My Response to Vic Toews’ Automated Email

The Honourable Vic Toews:

While I cannot argue that their is a problem with online exploitation, that is true of any media. The question is, is the response being considered appropriate to the level of threat? In my opinion, this is not the best way to deal with the issue, particularly since:

1. private companies (ISPs) will be responsible for maintaining databases for government use of personal information that they do not currently do; this is especially problematic in that it EXPOSES people more to identity theft and thus exploitation than it would do to protect them – all that data is in many different systems, accessible by many different people, with varying degrees of security.
2. I do not believe that giving up privacy and personal freedom is the best way to combat social issues, especially given what I’ve seen happen with Homeland Security in the USA.
3. regardless of intent, the information available can and sooner or later *will* be used for activities other than law enforcement. Huge stockpiles of data like that are very valuable in many ways, which is another reason why I worry about point (1) – that sort of compiled data would be of great value to marketers, identity thieves, etc.

I also have issues with some of the “myths/facts” section of your email:

Myth: Lawful Access legislation infringes on the privacy of Canadians.

Fact: Our Government puts a high priority on protecting the privacy of law-abiding Canadians. Current practices of accessing the actual content of communications with a legal authorization will not change.

For now. Who says what future legislation might bring? I would prefer not to give up my privacy to any extent, and especially not in a way that could be changed at any time in the future to allow broader access to that information already stockpiled.

Myth: Having access to basic subscriber information means that authorities can monitor personal communications and activities.

Fact: This has nothing to do with monitoring emails or web browsing. Basic subscriber information would be limited to a customer’s name, address, telephone number, email address, Internet Protocol (IP) address, and the name of the telecommunications service provider. It absolutely does not include the content of emails, phones calls or online activities.

Again, I can’t see it as being a good trade off in terms of privacy vs. security. My information is already in enough government and commercial databases. While keeping track of EVERYONE’S IP history for a year might help law enforcement officials in a vanishingly tiny percentage of cases, I don’t see that tiny percentage being of enough benefit to outweigh the invasion of my privacy.

Myth: This legislation does not benefit average Canadians and only gives authorities more power.

Fact: As a result of technological innovations, criminals and terrorists have found ways to hide their illegal activities. This legislation will keep Canadians safer by putting police on the same footing as those who seek to harm us.

This is such a broad over-generalization that it is semantically null. Also, the implication is that in order to deal with criminals, police need to be able to use criminal methods (“putting police on the same footing as those who seek to harm us”). As an ethical person, I do not endorse this idea, nor any other reformulation of “the ends justify the means”. Again I point out the slippery slope that the Americans are currently sliding down with this idea vis a vis terrorism & Homeland Security.

Myth: Basic subscriber information is way beyond “phone book information”.

Fact: The basic subscriber information described in the proposed legislation is the modern day equivalent of information that is in the phone book. Individuals frequently freely share this information online and in many cases it is searchable and quite public.

This is a fallacy. The difference here is that some people choose to make that information public, while this legislation would require it. This smacks of the same philosophy that got Mark Zuckerberg in legal trouble with privacy issues on Facebook. Simply because many people choose to share their information does not mean that everyone should therefore have no problem with being required to share their information by default.

Myth: Police and telecommunications service providers will now be required to maintain databases with information collected on Canadians.

Fact: This proposed legislation will not require either police or telecommunications service providers to create databases with information collected on Canadians.

Where this information will be stored then, and who will store it? This infonugget leaves the question begging.

Myth: “Warrantless access” to customer information will give police and government unregulated access to our personal information.

Fact: Federal legislation already allows telecommunications service providers to voluntarily release basic subscriber information to authorities without a warrant. This Bill acts as a counterbalance by adding a number of checks and balances which do not exist today, and clearly lists which basic subscriber identifiers authorities can access.

