Yesterday I handed out "how to vote" cards for the Greens at the state election. It did seem to be a significant waste to have so much paper produced. Slightly more than half the voters who visited my polling booth took cards from all parties, which was obviously of little use. There is some useful information to be gained from reading the cards from all parties, but nothing that you can analyse during the short period spent waiting in line. I expect that most people decide who to vote for before they get anywhere near the polling booth and just accept the cards because they feel that it may be rude to reject them. While ironically some people who didn't like the Greens refused to accept a card from me and told me that they didn't want it with the impression that they would offend me, I'd rather save the trees and not give cards to people who don't want to use them...

I spoke to a representative of the Family First party who tried to convince me that the Greens should be against homosexuality because the Greens are "against unnatural things", he also claimed that people who choose not to have children (being gay is apparently choosing not to have children) are selfish - unless of course they are a celibate priest. He also managed to offend a supporter of the ALP in two different ways which led to an amusing heated debate and then left before I could have any more fun. For the reference of other Family First people, I've pasted in the dictionary definitions of "homo" and "hetero", when used as prefixes those Greek derived words mean "like attracting like" and "opposites attract". An example of such usage is the term "homo-charged electrets" used in electronics.

From The Collaborative International Dictionary of English v.0.48 [gcide]:
Hetero- \Het"er*o-\ [Gr. "e teros other.]
  A combining form signifying other, other than usual,
  different; as, heteroclite, heterodox, heterogamous.
  [1913 Webster]

From The Collaborative International Dictionary of English v.0.48 [gcide]:
Homo- \Ho"mo-\
 A combining form from Gr. "omo s, one and the same, common,
 joint.
 [1913 Webster]

From Bouvier's Law Dictionary, Revised 6th Ed (1856) [bouvier]:
HOMO. This Latin word, in its most enlarged sense, includes both man and
woman. 2 Inst. 45. Vide Man.

The ALP (usually known as Labor) supporters had unfortunately believed the lies of their own apparatchiks. They were convinced that the Greens were directing preferences to the Liberal party, even though in most districts the Greens actually directed preferences to the ALP! The only exceptions were a small number of districts with split preferences (favoring neither Liberal nor ALP). It continually amazes me that while helping the ALP they were attacking us! Once I showed the ALP supporters the cards I was distributing they became quite friendly, as the Greens had a very low chance of winning the lower house in the districts for the polling place in question the preferences would go to the ALP.

It was interesting to talk to a Liberal supporter, he supports the workplace reforms implemented by the Federal government (Liberal) because he was hired for his current job because his employer can easily get rid of him if the business has a down-turn. It is hard to argue with someone who has only got a job because of the policy in question, but I did point out that continuity of employment is a major factor when applying for a mortgage. I recently bought a house and had a significant amount of hassle from the banks due to the fact that I work as a contractor. I had previously enquired about borrowing twice as much money while at my last permanent position and had much fewer problems from the banks.

I mentioned some of the other bad things the Liberal government has done (such as invading Iraq for no good cause), but the Liberal supporter was too sensible to comment on any of the issues where he would only lose. This however left him with not very much to say.

Most of the work of handing out the cards was quite boring and very tiring. Fortunately a friend decided to visit and help out so there were three people handing out Greens cards instead of the scheduled two which made it easier work. The ALP apparently had four people which seems to be an optimal number as there were voters arriving from two directions and no matter where they came from at least two ALP supporters would be able to intercept them.

Surprisingly the work was easier at the most busy times. When the queue stretched out into the street I could stoll along the queue and give the cards to the voters. When the queue disappeared later in the day the voters were walking past at high speed and I had to move quickly to get to them.

Now it's time to start planning for the next Federal election.

