Here’s the top feeds you should be subscribed to (CVE tags are reported in brackets):

1. NIST Vulnerability Database.
2. US Cert Technical Security Alerts [CERT].
3. SecurityFocus Vulnerabilities [SF-INCIDENTS].
4. Open Source Vulnerability Database [OSVDB].
5. IBM Internet Security Systems Threats [ISS].
6. Vupen Security Advisories [VUPEN].
7. Secunia Latest Security Advisories (Unofficial) [SECUNIA].
8. eEye Security Advisories [EEYE].

The above list is also available as OPML file you can import into your feed reader.

Furthermore, you should subscribe to Operating Systems product-centric vulnerability feeds to ensure you receive timely information regarding updated packages and suggested workarounds for your infrastructure. Here’s a comprehensive list, sorted alphabetically:

1. Apple Security Announce (Mac OS X, iPhone, etc) [APPLE].
2. Checkpoint’s SmartDefense Service [CHECKPOINT].
3. Cisco’s Product & Service Security Advisories [CISCO].
4. Debian Security Advisories [DEBIAN].
5. Fedora Security Updates [FEDORA].
6. FreeBSD Security Advisories [FREEBSD].
7. Gentoo Linux Security Advisories (GLSA) [GENTOO].
8. Mandriva Security Advisories [MANDRIVA].
9. Microsoft’s Security Notification Service Comprehensive Edition [MS].
10. NetBSD Security Advisories [NETBSD].
11. OpenPKG Security Advisories [OPENPKG].
12. OpenBSD Errata [OPENBSD].
13. Red Hat Security Advisories [REDHAT].
14. Slackware Linux Security Advisories [SLACKWARE].
15. Solaris SunSolve Alerts [SUNALERT].
16. SUSE Linux Enterprise Security Advisories (also contains OpenSUSE advisories) [SUSE].
17. Ubuntu Security Notices [UBUNTU].

OS security advisory feeds are available as OPML file as well.

Have I missed anything? Please report if you find some advisory feed I accidentally missed. Also, if you’re into an Operating System security team and you don’t offer a security announcement feed, please consider making it available.

1. Flash applet audio capture is very limited: only one device a time, only one stereo channel pair and doesn’t support devices without volume level mixer. It doesn’t allow any advanced setup like multi-channel digital mixers.
2. Audio and video are encoded on the fly and no local copy is recorded. Streaming services offer server-side recording, but after downsampling and packet loss, quality is very low. Even worse: any connection fault will interrupt your recording.

To achieve multi-channel audio capture and client-side recording, live events media producers traditionally have few options:

1. Process audio and video signals with external mixer and recording tools and then acquire analog output signals with an AD capture card. This makes multi-channel recording more expensive. Furthermore, if signal processing passes through analog components, streaming quality is degraded and HD video must be downscaled.
2. Record your audio-video using your camera and then use camera Firewire or analog output to stream to computer. To do this, you need to have audio inputs on your camera. This has three downsides: your recorded session may have lower video quality (miniDV or miniHDV tape recording quality may be lower than firewire output quality), you cannot record multitrack audio and you need to connect your audio mixer to your camera.
3. Use a digital mixer coupled with Flash Media Encoder software, which is only available on Windows, so if you’re a Mac OS X or Linux user, you’re out of luck. Also, you cannot record high quality encoded files but only FLV as they’re sent over to the broadcast.
4. Use UStream Producer Pro, a $199 tool released by UStream.tv for Windows and Mac OS X, that allows multi-camera management, HDV input, PIP and broadcasting output recording, at the same quality of the output stream.

For my live streaming setup, I wanted to use my MacBook laptop with Mac OS X, a Sony HVR-V1 HDV camera connected through Firewire and a Edirol M-16DX 16-channel digital audio mixer connected via USB to capture audio from a few condenser microphones. Methods mentioned above aren’t applicable, because they would require additional hardware and recording quality would be very low, compared to original signal quality.

After some research, I found a way to process audio and video signals before submitting them to Flash applet in Mac OS X. First, the requirements:

1. CamTwist: it’s a freeware software that creates a loopback video interface and allows multiple client apps to access a single video device at the same time. A number of video effects can be applied to the video stream by CamTwist.
2. Jack audio router: an Open Source application that allows custom routing of audio channels between multiple devices and programs simultaneously with very low latency.
3. An account on UStream.tv with an available broadcasting channel setup.

