Microphone not working on Debian laptop

After my recent success in getting video chat via MSN working on Linux (OK, Meebo's success really) I was disappointed to find that the microphone on my laptop wasn't working, and neither was my plug-in microphone, leaving my wife to have to type her answers while she could hear her friend speaking.
I managed to fix the problem later on, with a bit of fiddling. I think the solution I came across first is more complicated than a solution I found later, so I'll describe the easy solution first.
Not all input options are enabled in Volume Control (right-click speaker icon in panel, or use the Terminal command gnome-volume-control) by default. By selecting Edit > Preferences, it's possible to enable more options. The process is described in this tutorial, so I won't repeat it, but I'll add a screenshot.



The solution I actually used involved making changes in alsamixer, although I enabled the microphone just by fiddling with the controls until it worked. Using Volume Control is probably more sensible. Here's how to fiddle, if you must:

Select [Capture] with the tab key.
Select options with the left/right arrow keys.
Enable with the space bar.
Change options with the up/down arrow keys.

I think what worked for me was fiddling with the Input Source options. Here's a screenshot. I'm still not sure what all the option do, and of course the options may differ with different sound cards.


This advice may be helpful if fiddling doesn't work.

Footnote: When I'd got about half way through writing this, I kicked myself- I'd used the Alsa Volume Control a year or so ago in Ubuntu before Ubuntu switched to the PulseAudio system. I must have enabled my microphone under Alsa in Ubuntu and then completely forgotten how I'd done it- one of the reasons I now write this blog. And in the hope that somebody else in the same situation might find it useful.

Update: Some time after installing Debian Squeeze beta (as was) I noticed that my microphone had stopped working again. I managed to fix it using a tip from the ALSA unofficial Wiki page above.

Comment from reader: In my case, with the snd-hda-intel driver there was a mislabeling of capture channels (probably due to incorrectly selected model in snd-hda-intel). The alsamixer capture item labelled "Digital" was controlling the microphone recording volume, while "Capture" and "Capture1" didn't change anything.

I'm not sure whether Squeeze muted the required digital channel or I did it myself.

MSN video chat in Linux

Most computer users use Windows, and most of them use MSN for messaging. So how do you talk to them in Linux? Pidgin works fine for chatting over the MSN network in Linux (Gnome), but nothing works with video chat with sound.
Yesterday my wife asked me to set up a video chat with her friend (who uses Windows). This I had done previously by booting into Windows and using Live Messenger, but recently I deleted my Windows partition. I tried something I'd heard about previously: Meebo, "the web platform for IM on any network or site."
Frustratingly, I could see my wife's friend's webcam, but my own remained inactive. Embarrassingly, I had to concede that I couldn't set up video chat.
Later, I was Googling for an answer and came across this information:

You need to allow meebo access from the settings manager, go here. Look for mee.tokbox.com set to always allow. This works on a few other websites too. The problem is when you set it to allow while in the website for whatever reason it doesn't actually do it.

Also after setting it to allow restart Firefox

I've allowed Meebo in Flash player privacy settings, now I'm just waiting for an opportunity to test video chat.


UPDATE: Success!


Update: It looks like Flash 10 may not be able to access webcams because of a bug. Of course that bug may or may not have been fixed by the time you're reading this. If you follow the steps above and still can't see your webcam in Meebo, try here.

How useful is anti-virus in Linux? (Part 2)

In Part 1 I wrote about Linux malware found in a screensaver. In this post, I'm going to talk about a more recent story of a Trojan horse found in a Linux distribution. The story was picked up with glee by Ed Bott:

Every time I write about Windows security software, I get a predictable flood of responses from Linux advocates who claim that they don’t need any such protection. Today comes a shining example of why they’re wrong.