A few months ago I finished Play Money by Julian Dibbel and like his My Tiny Life before it, the writing style is simple yet sumptuous, or I guess just simply sumptuous. Like the travel writings that pre-figured anthropological writing, Dibbel takes us to a far-away exotic land (but only a click or two away) that are populated by a motley crew of wizard (or is lizard)? slayers, gold-diggers, money-makers, and virtual-world-builders. For many, these MMOGsare no strange-lands but are becoming weaved firmly and intimately into the fabric of everyday life, whether as entertainment, sociality, and or for a cadre of folks, as a source of income generation. I think the book has gotten enough coverage that I don’t need to rehearse its content in any detail but the basic story is that Julian embarks on a real world quest in the virtual land of quests to try to make enough money (to be specific make a little more than his monthly salary as a freelance writer) from trading and selling a slew of virtual objects and gold. In taking us along, he gives a compelling entry into the imaginative and morally complex world of these games. And better is that whether you know nothing about them or are a seasoned player, the book has much to offer. One of the reasons I respect Julian Dibbel is because he takes his sweeeet time to churn out a book-length manuscript. In a day and age when there is so much pressure to release quick and often, especially when writing about anything in the so-called virtual plane of existence, he waited nearly 8 years from the publication of his last book on gaming, My Tiny Life before publishing on a considerably higher-tech phenomenon. Following him on his most recent adventure, you learn that he threw himself into a variety of gaming environments persistently and consistently and did at least 3 years of research and writing (at one point in the book he confesses how excruciating writing for him, which is hard to believe as the words slip so nicely off the paper but whatever the extent of his writing angst is, he clearly spends a lot of care in crafting his sentences). And I am starting to think that if more people followed this ethic of long-term immersion, coupled with slow-brewed productive sparsity, we would get higher quality products (Yes, kinda like the Debian release cyclce). Like any good ethnographer, he gives an intimate portrait of life in these worlds of copious play where various types of real world economies have mushroomed apace with new technological developments. That is, he gives us a taste of what it is like, as he cleverly puts it to own unreality. Couched within tales of gaming gone real world economic, are hearty reflections on the place of play in social and economic life, the close resemblance and conceptual affinity between computers and games (and not just computer games, and here he does a fantastic job at explaining the Turing Test), self-doubts about writing in general and in particular about this topic, commodity fetishism, and the changing nature of capitalism in a world of ever-greater abstractions. All of this makes for an enjoyable read that if used in the classroom (which like A Tiny Life, I am sure will become standard for courses on Virtual Worlds) allows you to bring in some good supplemental material whether Edward Castranova’s Synthetic Worlds, Greg Lastowka and Dan Hunter’s The Laws of Virtual Worlds and or older heavy-hitters like Max Weber and Karl Marx. The only topic I think I would have liked to seen included is that of capitalist finance, because there are, I think, some real affinities, phenomenologically and conceptually, between finance capitalism and gaming the virtual game. Otherwise some of my favorite sections were on hackers and the object of the computer, but of course, I am biased that way. So here I leave you with a tasty morsel of something that was sumptuous to ingest: It is this endlessly repeatable collusion of freedom and determinism-the warp and woof of fixed rules and free play, of running code and variable input that sets both games and computers apart, together from the larger universe of information technologies they inhabit…. But only games share the universal machine’s game’s thoroughgoing commitment to the principle of recursion: the chained repetition of simple operations, each building on both the input of the moment and the outcomes of preceding steps. And only games, therefore, come close to capturing that precise mi of unpredictability and inevitability that makes the computer such a powerful simulator of our lived experience of the world. p. 104

I think there's a certain special sloth that Americans get to experience on the day after Thanksgiving that we don't get on other parts of the year. Something about the combination of gluttony and wholesomeness makes Black Friday a very mellow, enjoyable time. Maybe it's the fact that it's officially now The Holiday Season, but the stressful tasklist of December hasn't started yet. Or maybe just that it's a day off of work for no good reason except it just is. Maybe it's the fridge full of leftovers that still taste kind of good. I dunno. We had a good Thanksgiving dinner yesterday evening. Maj, Amita June and I had planned to go visit family in New Brunswick (New Jersey) for the holiday, which was really nice to do last year. But our visas are running out in December, and although we're (probably) not going to have a problem renewing them, our lawyer said it was a bad time to leave the country. So, we stayed in Montreal for Thanksgiving. Canadians have their own Thanksgiving, of course, on the 2nd Monday of October, but not having grown up with that day as Thanksgiving, and with most of our family celebrating in November, it's hard to get motivated around Canadian Thanksgiving. And it's just not that big a deal in Quebec, anyways. So we had a good dinner here; John Usher, Niko, Jeff Waye, Meg and Patti all came over and had a good time of it. I cooked my first Thanksgiving dinner -- a big salmon, potatoes and sweet potatoes, roasted broccoli and wax beans, a great big salad. Every family has a Thanksgiving dish tradition -- one of the Prodromous' is a big pot of macaroni and cheese. So I made that, too. We all ate pretty well, drank some wine, talked about the future of music and how fun it is to play hockey. Unfortunately, I managed to miss my Blinky Hockey practice last night -- I tried to put the (overtired) baby to bed at 10PM and ended up falling asleep myself. All in all a good TG, even though far from family. tags: thanksgiving family montreal black friday dinner canada