Once you’ve installed the programs and created the account, you can use the following checklist to configure your system to route your advanced audio-video stream both to UStream.tv and to your custom recording tools:

1. Connect your external camera and audio sources and wait until they’re properly recognised by the system.
2. Run CamTwist and select your video input from the Step 1 column and adjust input settings in the “Settings” column on the right. If you want, you can add effects in column Step 2 (check CamTwist documentation for details). If you need a preview, you can use Tools -> Preview menu (close it afterwards, so that it doesn’t eat up cpu cycles).
3. Run JackPilot program and configure access to hardware device from JackPilot -> Preferences menu (it should open automatically on first use). You need to select your audio driver (typically coreaudio), your hardware interface (select your multi-channel card), your hardware-specific setup (frequency, number input and output of channels) and then set your virtual Jack card channels and untick “Auto connect with physical ports”.
4. Once you’re done with Jack setup, close Preferences dialog and start Jack audio server by clicking on Run button in main dialog.
5. Open your audio-video recording tool and select CamTwist from available video input interfaces and JackRouter from audio input interfaces and start a new recording. For instance, if you use QuickTime to record your session, go to QuickTime -> Preferences menu and select Recording tab. In Video Source drop-down menu select CamTwist and in Microphone menu select JackRouter, then close dialog and open a new session with File -> New video recording menu and click on Record button to start recording. Important: if you don’t start recording, your tool may not show up in your Jack router setup, so do as you’re told
6. Open your browser (Firefox is better) and connect to UStream.tv, login with your account and click on Broadcast now button. A popup will open and once Flash applet is loaded, you can select your audio and video inputs just below the preview frame. Select CamTwist from Video drop-down menu and JackRouter from Audio menu. Check that you see video from your source in preview frame.
7. Go back to JackPilot and click on Routing button to open Routing panel. The panel contains 3 frames: on the first frame, you have your physical captures and your application audio outputs, on the second frame you have your physical outputs and your application inputs and on the third frame there’s a list of connection. What you have to do is create a series of mappings between items in first frame to items in second frame. To create a mapping, you need to select one item in first frame and double-click on item on second frame. To unbind the mapping, just repeat the same action again. In my setup, I create a mapping between stereo mix-down channels 17 and 18 of my mixer and Flash (Firefox) stereo input channels and then a mapping between the same mix-down channels and QuickTime stereo input. If you use a multi-track recording program like Cubase, you can add more virtual channels to Jack Router (in Preferences) and map each mixer input to its own virtual channel. Remember: if you need to change Jack Router settings to add more channels or change interface settings, you have to shut down Jack with Stop button first.
8. Now you’re ready to click on Broadcast button on your UStream.tv channel and go live. Check audio level with Flash Vu-meter and adjust volume slider accordingly. For what regards audio and video quality sliders, my advice is to keep audio above 70 and video at least 50: the more bandwith you have, the more you can raise video.

Be careful: audio and video streams are not synchronized, because there’s no common clock or timecoding between the source peripherals. This means that long audio-video sessions might get slightly out of sync if processing time is different between audio and video. My advice is to check wether your camera and audio mixer support timecoding synchronization in a common format: if they do, then set up a link between the two. If they don’t (which is probably your situation, if you’re using consumer devices), avoid running other cpu-intensive or disk-intensive processes during the streaming/recording activity and use a post-production tool like FinalCut Pro or Adobe Premiere Pro to match audio and video on recorded files by shifting and stretching appropriately. I will write more on this later.

That’s all. Have you found other ways to accomplish the same result? Need some hints for your setup or troubleshooting? Please share your thoughts using the comments box below and remember to subscribe to my feed for additional tips on AV techniques.

P.S.: Special thanks goes out to Maurizio Tognoni, who shared the hacking and testing efforts.

Shell prompt

First of all, you should check you’re using bash shell:

$ env | grep ^SHELL=
SHELL=/bin/bash

If not, you should check if bash package is already installed. If it’s already there, just change your user shell (and possibly root shell) with chsh or consult your OS manual. Be careful: if bash is not listed in /etc/shells, you might lock yourself out.

To set Gentoo-like colors on bash prompt, edit ~/.profile (or /etc/profile for system-wide defaults) and add the following:

if [[ ${EUID} == 0 ]] ; then
        PS1='\[\033[01;31m\]\h\[\033[01;34m\] \W \$\[\033[00m\] '
else
        PS1='\[\033[01;32m\]\u@\h\[\033[01;34m\] \w \$\[\033[00m\] '
fi

GNU ls

If you use GNU ls (use –version to check) and dircolors utility is available (from GNU coreutils), you can have colorful outputs by adding the following snippet to your bash profile (see above):

if type -P dircolors >/dev/null ; then
        if [[ -f ~/.dir_colors ]] ; then
                eval $(dircolors -b ~/.dir_colors)
        elif [[ -f /etc/DIR_COLORS ]] ; then
                eval $(dircolors -b /etc/DIR_COLORS)
        fi
fi
alias ls='ls --color=auto'

