A default RHEL4 install of a Rackspace (*) server contains a cron.d file named /etc/cron.d/rs_rhncheck that runs a job to check for Red Hat Network updates. In the default configuration this would send out a message every day indicating that up2date did nothing. To only get email when there is something interesting happening I changed the cron.d file to call the following script. The checksum is compared against the checksum of the output of up2date when it does nothing (I guess I could have tested the return code for diff). So when up2date either installs a package or decides not to install a new kernel package (or other important package) then I get an email. #/bin/sh
/usr/sbin/up2date --nox -u > ~/up2date.out
SUM=`md5sum ~/up2date.out cut -f1 -d\ `
if [ $SUM != "65c57b05b24bd8f656a0aec0d6db725a" ] ; then
  cat ~/up2date.out
fi (*) Rackspace support is really good. If I was paying I might look at other options but for my clients I am happy to recommend them without hesitation.

Share This

Returning from Toronto, we went straight to Ravinia to see one of my favourite vocalists: Madeleine Peyroux who didn't disappoint. Lovely afternoon / evening as Ravinia is such a treat: summer, lawn, picnic and excellent live music. Let's see if I get out there another time this year.

Went to Toronto last weekend for a wedding. Couldn't have been nicer -- on Toronto Island with its nice view of the city. The ceremony got slightly rescheduled because of the massive storm coming through last Friday afternoon which forced everything inside. Only drawback was that the party ended too soon due to ferry schedule. Caught up with some friends in town and glanced and a few of those fancy new digs that have come up since we left in 2000: the Opera house, lots of construction at the AGO and the neat building next door, the intriguing chrystal at the ROM. Always nice to come back, especially with the very nicest weather as it was last weekend.

In any graduate student career there are days where you just want to quit and do something else. Anything else. Like get a job in computers where you'll be making a lot more and potentially working a lot less. Today I've felt that urge more strongly than ever before. When I get back from Debconf I'm going to have to decide if it's worth sticking around for another year to finish my phd.

Parsing HTML to get the information you need can be a very hard task if you take complex pages like the ones generated by the Debian Bug Track System, which I need to do on my GSoC project while the debbugs people doesn't finish the SOAP interface. I was doing it through regular expressions, heavily based on the reportbug-ng code, when my mentor (thanks, Lo c) mentioned BeautifulSoup, a python module (with a strange name :P) to parse html.

If you ever need to parse html code in python, I strongly suggest you take a look on it. As usual with python stuff, it's very well documented, and it has a very good set of features which allows one to easily find anything inside a html document. It also has a xml module, which I haven't tried (yet).

BTW, did I already say I think GSoC is a great learning experience? Even I'm surprised by how fast I'm being able to apply GSoC-acquired knowledge in other activities, as I'm already using BeautifulSoup in another project.

I have uploaded exim4 4.67-2 to experimental. Lots of changes and improvements. Quite some changes have gone into the Debconf stuff (for example, the split/unsplit config question is not asked first any more), and into update-exim4.conf (including input sanitazion, transformation of input to lower case, and getting rid of the DEBCONFsomethingDEBCONF stuff in the configuration). I’d like you to test the experimental package before I upload to unstable (probably on sunday). Please report your findings.