Speaking of home All of Canada is abuzz right now about a recently-proposed bill by the ruling Conservative Party in Parliament to declare the Quebecois to be a nation within Canada. Sovereignty of Quebec has been an extremely contentious issue in Canada over the last 50 years (two sovereignist parties are major players at the federal and provincial level), and this form of recognition is an interesting step. The whole thing began with Michael Ignatieff, a candidate for the leadership of the opposition Liberal Party. He has stated publicly that Quebec is indeed a nation, and his followers are pushing to have that be part of the Liberal Party platform. The sovereignist Bloc Quebecois tried to steal their thunder by introducing a bill in parliament to the same effect. Their thunder was in turn stolen by the Government with the latest bill, which now has the support of all the parties and will almost definitely pass. The wording of the bill is interesting. First, it calls the Quebecois a nation -- the people themselves, not Quebec qua territory or government. Although the government has stated that this includes all people in Quebec, it's still pretty obviously targeted towards recognition of an ethnic group, French-speaking Quebecois, more than everybody who's living inside the borders. Second, it recognizes this group as a nation within Canada -- deflating the suggestion that it may become an independent state. I have to admit that the ambiguous nature of Quebec's status is one of the things I find fascinating about living in Montreal. As far as I can tell, few sovereignists hope for anything like a total split with Canada, but instead are looking for some sort of autonomous status. On the other side, even the staunchest federalists have seemed comfortable with granting Quebec more of an international profile, such as giving Quebec a formal role in UNESCO. My guess is that the nature of Quebec's relationship with Canada will change gradually until it reaches some stable point where everyone's comfortable. I don't know where that stable point is, but I think it'll be interesting to find out. At the turn of the 20th century, if you had told people that the British, Austrian, Turkish and Russian Empires would be dissolved and almost forgotten within 100 years, they would have scoffed. But in that short span of time, the idea of empire, spheres of influence, and Great Powers has passed from the world stage. We simply don't think in terms of Empire any more, but in terms of nation-states. My guess is that the 21st century will see a similar change in the idea of nation-state. With pressure from supranational organizations like the UN, EU, GATT and the International Criminal Court, as well as pressure from unrecognized nations like Quebec and Catalunya and Wales, I think the firm borders of the nation-state are going to loosen up a lot. What it will mean is anyone's guess, but I think if we're lucky we'll have a richer tapestry of nations and people participating in global politics and culture. And I think Quebec will be an important part of those changes. tags: quebec nation autonomy nation-state

Thanks, Biella! I'm glad to see that Biella is going to give us the goods on PR. Our Wikitravel 2007 Get-together is going to be on the island of Puerto Rico, and Biella's from there, so she's going to make up a list of good places to check out. Great news! tags: thanks biella coleman puerto rico wikitravel

Being the fully programmable neural network that I am (among other things), I've made a bit of effort to associate certain things and places with certain feelings, attitudes and activities. My workplace is connected to medium-abstract design choices that are easy to implement, with only short spans where the code doesn't fully compile, while at home I usually go for the more abstract, fully correct way that takes longer to code, but has the advantage of being more flexible and reusable. Which means that I often reuse stuff I wrote at home. Now the capitalist in me wonders whether I'm not actually giving things away for free that I ought to take money for. Rewriting the code makes no sense to me either, since it exists already. Is there a blindingly obvious solution I missed (apart from becoming a freelancer and getting paid per project)?

Wow...This time I'm truly amazed. A spam just hit my debian-devel mailbox. That's sadly not strange at all, I know. Only that I started reading it. It says:

Spammers don't seem to target us for their random alias generation
tools, or        maybe they haven't got to the letter 'o' yet. com
for subsequent posts, but that whole barn door thing comes to mind.
In so doing, values are overlooked often and mistakes are made. Maybe
Microsoft will let me        change my alias.
Maybe some of it would actually be useful to me. For whatever reason, my
Microsoft email address didn't ever get        spam.

Then it goes on talking nonsense splattered with all kinds of garbage talk, some news (or whatever) about stock options of a China Health thing, and goes on throwing nonsense blabber.
Sorry, I'm not linking to it (I'll probably later update this entry), it's still not available in the Web archive of debian-devel.">

In two days time we are having a state election in Victoria (Australia). For this election there is only one party with policies that are positive towards free software, that is the Australian Greens. The policy documents include an IT policy (note that the IT policy is on a link that may change while the policy documents is a permanent link).

The Greens IT policy has three sections under the goals, one of those is about open standards (ensuring that government data is in documented file formats for use by all with no need to purchase software) and another is about Open Source which directly advocates the use of free software by government agencies. The principles part of the document is also very positive towards free software and explains why it's beneficial for Australia.

Any Greens representatives that are elected on the weekend have to abide by the party policy, that means that they must advocate the use of open standards and Open Source in government use and vote accordingly when any legislation related to computers is being considered!

Some of the members of the Greens are also members of the free software community, we were able to explain to the other party members the benefits for Australia and for social justice in the use of free software, and thus we reached an agreement about on a policy that suits people who use free software - not to benefit such people, but because of the benefits to society of the use of free software.

I think it would be good if members of the free software community in other countries would also join their local Green party and promote similar policies. While there is no direct connection between the Green parties in different countries the aims are very similar and therefore the arguments that persuaded Green members in Australia can be expected to work reasonably well in other countries (I am happy to provide advise in this regard via private mail if requested).

Also it would be good if other parties could be persuaded to have similar policies. If you want to help the free software community but for some reason you don't support the Greens then please join a party that matches your views and advocate an IT policy that promotes free software.