Then Adrian Kingsley-Hughes jumped on the FUD wagon. So should Linux users all be installing anti-virus software? I decided to investigate. With a bit of searching, I found an analysis of the malware script concerned. Submitting the script to VirusTotal produced no detections, but I'd found this blog post from Sophos describing how they detect the malware as Troj/UnIRC-A. Another analysis suggested the malicious package was still available for download. I checked, and it was. The file had already been submitted to VirusTotal in February 2010, when there had been four detections. (A reanalysis didn't produce any more.)



Despite the rather gloating blog from Sophos above, they only added their detection for this malware on the day the story broke. F-Secure added their detection the day after. I don't know when Comodo and Panda added their detections, but I'm guessing they too added their detections after the story broke.

So should Linux users be installing anti-virus products, and combing their systems for malware? There are two points to make here:

• There's no evidence that any anti-virus product would have detected this malware before it was discovered and reported.
• Well over a month after the malware was discovered, it's detected by a tiny minority of anti-virus programs.

The real moral of the story seems to be (as the Sophos blog points out) for administrators to check signatures and checksums of files when using a distro like Gentoo. [Some background I picked up reading the comments sections of various articles about the story: Gentoo is a far from mainstream distro which requires users to compile everything from tarballs.]
In more mainstream distros, software in repositories is digitally signed by the developer, so it is not possible for a package to be replaced with malware. When enabling additional repositories, or trusted third-part repositories, always may sure the appropriate key is installed so software can be authenticated. The following warning means the appropriate key has not been installed, and you are at risk of installing a possibly insecure passage:

You are about to install software that can’t be authenticated! Doing this could allow a malicious individual to damage or take control of your system.

See here for an example.

How useful is anti-virus in Linux? (Part 1)

In almost three years of using Linux, I've never come across any Linux malware.
I have come across two tales of Linux malware. I'm revisiting them now to ask: do these stories suggest that using anti-virus software is necessary or advantageous?
In December 2009, malware was found inside a screensaver on gnome-look.org. The malware was a "script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads".
The moral of the story was clear: don't install software packages from untrusted sources.
The malware script can be found in the Ubuntu forum post linked to in the story above, so I decided to save the script as a text file and send it to VirusTotal, to see how many if any anti-virus programs detect it. I found that somebody had already done this, a couple of days after the malware was discovered, and that no anti-virus program at VirusTotal had detected the script at that time.

I then hit the 'Reanalyse' button to see what the result would be seven months later.


This time, eight anti-virus programs detected the script as malicious.
The two points that can be made here are:

• None of the anti-virus products on VirusTotal (which is most of 'em) would have detected this script as malware during the time it was available to download.
• Even seven months later, only a small number of anti-virus programs would detect this malicious script.

To answer the question: is using anti-virus software necessary or advantageous in Linux? In the case of new Linux malware at least, the answer seems to be that anti-virus software has nothing to offer- caution remains the key.

Pimp my Linux desktop!

Debian Linux, which I'm using at the moment, comes with a pretty standard blue-themed Gnome desktop common to several distros- Debian, Mandriva and Fedora- distinguished only by a branded wallpaper.
It's a simple and elegant theme, but over the last few days I've been customising my desktop, changing the theme and icons. The new theme is a dark one which I think suits my laptop with its grey-bordered screen.



(I used the New Wave 0.9.0 beta 1 theme. The wallpaper is Wassily Kandinsky, Composition VIII, 1923.)

But first of all I changed the icon theme. For some reason I never liked the default 'refresh' icon, particularly as it appears in Firefox/Iceweasel. To my eye, the appearance of Firefox using the Elementary or Gnome-Colors icon theme is much more pleasing.







I changed the theme and icon set pretty much by trial and error, and by Googling for Gnome themes and icons. After I'd finished, I found a couple of good 'how to's', so I won't repeat the information they contain, but rather describe a few issues I came across and the solutions I found.

How to install themes on Ubuntu/Debian.
Customize and Theme-Up your Ubuntu Linux.

(These guides apply to the Gnome desktop, so they may with luck apply to other distros using Gnome too.)

