Automatix 'Actively Dangerous' to Ubuntu

exeme writes "Ubuntu developer Matthew Garrett has recently analyzed famed Ubuntu illegal software installer Automatix, and found it to be actively dangerous to Ubuntu desktop systems. In a detailed report which only took Garrett a couple of hours he found many serious, show-stopper bugs and concluded that Ubuntu could not officially support Automatix in its current state. Garrett also goes on to say that simple Debian packages could provide all of the functionality of Automatix without any of the problems it exhibits."

FUD

[Anonymous Coward]

I have used automatix on 50+ installs of ubuntu edgy and feisty... Not one problem yet.

Old News

[solcott]

This is old news, well Automatix being dangerous in general I mean not Mr. Gattett's report. Automatix has been referred to by many as a tool to "enhance" Ubuntu by lazy users who do not care about system security or stability since Breezy Badger.

Re:Illegal?

[solcott]

Illegal for them to distribute, or illegal for the user to download?

Neither, in some countries it can be used to obtain illegal software. For example giving residents of the United States the ability to play copy protected DVD's or audio compressed with mp3 without the user paying a royalty fee. Automatix in itself is no more illegal than Firefox or Internet Explorer, they are also just tools that "could" be used for illegal purposes, like viewing child pornography.

Re:I think it screws up when upgrading.

[Constantine XVI]

I appreciate your zeal on the subject, but if Ubuntu distributed MP3 without paying for the license in certain countries (like USA), they would be in serious legal trouble. However, in Ubuntu 7.04, it will automatically install the proper decoder for you the first time you try to play an MP3. It works, it's painless, and it's the best we can do until we get someone in Congress (or your respective national legislature) brave enough to destroy software patents.

Re:warez?

[realdodgeman]

It is not warez. It is codecs, closed source software and other stuff you don't get in your basic install. But with 7.04 most the things Automatix does is useless, since it is equally easy to do the same thing in add/remove.

Re:Could someone clarify why it is illegal?

[Anonymous Coward]

From Automatix [getautomatix.com]:

AUD-DVD codecs (NON-FREE Audio and DVD codecs) (Installation of this option is illegal in the United States of America)

Automatix not needed anymore

[realdodgeman]

After the launh Ubuntu 7.04 Automatix isn't worth using anymore. Codecs are easily installed with add/remove, as is most of the other software in Automatix' repositories. And the few programs that you can't find in add/remove are mostly published as .deb packages. Google has even made a .exe like installer for google earth.

Slashdot Spin, as per usual...

[gunny01]

There nothing inherently illegal about Automatix: it just allows you to break the DMCA.

The article is a technical crictism of Automatix, how it doesn't follow proper package rules, etc.

This is the conclusion to the article, which sums it up pretty well

Automatix exists to satisfy a genuine need, and further work should be
carried out to determine whether these user requirements can be
satisfied within the distribution as a whole. However, in its current
form Automatix is actively dangerous to systems - ranging from damage
to small items of user configuration, through removing user-installed
packages without adequate prompting or warning and up to the (small
but existing) potential to leave a system in an unbootable state.

The current design of Automatix precludes any reasonable way to fix
some of these problems. It is attempting to fulfil the role of a
high-level package manager without actually handling any sort of
dependency resolution itself.

A more reasonable method of integrating Automatix's functionality into
Ubuntu would be for the Automatix team to provide deb files to act as
installers for the software currently provided. These could then be
installed through the existing package manager interfaces. This would
solve many of the above problems while still providing the same level
of functionality.

In its current form Automatix is unsupportable, and a mechanism for
flagging bugs from machines with Automatix installed may provide a
valuable aid for determining whether issues are due to supported
distribution packages or third party software installers.

Automatix is barely needed anymore. You can do just about anything through the standard repos these days.

Re:Illegal? Misleading and Misconstrued FUD

[cortana]

Erm, did you even read the analysis? Automatix craps untracked files all over the user's system. It makes to effort to interoperate with Ubuntu's package manager (dpkg) and is even prone to race conditions that could leave the system unbootable!

Re:"...could provide..."

[imroy]

If it's so simple to make the package provide the functionality, why hasn't anyone done it?

They have. There's Debian-Multimedia [debian-multimedia.org], which has been around for a few years. I know there's one or two specific to Ubuntu, five minutes Googling will probably find one. I've been using D-M for years now and have not had a problem. Automatix is an ugly hack and should be avoided at all costs.

Re:I never understood

[cortana]

They already have; the repositories are called 'restricted' and 'multiverse' (the former is supported by Canonical, the latter is not).