Currently people who want to vote for free software in the Victorian election have no option other than to vote for the Greens. As a member of the Greens I am happy to document this as a reason to vote Green. But as a member of the free software community I would like to see other parties adopt policies that promote free software.

The Greens adoption of a policy that promotes free software was largely driven by the issue of social justice. We believe that every Australian citizen has the right to access all public government data. If government data is available in proprietary formats then access is only granted to people who can afford the latest software ($800 for a full copy of MS Office) and hardware to run it ($600 at least). We believe that unemployed people who receive free Linux computers from Computerbank should be able to access government data. We also believe that when FOI laws apply in 30 years time all current data should be accessible, there's no chance that whatever version of Office is being sold in 30 years time will read current MS file formats, and there's no guarantee that MS will even be in business then. File formats for which there are authoritative open-source programs written to use them will be accessible in 30 years time and more.

Live CD on a removable disk Eros is a hardware guru that happened to be the unknown guy sitting next to me on a plane. He happens to be a happy Kubuntuer. While chatting, he told me one of his systems is an external hard drive made by copying a Kubuntu live CD image on it. Why did you do so? I asked. Because this way I can plug it in any computer, and it'll do hardware detection at boot. However it's a hard drive, so it's fast, and I can keep my home and all my customisations on it. I had never thought of it. That's an interesting and smart (ab)use of a live CD. Now I wonder: what would be required to plug the live CD boot time hardware detection infrastructure on an existing Debian or Ubuntu instalation? Update: slh on IRC suggests (a bit edited by me):

A lot of the former "obscure black magic" for live CDs isn't needed anymore. What is needed is: a kernel with static usb-storage, libusual, ehci-hcd, ohci-hcd, uhci-hdc (or an appropriate initrd/ initramfs). udev takes care of most h/w detection issues these days. As long as everything needed to boot is contained in a single partition you don't need a fstab: udev, hal and pmount take care of the rest, procfs, sysvfs, devpts, usbfs, shm are mounted by sysvinit. All what is left is a tool to create the xorg.conf while booting (those tools exist and just need to be called early). Everything else is just a matter of convenience: enhancing the live span of the USB key by changing data into tmpfs, etc.; if passwordless logins are required then xsession and inittab need to be changed; new ssh host keys generated on boot; small stuff. With ordinary flash storage, jffs2 and something to reduce write access is a good idea: perhaps unionfs for /var/ and /home/, bind mounting /tmp/ on /var/tmp/), but that's also not strictly necessary. Mostly it boils down to running the xorg-creation script at every boot time. There are various tools to do that. Some are here, but there is surely more. (Enrico's note: do we have anything in Debian that we can install and just does that?) Since USB and PS/2 mice share the same device since kernel 2.6, that part of xorg.conf doesn't strictly need to be detected, same for the keyboard (alps and synaptic touchpads can be easily detected) and X.org can use the screen's ddc info although it's not always reliable. It can boil down to just detecting the video chipset: something like this, that uses PCI IDs from discover1-data. It can also become a lot easier with X.org's own ddc detection, which almost boils down to configuring input devices and selecting the video driver. If I understand Daniel Stone correctly, X.org will soon improve its detection routines (fail safe X (auto-)configuration) as well in X.org 7.3. xresprobe is in debian: it's pretty similar to ddcxinfo-kanotix, both forked off RedHat's kudzu package - and all fail miserably on amd64. That's why ddcxinfo has a fallback to 1024*768 @75 Hz which "always works (+manual overrides)".

After a recent apt-get dist-upgrade I noticed that I'm using Firefox/Iceweasel 2.0 now. Which is nice and all, but it doesn't really fit my way of browsing and TAB-handling. I always have lots of TABs open simultaneously. And by lots I mean 100-600. I'm not kidding. Firefox 2.0 changed TAB sizes and behaviour which makes it completely unusable for me. A quickfix to make it at least bearable:

1. Type about:config in the URL bar.
2. Search for browser.tabs.tabMinWidth default integer 100
3. Change 100 to 8.
4. Restart the browser.

A lot better now... Now I need an extention which provides me with a scrollbar for the TAB-bar, I cannot click 200 times just to move to a TAB which is 200 TABs away from the current one...