Here are the issues I came across:

Install an Ubuntu theme in Debian and it may depend on an icon theme that is not installed- New Wave for example told me that it was using the Humanity-dark icon theme, when in fact it was using the default theme- the Humanity-dark icon theme appeared on the menu but with no icon.










Install the missing icon theme manually, or another of your choice.

It's apparently possible to change the Main Menu icon in some distros using Gnome Configuration Editor, but this doesn't work in Debian Lenny. It is possible to change the icon by substituting one of your choice in the following folders:

/usr/share/icons//scalable/places
/usr/share/icons//32x32/places
/usr/share/icons//24x24/places
/usr/share/icons//22x22/places
/usr/share/icons//16x16/places

(To use the Debian swirl, do a Google picture search. You'll need a .png and an .svg icon. Get a 32x32 .png and scale it with GIMP to the smaller sizes. The .svg icon goes in the /scalable/ folder, of course.)




After installing a theme in a user account, applications run as root do not fully adopt the theme- they have a "Windows 98" boxy appearance. The answer is to install as root, but when trying to start gnome-appearance-properties as root in Debian, I got the following error message:

Unable to start the settings manager 'gnome-settings-daemon'.
Without the GNOME settings manager running, some preferences may not take effect. This could indicate a problem with Bonobo, or a non-GNOME (e.g. KDE) settings manager may already be active and conflicting with the GNOME settings manager.

I found the answer was to copy the theme to the /usr/share/themes/ folder as root. After doing that, I ran gnome-appearance-properties as root, ignored the error message, and selected the theme I wanted- which seems to work without any problems.

Firefox returns to Debian?

Debian comes with a rebranded version of Firefox called Iceweasel. The reasons for this are that the Firefox logo was copyright, and everything in Debian must be strictly free software- thus free to modify- and Debian maintains its own Firefox/Iceweasel package after Mozilla itself has stopped providing security updates for them. (Debian Lenny comes with Iceweasel 3.0- perfectly stable- which is the aim of Debian stable releases by definition- but old.)
Now Firefox has dropped the restrictions that were an obstacle to the use of its logo by Debian, and there is hope that the other issues may be worked out to allow Firefox back to Debian, I discover on the Debian Forum.
I have to admit that I'd already dropped Iceweasel for original Firefox, which I installed according to the instructions on DeviceGuru. I'd got used to using Firefox 3.6, and couldn't get used to using a rebranded Firefox 3.0. (A more up-to-date Iceweasel, 3.5, is available from Debian Backports, but I only discovered that after dropping Iceweasel.)
Firefox installed in this way has to be updated manually after starting Firefox as root. Another slight disadvantage is that browser plugins for Iceweasel don't work with Firefox (Totem 2.22.2 plugin is too old?) The way round this is to tell Firefox to open content such as MPEG video in Totem rather than with the broswer plugin. (This is also true for Opera and Chrome. They will see the browser plugin but it won't work. Either disable the plugin- Chrome- or tell the browser to use Totem- Opera.)
[UPDATE: A comment suggests using the mozilla-mplayer plugin instead of the Totem plugin.]
(The instructions for installing Firefox can also be modified to install Thunderbird, which is replaced by a rebranded version in Debian for the same reasons.)
I tend to agree with this quote from the Debian Forum:

I think this would be great. Not because Firefox is "better" than Iceweasel or whatever, but because this was always an unfortunate nitpicky battle that to my mind made FOSS look somewhat silly to outsiders. The whole thing became a lightning rod for extreme positions, and people just beat each other over it.

I would love to see Debian and Mozilla work this out.

UPDATE: A comment suggests that Firefox will update itself, but this doesn't seem to be true. As far as I can see, my original post is correct, and you have to update as root.

I've got a fever- it must be a virus!

