KCModules (i.e. the thingies for System Settings and KInfoCenter) are added to their categories.

I also came to think about improving the general experience. In my opinion the interface should be redesigned making the search a central part (considering nepomuk/strigi usage gets implemented), there is really no way I would want to browse docs manually in the year 2008 . Also using Phonon and KHTML/QWebKit a much greater use of online content should be considered (e.g. screencasts).

About the written online content we also had a discussion today. Essentially a lot of the documentation is outdated, no wonder thinking of the amount of applications and features, so really no one's fault here, still we should improve the situtation. Current proposal: using a wiki for ongoing documentation, then take snapshots for proof reading by the responsible developers and then let translators do their magic. Eventually even do the translation in the wiki? I certainly think with this approach we should only ship a very basic amount of documentation with KDE and access the remaining parts online.
I think Windows' help does it quite the same way in that it includes the MS support database, well at least I think it does.

If anyone wants to get loads of karma, he/she may step up and start work on KHelpCenter, I really think there is great potential for this application.

-------

Another really cool thing: work on a new wiki.kde.org started (whichmakes me quite happy since the current one was always kind of not-working when I needed something). The best thing about it is that it got OpenId (alsa known as 'I-only-need-one-login') support, which goes very well with the OpenID support in Amarok's web infrastructure.
The thing is: we need you! you, dear reader
Content from wiki.kde.org needs to be reviewed and selected for migration or dumping (later on moving and updating seems to be on the todo).

So, if you have some time and want to help KDE get a new shiny wiki -> join #kde on irc.freenode.net and poke Jucato

-------

Meanwhile I got firefox-qt to work (at least until you press any buttons...), head over to Jonathan's blog for more information.

One note about the used archive though: this archive is meant for very expermiental packages (Intrepid users will find mozilla-plugin-plasma for example). By experimental I don't only mean the software itself but also the packages, e.g. there is no guarantee that firefox-qt will be named firefox-qt once it is in the offical archives.
Therefore I suggest to be very careful which packages get installed from this archive, I would even go so far that you should remove it once you installed the desired software and check for updates yourself.

The Awful KHelpCenter

nospam@example.com (Harald Sitter) — Fri, 15 Aug 2008 12:24:00 -0400

Today I did a little bug hunt (that's where you actually search for the bugs and then kill them int he most hackish manner

And KHelpCenter made me cry, seriously...

It's still using the crystal icon all over the place:

It's main content is for some reason missing icons:

Remember this pic:

Notice anything?

Note the upper right in the following

Glossary has an as awesome icon issue open content uses help-contents, closed ones should use contents2 (crystalsvg name of course, and an oxygen replacement never got requested apparently :S)

Content of the Glossary then did it and made me cry

At least I got search index....

...strange that it doesn't work even though the index builder said so

First off: I didn't report these issues yet, because bugs.kde.org only offers versions up to 3.5 and unspecified, now I can't really use unspecified, right?

Things I was wondering: Why does khelpcenter still use htdig? Wouldn't Strigi/Nepomuk would be better for that kind of job? Does the index builder need to make me think it succeeded? Does everything have to look so broken? Is khelpcenter actually maintained?

Meanwhile I understood that none of the answers is important anyway .... we, KDE, as a community should just go fix these issues.

I already did a start

GSoC weekly report - issue 11

nospam@example.com (William Viana Soares) — Thu, 14 Aug 2008 17:44:30 -0400

Here I am again, this time from aKademy 2008 in Belgium. It is my first akademy and as an experience it was awesome. The best part was meeting the people behind the nicknames. The community is great and it’s huge. Over 300 people came to the event, what is overwhelming. I’ve learnt many things, talked to many experienced people who really knows what they are talking about.

The organization of the event was perfect, there were many interesting talks, it’s a shame I’ve had to miss some of them. The social event sponsored by Nokia and the boat trip today were really really awesome (free beer, free food, what else could you ask?).

The only bad thing was that it was not really very productive in terms of code but it was really helpful to meet some of the plasma guys who were really kind to me and helped me a lot.

What was also very cool was the n810 that Nokia gave to some of us (a lot of us). It has become the favorite toy arround akademy. It would be really nice to have amarok playing on one of those with an adapted UI for the touch screen. Maybe someday, who knows ?

As for the Summer of Code program, well, it’s coming to an end and I still have lots of things to do, what is making me feel a little bit worried. I’ll have keep coding after deadline (18th august) to go as further as I can.