Again, we have the difference between choice and requirement at issue here. Simply because an ISP can choose to cooperate with authorities is not the same as requiring them to do so. There are quite a few cases I’ve read of where telcos refuse to cooperate without warrants and the like because the authorities quite obviously have no real business requesting certain information. This legislation would take away the ability to withhold information based on the provider’s judgment of the consumer’s best interests and the business’s own privacy policies and ethics.

For your amusement, Rick Mercer’s take on the subject – that is, that Candians aren’t stupid enough to think that it’s either this bad piece of legislation, or being lumped in with child pornographers (why, O why, are the PCs so set and determined to try and drag Canada into US style black-and-white extreme polarization of political issues???)

AHHH! I MUST HAVE ONE!

Toews’ Automated Reply

Thank you for contacting my office regarding Bill C-30, the Protecting Children from Internet Predators Act.

Canada’s laws currently do not adequately protect Canadians from online exploitation and we think there is widespread agreement that this is a problem.

We want to update our laws while striking the right balance between combating crime and protecting privacy.

Let me be very clear: the police will not be able to read emails or view web activity unless they obtain a warrant issued by a judge and we have constructed safeguards to protect the privacy of Canadians, including audits by privacy commissioners.

What’s needed most is an open discussion about how to better protect Canadians from online crime. We will therefore send this legislation directly to Parliamentary Committee for a full examination of the best ways to protect Canadians while respecting their privacy.

For your information, I have included some myths and facts below regarding Bill C-30 in its current state.

Sincerely,
Vic Toews
Member of Parliament for Provencher

Myth: Lawful Access legislation infringes on the privacy of Canadians.

Fact: Our Government puts a high priority on protecting the privacy of law-abiding Canadians. Current practices of accessing the actual content of communications with a legal authorization will not change.

Myth: Having access to basic subscriber information means that authorities can monitor personal communications and activities.

Fact: This has nothing to do with monitoring emails or web browsing. Basic subscriber information would be limited to a customer’s name, address, telephone number, email address, Internet Protocol (IP) address, and the name of the telecommunications service provider. It absolutely does not include the content of emails, phones calls or online activities.

Myth: This legislation does not benefit average Canadians and only gives authorities more power.

Fact: As a result of technological innovations, criminals and terrorists have found ways to hide their illegal activities. This legislation will keep Canadians safer by putting police on the same footing as those who seek to harm us.

Myth: Basic subscriber information is way beyond “phone book information”.

Fact: The basic subscriber information described in the proposed legislation is the modern day equivalent of information that is in the phone book. Individuals frequently freely share this information online and in many cases it is searchable and quite public.

Myth: Police and telecommunications service providers will now be required to maintain databases with information collected on Canadians.

Fact: This proposed legislation will not require either police or telecommunications service providers to create databases with information collected on Canadians.

Myth: “Warrantless access” to customer information will give police and government unregulated access to our personal information.

Fact: Federal legislation already allows telecommunications service providers to voluntarily release basic subscriber information to authorities without a warrant. This Bill acts as a counterbalance by adding a number of checks and balances which do not exist today, and clearly lists which basic subscriber identifiers authorities can access.

Anyway, I gave the two post on their website a read, and found enough basic English and debating errors that I thought it would be edutaining to blog about them.  Yes, Virgina, I *am* feeling a teensie bit petty this morning, but them’s the breaks!  If you’re gonna pass yourself off as a serious organization, I’m gonna take you to task for really basic mistakes like the ones to follow.

First off, here’s screen caps of the original two posts.  I’m not going to link to them for two reasons: (1) I don’t want to contribute to increasing their site’s search engine rankings and (2) to prevent link rot.

So, off we go then to deconstruct the first post!

