DistroWatch Weekly, Issue 652, 14 March 2016

Feature Story (by Jesse Smith)

ReactOS 0.4.0



Many people in the open source community see Microsoft's Windows operating system as an enemy, or at least an unwelcome competitor. Still, the fact remains many people find being able to run Windows applications useful, sometimes even necessarily for one reason or another.



ReactOS is an open source operating system which seeks to re-implement the design and technology of Microsoft Windows. Written from scratch, without using any code from Windows, ReactOS uses its own implementation of the NT kernel and cooperates with the WINE project to offer compatibility with Windows software, file systems and device drivers. The latest release, version 0.4.0, includes the following features:

ext2 read/write and NTFS read support

New explorer shell and theme support

SerialATA support

Sound support

USB support

VirtualBox and VirtualPC support

Wireless networking There are two editions of ReactOS we can download: a live CD and an installation disc. The installation disc is 94MB in size while the live disc is a mere 66MB. These files are compressed to provide faster downloads and, once decompressed, the ISO images take up 113MB and 198MB of space, respectively.





ReactOS 0.4.0 -- The application menu and file manager

(full image size: 59kB, resolution: 1280x1024 pixels)



I downloaded both editions of ReactOS and tried to use both. At first I attempted to write the images to a USB drive as USB support was mentioned in the project's release notes. However, I was unable to get either of my test computers to boot from the USB thumb drives and I burned copies of the ISO files to CDs. When trying to boot the operating system on my laptop computer, ReactOS immediately displayed an error message saying the operating system was "out of memory". When attempting to boot the operating system on my desktop machine, the operating system started to load, but after about 15 seconds displayed the classic Blue Screen Of Death, reporting the system could not continue to run and had shut down to avoid damaging the computer's hardware.



Not yet deterred, I tried booting both discs in a VirtualBox virtual machine. The live disc booted to a Windows-like desktop. The background was soft blue. Icons for accessing the file system were displayed in the upper-left corner. The operating system's application menu, task switcher and system tray were displayed along the bottom of the screen. The interface closely resembles a Windows 98 or Windows 2000 desktop system.



While playing with the live disc can give us a feel for what ReactOS looks like, if we want to really explore the operating system we will want to install it. I rebooted my virtual machine with the ReactOS installation disc mounted. The disc boots directly into the project's text-based installer which looks and acts a good deal like the Windows installer from the XP era. We are asked to select our keyboard's layout from a list and then warned ReactOS supports installing on partitions formatted with the FAT file system exclusively. We are then asked to select our screen's resolution from a list. Next, we are shown a list of partitions on our disk and given the chance to delete the existing partitions or add new ones. We are then asked which partition should play host to ReactOS. The last question the installer asks us is if it should install a boot loader, either on our hard drive or on a floppy disk. With our answers given, the ReactOS installer then copies its files to our drive and reboots.



When the system starts up for the first time, it loads a graphical environment and a configuration wizard walks us through the remaining steps of setting up the operating system. We are shown licensing information for ReactOS and then given the chance to change our keyboard and language settings. We are asked to provide our name and then set a hostname and administrator password for our system. The final screen gives us the chance to change the system clock and set out time zone. The system then reboots again and, when ReactOS starts, it brings us straight to the desktop environment, logged in as the administrator.



Whenever I started ReactOS, the system always logged me in automatically, even after I had created additional user accounts. If I logged out of the administrator account I would be presented with a graphical login screen. I tried to sign in as other users I had set up on the system, including a regular user account and a guest account. Attempting to sign into any account, even the administrator's account, would simply return me to the login screen again. This meant that if I logged out of the administrator account I would need to reboot the system in order to get signed in again.



Each time I logged into the ReactOS system, a hardware wizard would appear and offer to try to find device drivers for two pieces of virtual hardware. The wizard was unable to find drivers for either of the devices (identified as System Device and Audio Device). The hardware wizard appeared every time I logged in, even after I checked the box telling the system not to show the window again. Also on the topic of hardware, according to the ReactOS task manager, the operating system used about 100MB of RAM when sitting at the desktop. I was a little sceptical of this reading as the task manager incorrectly detected the amount of total RAM available. This memory detection error appears to be a problem with the task manager itself rather than ReactOS in general as the system information panel (found in the My Computer->Properties menu) displayed the correct amount of available RAM.