exim4 (4.67-2) experimental; urgency=low
  - update-exim4.conf:
    - finally get rid of the DEBCONFfooDEBCONF stuff. That information
      is now passed to the configuration by ue4c by directly setting exim
      macros in the configuration. This has caused both the configuration
      and ue4c to be much shorter.
    - run with -e, -C and -u.
    - convert input read from update-exim4.conf.conf to lower case
    - barf if strange characters are found in ue4cc. Closes: #400294
  - Remove superfluous “x$foo” = “xbar” constructs from scripts
  - Add routers to reject mail to accounts with low UID.
    Closes: #400790.
  - Make daily cron job barf if /usr/bin/mail is not found. Have
    exim4-base recommend mailx. Closes: #427960
  - Have all -daemon packages provide exim4-localscanapi-1.0 and
    exim4-localscanapi-1.1 as requested by Magnus Holmgren while fixing
    #426425. Also include exim4-localscan-plugin-config script with
    exim4-dev. Thanks to Magnus for helping with this. Closes: #428274
  - remove /etc/exim4/email-addresses symlink and document this.
    Thanks to Josip Rodin. Closes: #420578
  - introduce conf.d/250_exim4-config_lowuid which optionally allows
    to reject (or alias away) mail to low-uid accounts that are not
    listed in an exception list. Thanks to Dominic Hargreaves,
    Marc Sherman and Ross Boylan. Closes: #400790, #307768, #331716
  - remove versioned depends on cron, since the version we need is
    well before sarge.
  - Add cron   fcron dependency. Fcron is going to be removed again
    at the first sign of trouble. Closes: #381806
  - remove move_exim3_spool debconf template. Closes: #391762
  - replace openssl gendh with openssl dhparam. Closes: #413235
  - adapt docs, README and manpages
  - have Hilko fix the lynx-dump postprocessing to repair generating
    README.Debian text version. Thanks!
  - increase README.Debian generation robustness. Thanks to Hilko.
  - debconf:
    - Partly apply Christian Perrier’s patch for reviewed
      templates and control file. Closes: #426980
    - Other minor template changes.
    - get rid of “mails” in debconf templates, use “messages” instead.
      Re-word local_interface debconf template. Other minor changes.
      Thanks to Jens Seidel and Christian Perrrier. Closes: #394976
    - re-work exim4-config.config logic to have split/non-split config
      asked last instead of first. This partly addresses #410756.
    - Add exim4-daemon-heavy.templates, exim4-daemon-light.templates
      and exim4.templates to POTFILES.in
    - Re-Word dc_other_hostnames debconf template.
      Thanks to Hans G. Ehrbar. Closes: #421860
    - translation updates:
      - French
      - Ukrainian. Closes: #427793
      - Bulgarian.
      - Thai.
      - Galician.
      - Swedish.
      - Punjabi.
      - Indonesian.
      - Italian.
      - Khmer.
      - Traditional Chinese. Closes: #428072, #428069.
      - Portuguese.
      - Simplified Chinese. Closes: #428072, #428069.
      - Marathi
 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 13 Jun 2007 14:00:38 +020
0

I was asked:

"How can I change the ways I communicate to set a good example of green-ness to company employees? Does anyone have some ideas? This is rather outside of my knowledge field. I guess anything that decreases carbon footprint is probably good?"

Most of this is obvious. We know we should be doing it, but sometimes the usual "too hard" excuses get in the way. Just doing it and making it clear why you're doing it is the biggest step. Like hand-correcting a small error in an internal note instead of reprinting, using both sides of the paper or 2-up printing, or moving to electronic communication instead of paper where possible. Two of my consumer co-operatives ( the Cooperative Group and the Phone Co-op ) take it a stage further: communicate it to others and persuade them to take similar action. tCG does this with its Climate Challenge pledge and Climate Doctor online Q+As. Phone Co-op ask customers to switch to paperless billing and put profiles of green companies into their (online) newsletters. Two more asides: Carbon footprint is not the only aspect of green-ness. It's the most important and popular just now, but there are things that reduce carbon footprint but aren't very green (nuclear power, for example). Greenwashing is a danger. I feel that communicating that you're very green when you're not really will cause you more trouble in the long run than accurately communicating limited green-ness. How else would you practice green communication?

For about two weeks now it seems that a botnet is attacking one of my Gallery2 installations in order to either comment spam me or to solve the captchas:


121.132.186.55 - - [14/Jun/2007:09:09:27 +0200] "POST /main.php?g2_GALLERYSID=4cc6b5e4b7ce4a207957a07c081b6f65 HTTP/1.1" 200 12167 "http://gallery.foobar.net/main.php?g2_GALLERYSID=631acbacb15f2cfb83cdaf592721c082" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" 0 gallery.foobar.net
121.132.186.55 - - [14/Jun/2007:09:09:30 +0200] "GET /main.php?g2_view=comment.AddComment&g2_itemId=7152&g2_return=main.php%3Fg2_itemId%3D7152%26&&g2_returnName=photo HTTP/1.1" 200 10349 "http://gallery.foobar.net/main.php?g2_view=comment.AddComment&g2_itemId=7152&g2_return=main.php%3Fg2_itemId%3D7152%26&&g2_returnName=photo" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" 0 gallery.foobar.net
121.132.186.55 - - [14/Jun/2007:09:09:32 +0200] "POST /main.php?g2_GALLERYSID=b45c76223a933ba3bed6e09a9589a6cd HTTP/1.1" 200 12081 "http://gallery.foobar.net/main.php?g2_view=comment.AddComment&g2_itemId=7152&g2_return=main.php%3Fg2_itemId%3D7152%26&&g2_returnName=photo" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" 0 gallery.foobar.net


Sadly Gallery2 seems to not offer the configuration option to disable comments for non-authorized/logged-in users, just only to disable captchas for some users/groups, but apparently disabling captchas for guests seems totally wrong for me.
Currently I'm blocking the hosts with an iptables rule whenever I see an attacking host by accident, but I guess that there should be a better option...

The Real Cambridge is quite a lot different from the US Cambridge. There are vast stretches of green grass everywhere. People drive little brightly-coloured Volkswagons on the wrong side of the street, and in some places one can be walking down the middle of the street and not realize that vehicle traffic can go there too until a car creeps up behind you, trying to get through. Everywhere that’s not explicitly marked “no cycles” (the colleges, historic important buildings, etc.) features dozens of locked up, often step over-framed commuter bikes, decorated with panniers and front baskets. I still find it vaguely nerve-wracking being in a British vehicle, since I’m always expecting cars traveling in the opposite direction to come wheeling towards me. But I have yet to step off the curb and almost get hit by a double-decker bus because I looked in the wrong direction before starting across. The Cam River is frankly quite puny. Walking alongside it you can witness such events as crew boats nearly crashing into tour boats, and apparently a sort of crew racing called “knocking” is often used because of the river’s narrowness. It’s also not very deep, as can be proven by the periodic punt hires along its shores. And here punting is not to procrastinate (very much an MIT-ism) but to propel a punt , which is a flat-bottomed boat with square ends, by pushing a pole against the bottom of the river. It’s difficult to go six hours without being offered a cup of tea, especially if one is visiting many different people. And I have no idea how people can manage to get drunk off of beer, because a pint is quite enough to fill my stomach and leave no room left for more. So much liquid! And the prices of everything here are just about the same as in the US–except in pounds sterling, not dollars. Which means things really cost twice as much. But since the only things I really need to buy are food, drink, and miscellaneous (like anti-death-by-hay-fever-histamine), things will work out alright. Things have been awesome so far, and the local free software-Debian-Ubuntu-GNOME crowd has made me feel right at home. Maybe someday I will actually swap Cambridges for a while. I’ve gotten to see a bit of Cambridge University here too. Since Hanna’s (really awesome) dad is a fellow of King’s College, we got to go in and look around even though it’s exam season and the general public isn’t allowed in — there’s always a person in funny academic robes standing at the gate and shooing away tourists. Right through the gates there is a large, pristine mowed lawn. It’s in such a condition because no one is allowed to walk on it — unless they’re a fellow of the college. Flaunt that. Her dad also supervises the Cambridge end of CME, so we crashed an end-of-the-year garden party for that this past afternoon. And Saturday it’s off to Scotland, which should be just as awesome! And with more people and more Debian! I’m excited.

Ben Armstrong commented:

"When trying to pin down the exact date when I joined, the keyring changelog is no help. First entry for me is in 2000, which is 3 years later. The web archive is no good, as I joined too late in 1997. Searching for me in the PTS shows my first changelog entry 6 Nov 1997, but that's a bit sloppy because that datestamp was added when the packaging process started. It doesn't reflect when the package was finally uploaded. Mailing list posts are little help. But the first file on master is Dec 8 1997 .Xauthority. So I know it was between November 6th and Dec 8th. Not too bad, but I'd love to know the exact day."