• The author manages to mangle DeGeneres  as “Degeneres”.  Whups, should have turned off the auto correct!  Or at least proofread the article before publishing.
• Basic grammatical errors!  For instance, “…hiring an open homosexual spokesperson…” should be “…hiring an openly homosexual spokesperson…”
• Logical error: “Unless JC Penney decides to be neutral in the culture war…”  Wouldn’t being neutral mean that JCP should ignore the issues of the ‘culture war’ altogether, and base their hiring on anything but sexual orientation?  Particularly as I doubt that their commercials are going to be promoting any sexuality at all, straight or gay.  I rather imagine that they’ll be more focused on selling things to people, that being their business.  Which in fact the article goes on to point out:  “Their marketing strategy is to help families shop and receive a good value for their money.”  Soooo a bit of muddy thinking there, no?
• They’re also just pulling statistics out of their asses:  “The majority of JC Penney shoppers will be offended and choose to no longer shop there.”  Fair enough – let’s see the surveys you’ve done or the third party data and reports you’ve analyzed to support this statement, then.  Oh – citation needed?  Whups.  Oddly enough, in choosing their spokesperson I’m willing to bet that JCP’s massive marketing department did do some basic consumer polling and go over their own sales data and consumer profiles.
• Another logical error: “By jumping on the pro-gay bandwagon…”  I’m not sure how hiring an openly gay comedian is pro-gay, exactly, especially since the reasons given for hiring Ellen don’t mention sexuality at all.  And while pink dollars are big dollars, I doubt that they’d be enough to support a huge department store chain.  Which oddly enough the article points out itself: “The small percentage of customers they are attempting to satisfy will not offset their loss in sales.”  And again, I seriously doubt the focus of the commercials will be something like Ellen saying “As a lesbian mom, I’d like to say that shopping at JCP is the gayest thing you can do to help support destroying America!”  I’m pretty sure homosexuality will be left completely out of it, and that their commercials are going to be about getting people to shop at JCP regardless of their sexual orientation.  In fact, the reason JCP chose Ellen was – and this was cited in the article – was because JCP felt that they “share the same fundamental values as Ellen…integrity, simplicity and respect.”  Perhaps OMM could learn something from that.

The second article is more of the same:

• Still mangling DeGeneres  as “Degeneres”.
• Still having problems with grammar:  “hangs up on them rather than verses hearing their concerns” should be either “hangs up on them rather than hearing their concerns” or “hangs up on them verses hearing their concerns”.  Also, they’re using the homophone “verses” instead of “versus.”
• Still having problem with constructing logical arguments, too:  “Degeneres is not a true representation of the type of families who shop at the retailer.”  This after quoting the company president in their first article saying that she does, and exactly what the family values are that she represents?  And again, no data is presented to back up this opinion.  It’s just flung out there with no support at all.  In fact, it’s flat out contradicted by the quote from the company’s president, who should certainly be in a position to provide and expert opinion.
• Some serious hyperbole going on, too.  Is it really tragic to be transferred to the customer service department manager’s voicemail?
• More logical fallacies going on:  “Since the corporate office doesn’t consider your call important, please call your local store manager.”  Er, generalizing a bit there?  Just because the author felt that their call wasn’t given the attention the author felt it deserved doesn’t mean that the corporate office considers all calls about the matter unimportant.

So.  Rather than focusing on promoting hate, perhaps these moms should be focusing on promoting good old traditional American values like paying attention to detail and taking pride in your work.  Especially when you’re an organization rather than an individual and posting something intended to be seen by the broader public.

You’d think as moms they’d be paying more attention to kid-oriented basics like reading, writing and ‘rithmitic.  I’ve always thought that education and raising awareness of LBGT issues was important, but I didn’t think that ignorance really ran this deep.  Now I see that basic education in things like grammar, spelling and logical argument will have to be done first before we can move on to more advanced topics like “tolerance”.   OK, OK, a low blow, but man – how can anyone be expected to take such badly written claptrap seriously?
PS:  I used the acronym OMM instead of the organization’s name to keep search engine ranking low.  However, every time I wrote it all I could hear in  my head was Cookie Monster going OMM NOM NOM NOM!  Am I the only one?  It sure made writing this post a lot more fun!