Speaking of having a kid, it’s been a while since Esther has appeared in this space. She’s grown up quite a bit:

Writing tests is virtuous. It's the wholemeal bread of programming. Do it, and you'll be so much fitter. Except it tastes like cardboard and gets in the way of consuming the yummy treacle sponge of programming. But now I've got the testing religion. I view the lack of tests with the disapprobation of a reformed smoker tutting and huffing at the merest suggestion of a Marlboro Light. How did this happen and how can I be sure I won't backslide? The moment of transition was the first time that a test saved me from releasing software with a bad bug in it. The theoretical knowledge of virtue was translated into the palpitating relief of not disgracing myself in public. After that happened a few more times, I found myself desperately uncomfortable with the idea of releasing anything that didn't have decent test coverage. And so a virtuous habit is formed. It's not just driven by fear. With the right tools to hand, writing tests can be a lot of fun. You don't always need to be "in the zone". If you've got a spare half hour here and there, you can use it to increase the coverage of your tests. Getting better at testing is one of the ways I've become a much more proficient Rails developer over the last year of work on Expectnation. In case it helps anybody else, I thought I'd share some of the tools and techniques that are part of making Rails testing fun and effective. Continuous testing Whenever a checkin is made to our source repository, tests are run and the results emailed to everybody working on the project. As with the "you broke the build" disincentive, you need to be kept honest by frequent running of the tests. There are a variety of tools around to help you do continuous integration with Rails, most of which have some dependence on you using Subversion for source control. In the event, I just created my own script to do what we required. Coverage reports One of the big mental hurdles with testing is knowing how many tests you should aim for.  You can't prove a negative: even if your tests are all passing it still doesn't tell you much about the tests you haven't written that might fail! We use rcov as part of the continuous integration process, and post the results to our project web site. The pretty red and green bars give you some idea of when you're starting to get adequate test coverage, and the line-by-line breakdown is invaluable. Tainting strings One of the easiest errors to make in Rails templates is to miss the call to h(), to escape any HTML in an output string. The only real way to catch these errors is through automation. The wonderful safe_erb plugin helps you do just that. By using Ruby's tainting mechanism for strings, it throws an exception if you render any external data unescaped. One of the beneficial side effects of safe_erb is that you then become very particular about ensuring your functional tests properly cover every action in your application.  Tests such as get 'index', which before seemed mundane and redundant, are now essential, as you want to test for tainted strings. In addition to the above techniques, there are a lot of fun shiny gadgets to help you write tests, such as ZenTest, but the three things above are the ones I've found to be of significant value. I ought to conclude with words of praise for Rails. It goes out of its way to make testing an important part of the development lifecycle, and the availability of the of unit, functional and integration test functionality makes it easy to get started. Every time I teach somebody about Rails' testing features, they end up finding it very enjoyable.
Don't forget, testing can be fun!

At the start of this week, one of the mailservers I run came heavily under attack. As well as the continuing surge in the sheer volume of spam - which has been reported widely in articles like Spam up by 59 per cent [Spannerworks Search Marketing News] - there were dozens of clients opening connections and then just sitting there idle. Very strange. To bring things back under control, I added a mixture of new anti-spam methods, but some things will always be attractive enough for bad people to attack manually and defeat whatever anti-spam you put in place. The only anti-spam which can't be defeated is one that will defeat all real people - and that helps spammers to pollute the network, IMO, making everyone else waste yet more time as a result of their spamming. My main anti-spam at the moment is a mix of:

• throttling and limit simultaneous connections - make them speak slowly and clearly;
• greylisting but be careful not to put the block time too high, else yahoo's mail relay farms will give up;
• tarpitting triggered by a DNSBL match - this is often enough to make spammers give up (too expensive) or violate the SMTP protocol;
• moderate list mails by Content-Type - most lists prefer text/plain;
• moderate by content string matching - rather fiddly to do this.

I always argue against doing a hard reject for a dnsbl match. In general, dnsbls are way too trigger-happy and too prone to false positives, especially for things like new mailservers coming online. Just this month, one of my ISP mailservers ended up in sbl-xbl and I couldn't find out why. Once I had added the extra anti-spam, the spam volume dropped significantly. Total message volume reduced by about 20%. I can't tell reliably how many of the 20% (or the remaining 80%) are spam, of course. But then the network connection failed, which may have been the cause of the idle connections that turned this into a crisis in the first place.

I need to set up a spam filter, preferably with instantaneous rejection of emails. The way postfix does this is to immediately attempt to forward the mail to a filter, which is then responsible for feeding it back. This is probably the sanest way to do it, as it allows postfix to handle timeouts in the filter, and it allows the filter to modify the message (e.g. tag it) Now, all I need is a filter that actually works in this place. What would be nice would be a readymade spam filter installation that I could simply boot on a virtual machine and be set.

From Crikey: If a government wanted to figure out how best to defend the country, it wouldn t hold an inquiry into the air force. It would hold an inquiry into defence. So if a government wanted to figure out how to plan for responsible energy consumption in an age of climate change you d assume it would hold an inquiry into energy consumption. Instead, the Australian government holds an inquiry into nuclear energy.

The above really says it all. The Liberal government has decided that they want to get nuclear reactors regardless of what the citizens want. Surprisingly the Switkowski report was not very positive towards nuclear power. It concluded that producing 1/3 of Australia's electricity requirements would require 25 nuclear power plants, and that they would have to be built close to population centers, and mainly on the east cost. I guess that means about 8 reactors for Melbourne and about 10 for Sydney! It has been suggested that the federal government could force nuclear power on the states even if the state governments don't want it!