Re:Slashdot Spin, as per usual...

[theantix]

"There nothing inherently illegal about Automatix: it just allows you to break the DMCA."

Incorrect. Distributing w32codecs and other proprietary software without permission violates traditional copyright law, not just DMCA provisions.

Re:Could someone clarify why it is illegal?

[xenocide2]

Automatix provides w32codecs, a package that's likely to be illegal in most countries that respect copyright. It's a set of DLLs and other code libraries used for decoding videos in Windows. It has about 60 codecs from unidentified sources with no particular attention to licensing that I can see. This package is often used as a workaround for Linux's generally poor support for video playback.

It's a question of whether you want to gamble that large software companies will continue to look the other way on your infringement or not.

Re:Why?

[kebes]

The summary is misleading... in particular the use of the word "illegal."

Automatix is a utility that automates the installation of a bunch of software that is considered "must have" for people just switching to Ubuntu. For instance, it installed Firefox, mplayer, wine, DVD playing software, and multimedia codecs. (Actually the installer would just give you a list of things you could install, you select the ones you want and click "next.")

I don't really understand why this is being characterized as "illegal software." The packages are already in the usual repositories. The utility would just automate the installation for you. If you live in a country where installing one of those packages is somehow illegal (is this actually the case?), then that's your responsibility. The tool is just an automator intended to ease the transition for new users. It really provides nothing above and beyond the standard packaging interface, except that it was easier (in some people's opinion) to tell new users "install automatix" rather than telling them to open the package manager and list the software they should install.

In any case, the whole argument seems rather pointless. Automatix was created a few years ago, at a time where installation of things like multimedia codecs was perhaps non-obvious. New users were flooding forums with repeated requests like "my mp3s don't play! why?" and "how can I play DVDs on this Ubuntu thing?" Automatix was created as a simple response to that.

In the meantime, Ubuntu has, from what I can tell, cleared up these issues. Installation of codecs is straightforward and pretty obvious. The package manager is very user friendly. In short, there is no need for Automatix. Basically, Automatix was an ugly hack. It's always been recognized as such, and developers have always discouraging people from using it. On the Ubuntu forums, the standard advice is no longer "install Automatix," since it is recognized to be a non-optimal solution.

So, in short... I think this issue has already passed us by.

Re:Old News

[jlarocco]

When Linux distros finally sort out the farce that is installing vendor provided graphics card drivers, software and codecs etc, then tools like Automatix won't be needed.

I use Linux, have all of those things, and I've never even heard of Automatix. I'm not using Ubuntu though.

Re:Illegal software installer?

[MrFlannel]

The 'illegal' part of this thing is nothing but a footnote.

The important thing is that it's a stupidly dangerous (to your system) piece of software, that most members of the Ubuntu community are trying to inform everyone about. A lot of community sites swear by it, and when anyone argues they give the 'it works fine for me' argument.

This is not the mentality we want to have as a linux community. The automatix team refuses to make their software better, and launced a few all-out assaults on the communities that warn against it. Even going as far as to say (on their website, up until a few months ago) if you go ask help for automatix in their IRC channel, and claim that the people in the ubuntu channel sent you there, they (automatix team) won't help you. Which is stupid in and of itself, but that's the mentality that the automatix people have exhibited time and time again.

Because of this, and in some random attempt to clear their piece of software (and argue about it's proper terminology whether 'package manager' or 'packaging script' or whatever), and to get their lead developer (arnieboy) unbanned from the ubuntu forums (for trolling, more or less), they went to the Forum Council and petitioned, the forum council rejected some stuff, and said that they shouldn't make a decision on the technical merits (since they're not technically qualified or whatever). I imagine this is the fruit of their lack-of-verdict, someone higher up (who was qualified to assess its technical merits) finally took a semi-official look.

I wish I had links for the meeting, here it is: https://wiki.ubuntu.com/MeetingLogs/ForumCouncil/2 007May18/Logs [ubuntu.com]

Re:I think it screws up when upgrading.

[jlarocco]

I listen to music constantly while on my computer. It took me several hours to figure out how to install MP3 support when I first tried Linux. Even then, I couldn't play my videos either, which annoyed me. I dropped it because i had no reason to switch yet. My sister was forced to use linux when I lost my windows disks. The only reason she gave me for not wanting to keep it? She couldn't use flash on 64bit linux, which prevented her from listening to music on Purevolume. She even told me today that she misses the OS, but wished she could use flash. Music means a lot to some people.