To enable colors, you need to save Gentoo color defs to ~/.dir_colors (or /etc/DIR_COLORS for system-wide defaults).
Alternatively, if you miss dircolors binary on your system, save output from dircolors on a Gentoo machine and copy’n'paste it into bash profile:

LS_COLORS='...weird colon-separated string...'
export LS_COLORS
alias ls='ls --color=auto'

BSD ls implementation

A special trick is required for FreeBSD and Mac OS X: add the following line to your bash profile:

export CLICOLOR=1 LSCOLORS="ExGxFxDxCxDxDxhbhdacEc"

If you want to further customize colors on your Mac OS X Terminal, you can use SIMBL TerminalColours plugin (Snow Leopard version).

GNU grep

You can enable coloring of the matched part by appending the following alias to your bash profile:

alias grep='grep --colour=auto'

As usual, if you have any coloring tips’n'tricks you want to share, please use the comment box below.

This post deals with two system-wide alternatives, sysinitv and Mac OS X’s launchd: the first represents the tradition, while the latter represent innovation. Feel free to use comments to share your tips.

System V init

Also known as sysinitv, it’s the historical choice for most unices. Every OS has customized its own version so there’s no common standard. First process, typically /sbin/init reads config in /etc/inittab and executes a series of commands, depending on which runlevel is currently set.

In typical configurations, init launches a main rc script on runlevel change (boot sequence runlevel, default multiuser runlevel, etc), which in turn runs all the initialization scripts in a runlevel-specific folder. For example, in Redhat Linux each system service has an init script in /etc/init.d/. These init scripts respond to a number of actions that can be passed as parameter, for example /etc/init.d/sendmail start runs a function that starts sendmail daemon. Typical actions include: start, stop, restart, status. Some scripts implement specific actions: for instance apache service implements reload action, which does a graceful signal-based reload. Furthermore, most OSes include additional dependency information in those scripts and import script configuration directives from external files (/etc/sysconfig/ on Debian, SuSE, etc, /etc/conf.d/ in Gentoo).

When rc scripts is ready to process init scripts, it looks in appropriate runlevel folder (in RedHat Linux and derivatives its /etc/rc.d/rc<runlevel>.d/,  Gentoo has /etc/runlevels/<runlevel>/, etc) and executes entries which are symlinks to the actual /etc/init.d scripts.

Most of these systems use a specific naming convention for these symlinks, to define order of execution (scripts are run in alphabetic order) and action to be passed as parameter. For example, on RedHat-style systems, scripts are named as S<NN><service> or K<NN><service>, where NN is a number from 00 to 99. S means start action (ie. /etc/rc.d/rc3.d/S60sendmail start), while K means stop action. In other systems such as Gentoo, order of execution is determined dynamically by dependency information (requires additional computing and dependency caching).

Operating systems typically implement command-line, ncurses-based or X11-based tools to manage adding and removing items from runlevels: chkconfig under RedHat/CentOS, update-rc.d under Debian, rc-update under Gentoo, boot up manager (bum) under Ubuntu.

Pros: well known, easy for unix admins, easy to add new custom scripts.
Cons: no common standard, no parallel execution (except for Gentoo), no support process monitoring (ie. restarting daemons on crash).

launchd

It’s installed by default on Mac OS X 10.4 (Tiger) and later. Once launchd is run by the kernel, it runs /etc/rc (a BSD-style system wide initialization script) and scans/System/Library/LaunchAgents and /Library/LaunchDaemons for plist files. Each plist contains a series of properties that define behaviour of launchd and customize run setup (command parameters, working directory, process owner, resource limits, etc). Launchd monitors processes and dynamically acts to adapt process status to requirements defined by configuration. This includes: running process automatically at boot, respawning process on unexpected quit, starting and stopping process upon several conditions (cpu load, network status, filesystem mounts, file presence, time schedule, shutdown, sleep, etc).

Finally, launchd companion is user tool launchctl, which interacts with launchd through a socket and allows administrator to send in requests like start, stop, list, limit, shutdown, etc.

Pro: amazing configuration directives, powerful extension mechanism, post-spawn process monitoring and usage management, scheduled actions (as in cron), stdio-to-inet support as inetd, can add processes without configuration files.
Cons: configuration plists are an Apple-world standard, many great features are Mac OS X specific, strict process launching requisites (see launchd.plist manpage), no support for configurable dependencies, no support for custom process signaling, complex logic may lead to unexpected results.

(continues)