hiring an open homosexual spokesperson

1. A Caveat
2. Unlocking & Rooting
3. User Interface / ROM
4. Keyboard & Trackpad
5. Microphone & Speakers
6. Camera & Picture Quality
7. Battery Life
8. Hardware Overview
9. Full Tech Specs

Firstly, a caveat: I am using this phone in Canada, so most of the native T-Mobile features aren’t available as I’m on a different network.  In Canada,  WIND Mobile and Mobilicity operate on the same 1700/2100 band (AWS) as T-Mobile and allow users to bring their own phones.  I went with WIND solely because they have a slightly broader coverage of the Edmonton metro area.  Their customer service is definitely sub-par, but they are actually quite experienced with Android phones and got me up and running very quickly.

For those who are interested, I bought the phone off of eBay for $215; the seller was a total sweetie   Be forewarned that if you buy it from an actual eBay store (for instance, thegizmotrader) you’ll have to pay the shipping company to act as your import broker.  For UPS, this is an outrageous $40 that you pay to UPS over and above what you actually pay to the seller for shipping and handling.

Unlocking & Rooting

Unlocking is dead simple, it took me two minutes.  There’s good documentation here for Windows users (Linux users should be able to follow the same guide and adjust accordingly).  A less technically savvy person might have to fumble around a bit longer, but even so I would expect the average user to be able to unlock this bad boy in under thirty minutes.

Rooting was also a piece of cake.  I wrote a rooting guide for Linux users, and you can use SuperOneClick if you’re a Windows user.

User Interface / ROM

I found the native UI to be laggy and ugly in the extreme, and since I couldn’t use most of the T-Mobile features anyway I dumped the native ROM and tried out several alternates.  All of the ROMS are based off of the T-Mobile ROM as the hardware APIs aren’t available for building one from scratch, but they are heavily tweaked and optimized.  I eventually settled on Glorious Overdose as the best of the lot – clean and zippy interface, all the bloatware stripped out and extremely stable.  Kudos to ayoteddy and sduvick!

Keyboard & Trackpad

Without question the best keyboard currently on the market from any manufacturer.

The buttons are well spaced out and have great clicky tactile feedback, and it’s very easy to thumb-type very quickly on them.

The laser touchpad is pretty decent, but it can be a bit slow to respond.  It can also be used as a button to click on screen elements instead of using your finger by simply pushing on it.  It’s way better than a D-pad, but I still find the original G1′s trackball to be the best mouse substitute.

Microphone & Speakers

The handset microphone works very well, people had no trouble hearing me and reported that the sound was of excellent quality.  Ditto for the speaker, excellent sound and quite loud.  The speaker phone, which I use a lot when I need my hands free to work when doing technical support, is decent but not spectacular; sound is a bit tinny.

I can recommend the BlueAnt Q2 Bluetooth Headset for use with the Sidekick.  It’s feature packed, inexpensive, and works even better than my original Plantronic Voyager Pro.  It has a native Android app that also enables some nifty features like reading your SMS messages to you over the headset as they come in!

Camera & Picture Quality

Rear camera:

The camera is definitely middle of the line at 3MP, but the video quality is decent at 720×480 @ 30 fps.  The biggest disappoint is the lack of a flash; it will take pics under low light conditions like at a night club, but the results are usually rather grainy.  Pictures are of decent quality in good lighting conditions, and the focusing and shutter speed are good.

Front camera:

A basic VGA cam, it handles video conferencing apps like Skype well.

Battery Life

Mediocre to poor, depending on your use.  Definitely not for heavy use, as it won’t make it through the day without a charge.  I keep mine plugged in at the office or in the car, and usually have ~85% battery at the end of the day.  However, with heavy use and no on-the-go charging, it usually dies by dinner time.  Even with light use you’d still need to charge it over night every day to ensure you had enough power for the next day.