To get Flash working on 64-bit Linux, try searching your distro's software repository for "nspluginwrapper". Technically it's a bit of a hack, but from a user's perspective it's fairly transparent at getting 32-bit browser plugins to work on 64-bit platforms.

Debian, at least, has it.

Also on Debian, to get MP3 and video codecs add http://www.debian-multimedia.org/ [debian-multimedia.org] to your list of repositories, either in the Synaptic GUI, or in /etc/apt/sources.list. It's been a while since I first started using it, and I think you might have to reinstall or upgrade some packages that depends on the codecs, but after it's setup it works just like the official repositories.

Re:I think it screws up when upgrading.

[FauxPasIII]

> She couldn't use flash on 64bit linux

I know you're just trying to rant, but in case anybody else is interested:

sudo su -
echo 'deb http://janvitus.interfree.it/ubuntu/ [interfree.it] feisty-upure64 main-amd64' > /etc/apt/sources.list.d/jantivus.list
apt-get update
apt-get install nspluginwrapper

and voila, you can use the flash plugin on 64bit linux.

Medibuntu

[alphasubzero949]

Medibuntu [ubuntu.com] is a much safer way to install codecs and some third-party apps than Automatix.

Re:Old News

[Chandon Seldon]

When Linux distros finally sort out the farce that is installing vendor provided graphics card drivers, software and codecs etc, then tools like Automatix won't be needed.

Ubuntu handles all that stuff with less problem than finding and installing Automatix.

Automatix *isn't* needed.

Re:Why?

[Chandon Seldon]

That stuff is exactly what the "ubuntu-restricted-extras" package is for.

Rather than screw around with Automatix, perhaps someone should post the following script instructions:

1. Enable the universe and multiverse repositories. (System -> Administration -> Software Sources ; Check the "Universe" and "Multiverse" checkboxes. ; Press the "close" button. )
2. Install the ubuntu-restricted-extras package. (Applications -> Add/Remove... ; Set the "show" drop down in the top right to "All available applicatons. ; Type "ubuntu-restricted-extras" into the search box. ; Check that package. ; Press OK. )
3. (Optional) Activate encrypted DVD support. (Open a terminal window. Type "sudo /usr/share/doc/libdvdread3/install-css.sh" and press enter.)

I really don't see how installing some random script off a website and then messing with a new GUI program is any easier than that.

Re:I think it screws up when upgrading.

[jonom]

Mod parent up!

On a lot of support forums I see people having trouble with 64 bit Linux, I guess they figure they have a 64 bit chip so they have to install a 64 bit OS -- even though there are warnings all over the place about compatibility issues.

Re: 64-bit

[tchuladdiass]

Not only that, but you can also run the 32-bit versions of your programs on a 64-bit OS install. In the case of Flash, just install the 32-bit version of Firefox, then all your 32-bit plugins will work fine. The only problem that will be encountered when running a 64-bit install is if you have a binary-only driver (kernel module) that is only available for 32-bit.

WMA and WMV

[goaty_the_flying_sho]

Let's keep in mind that both WMV and WMA have native, free software decoders available that don't require agreeing to Microsoft's licensing.

Re:Ubuntu has its own problems

[Stormx2]

Before the Ubuntu team criticizes add-ons that make the system useful to many more people, they should get their own house in order.

You have to understand that development doesn't follow a simple step-by-step process, especially with as many developers / package maintainers as there are on your average distro. While addressing their own "house", the devs can also address other headaches, e.g. the hoards of people with broken systems due to automatix.

There is a net loss in using automatix. Upgrading is a huge pain, as so much stuff is broken / hacked together. Most things automatix was built for can now be done quickly in a none-hacky way. There is no real reason to use automatix, as the problem automatix addressed (lack of an easy way to make common customizations/installs) isn't there anymore.

1. The version of RealVNC is broken and possibly insecure.

You sure about that? I certainly used RealVNC before the feisty final release. Insecure? That'd be addressed in security updates.

2. The CDFS-src package is broken, and has been for months.

Can't comment, know nothing of it.

3. There does not seem to be any good and easy way to install a firewall. Red Hat seems to have a simple IPTABLES firewall installed as an option in the installation process, why can't Ubuntu do this?

iptables is also installed by default on ubuntu. You can also use firestarter to manage it in through a GUI, that's what I do :-)

Re:Old News

[Stormx2]

Wow, I'm replying to two of your ignorant comments.

Or in other words, people who quite rightly find installing things like codecs and then having to modify countless config files so the media player and the browser can use them either difficult or, quite rightly, a bloody ridiculous thing to have to do.

