Secure Virtual Network Computing

With the ever increasing speed of internet data transfer, virtual network computing (VNC) has become a viable alternative to stand alone work stations with duplicate software installations. VNC enables users to access the desktop of a work station remotely via the internet through a slim client computer for the processing of data with heavy-weight applications. Commonly, a window server application needs to be installed on the work station and a viewer application needs to be installed on the client computer to display the work station's desktop. Once the client is connected to the server, the user can work on the server like on any other desktop. Modern VNC versions even allow drag-and-drop file transfer between client and server.

Commercial VNC software is available for Linux/Unix, Microsoft Windows, and Apple's OS X operating systems (e.g. RealVNC). Apple provides simple remote desktop connectivity for its computers in Leopard (ARD 3.2). Redstone Software offers only the Vine 3.0 server for OS X (formerly OSXvnc) free and charges for a sophisticated server/client combination with which you can drag and drop files. However, Chicken of the VNC can be used for viewing on OS X as a free complement to the Vine server.

A great advantage of VNC is that the connectivity between client and server is platform-independent. Their operating systems need not be identical. I currently use TightVNC. TightVNC is an award-winning open source project offering a highly functional package for UNIX- and Microsoft Windows-based operating systems. I installed the server on a computer running Microsoft Windows XP-64. I view the desktop on a machine running Ubuntu 8.10 or on Apple computers running OS X. TightVNC comes with a platform-independent, Java-based viewer that can be used as stand-alone application, provided the Java Runtime Environment (JRE) is installed. JRE is included with OS X and can be easily installed with the Synaptic Package Manager on Ubuntu. In addition, a viewer applet can be accessed on the server through the browser. The latter option does not require any install on the client.

VNC connections commonly use ports with numbers equal to or greater than 5900. The last digits identify the display number. The user needs to register a user account with username and password on the server. The regular login dialog is unencrypted, rendering the server vulnerable to break-ins. This hazard is perhaps tolerable on a local network protected by a firewall. However, if the server is slated to be accessible over the internet at large, unencrypted login exposes the server to excessive risk. Remote login to the server through a secure shell with RSA encryption is preferable and SSH protocols provide this option.

SSH encryption is fairly safe, particularly when passphrase encryption is employed. As additional precaution, the administrator may wish to ascertain that root login is disabled in the SSH configuration script. I once made the mistake to administer a computer with superuser privileges choosing a common English noun as password. I did not know that root was enabled by default as username on port 22 in the SSH configuration script. It took some miscreant five years to guess the password, turning my machine into a reflector for evil data transfer, until the gate keepers found out about it. To preempt complications of this nature in the future, I use sudo these days, if I need to execute commands with superuser privileges.

Remote login to a VNC server from a VNC viewer with SSH entails two steps: first the connection to the VNC server needs to be successfully established via the SSH protocol, and then the viewer has to be opened using the connection. I developed a Java-based application on the intel architecture from open sources for Apple's OS X 10.4 (Tiger) and 10.5 (Leopard) that achieves this goal in a convenient amalgamated process. This sVNC client combines jcraft's SSH login with the TightVNC viewer.

If you like to use the sVNC client, you may wish to download the zipped folder containing the application bundle with a click on the logo on the left (trademark application #77642277, pending). Copy the application to a folder of your preference. Double-click on the application's icon to launch the SSH dialog. You are asked to enter your username @ the VNC server identified by name or IP address. Subsequently, you need to provide a listening port:host:remote port combination, specifying the local host and the ports for the displays. Commonly, you can use the default combination 5900:127.0.0.1:5900. This combination specifies the host and serves from and to displays with the number 0.  If the VNC server uses a different display number, e.g. display 1, change the first number to 5901. If you wish to use a different display on your home computer, you need to change the last number accordingly. There is no need to change the address for the local host.

After you provided this information, the SSH dialog generates RSA keys. Your consent is needed. You must enter your password for the VNC server. The connection is attempted. In case of success, you need to provide your password once more for the VNC viewer, the display of the remote desktop should pop up, and you are ready to go. The configuration options to the viewer can be found in the README file included with the application in the zipped folder.

The client works well for me. If the remote desktop seems unresponsive to clicks, hit the refresh button on the viewer's top panel. The viewer may crash when the server is accessed in a sleep state. Do not be discouraged. The viewer will work on the second attempt. I hope sVNC will be useful to you.

AquaInkscape

With Aqua, Apple provides its customers with an intuitive graphical user interface (gui) and an appealing desktop display. Apple's OS X, also known as Darwin, is a UNIX-based operating system. This permits frugal users to run free open-source software on their Apple computers. The main obstacle that needed to be overcome was that much open source software is developed for operating systems that use the X11 window system, whereas Apple uses its own Quartz Compositor. Apple solved this problem with developing X11.app. This application consists of a command line terminal that is run from an X11 window server. Open-source applications that were compiled for Apple computers and use X11 can be run from this terminal. A number of such applications can be found under the Unix & Open Source tab on Apple's Mac OS X Software downloads site.

The X11 windows system does not take fullest advantage of Aqua's capabilities. The X11 project develops very rapidly, progressing faster than the three-year release cycle of Apple's OS X. Incompatibilities may result. Hence, I decided to adapt available open source software that scientists commonly use, e.g. desktop publishing and graphics applications, to run with the Quartz Compositor as back end. The applications take advantage of Aqua and do not need X11.app. They are compiled for Tiger (OS X 10.4) and, more recently, Leopard (OS X 10.5) on the intel (i386) architecture. The applications can be downloaded from my project site on sourceforge.net called "Software for Small Budget Science".