ReactOS 0.4.0 -- Managing services and device drivers

(full image size: 76kB, resolution: 1280x1024 pixels)



ReactOS has an interface that looks and feels very much like earlier versions of Microsoft Windows. The file manager, control centre and application menu all have a very familiar appearance. I spent a lot of my time exploring the settings panel and had mixed results. As I mentioned before, I was able to create user accounts and set passwords for them, but I was unable to log into the accounts. There is a module for dealing with printers, but ReactOS was unable to detect printers on my network and I could not find a way to add printers to the system. Changing the desktop's appearance worked well enough and the networking configuration settings worked for me. Unlike earlier versions of Windows, ReactOS has a software manager and I had some good and some bad experiences with managing packages, which I will cover later.



ReactOS ships with some familiar applications, including a text editor, image editor and calculator. There are a few small games, including Mine Sweeper and Solitaire. These programs work, but tend to be limited in their functionality. For instance, the image editor is only able to work with bitmap (BMP) image files and cannot save images in other formats. Transferring files posed a problem early on too as ReactOS does not ship with an OpenSSH client. There is an FTP command line client available in the default installation, but upon connecting to a remote FTP server using the default client, the entire ReactOS system locked up, forcing a hard reboot.





ReactOS 0.4.0 -- The control centre and networking settings

(full image size: 72kB, resolution: 1280x1024 pixels)



While older versions Windows had a configuration module which would facilitate removing applications, they did not feature a software manager in the same way most Linux distributions do. ReactOS has taken the initiative of adding a package manager, called Applications Manager. This program displays a list of software categories down the left side of the window and a list of items in the selected category on the right. When we highlight an application with our mouse, a brief description of the software, its size, license and website are displayed at the bottom of the screen. There are 172 available applications in total, most of them popular open source programs such as LibreOffice, the GNU Image Manipulation Program (GIMP), VLC and GnuCash.



Since one of the main advantages of running ReactOS appears to be the ability to run applications developed for Windows, I decided to try installing a handful of the programs listed in Applications Manager, along with a few programs I installed from the Web that were not listed. The GIMP software installed, but upon starting up GIMP displays dozens of error messages and then locks up. I tried to terminate the GIMP process using ReactOS's task manager, which caused the task manager to also lock-up. A reboot was required to resolve the situation. Firefox was available in the software manager and worked as expected. I was able to browse web pages and play HTML 5 videos, though videos played without sound. I tried to install Flash, but the Adobe Flash installer failed to connect to Adobe's servers. I'm not sure if this is a compatibility issue with ReactOS or a glitch on Adobe's side of things.





ReactOS 0.4.0 -- Installing software with Applications Manager

(full image size: 70kB, resolution: 1280x1024 pixels)



Filezilla was not available in the software manager and, while I was able to install the software from Filezilla's website, the application would not launch. The Putty implementations of secure shell and secure FTP are in the software manager and worked perfectly. Both LibreOffice and OpenOffice are listed in the software manager, the former refused to download due to a broken URL, but OpenOffice did install. However, OpenOffice would not launch due to a missing file. Steam was listed in Applications Manager, but would not download and the error message given seems to suggest an incorrect checksum was the problem. In short, less than half the programs I tried worked and installing software from outside sources tended not to deliver the desired experience.



Conclusions



The ReactOS project appears to be trying to recreate the experience of Windows 95 through to Windows 2000 as faithfully as possible and, from a look and feel perspective, the developers have done an amazing job. However, from a practical point of view ReactOS rarely delivered the functionality I would expect from its closed source cousin. The system refused to run on either of my test machines and, though it would install in VirtualBox, I regularly ran into system crashes, sound didn't work and most of the Windows applications I tried to run failed in some way. I have had better luck running Windows software with WINE on Linux boxes than I did with ReactOS.