For those reactors to be economically viable a carbon tax is required (this means taxing all energy sources on the amount of carbon that they release into the atmosphere). The Liberal government has been opposing such a tax but now the report they commissioned recommends it.

The Victorian branch of the Liberal party seems to support such things. I have been walking past the office of Ted Baillieu (the leader of the Victorian Liberal party) on my way to work. He has a sign in his office window opposing wind power so I guess he'll be supporting nuclear power.

It's something to keep in mind at the election on Saturday. I'll be handing out how to vote cards for the Greens.

Gunnar, how can you take with such calm this horrible cold weather? I mean, 10°! In november! Yesterday’s forecasted minimum was – 1°, and it even snowed on the Ajusco. We’re supposed to be a nice tropical country. OTOH, I do commiserate with you on the christmas music.

Introduction: This guide will walk you through the creation of an encrypted filesystem using LUKS. LUKS is the Linux Unified Key Setup and is a standard format for linux hard disk encryption. It has a lot of interesting features such as using a key on a removable disk, keeping multiple keys, and more. This is the technology used by the Debian Installer (since etch beta3) and is quickly becoming a standard in the linux world. Who this guide is for: This guide is for anyone who wants to secure their data using an encrypted partition. While it is tailored to users of Debian, it should apply elsewhere in the linux world. This guide is intended to add an encrypted device to an existing install, if you are contemplating a fresh install, the Debian Installer will configure encrypted filesystems for you. Ready? Then let’s begin Prepare the partition (or other block device) to be used This can be a partition on disk, a logical volume in LVM or some other block device. For this example, I created a 40 GB volume in LVM.

• For a physical partition, you would need to have an entire partition available on disk. Instructions for this can be found from many other sources
• For LVM, create a partition like this
  lvcreate -n crypto_test --size 40g asimov-vol

Install cryptsetup This utility provides an interface into the code in the linux kernel that handles encrypted block devices. It’s packaged for Debian in both testing and unstable, stable has an older version and I don’t know whether or not it will work in the same manner.
apt-get install cryptsetup Set up encryption on the partition: This initializes the partition for encryption and sets the initial key. People not using LVM will want a path like /dev/hdxY where hdxY is the partition on their hard drive that will be used for encryption. Important! This command will wipe out anything on that partition

cryptsetup luksFormat /dev/mapper/asimov--vol-crypto_test
WARNING!
========
This will overwrite data on /dev/mapper/asimov–vol-crypto_test irrevocably. Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.

Congratulation! You now have an encrypted block device! However, it’s not quite ready to use. Open and map the device: This opens the device (prompting for a passphrase) and maps it to a block device in /dev/mapper. This can be used like any other block device, and the encryption/decryption is transparent. The first path (/dev/mapper/asimov–vol-crypto_test) is the encrypted partition you set up earlier. The name (crypto_test) is the name of the volume, the block device will be mapped as /dev/mapper/<name>.

cryptsetup luksOpen /dev/mapper/asimov--vol-crypto_test crypto_test
Enter LUKS passphrase:
key slot 0 unlocked.
Command successful.

Create the filesystem of your choice on the device: This is just like setting up any other block device. I use ext3, others may prefer different formats.
mkfs.ext3 /dev/mapper/crypto-test Add the definition to /etc/crypttab: /etc/crypttab is a list of encrypted devices that are mapped on boot. The format is <map name> <path to device> <key file> <options> Since we’re using a passphrase, we don’t have a key file.
crypto_test /dev/mapper/asimov--vol-crypto_test none luks Create a mount point: This is where the encrypted device will be mounted on your filesystem.
mkdir /mnt/crypto_test Add the device to /etc/fstab: /etc/fstab tells the computer where to mount different devices on the filesystem. The format is
<source path> <mount path> <type of filesystem> <options> <mount options options> <dump frequency> <fsck pass> More information can be found by reading man 5 fstab. You will want to add a line like this: /dev/mapper/crypto_test /mnt/crypto_test ext3 defaults 0 2 somewhere in this file. Update the initial ramdisk. The initial ramdisk is used to jumpstart the boot process and load modules for the kernel that it can’t load itself (such as drivers for block devices that contain the modules it uses). I’m not sure if this is needed or not, but I wanted to be on the safe side.
update-initramfs -u -k all Congratulations Now your encrypted filesystem is completely set up! Reboot the system and you will see it prompt you for your passphrase during the boot cycle. Once the password has entered, the encryption is completely transparent. If you want to use your encrypted filesystem before rebooting, simply type mount /path/to/mountpoint.