Hardware Overview

Definitely not a powerhouse, but again good enough for an average user or technical user like myself.  If you want a gaming platform, this is not your phone (though video and audio are quite good).  It has only a single core and 512MB of RAM.  If it wasn’t for the fantastic keyboard and the nifty pop up screen, this would be in the ‘cheap free phone with sign up’ category.

GPS often takes two to five minutes to lock on, somewhat longer than average in my experience.  However once locked, it rarely loses it.

Radio is excellent, I get a 3G signal even in the concrete elevator shaft in my office building.  The phone is in fact 4G capable, but most carriers in Canada don’t have much coverage for 4G as of yet.

Full Technical Specifcations for
Samsung’s Sidekick 4G (model T839) for T-Mobile:

(credit: GSM Arena)

In our view, Internet policy should strive to balance the sometimes competing goals of the global free flow of information (which is clearly critical to U.S. businesses), with enforcement of the rule of law. We don’t see those competing goals as mutually exclusive, but rather, complimentary. In fact, that balance is essential to a flourishing, yet safe, Internet.

In case you’re wondering what I’m talking about:

com·pli·men·ta·ry:

1. Expressing a compliment; praising or approving.
2. Given or supplied free of charge.

I do believe what they meant was:

com·ple·men·ta·ry:

1. Completing; forming a complement.
2. (of two or more different things) Combining in such a way as to enhance or emphasize each other’s qualities.

Ah, GoDaddy… trying so hard to pretend to know what you’re talking about, and still massively failing on all fronts.  Spellcheck is good, but actually knowing what you’re talking about (either conceptually or in terms of vocabulary) is even better.

Here’s a browsershot of the full text from GoDaddy’s blog, if you’re interested:

It took me quite a while to find any actual data on the number of malware apps estimated to actually be out there, given the search engine signal to noise ratio from all the bloggers jumping on the 472% bandwagon and quoting each other.

I tried the website for Lookout first, which is one of Android better security apps.  Lots of interesting stuff, but couldn’t find any hard data in the blog or forums including a report on malware numbers from June 2011 counting 400 malware apps (thanks to redditor diff-t for the heads up!).  There is no Lookout data for November 2011, though, and no way to tell if Juniper is using the same counts or not in deriving their 472%.

Eventually I found the original malware report from Juniper [PDF].  Juniper requires registration to access; I’ve hotlinked directly to the report to save you the spam (annoyingly, I had to switch to Chrome to get the registration form to work for me; in Firefox it errored out: p.onStatusChange is not a function).  And… there were no hard numbers showing where this figure came from in the report!  Nada.  Just

“400% increase in Android malware since summer 2010″

This is a professional report?

However, the report did quote the numbers from summer 2010:

“In all, the research indicated that 29 applications were found to request exactly the same permissions as known spyware applications.”

And, genuis that I am, I can do math: 4.72 * 29 = 137.  So, we have a frightening, blogosphere-shaking increase of… 108 malware apps.

And I can play the statistics game, too.  What percentage of apps on the market are malware, then?  Well, as of Nov 2011 there are 370 000 Android Marketplace apps.  Here comes the math genius-ness again:  137 / 370 000 = 0.00037, or 0.037%.  Not quite so scary now, is it?  Not much of a headline there: “0.037% of Android apps are malware, up from 0.0078%!”  I call shenanigans on this.

So while Android is certainly picking up steam as a target, this is more a function of increasing marketshare than a fault of the open nature of the marketplace – something the report actually gives a nod to but doesn’t seem to be mentioned by most of the blogosphere.  While the PC Mag article at least gives a nod to these facts, they still jump on the bandwagon with the “Five fold increase” part of their title.  Ah, sweet sweet sensationalism, build me some links!

And while security on a phone is certainly an important concern, and people should definitely be aware that with increased marketshare Android is coming under increased attack, I don’t think it’s worth the furor currently raging. Personally I suspect that a significant chunk of the brouhaha is being fueled by FUD from competitors (*cough*Apple*cough*) spurred by the fact that Android has recently hit over 50% marketshare for smartphones.  But hey, that would be unethical.