In the end, while I admire the ReactOS team's attention to detail in recreating the Windows interface, I do not think running ReactOS is practical for most situations. WINE will run most Windows software passably well and there are lots of good open source alternatives to most closed source applications. Running an old copy of Windows in a virtual machine would probably offer a better experience in most circumstances. The one area where I think ReactOS would shine would be if a person needed to run a Windows clone on hardware that also required Windows specific drivers. ReactOS reports itself to be compatible with drivers written for Microsoft's operating system and I think that may prove to be the project's strong point. Some old systems are very particular when it comes to applications and drivers and I think ReactOS might fill in nicely in those situations. * * * * * Hardware used in this review



My physical test equipment for this review consisted of a de-branded HP laptop and a desktop HP Pavilon p6 Series with the following specifications, respectively: Processor: Intel i3 2.5GHz CPU

Display: Intel integrated video

Storage: Western Digital 700GB hard drive

Memory: 6GB of RAM

Wired network device: Realtek RTL8101E/RTL8102E PCI Express Fast

Wireless network device: Realtek RTL8188EE Wireless network card Processor: Dual-core 2.8GHz AMD A4-3420 APU

Storage: 500GB Hitachi hard drive

Memory: 6GB of RAM

Networking: Realtek RTL8111 wired network card

Display: AMD Radeon HD 6410D video card

Miscellaneous News (by Jesse Smith)

Wayland coming to Fedora in stages, Ubuntu seeks to remove Python 2 from installation media, Debian switches back to Firefox and Trisquel's status



The Fedora distribution has been a leader when it comes to adopting the Wayland display technology which is intended to be a modern replacement for the aging X display software. For a while it looked as though Fedora 24 would ship with Wayland as the default display technology, but the Fedora developers have decided, for now, to keep using X as the default technology and use Wayland as a session option. A blog post on the GNOME website talks about work that has gone into GNOME Shell running on Wayland and the desktop features we can expect to see in Fedora 24. " The Fedora Workstation working group decided this week that we're not quite there yet for making the Wayland session the default in Fedora 24. That is a bit of a disappointment for me, since we have worked very hard this cycle to close the gaps; you can see the progress we've made here: primary selection, kinetic scrolling, drag-and-drop, start-up notification, pointer confinement have all landed this cycle. Not to mention countless smaller bug fixes and robustness improvements. But gaps are gaps, so we will take one more cycle to address them. " * * * * * Fedora is not the only distribution trying to shake off older technologies. The Ubuntu team is currently trying to remove older versions of the Python interpretive language from their Desktop edition. Major versions of the Python language, specifically versions 2 and 3, are similar, but not compatible with each other. This means software originally developed with Python 2 needs to be altered to work with Python 3. The result is that most distributions need to ship both versions of Python in order to support all the software that has been developed using the language. Barry Warsaw reported earlier this month that Ubuntu is very close to removing all dependencies on Python 2 from its Desktop edition: " A long standing goal for Ubuntu has been the demotion of Python 2 off of the default installation images. This is something many folks have been working on for quite a few cycles, and it's finally within our reach for Desktop (Server and Touch already have no Python 2 on them). Of course this is within the context of a much longer term, cross distro effort to port the entire world to Python 3. We have one last thing holding Python 2 on the Desktop image, and it's a problematic one: system-config-printer. Actually s-c-p is already itself ported to Python 3, but it transitively depends on Python 2 through the chain of python3-smbc -> libsmbclient -> samba-libs -> libpython2.7. So the real problem is fully porting Samba to Python 3. Ubuntu is not the only distro converging on this bottleneck. Clearly, we won't have untangled the Samba stack in time for 16.04. " Some alternative plans for reducing dependency on Python 2 are mentioned in Warsaw's e-mail. * * * * * Last month we reported that Debian developers were considering dropping their modified edition of Firefox, named Iceweasel, in order to resume packaging Mozilla's Firefox complete with the "Firefox" name and branding. Last week the Debian project moved forward with this plan, packaging the Firefox web browser in place of Iceweasel. People who currently use the re-branded Iceweasel browser will automatically receive the new Firefox package as an update. " This took longer than it should have, but a page is now officially turned. I uploaded Firefox and Firefox ESR to Debian Unstable. They will have to go through the Debian NEW queue because they are new source packages, so won't be immediately available, but they should arrive soon enough. People using Iceweasel from Debian Unstable will be upgraded to Firefox ESR. " * * * * * Trisquel GNU/Linux is a distribution that is built from Ubuntu packages with all of the non-free components removed. This results in an entirely free (as in liberty) operating system. Last week the Trisquel project released a status report which talks about the project's improved build system, upcoming plans for Trisquel 8 and the project's finances: " This year will bring us Trisquel 8, codename "Flidas". We have already started the development, aiming to produce the first testing images in a couple of months followed by a final release not long after the upstream distro (Ubuntu 16.04) is released in April. Editions will continue to include a main GTK-based desktop, a lighter environment and a Sugar-based image, but we hope to extend that list with new additions. " The rest of the report contains further details.





