thaeger's blog

A comment on my recent VBA Macros update asks several questions about security for macros in OpenOffice.org.

I asked Noel Power to help me out, and he graciously provided us with some brief answers to show some of what he is thinking about regarding security for macros.

1. Are you guys going to do anything about security?
   Openoffice.org is serious about security. Recently a dedicated team has been set up to respond to security issues. That team are continually evaluating the security aspects of the application, some insightful comments from one of the Openoffice.org security experts can found here.
2. Will you retrofit a carefully considered security model (like Java has) into VBA?
   No - it’s not sensible. Scripting in Openoffice.org is more than just Basic. How about Python bindings, etc.?
3. Will you support digital signatures to help users decide whether to execute a particular document/program?
   Openoffice.org already supports signing of macros and you can configure the application so that only signed macros are allowed to be executed.
4. How will you avoid importing VBA trojans and viruses to OO?
   Macro signing, querying the user before executing, macros. Enterprise-wide lock-down to manage those settings easily.

Novell recently released an updated version of Compiz for SLED10*. While I have not identified many changes that end users would notice, there is one that Nat Friedman first showed me at LinuxWorld Expo last week. The Scale plugin (which scales down all open windows on a desktop, allowing you to pick which you want to come make the active window) has gotten a cool improvement.

The scaled-down windows used to lay out on the page like this:

Now they share the screen space much more evenly, like this:

It’s a subtle but noticeable change. My example shots aren’t the best for showing the improvement, but I only had one screenshot of the old scale plugin, and I had worked on it a lot to get it so it did not waste any screen real estate. So, regretfully, this new one I just made shows a lot more screen waste than is typical of the plugin’s updated behavior. Nevertheless, I like that it no longer crams the scaled windows onto the screen (always favoring the upper-left). It has a more natural visual appeal.

Taking another example using three open windows, it evenly distributes them like so.

My favorite part of the story about when Nat showed me this is that he had pulled it from internal Novell repositories. I was helping him organize his demo for the LinuxWorld Expo pre-conference keynote he was to deliver that afternoon. When he installed it, I remember thinking to myself, “Well that’s not a very real demo if you’re going to show unreleased code for Desktop Effects.” The following day, Novell released the patch to all subscribers of SUSE Linux Enterprise, and thereby vindicating Nat’s use of it on stage. I love how quickly open source updates happen.

….

*It’s possible that the code has been also released on openSUSE as well, but I don’t have that installed at the moment.)

As I previously mentioned in my post about VBA macros, you gotta love a guy like Michael Meeks. However, I’ve recently learned that you also gotta love Novell’s Noel Power, since he’s doing much of the work at Novell on VBA macro support in the Novell Edition of OpenOffice.org. The amount of work these guys have already done will go a long way to improving OpenOffice. That is, of course, dependent on if/when this massive code contribution gets accepted into the upstream version. (Michael expresses some concern that the folks at Sun may be too caught up with their own work in this area to review Novell’s submission.)

Since that first post on this subject, several people have submitted macros for the team to test. When I started this, I wondered how long before the team would ask me to back it off a bit, but so far they tell me to keep ‘em comin’. So, if you find macros that don’t work in the Novell Edition of OpenOffice on SLED10, let me know! It’s still thaeger at my company’s name .com. (Please include “VBA Macro” somewhere in the title.)

Yesterday, Michael sent me an email with a spreadsheet attached showing the list of functions that the team are now working on integrating. It’s a solid list, and I really respect their process. Rather than run the fool’s errand of parsing the entire VBA language, the team is taking a more parsimonious route. They’re using community- and customer-submitted macros to determine which VBA features/functions we currently support inadequately (or not at all). According to their apparent frequency of usage, the team is first taking on the parts in which they can make the biggest impact (most likely weighed against development effort to complete, of course).

The best part of the file Michael sent to me was that the data was formatted into a “Data Pilot,” which is OpenOffice’s analog to the Microsoft Excel “pivot table.” Data pilots, as well as support for xls pivot tables, is a whole new feature area in OpenOffice.org that I really ought to post something about, too. (So many features, so little time.)

As an interesting side phenomenon, many Macintosh community members were recently alarmed to learn that apparently Microsoft has made some kind of announcement about Microsoft stating that they may be dropping support for VBA macros in Excel on Mac. That linked many Mac users over to my blog post, and produced a couple more macro submissions. I’ve always had a lot of respect for the Mac. It’s a great platform. (In fact, I survived my college years using an old Mac XL. That’s right, a converted Lisa!) These Mac users now see OpenOffice as a potential salvation to Microsoft’s abandoning them. Yet another reason for open source, methinks. Again, I hope that Sun are not so distracted by fixing their proprietary VBA support that they can take a look at integrating Novell’s patches up‑stream.

[22Aug06 Update: Noel Power provides some answers on macro security.]

On some of my posts, I include an occasional application screenshots. The better ones that I have done may look something like this one of f-spot (which I made when frustrated with the quality of a screenshot in a presentation I was reviewing).

You might notice that it has really nice shadowing. Too nice. Casual consipracy theorists could get the idea that my blog might be supported by a cadre of Novell graphics people as part of a underhanded–even dastardly–marketing effort by Novell.

For everyone else, the cool shadowing is simply courtesy of Compiz, the compositing manager that sits atop Xgl or AIGLX and provides all the cool Desktop Effects in SUSE Linux Enterprise Desktop 10.

However, if you have ever tried to screenshot an application while using Compiz, have probably found some issues.

First off, the Alt+PrtSc key combo that usually can grab a screenshot of the currently active window does not grab the window decorations (title bar, mainly) on the window under Compiz.

By the way, about an hour before the interview with Jeremy Allsion today, while Erin and I were leading the Desktop Experience hands on session, Nat burst into our theater, screaming like a little girl*, and sporting two glass awards.

SUSE Linux Enterprise Desktop 10 won Best Desktop Solution and Best of Show at LinuxWorld. (w00t!)

*perhaps I exagerrate about the screaming

Our first ever “recorded before a live studio audience” editions of Novell Open Audio are now online.

For these interviews, Erin Quill and I took over Novell’s main theater at LinuxWorld. Several Novell Open Audio listeners attended both sessions, for which Erin and I both say thank you!! The support means an absolutely tremendous amount to us.

As previously reported, our guest on Tuesday was Nat Friedman. Rather than talk about SUSE Linux Enterprise Desktop with him, we mostly chatted about desktop Linux, integrating Ximian with Novell, and how Nat got into desktop Linux in the first place.

Today we chatted with our pal Jeremy Allison, throwing him a bunch of softballs. Audience questions for Jeremy were a lot tougher than ours.

Here are some of the pics from our session with Nat:

Ted, Nat, Erin, in that order

Nat speaking on where he sees desktop Linux heading next.

Erin sporting his wildy popular “Chapeau des Fleurs”