Original infographic:

All commands here are issued as root (use sudo -i to get a root shell if you don’t have access to the root account).

First of course you need to ensure that it’s installed and set to run at start up:

• yum install vsftpd
• chkconfig vsftpd on
  

If you’re running a firewall that it is configured to allow FTP traffic through.  My CentOS uses iptables:

• service iptables stop
• iptables -A INPUT -p tcp -m tcp –dport 21 -j ACCEPT
• Open /etc/sysconfig/iptables-config in your favourite text editor.
• Either add IPTABLES_MODULES="ip_conntrack_ftp" to the top or insert ip_conntrack_ftp into the existing IPTABLES_MODULES entry.  In the latter case, remember that module names are separated by a space: (eg) IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp"
• service iptables restart

This solved my problems – hopefully it will do the same for you!

The primary reason Apple has the tablet market locked down is of course that it was first to market with a complete, polished multimedia platform that had great vertical integration via iTunes.  While weak initially as an eReader, with Kindle and other apps it made up that ground quickly.  And Apple fans bought it up by the zillions simply because it was the latest and greatest Apple product, creating the market for tablets out of thin air.

Evidence that it was bought by fans simply because it was an Apple product is pretty easy to come by.  For me the most telling is that one of the most popular accessories is iPad cases that you slot it into to give it a keyboard and stand up the display as a monitor.  Seriously?  Why not just buy a netbook and be done with it?  People bought it because it was Apple’s latest and greatest, and then have to use cumbersome workarounds to get it to act like the computing platform they need.  If you need a netbook instead of a multimedia tablet, you shouldn’t be buying a far more expensive, far fewer productivity apps, have to get accessories to use it at all work around.

Regardless, Apple put out a great product with good support and lots of apps and infrastructure to support it.  The rest of the industry was caught completely flat footed, as the tablet market had been tried already around 2000 and failed pretty much completely.  Apple’s managed to carry the day in a way that only Apple had the resources and user base to do so.

So why can’t they keep the market to themselves?  Competitors have been falling all over themselves to offer similar products, and so far no real traction has caught for them as evidenced by HP’s complete abandonment after only a few months of their own Touchpad, and other companies aren’t doing much better.

The answer is, they are too early to market in their attempt to compete.  By rushing imitation products out the door, they are missing two key features that make a tablet a desirable device:

• A smooth, easy to use OS designed for use on a tablet device.  WebOS and Android just aren’t geared for it, and it shows.
• Vertical integration with multimedia services.  iTunes is already out there and ready to serve up media, and it’s no difficulty at all for uses to switch to a new device.

And unfortunately for Apple, those two factors are self limiting.  Time will erode both of them fairly quickly.  Android Honeycomb is a hasty hack at a tablet OS, but Ice Cream Sandwich surely be far better developed.  Google has already done it once with Android – it only took a couple of iterations before it caught up to iOS on the smart phone.  And the same reasons that made Android attractive to smart phone manufacturers will make it just as attractive to tablet manufacturers: it’s free and it’s easy to customize.  And Google, unlike HP with webOS, has the will and the resources to keep pushing for that marketshare along with a dedicated Android user base.

Vertical integration is still a big advantage in Apple’s corner, but with Amazon posed to release it’s own tablet by October that edge will be seriously diminished as well.  And Amazon will take any marketshare it can get – unlike Apple, it will be happy to open it’s online store to any other Android tablet manufacturer.  Once a big player can vertically integrate multimedia access across any Android platform, Apple’s iTunes advantage vanishes for anyone not already locked into it or those wanting to free their information.

So yes, the tablet market belongs to Apple.  But not for ever, and definitely not for much longer.