I've addressed codecs in my other post to you. Here's the jist again: open a media file, if you don't have the codec, it will install it. Firefox, and gstreamer-based media players, will automatically make use of the new codecs, no questions asked. This is a non-issue.

When Linux distros finally sort out the farce that is installing vendor provided graphics card drivers, software and codecs etc, then tools like Automatix won't be needed.

Under ubuntu: System > Administration > Restricted Drivers Manager. Enter your password when prompted. Mark the checkbox under the "enabled" column. Reboot when prompted. This is about a thousand times easier than trawling the web for a driver on windows, not to mention the often buggy installers (which I've had my fair share of)

Software? Add/remove programs and synaptic cover this in a way which is far more simple, centralised, consistant and user-friendly than Windows. Software management under most distros is about as good as it gets (e.g. yum, apt, etc). Codecs I've already covered.

You seem a little misled by these issues anyway. Stop by in your distro's IRC channel and they'll help you through it.

Re:And the reason Automatix exists?

[mjg59]

I understand that users don't want to have to change their touchpad configuration just because they're using an ALPS pad instead of a Synaptics one. I understand that users would like their Wacom touch screens to work without having to edit xorg.conf. I understand that users don't want to have to configure their hotkeys in order to get them to do anything useful. I understand that users want their laptops to suspend and resume correctly. Those are issues that I understand and have had the time and skills to do something about.

I also understand that users want to be able to play their MP3s, their DIVXs and use their ipods. The reason I do less for these people is that I have very limited time (I have a full-time job that's nothing to do with Linux development). Does that mean I want everything to be done via the CLI? Am I ignoring the needs of users? Do I have a fundamental misunderstanding of what people actually want to use Linux for? No, I don't think so. I just contribute where I can with the resources I have. I'd prefer to be able to solve all of these problems, but I'm limited by actually having to do other stuff with my life.

Re:Illegal?

[Kjella]

(as far as the DMCA says; it could be legal to distribute it as protected free speech, but I don't know if anyone has tried to use that defence since the MPAA backed off in the DVDJon case).

1) The DVD-Jon case was in Norway
2) Consequently, it wasn't under the DMCA
3) It was the public prosecutor that tried and failed twice to convict him
4) They chose not to appeal it to the Supreme court, but only because there was no point
5) Since then, Norway and the rest of EU has been forced to adopt the EUCD aka euro-DMCA
6) Nobody has really tested the current law after the EUCD, at least not here in Norway

Re:Illegal?

[Lavene]

5) Since then, Norway and the rest of EU has been forced to adopt the EUCD aka euro-DMCA
6) Nobody has really tested the current law after the EUCD, at least not here in Norway

One 'problem' with the EUCD, atleast here in Norway, is Article6 tp 1 that states: 1. Member States shall provide adequate legal protection against the circumvention of any effective technological measures, which the person concerned carries out in the knowledge, or with reasonable grounds to know, that he or she is pursuing that objective.
What makes this the coolest paragraph is that as soon as a way to circumvent the protection is published it's no longer effective. Downloading a program that enables you to play something is not really "actively pursuing" to circumvent a DRM scheme.
However, even if circumventing DRM for personal use is not ruled illegal (still in Norway), normal copyright laws still applies so you can not distribute it even if the DRM is 'ineffective' of course.

Re:I think it screws up when upgrading.

[QuoteMstr]

Correct me if I'm wrong, but I don't think Fluendo's codec is the right approach. It comes in source form, covered under the BSD license, and a binary blob, covered under Fluendo's proprietary EULA [fluendo.com], and according to Fluendo's site, but not any legal document I can find, the patent license only applies to the binary version. That claim raises some interesting questions:

1. What interest does Fraunhofer have in granting a patent license for the binary version, but not the source? There's no difference in terms of how available the software would become, in principle. The number of installations is bounded by the number of GStreamer installations regardless of whether the package is proprietary or not, since it's freely redistributable (after signing a contract).
2. Given that, realistically, every Linux user in the US can already get a free mp3 decoder, what advantage does Fraunhofer gain by not granting a blanket MP3 patent license for free software?
3. What's going on with the redistribution contract? It seems to have some interesting interactions with the BSD source license.
   • 1.4

     The Distributor might at some point want to make changes and improvements to the Plug-in Source Code used to generate the Plug-in. Such changes shall automatically be copyrighted to Fluendo and Fluendo shall be notified of these changes, so that Fluendo can include them in the official Plug-in Source Code if they so choose. Any such changes will have to be approved in writing by Fluendo or included in the official Plug-in Source code from Fluendo, before a binary incorporating the changes can be shipped by Distributor.