I used to be an anti-malware expert when I used Windows- I could tell you the relative merits of anti-virus programs, anti-spyware programs, anti-Trojan programs, rootkit detectors and firewalls.
I now run Linux with no anti-virus, or indeed any sort of security suite, scanner or intrusion detection program.
This is not actually because I discovered Linux is much more secure, rather because, coincidentally around the time I started using Linux, I realised that anti-malware programs aren't really necessary in Windows, or perhaps more accurately, aren't that effective.
I was reminded of this by a post on KrebsonSecurity, written by one of the best reporters on malware and cybercrime. The gist of the report is: don't rely on anti-virus software to protect you from Windows malware. There are lots of comments on the page questioning the value of the research cited in the post, but I have to say it jibes with my experience of Windows malware: any anti-virus has only about a 20-60% chance of catching new malware, and only a 40-90% chance of catching old malware. The graphic below doesn't reveal the best and the worst of anti-virus programs, but honestly, it doesn't matter that much.














There are also several comments on the blog post about how malware can now persist even after an operating system reinstall, so basically, if you get a "virus", you're going to be buying a new computer, which, although they carry a grain of truth, are basically tin-foil hat paranoid nonsense.
There's no guarantee that an anti-virus program will protect you from malware, indeed, a 10-80% chance that it won't. What you need to do in Windows is learn to recognise and avoid viruses. Now a long article on how to do this is beyond the scope of this post, but for a start, make sure all web-facing software is up to date. (Secunia can help here.) Honestly, armed with up-to-date software and a knowledable user, your computer is going to laugh in that face of malware!
This is not to say that I wouldn't use an anti-virus program in Windows- I'd always have one running. My personal choice would be avast!, Avira, maybe Panda- because they are free. I wouldn't pay for an anti-virus (for private use) because they are really only a second or third line of defence. (Of course, in a commercial/institutional environment, where you have all and sundry using your system, this doesn't apply.)
Linux can have a big advantage here, in that assuming your distro of choice has a package manager, it will tell you about any web-facing software that needs updating for security reasons. A old version of Flash, Adobe or Firefox allowing a drive-by download is less of a risk. (Not to mention zero-day exploits in Internet Explorer.)
Malware is not an issue Linux users can ignore, as this report proves. But Ed Bott's report also illustrates how the paranoia of Windows users tries to infect Linux users. Are Linux repositories infected? Should Linux users now be scouring their machines for malware? No. This was an issue with one distro. Most Linux distros insist on package signing, which would have prevented this attack.
Relax! Don't panic! It's still possible to connect a computer to the internet without getting pwned, Linux or Windows.

Sun Java in Debian

I've been using Debian on a couple of laptops for a while now, and never needed to install Sun Java, but recently a web site prompted me to install it, so I thought I'd give it a go, thus finishing the trinity of non-free multimedia installations in Linux: Flash, MP3 ripping, and Sun Java.
Flash required adding a repository for Lenny backports, warnings that my system couldn't be considered stable any more, and warnings from Firefox that I was running an insecure version of Flash until I realised I had to enable automatic upgrades for backports.
MP3 ripping required adding the Debian Multimedia repository, and installing the package gstreamer0.10-lame.
The Sun Java package is in the Debian non-free repository, as is the browser plug-in. (sun-java6-jre and sun-java6-plugin were the required packages.) Marking the packages for installation resulted in a scary message:

You are about to install software that can’t be authenticated! Doing this could allow a malicious individual to damage or take control of your system.

This message is scary because malware can find its way into a Linux repository, if the packages are not digitally signed, and ignoring messages like this is the last thing users should be doing. I couldn't find an answer on Google, but the Debian Forum was helpful. It seems I needed the package debian-keyring. Quite why Debian doesn't prompt you to install the debian-keyring package when you enable the non-free repository is a bit of a mystery- maybe I did something wrong or missed a message, I don't know.
All in all, installing Flash, enabling MP3 ripping, and installing Java was a lot less painful in Ubuntu.
And the site that required Java? I went back and tried it again, but nothing happened- either a broken applet, or not compatible with the Sun Java version I have installed. The site wasn't that interesting, so I couldn't be bothered to find out which. So I still haven't really come across a site yet where I really need Java, but at least it's installed now in case I ever need it. :-P