Of course SHIFT + NUMLOCK does turn it off again, as does going into System->Preferences->Keyboard “Mouse Keys” and unchecking “Pointer can be controlled using the keypad”.  Which is a pain, as I’ve never used the numeric keypad to control my mouse; I’d rather just turn off the option altogether.  Thankfully, disabling it is very easy:

• Open /usr/share/X11/xkb/compat/complete for editing as superuser
  (eg) Hit ALT+F2 and then enter gksudo /usr/share/X11/xkb/compat/complete
• Comment out mousekeys & accessx(full):
  // $XKeyboardConfig$
  // $Xorg: complete,v 1.3 2000/08/17 19:54:34 cpqbld Exp $
  default xkb_compatibility “complete” {
  include “basic”
  augment “iso9995″
  //augment “mousekeys”
  //augment “accessx(full)”
  augment “misc”
  augment “xfree86″
  augment “level5″
  };

That’s all it takes!

I recently needed to move an installation using MySQL running on an Ubuntu server to a new PBX in a Flash (CentOS) server.  On Debian systems this is a breeze as the package is well maintained in the repositories, but on CentOS it’s a little more involved.  Here’s how I did it:

1. Openfire isn’t available using yum, so the first step is to download the rpm.  You can get it from Ignite Realtime’s downloads page to get the latest version, or use wget to snag openfire-3.7.0-1.i386.rpm.  It includes it’s own Java runtime, so you don’t have to worry about dependencies.
   Since this was a migration and I didn’t want to do an upgrade and then troubleshoot any possible complications from upgrading and migrating simultaneously, I needed to download an older version.  This was much more painful than it needed to be as unfortunately Ignite Realtime doesn’t seem to maintain an online archive for older versions.  After some experimentation I figured out the package name and was able to use wget to pull it from the download URL.
2. Logging into MySQL on the CentOS server, I created an “openfire” database and then gave access rights to a new user created using the same name and password as the MySQL openfire account on the Ubuntu server.
3. On both servers, I stopped the openfire and mysql services.
4. Since it was a migration, the configuration information such as the server name was staying the same.  I could just copy the Ubuntu server’s /etc/openfire/openfire.xml onto the CentOS server at /opt/openfire/conf/openfire.xml.
5. I used tar to copy the Ubuntu server’s /etc/openfire/plugins directory to the CentOS server’s /opt/openfire/plugins directory (keeping the same permissions – don’t forget the -p flag!).
6. On CentOS, I had to recursively chown the plugins directory and the openfire.xml for daemon:daemon (on Ubuntu, it’s openfire:openfire).
7. I then copied /var/lib/mysql/openfire/ from the Ubuntu server to /var/lib/mysql/openfire/, making sure to keep the permissions when I tarred up the files and after untarring making sure the file ownership was mysql:mysql.
8. Since PBX in a Flash uses IPTables as a firewall, that needs to be updated as well.  I added
   -A INPUT -p tcp -i eth0 –dport 5222 -j ACCEPT
   -A INPUT -p udp -i eth0 –dport 5222 -j ACCEPT
   -A INPUT -p tcp -i eth0 –dport 7777 -j ACCEPT
   -A INPUT -p udp -i eth0 –dport 7777 -j ACCEPTr0
   -A INPUT -p tcp -i eth0 –dport 9090 -j ACCEPT
   -A INPUT -p udp -i eth0 –dport 9090 -j ACCEPT
   -A INPUT -p tcp -i eth0 –dport 9091 -j ACCEPT
   -A INPUT -p udp -i eth0 –dport 9091 -j ACCEPT
   to /etc/sysconfig/iptables and updated iptables with the following command: iptables-restore < /etc/sysconfig/iptables.
9. I started the MySQL and Openfire services up again on the CentOS server, and using Ignite Realtime’s Spark instant messaging client I connected to the server using the IP address.  Success!
10. Finally I changed over the DNS entries to point at the new CentOS server.  Once the change had propagated, I logged in at http://www.mydomain.com:9090 using the original Debian username and password and verified the web console was up and running.

A bit tricky, but not too bad!  If you get stuck, there’s lots of info available by searching and you can always try the (unfortunately rather sparse) official Openfire documentation as well.