     Uh, so a distributor can't modify the codec without signing the copyrights over to Fluendo?
   • 1.5

     Distributor shall not license or grant any right on the Plug-in or the Plug-in Source Code in a different way than as described in the corresponding licenses made by Fluendo for each of them.

     Doesn't that make it some weird viral BSD license instead of the BSD itself?

Where are DAG and DRIES when you need them?

[Antique Geekmeister]

Seriously, we've seen exactly this sort of awful, awful bundling written for a lot of RPM repositories as well. Filtering out the badly written ones and providing work-arounds for them is really painful. I'm not surprised at all that some amateur software bundler wrote their "great idea to put it all in one place!" software but proceeded to violate all sorts of basic software standards.

For excellent examples of just this sort of conflict and mispackaging craziness, take a good look at any of the Oracle installers of the last 8 years or so, or any of the hardware vendor's driver installation tools. Serously, most of them are not as bad as this, but lord, they're not good. This is why I worship the names of DAG and DRIES, the primary third-party RPMforge repository maintainers for the RedHat based world. They just do things right and set an amazing example for this sort of repository manager wanna-be.

Re:Illegal?

[jibun]

Yes, the wording was unfortunate. What was probably meant was something like this:

5) Since then, Norway and the rest of the European Economic Area has been forced to adopt the EUCD aka euro-DMCA

See http://en.wikipedia.org/wiki/European_Economic_Are a [wikipedia.org] to understand how Norway integrates into the EU single market and legal framework.

Re: 64-bit

[TheRaven64]

The problem is that AMD changed a lot with x86-64 beyond doubling the register size. They also added a few more registers and tidied up the instruction set a fair bit. Running in 64-bit mode is typically faster, since you get a lot less register churn. On something like SPARC, it's typical to run pretty much everything in 32-bit mode, because all you get by going 64-bit is a load of extra overhead on loads and stores of pointers. On x86 you get this overhead, but it's offset by the extra registers. This makes running 64-bit software on x86 much more attractive, even if you don't need the extra address space.

Re:I think it screws up when upgrading.

[Anonymous Coward]

Mod Parent down. You're working on very outdated information. I've been running a pure 64bit OS for ~4 years. I can't remember the last time in the last 2 years I had trouble with a flash site. (Other then they're generally complete and utter crap) nspluginwrapper works 99% of the time for running 32bit flashcrap in a 64bit browser. If someone can comprehend basic english and follow simple instructions, there is no reason to handicap a 64bit system with a 32bit OS. To mimic the fanboiz... 32bit is so Microsoft. Even commercial games run fine either under Cedega or natively. Granted my native game list is fairly short being Doom3, UT2k4, NWN, and America's Army.
Granted it used to require the building of a 32bit CHROOT, but for the last 2+ years it's been the installation of half a dozen libraries.

uname -a Linux ShadowAerie 2.6.20-gentoo-r8 #2 SMP Sun May 20 10:45:23 EDT 2007 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ AuthenticAMD GNU/Linux
uname -a Linux ShadowBook 2.6.20-gentoo-r8 #4 PREEMPT Tue Jul 31 17:07:41 UTC 2007 x86_64 AMD Turion (Tm) 64 Mobile Technology ML-44 AuthenticAMD GNU/Linux

YMMV, IMNSHO, etc etc

P.S. Yes these are relatively new installs. The original Athlon64 Socket 939 3500 is in a box waiting to be put in a new case. It used 2.6.8 or 9 kernel.

 

automatix has never been needed

[razpones]

I never needed automatix to install codecs, for the most part they were available in external repositories that just had to be either downloaded (when it was possible) or just included in the apt sources.list, get the key and that is it, apt-get install. I'm an average user with just the minimal knowledge to do things and set up systems, when i don't know how to do things I use google, go to forums etc.., I believe that if you are going to use a particular system be it windows, linux or mac, there is the need to learn to use it, not just turn on the computer and everything will work automatically, for the most part americans like their remote controls, but computers are not televisions, so please take the time to learn how to use what ever system you want to use, including how to install codecs, the illegality part of some of them, well, its an other issue.

Re:Illegal?

[pAnkRat]

...hat Ubuntu (the distributor of Automatix)...

Ubuntu is not the distributor of Automatix.
It does not endorse Automatix.
I know because I lurk in the ubuntu help IRC channels sometimes,
I know that Automatix causes many problems for users.
These users then turn to "official" ubuntu support, only to get redirected to the automatix channel.

The Automatix vs. plain Ubuntu battle is well documented on the web.