No snapshots this week, sorry

Project Neon: neonmake

nospam@example.com (Harald Sitter) — Thu, 14 Aug 2008 16:36:00 -0400

I totally forgot to blog yesterday :-S

Anyway, since the first day of Project Neon, there was neonmake. You might be wondering what neonmake is, though if you read all the other blog posts about Project Neon you probably know that I will explain it as following:

neonmake is a wrapper around make, ensuring all environment variables are set as necessary

That however doesn't really describe it very well, in theory neonmake should be called amarok-nightly-kde-nightly-cmake-make-sudo-make-install, which of course is far too long

Well, let's get through it step by step.

neonmake consists of 3 parts - neonmake, make.sh and varsrc

neonmake is a wrapper around cmake, make.sh and sudo make install
the nifty thing about it is that it will bring you to $src/build, or stay there, or create it (i.e. it forces you to do out-of-source builds and keep your source tree clean
it will also detect whether you are trying to compile anything amarokish (i.e. if amaork is part of the source directory's name) and tell make.sh about it

make.sh is a wrapper around make and varsrc
it will force compiling against kde-nightly or amarok-nightly depending on certain magic cases and invoke vasrc
once varsrc is finished it will run make

varsrc is responsible for the environment variables and is usually invoked by all amarok-nightly- or neon scripts

The actual capabilities are quite confusing (I think I don't even understand it completely, and I created that thing after all).

you can run neonmake with kde or amarok as argument forcing it to compile against kde-nightly or amarok-nightly
if the source folder contains the word "amarok" neonmake will asume you compile against amarok-nightly
neonmake will create and/or take you to a subdirecotry called "build" ensuring you do an out-of-source build
if 1. and 2. don't apply varsrc will check whether kde-nightly's kde4-config is available
if kde4-config doesn't return the proper direcotries it asumes we have kde-nightly installed but aren't using it -> variables for amarok-nightly
if 4. does not apply (i.e. no kde-nightly is installed) it will check for amarok-nightly's kde4-config, if it is available -> varaiables for amarok-nightly
if none applies it will throw out totally insane errors

to sum that up:

you can only compile against kde-nightly with kde as argument or when you are running it
you can only compile against amarok-nightly with amarok as argument or when kde-nightly is not installed or when the directory name contains amarok

Suggestions for improvements, as always, very welcome.

Now you go play with neonmake and I have to rest from this post.

Responsible Disclosure, and Amarok 1.4.10

nospam@example.com (Jeff Mitchell) — Thu, 14 Aug 2008 13:55:00 -0400

Yesterday we released Amarok 1.4.10, an unanticipated security release. From the Release Anouncement you may notice that we gave thanks to Google Alerts for notifying us of this vulnerability. This was perfectly accurate. Read on for why.

I want to say up front that the security value of this vulnerability rates so low that it's amazing Secunia even bothered with it. It requires local access (or at least, a shell prompt), and it requires our code parsing a file whose name was hardcoded to execute the code (doesn't)/overflow a buffer (doesn't)/do things incorrectly (doesn't). At worst, you could maybe make Amarok crash, and since this would be a race condition, you'd have to be extremely lucky, and this could only happen between when the user was downloading the Magnatune database and when it was being parsed. Not exactly mission-critical. So, the actual threat of the vulnerability was approximately nil. That wasn't the driving factor behind the sudden release -- the driving factor was the fact that since Secunia did issue an advisory, we wanted to respond to it as soon as possible. Which should have been 36 hours before. Here's where the bungling comes in.

At midnight Tuesday morning, Dwayne Litzenberger posts a bug report on the public Debian bug tracker with snippets of code from Amarok, and the following:

I'm not familiar enough with Qt to be sure, but it looks to me like the code creating a temporary file insecurely. At minimum, I think this code will break if another user has already created /tmp/album_info.xml (thus preventing the current user from deleting it).

Now, I'm more familiar with the KDE and Gentoo bug trackers, which explicitly ask you to not post security related information there, but to contact the projects directly (this would be in following responsible disclosure guidelines). Debian's bug tracker doesn't seem to say this, but it's hard to say -- in a couple minutes of looking around, I didn't see a link that would let me file a new bug directly. It seems you have to either email it in in a certain format or run their reportbug tool.

But as I was saying -- it gets posted to the public bugtracker, and Dwayne doesn't actually contact us directly. Neither does Debian. Perhaps they don't have bug triagers like I'm used to in Gentoo, and perhaps the maintainer of the package wasn't around for those 36 hours. Perhaps they simply didn't bother -- after all, we recently found out that Debian has created several patches for 1.4 over the years that their maintainer(s) never forwarded upstream.

Mid-Wednesday, Ian gets a Google Alert for Amarok -- Secunia has issued a security advisory against us. This is how we first find out about it, which was apparently considered enough of a vulnerability for Secunia to bother with it. Dwayne didn't notify us. Debian didn't notify us. Secunia didn't notify us. No one bothered.

This doesn't exactly correspond to normally followed responsible disclosure guidelines. A fellow developer thinks "Joe User" -- in this case Dwayne -- shouldn't be expected to know those guidelines. I don't buy it. If you know enough about security to recognize a vulnerability, you should know enough to properly disclose it.

My fellow developer also thinks that Dwayne acted responsibly, letting the world know about the vulnerability as soon as possible so that users could arm themselves against the problem until it was fixed. This is wrong, and easily seen to be wrong.

Let's forget for a moment that the vulnerability was miniscule in terms of threat level, and just think about it in terms of being a vulnerability, to prevent yourself from thinking "well yes, I see your point, but it was really miniscule" -- because that's not the problem with what happened here, and next time the vulnerability could turn out to be major.