Tips and Tricks (by Jesse Smith)

Verifying ISO images



In the wake of the attack against the Linux Mint website last month there have been many concerns raised that distributions are not doing enough to protect their users from downloading compromised ISO files. People have written to us and asked why there are not more checks in place against people installing corrupted ISO images. We have received e-mails asking us to set up a database of checksums so people can verify the one their distribution's website provides is correct. Others have asked us to put a big banner on our website to warn people when a project's download servers are compromised.



While we have received a number of interesting technical suggestions for checking the legitimacy of ISO images (with varying degrees of practicality), the reason we are not implementing most of them is the problem the Linux community faces with regard to corrupted ISO files is not technical, but (I believe) educational.



The truth is, Linux Mint, like most of the major open source operating systems, not only provides checksums (digital fingerprints) for their ISO files, the project also digitally signs the checksums. This means, in short, that if an attacker replaces a good ISO image with a corrupted one, the bad ISO's checksum will not be correct. And, if the attacker is smart enough to replace the distribution's checksum too, then the checksum's signature will not be valid. Put another way, there is a chain of trust. We know the ISO file is correct because the checksum is correct. And we know the checksum is correct because it was digitally signed by the development team. If the signature is bad, then the chain of trust collapses and the ISO cannot be considered safe to install.



All of this probably sounds a little abstract, so why don't we look at an example? Let's use Linux Mint's latest release, version 17.3, and walk through how to confirm the ISO image available for download is legitimate. If we look at one of the Linux Mint download mirrors we will find a collection of ISO images; a file called sha256sum.txt which contains checksums (digital fingerprints) of the ISO files; and a signature file, sha256sum.txt.gpg. Let us assume, in this example, we are downloading the linuxmint-17.3-cinnamon-64bit.iso file, which we plan to install. While the ISO file is downloading, we will also download the sha256sum.txt and sha256sum.txt.gpg files.



The first thing we should do is attempt to verify the checksum file, sha256sum.txt, is valid. That means it has been signed by a developer working for Linux Mint. We can do this with the gpg command line program. Running the following command will attempt to verify the checksum file is correct: gpg --verify sha256sum.txt.gpg sha256sum.txt In this case, I get back the information: gpg: Signature made Wed 06 Jan 2016 12:06:20 PM AST using DSA key ID 0FF405B2

gpg: Can't check signature: public key not found We know when the file was signed and with which key (0FF405B2), but we do not know whose key that is. We need to download and verify the key. We can do this by asking a special server, called a key server. A key server holds a collection of keys and information on those keys. Here we check out information on the key 0FF405B2. I use the pgp.mit.edu server, which is a popular one for holding digital keys: gpg --keyserver pgp.mit.edu --recv-keys 0FF405B2 Here is the information I get about the requested key: gpg: requesting key 0FF405B2 from hkp server pgp.mit.edu

gpg: key 0FF405B2: public key "Clement Lefebvre (Linux Mint Package Repository v1) <root@linuxmint.com>" imported It looks like this key belongs to Clement Lefebvre of the Linux Mint team. That is a good sign. Now we try to verify the checksum file again: gpg --verify sha256sum.txt.gpg sha256sum.txt Since we have data on the digital key now, gpg gives us the following information: gpg: Signature made Wed 06 Jan 2016 12:06:20 PM AST using DSA key ID 0FF405B2