Last week, I completed my first Aqua-build of Inkscape for Tiger. I named it AquaInkscape. A version for Leopard is in preparation. Inkscape is a versatile vector graphics application with a great number of tools and options similar to Adobe's Photoshop®
and Illustrator® CS4
or the open source application GIMP. These applications feature freely-floating tool bar, control and navigation windows that are detached from the main window with the canvas. This is great when you have two monitors attached to your computer and are able to reserve one for the tools, control and navigation, leaving the view of your work unobstructed on the other. However, if work needs to be done on a small display like a PDA, clutter ensues and free-floating windows quickly finish unretrievable in the stack of open windows.

By contrast, in Inkscape the tool bar is integrated into the main window. This may seem old-fashioned. But I found it truly helpful when working in a confined space. Detached popup windows provide further options. But these windows are task-specific and do not need to be left open. This design profoundly enhances the user's experience of an uncluttered workspace.

To software engineers, Inkscape offers the advantage of an application that can be accessed by and integrated into programs written in Python, a programming language widely used in science and for internet applications (e.g. the Google App Engine).

Below,  I briefly summarize my experience with a number of issues pertinent to building AquaInkscape.

• I compiled 35 packages to build this application. The needed packages were identified using configure --help, beginning with Inkscape and proceeding through the packages required subsequently. I used the latest stable releases for most packages and developmental versions for gtk+-2.0 and cairo. 

• For compilation, I followed GNU standard procedures, that is the commands aclocal, autoconfig, autoheader, and automake, if the package was unconfigured. Sometimes, packages provide an autogen script that can be used instead. Then, I execute configure, make, make test and, if all goes well, make install. I install into the default location, that is /usr/local. 

• In order to be able to run the packages with Aqua, the compiles have to be configured without X11 and with quartz, if configure --help indicates these options. The packages gtk+-2.0 and cairo are instrumental for rendering Inkscape's gui. They can be built for quartz. 

• The demos in gtk+-2.0 and tests in cairo instruct about the potential performance of these packages with Aqua. In the demos for gtk-2.0, not all options worked because the default collection of theme icons known as hicolor icon theme was incomplete. I found a full set that fulfilled the necessary requirements in the Mac4Lin Leopard gtk icon theme package. 

• With my cairo build (version 1.7.4) a third of the tests failed. Most failures involved tests with very large font and some svg options. Only few failures were associated with quartz. I decided that the chances were good for a functional version of Inkscape for Aqua.
  

• It is important to configure the font usage accurately, because faulty instructions may result in ugly font output and Inkscape crashes. I use fontconfig and freetype2 for font management. On my system, the path to the default fonts needed in the configuration of fontconfig is /usr/local/etc/fonts.  You may furnish additional font with ghostscript or gutenprint. Both packages will install fonts in /usr/local/share by default.

• For ImageMagick, I used precompiled binaries.

After all required packages had eventually been installed, I was prepared to compile the inkscape binary with the MacOSX build script provided in Inkscape's packaging folder. I specified the options openoffice files, internal perl, LittleCms, Inkboard, Poppler-Cairo, ImageMagick/Magick++, Libwpg, as well as with and without internal python. For Python, I compiled and installed version 2.5 on my system. Precompiled MacOS X binaries of Python 2.5 cannot be used because they are incompatible with the Numpy package that Inkscape requires. Therefore, the python version of AquaInkscape contains Python 2.5 modules.

Finally, I had to edit the scripts for packaging so that AquaInkscape would launch without asking for X11. The resulting application seems in good working order. I have not tested all possibilities. The only shortcoming I found so far and have been unable to resolve is that the program does not respond to the quit button in the application menu once inkscape-bin is running. The application can be quit, however, with the button in the pulldown menu under File and with the button in the icon menu on the dock. Clicks with the mouse expand the compressed tool icons in the side bar. Have a try and be patient at start up! The application takes some time to launch.

Broken Cups in Your OS X Cupboard

I work a lot with pictures professionally and have been using Apple computers for most of my career, except my Master's Thesis which I wrote on a DEC PDP 11. I was only a user. However, it always struck me with trepidation that I did not understand a thing of what was going on under the hood. I was eventually roped into computing, when the Apple operating system turned to UNIX around the year 2000. With the introduction of OS X, Apple had opened itself to Open Source computing which opened a new universe to me. Seven years later, I spent way more time with compiling packages than I ought to, and way more often than I liked, I ended up in a real fix. Regardless, the euphoria of empowerment outweighed the disappointment by far.

Today I report on one example of the kinds of adventure one may encounter on this road. Several months ago, I happened on the website of cups printing. Cups is the printing routine used in OS X. I found a pre-compiled binary of a more recent version than I had ready for installation. Since I wanted to be at the cutting edge, I downloaded the offering and installed it without reading the fine print. The result was that I could not print anymore. The fine print said that one had to re-install the operating system, if the update did not work. Oh!

I was not prepared to do that. So I compiled the most recent 1.4.x version for developers from source myself and installed it. After that, I could not even get passed the login window. I had a series of sweaty moments since then. I did not believe the functions that depend on cups! Much of OS X appears to depend on the cups library in one way or another. How can this be in the age decentralization? I managed to fix the problem by re-installing n older version in the single user mode.

Months later, I re-visited the cups website. The pre-compiled packages were gone, and it was recommended to try one the versions 1.3.x. After a number of tries, one of them worked and I offer the result on my SourceForge.net project (Software for Small Budget Science). The package is compiled with Tiger on Intel. It has worked well for me. However, one nuisance remains. The package needs to be reinstalled after each Apple security update. Let my adventure be a warning.