There has been a lot of interest recently in the VFX VoIP service launched by WorldXchange (WXC), no doubt partly driven by the fact that there is no monthly charge until April 2007. I had a spare Linksys PAP2T so I thought I would try the service out to see how it performed. The signup process didn’t go anywhere near as smoothly as it did when I signed up for my WXC DSL connection. The online signup form tried to force me to select a new WXC DSL Plan (I don’t want to do that, I want to keep my old plan with free National traffic). Despite trying several times and making sure that the only checkbox ticked was VFX each time, it refused to let me go any further. Giving up on the web form, I rang the WXC helpdesk who answered promptly. It is easy to see why WXC won the 2006 award for best call centre. Every time I deal with them over the phone it is a pleasant experience. This time was no exception. The CSR I was talking to explained that the webform was dying because I tried to use a VFX username that differed from my WXC DSL username. There was no mention of this restriction on the website! Anyway, 15 minutes later, with my MAC address taken down and my voice recording completed, I was told we were all done and that I would receive my welcome email and account details with 2 working days! 24 hours later I received the email with the details, followed promptly by a phone call from WXC CSR who was ready to talk me through the process of setting up my PAP2. Configuring the PAP2 was a simple procedure, I had to copy and paste a URL into the Provisioning Rule field of the web interface and reboot the device. It then downloads configuration information directly from WXC (based off the device MAC adddress) and configures itself. I was up and running with dial-tone about 2 minutes after receiving the email. Very smooth. I understand that the process is even easier if you purchase a pre-configured PAP2. The downside to the whole scheme is that in trying to make the process as simple as possible WXC has locked the entire system down very tightly and remove a lot of the flexibility that I would desire. In particular my PAP is now completely locked, I can’t access any of the web interfaces, and even the dial-in prompt on the PAP2 replies with a curt “cancelled” before hanging up. There is no way for me to configure the second line of the device to talk to a second SIP provider. Apparently WXC will create a custom configuration for me so that I can still use the second line, but I imagine this requires giving them all my account details for my second SIP provider, which I’m not sure I’m comfortable doing. It also appears that WXC has an arrangement with Linksys such that every PAP2 now sold in New Zealand comes pre-configured to be used with WXC. I haven’t had a chance to look at one of these PAP2s yet, but if it were to turn out that I had to contact WXC to remove the locking on my PAP2 before I was able to use it with another VoIP provider I would be fairly annoyed. The MyVFX portal is very underwhelming. It insists on opening itself in a new browser window, and isn’t integrated with the rest of the WXC/VFX website. From what I can make out it’s just a branded frontend on to the management system that WXC has purchased. The user interface is reminiscent of the design of the 1990s. I think there is a lot of potential for WXC to improve the experience in this area and I doubt that the average user would be comfortable updating settings via MyVFX in its present state. On the technical side of things the VFX service seems to be fairly well designed and secured. The devices are provisioned and configured using the Linksys/Sipura provisioning tools, which appear to encrypt all conversations with the device. The setup process downloaded two configuration files and a firmware file (v 3.1.10) to my PAP2. Both of the configuration files were binary and appear to be encrypted. Interestingly it appears that WXC downgraded the firmware from 5.1.1 to 3.1.1 during the provisioning process. The MyVFX portal and SIP server appear to be using some sort of BroadWorks device. The device fetches it’s configuration file from the WXC server every time it is powered on, so it will be easy for WXC to push out updates and configuration changes as they desire. The VoIP side of things is performed using SIP, which appears to be using standard HTTP Digest authentication. The username and passsword for this being hidden inside the encrypted configuration files which are downloaded to the device. The voice data uses the G.729 codec inside an RTP stream, and from a few short calls seems to be relatively good quality. Conclusion
Overall, VFX seems like a very easy to use and simple service. Simple being the keyword. By locking down the devices so securely and preventing people from using softphones and devices other than Linksys equipment I imagine many people like myself are excluded from the potential market. I can’t see myself keeping the service after I have to start paying money for it. But I would definitely recommend it to friends and family who are looking for a simple, easy to use VoIP system.

I'm using SMTP over dialup to my smarthost. Unfortunately that doesn't stop spamassassin to think I am a spammer:

Received: from tesla.df7cb.de ([88.198.227.218] ident=postfix)
        by merkel.debian.org with esmtp (Exim 4.50) id 1Gm6h1-0001Fw-26
        for ???@qa.debian.org; Mon, 20 Nov 2006 03:48:03 -0700
Received: from volta.df7cb.de (dslb-084-058-218-241.pools.arcor-ip.net [84.58.218.241])
        by tesla.df7cb.de (Postfix) with ESMTP id 2F5364475D
        for <???@qa.debian.org>; Mon, 20 Nov 2006 11:48:24 +0100 (CET)
Received: by volta.df7cb.de (Postfix, from userid 1000)
        id BBABE18E95; Mon, 20 Nov 2006 11:49:32 +0100 (CET)
 0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
 0.1 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP address
                            [84.58.218.241 listed in dnsbl.sorbs.net]
 1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
               [Blocked - see <http://www.spamcop.net/bl.shtml?70.103.162.29>]
 2.5 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
                            [84.58.218.241 listed in sbl-xbl.spamhaus.org]
 1.7 RCVD_IN_NJABL_DUL      RBL: NJABL: dialup sender did non-local SMTP
                            [84.58.218.241 listed in combined.njabl.org]

My previous solution was to use an openvpn tunnel to the smarthost, but my current one (provided by codebreaker) is a vserver, so that doesn't work. Ganneff provided the workaround: make postfix drop the Received: header.