gpg: Good signature from "Clement Lefebvre (Linux Mint Package Repository v1) <root@linuxmint.com>" Now we know when the checksum was signed and by whom. The information looks correct so we know we can use the checksum file to verify our ISO download. We can do this with the following command: sha256sum -c sha256sum.txt Assuming the ISO image is correct, we will see several lines, one of which should read: linuxmint-17.3-cinnamon-64bit.iso: OK If the above line does not appear in the output from the sha256sum command then the ISO file cannot be trusted. Either it was corrupted during the download and should be deleted or the file has been replaced on the server and should not be trusted. Whatever the cause, a bad ISO file will result in sha256sum displaying a warning: sha256sum: WARNING: 1 computed checksum did NOT match Hopefully more projects will start signing their checksum files and those that already do will make it easier to find their signatures. Often times it is necessary to browse project mirrors to find checksum files and their signatures and the attack on Linux Mint's servers has demonstrated this information needs to be easier to find. The Peppermint OS team has a fine example on their website of how this can be done. Clicking on one of the project's download buttons brings up a page with links to the ISO, its checksum and step-by-step instructions explaining how to verify the downloaded ISO has not been corrupted. I believe the Peppermint OS team deserves some credit for being community leaders in educating their users and keeping them safe.



We will also be helping to keep our readers safe. In our front page release announcements we will provide links to signature files as well as checksums, when they are available.





Torrent Corner

Weekly Torrents



Bittorrent is a great way to transfer large files, particularly open source operating system images, from one place to another. Most bittorrent clients recover from dropped connections automatically, check the integrity of files and can re-download corrupted bits of data without starting a download over from scratch. These characteristics make bittorrent well suited for distributing open source operating systems, particularly to regions where Internet connections are slow or unstable.



Many Linux and BSD projects offer bittorrent as a download option, partly for the reasons listed above and partly because bittorrent's peer-to-peer nature takes some of the strain off the project's servers. However, some projects do not offer bittorrent as a download option. There can be several reasons for excluding bittorrent as an option. Some projects do not have enough time or volunteers, some may be restricted by their web host provider's terms of service. Whatever the reason, the lack of a bittorrent option puts more strain on a distribution's bandwidth and may prevent some people from downloading their preferred open source operating system.



With this in mind, DistroWatch plans to give back to the open source community by hosting and seeding bittorrent files. For now, we are hosting a small number of distribution torrents, listed below. The list of torrents offered will be updated each week and we invite readers to e-mail us with suggestions as to which distributions we should be hosting. When you message us, please place the word "Torrent" in the subject line, make sure to include a link to the ISO file you want us to seed. To help us maintain and grow this free service, please consider making a donation.



The table below provides a list of torrents we currently host. If you do not currently have a bittorrent client capable of handling the linked files, we suggest installing either the Transmission or KTorrent bittorrent clients.



Operating System Torrent MD5 checksum ClearOS 7.2.0 ClearOS-DVD-x86_64-7.2.0.iso a094763e6ed5d9b073fd4e651f9a48f1 Qubes OS 3.1 Qubes-R3.1-x86_64/Qubes-R3.1-x86_64.iso.asc 5c8343efc35f59af374ef6b373eede05



Archives of our previously seeded torrents may be found here. All torrents we make available here are also listed on the very useful Linux Tracker website. Thanks to Linux Tracker we are able to share the following torrent statistics.



Torrent Corner statistics:

Total torrents seeded: 172

Total data uploaded: 31.5TB

Released Last Week

Tails 2.2



The developers of The Amnesic Incognito Live System (Tails), a Debian-based live disc for anonymous communication and on-line web browsing, have released a minor update to their distribution. The new release, Tails 2.2, features support for viewing DRM-protected DVDs, automatically saves the KeePassX database after each update and includes an update to the Tor Browser. " This release fixes many security issues and users should upgrade as soon as possible. New features: Add support for viewing DVDs with DRM protection. Upgrades and changes: Replace Vidalia, which has been unmaintained for years with a system status icon indicating whether Tails is connected to Tor or not, Onion Circuits to display a list of the current Tor circuits and connections. Automatically save the database of KeePassX after every change to prevent data loss when shutting down.... release notes.