Had Dwayne notified us first, instead of posting on the Debian bug tracker and letting it lie:

Our users would have been protected from the threat 34 hours earlier (it took us five minutes to patch it, and another hour or two to get the tarball out).
The information would have been made available to a wide audience via the Amarok users' mailing list and the packagers' mailing list 36 hours earlier, so that anyone worried about the threat would have been notified and could take action 36 hours earlier.
The Secunia Advisory could have come out already supplied with the information necessary for people to fix the problem (upgrade to 1.4.10).

By not following responsible disclosure guidelines, any users concerned about Amarok's security were unaware of, and running, unpatched software for at least a day and a half longer than if responsible disclosure guidelines had been followed. Far from letting the users know so that they could act to protect themselves, the users actually ended up being the ones getting screwed here.

Now, I will say something in Dwayne's defense, on the off chance that he could spot a security bug but really didn't know responsible disclosure guidelines -- on their bug tracker, Debian has the following piece of information:

Don't file bugs upstream: If you file a bug in Debian, don't send a copy to the upstream software maintainers yourself, as it is possible that the bug exists only in Debian. If necessary, the maintainer of the package will forward the bug upstream.

In this case, the first "if" in that sentence should have failed -- it shouldn't have been filed in Debian's bug tracker. But even if the user decided they want to put it there, security bugs shouldn't be included in this -- they should not initially be public, in following responsible disclosure guidelines; or, if Debian wants security bugs to go through its public bug tracker as well, they should be on the ball and not sit around on these reports for more than 36 hours.

So, to wrap up: disclose security bugs you find in a project properly. Contact the project, and if you must post it publicly somewhere before giving the project a reasonable chance to respond, don't sit on it, but contact the project as well and make sure they know about it so they can start fixing it. Do it right, and the one getting the credit for notifying the project won't be Google Alerts; it'll be you.

Continue reading "Responsible Disclosure, and Amarok 1.4.10"

Qt Firefox

nospam@example.com (Harald Sitter) — Tue, 12 Aug 2008 19:20:00 -0400

Due to the KDE Dot interview about Qt Firefox I (as a Kubuntu guy) felt pretty challenged....

me@apoc { ~/moz }$ ls -lah | grep deb
-rw-r--r-- 1 me me 22M 2008-08-13 00:35 firefox-qt_0.1~hg20080812-0ubuntu1~ppa1_i386.deb

That's all for now

DBug

nospam@example.com (Harald Sitter) — Tue, 12 Aug 2008 09:59:00 -0400

What is better than Akademy?
...
inGardenWithCoffeeHaXX0ring(tm)

Nowadays everyone is obsessed with debugging, including me, this obsession leads to the urge of having debug packages for each any everything. So, while half the KDE crew was listening to talks due to leak of power supply I was working on debug packages for Project Neon (i.e. kde-nightly and amarok-nightly) and I think the Neon PPA doubled its size.

Now you can install amarok-nightly-dbg which is pulling in a complete debug stack for amarok-nightly. In addition to that you also get a new script called amarok-nightly-debug which wraps around amarok-nightly-vars and gdb. Basically the same applies for kde-nightly, but kde-nightly-dbg will only pull in the necessary dbg packages rather than the complete stack (just like kde-nightly). There is no wrapper script yet, but kcrash takes care of almost everything anyway

If you have time, please take the dbg packages for a testcrash and complain if it fails to crash ... err... to trace the crash

And tomorrow I'll tell you about a script I created months ago and used it yesterday for the first time.

Best Application EVAR!

nospam@example.com (Leo Franchi) — Sun, 10 Aug 2008 17:04:38 -0400

so the very kind folks who won the Akademy awards last year ( sebastian trueg, matthias kretz, danny allen ) decided to go ahead and award Amarok with the Best Application award! we are obviously very excited and very pleased to win this award, and want to (tearfully) thank all those users who have been with us through the long dark (teatime of the soul) times of Amarok 1.x.... wait, we never had those. nevermind.

Anyway, I would like to thank everyone on the behalf of the Amarok team for supporting us, and most of all for believing in us throughout the long Amarok 2 process. It's coming. Soon. But Not Yet (tm).

The other winners of Akademy awards this year include Nuno Pinheiro (Oxygen) for Best Non-Application Contribution, and we're exceedingly glad to be able to say that we have been collaborating with Nuno to get some kick-ass new looks for Amarok. Our continued cooperation will definitely result in some pretty sweet new designs for Amarok, and we are really happy to be working with him.

The other winner of the Best Contributor to KDE is none other than Aaron Seigo, KDE dancer extraordinaire and resident party animal. After a late night saturday, Aaron was able to provide enough lap dances to the judges to sway their opinion in his favor, and he took home the goods.

I'm excited to be done with the talk portion of Akademy, and to get to the hackathon sessions. I'll have to find a way to get through the e.V. meeting tomorrow, but other than that, expect a productive week of amarok hacking coming up!

Akademy social event

nospam@example.com (Seb Ruiz) — Sun, 10 Aug 2008 04:22:38 -0400

Last night I managed to have nearly 100 people sign Lydia’s little black notebook at the Akademy beer-event. It was fun and a perfect example of how beer can give you a reason to do practically anything.

Coming up: Amarok talk. Must write notes.