[0] cb@tesla:~ $grep header /etc/postfix/main.cf
header_checks = pcre:/etc/postfix/header_checks
[0] cb@tesla:~ $cat /etc/postfix/header_checks
/^Received: from [a-z]*\.df7cb\.de \(dslb-[0-9.-]*\.pools\.arcor-ip\.net/ IGNORE
Received: from tesla.df7cb.de ([88.198.227.218] ident=postfix)
        by merkel.debian.org with esmtp (Exim 4.50) id 1GmX3t-0000Pw-4I
        for ???@qa.debian.org; Tue, 21 Nov 2006 07:57:27 -0700
Received: by volta.df7cb.de (Postfix, from userid 1000)
        id 69AB218EAC; Tue, 21 Nov 2006 15:58:57 +0100 (CET)

Of course this is a gross hack, but I'm happy with it :)

I'm planning a small hack-a-thon at my flat on the weekend around December 8th to 10th, without any particular goal or focus. The idea is to simply hack on everybody's favourite projects, exert peer pressure onto each other so things get actually done and in the process raise the general (in)sanity level. There is internet/internet6/anonet connectivity, crash space and food (and beer). I'm out of Salmiakki, though.

Contributions from iterating.com ITeRating has contacted me looking for ways of exchanging data with Debtags. There have been various outcomes of this:

• ITeRating is now providing a custom tag source. To activate it, just uncomment the ITeRating line in the file /etc/debtags/sources.list shipped with a recent version of debtags.
• ITeRating sent a tentative mapping between their categories and the Debtags ones, which has spawned quite some work in the list and ended up with various new tags being added to the Debtags vocabulary.

Debian Jr. development revived Recently there has been some lively discussion on the Debian Jr. list about how to arrange an account for a child of 1 to 3 years of age. Suggestions included using set-top box software like Freevo, tailoring DEs with panels and large buttons, using simpler WMs like fvwm, or using an “activity centre” app like Gcompris. Now, I respect those parents who hold that a child this young should interact more with the “real world”. While I wouldn’t go so far as to outright prohibit my young ones from computer use, I can see the wisdom in keeping it to a minimum. But, for better or worse, our family is one of several who have some experience helping our youngest members use our Debian systems. We would like to share what we’ve learned through the Debian Jr. project. Getting started with live.debian.net To that end, last week I was inspired to follow the Debian Live ISO Howto to produce my first rough draft of a Debian Jr. live CD built from scratch on Etch. For the final product, we’ll want to use a local partial Debian archive mirror, as it not only optimizes fetching packages for several build iterations, but also can be kept stable, which is important as we near release. But for this draft, I ran into trouble building the complete package list to populate the partial mirror, as cdebootstrap, which make-live uses, has no handy --print-debs switch like debootstrap does. So for now, I rely on approx to cache packages for optimization only. A straightforward process to create a working live CD The rest of the process was straightforward: using live-package, I created a package list¹ containing Gnome and the Debian Jr. metapackages, I configured /etc/make-live.conf to point at my proxy, and then I ran the make-live script on the package list. The end result was ./debian-live/binary.iso, which successfully booted under qemu. At this stage, there is not much to show. To be truly useful, the live CD needs to be set up so that children and their guides can immediately find and use the material intended for them. We will need not only one live CD user, but four, varying in age range and role. (More about this in a future article.) However, it is an encouraging start, and shows that we may be able to produce something usable by the time Etch releases.

¹ For this exercise, I simply combined /usr/share/make-live/lists/gnome with the junior-* metapackages in Etch, and added mozilla-firefox-gnome-support to satisfy Gnome’s web browser dependency and cut down on redundancy, resulting in the following list.

junior-art
junior-doc
junior-games-card
junior-games-gl
junior-games-net
junior-games-sim
junior-games-text
junior-gnome
junior-internet
junior-kde
junior-math
junior-programming
junior-puzzle
junior-sound
junior-system
junior-toys
junior-typing
junior-writing
mozilla-firefox-gnome-support
eject sudo
console-common locales
gdm gdm-themes gnome-desktop-environment gnome-cups-manager gnome-screensaver
gnome-themes-extras
rhythmbox synaptic
x-window-system-core