Linux From Scratch 7.9



Bruce Dubbs has announced the release of Linux From Scratch (LFS) 7.9, a book of step-by-step instructions on how to build a base Linux system from scratch. Beyond Linux From Scratch (BLFS) 7.9, a separate book that extends the base system with additional software packages for desktops and servers, is also out: " The Linux From Scratch community is pleased to announce the release of LFS version 7.9 and BLFS version 7.9. This release is a major update to both LFS and BLFS. The LFS release includes updates to glibc 2.23, Binutils 2.26 and GCC 5.3.0. In total, 25 packages were updated and changes to text have been made throughout the book. The BLFS variant includes approximately 800 packages beyond the base Linux From Scratch 7.9 book. This release has 597 updates from the previous version including numerous text and formatting changes. A major change to BLFS includes the addition of the KDE Plasma 5 desktop. " Read the rest of the release announcement for more information.



Qubes OS 3.1



Joanna Rutkowska has announced the launch of Qubes OS 3.1, a new stable release of the Qubes operating system which enforces strong isolation between tasks. Version 3.1 of the security-oriented project features a new management system that centrally controls Qubes configuration: " The major new architectural feature of this release has been the introduction of Qubes Management infrastructure, which is based on popular Salt management software. In Qubes 3.1 this management stack makes it possible to conveniently control system-wide Qubes configuration using centralized, declarative statements. Declarative is a key word here: it makes creating advanced configurations significantly simpler (the user or administrator needs only to specify what they want to get, rather than how they want to get it). This has already allowed us to improve our installation wizard (firstboot) so that it now offers the user ability to easily select various options to pre-create some useful configurations, such as e.g. Whonix or USB-hosting VMs. " The new release of Qubes OS also supports booting on machines with UEFI and introduces additional hardware support for a range of video cards. The release announcement and release notes have additional details.





Qubes OS 3.1 -- Exploring the application menu

(full image size: 142kB, resolution: 1366x768 pixels)



ClearOS 7.2.0



Devin Johnson has announced the release of ClearOS 7.2.0, the latest stable version of the project's CentOS-based distributions designed for servers: " ClearOS 7.2.0 final for all editions has arrived. ClearOS 7 is available in three editions - Community, Home and Business. All editions can be installed from the same ISO image, but each edition provides access to different repositories with a mix of applications, support and services to meet different environment needs. This release is the second in the ClearOS 7 series and provides primarily maintenance and bug fixes. ClearOS 7.2.0 introduces: support for LVM caching; improved VM support. " The brief release announcement links to a more detailed changelog which provides a comprehensive list of changes and update since the release of ClearOS 7.1.0 in November 2015: " Dashboard unusable in FF - resolved; prevent Zarafa from being installed when Samba directory used - resolved; Suva daemon is not reloadable - resolved.... " * * * * * Development, unannounced and minor bug-fix releases

SparkyLinux 4.3-dev2

PClinuxOS 2016.03

Manjaro Linux 16.03 "LXQt"

FreeBSD 10.3-RC2 (Announcement)

Upcoming Releases and Announcements

Opinion Poll

Do you buy computers with Linux pre-installed?



In the past it was often difficult to find companies which sold computers with Linux pre-installed on their hard drives. Over time, the situation has gradually improved with more and more companies selling computers with Linux already installed.



This week we would like to know if you buy your computer(s) with Linux pre-installed or if you purchase computers with another operating system in place and install Linux later? If you have purchased computers with Linux (or BSD) already installed on the drive, please let us know where you bought your computer in the comments.



You can see the results of our previous poll on reviewing Ubuntu community editions here. All previous poll results can be found in our poll archives. Do you buy computers with Linux pre-installed?



I buy computers with Linux/BSD pre-installed: 183 (7%) I buy computers with blank hard drives: 401 (15%) I buy computers with another OS pre-installed: 565 (21%) I assemble my own computers from parts: 961 (35%) Some or all of the above: 570 (21%) None of the above: 52 (2%)

DistroWatch.com News