Glad it was some use. I have my suspicions that the only way to find the exact date is to get all the keyring maintainers from that time and regress them under hypnosis. Do you think we can arrange that as a BOF at Debconf next week? The "Cracking Open Minds to Discover Debian Developer Joining Dates BOF"?

After the feedback related to my latest post about NaughtySVN I thought it would be nice to commit my pending changes about update, although they are not enough to make a functional update feature.

I also thought is time to clarify a few things about the project:

• NaughtySVN is a project that tries to be first a sane SVN client for Nautilus in the style of TortoiseSVN available on Windows
• the project is designed in such a way that different frontends and backends can be added[1], so it shouldn't be hard (in theory) to add support for konqueror, gnome-commander on one side or darcs, mercurial or git on another side.
• For now we are working for a Nautilus+SVN client combination and we are in the alpha stage
• different menu items will appear as needed and when they make sense (the update command will appear only if an update is possible, i.e. context menu of a file/directory in a working copy)

[1] see the comment starting from "A word of caution" in this message from Alexander Thomas

• encrypted everything the way d-i does it (boot unencrypted - rest dm-crypt+LUKS). Check
• strong passphrase for encryption. Check
• seperate laptop ssh key. Check
• sshd only public daemon running. keylogin only. Check
• other stuff that ‘listens’ either killed or firewalled away. Check
• weak password on user account. hmmm
• screensaver/autolock after 3 minutes. Check
• sudo-to-root passwordless. hmmm

Am I on the right track? should I turn up my paranoia on the ‘hmmm’s or is it in general acceptable? Oh - and of course - a layer of security by obscurity is always nice. So let us throw dvorak keymap in also.

... is NaughtySVN.

I have joined this project which was started by Alexander Thomas a few weeks ago and I have convinced him that is better to have a release sooner rather than later. The project is still in its early alpha stage[*] but I thought is better to have a rather minimalist and functional client first.
So, I talked to Alexander and we came up with a roadmap; for the 0.0.1 release I am working on the update feature which is about 40% done[1][2] (update dialog screenshot).

Of course, after the release I will probably make a debian package, too, unless someone else beats me to it :-) .

So, the future is bright.


Update: as a response to a comment, NaughtySVN is designed to be not only a Subversion client, but also a framework for other VCS-es and other clients. It just happens that we are working on the Subversion backend and client at the moment.

P.S.: as curiosity of mine, I have written in python a small nautilus plugin that does the svn update (is a svn frontend) and I must say I really miss the development speed of python when writing in C (or maybe I am out of practice).

[*] only a few features are implemented and can't be used yet as a SVN client without being forced to use another client.
[1] according to my estimations
[2] update related code is not committed yet

This is driving me insane... Oo.org has an option not to load settings with the document. The biggest part of it that we're using is that the default printer should be selected no matter which printer was last used in the document (think networked environment.) And this doesn't work, and apparently nobody noticed from 2.0 to 2.2. (Debian #428646, oo.org #78365, and greetings to _rene_.) Oh well, I'll just have to stamp down hard on the fingers of users who question this behaviour and tell them it's just to keep them on guard... (meanwhile, villa.debian.org. or the netwerk between it and our site comes close to dial-up speed, which is pretty annoying when downloading openoffice.org debs... Yes, I could use another mirror, of course. But now's lunchtime, so I guess I'll just wait.)

Now that we’ve settled into our new apartment in Dublin, the ADSL has been connected and I’m back on the net! Obviously I’ve had Internet access at work during this time, but there has been so much new information to take in that I haven’t really had time to do any Debian or WLUG work. I’m still waiting for the shipping company to deliver my computers, so it will be another week or two before I have a development environment that can build and test package. Once that’s setup again I have updates queued for the following:

• PHPwiki - Upgrade to 1.3.13p1
• libtrace - Upgrade to 3.0.2

Unfortunately I’m not going to make it to Debconf this year, despite being the closest geographically that I’ve ever been.

Are you having trouble with your health insurance? Are they stalling on paying a bill? Denying a claim? Not telling you what the heck is going on?? Well you can and should take action to eliminate some of the mystery and move forward, and possibly win fight against the health insurance company. Thanks to my unpleasant ordeals with BCBS of NJ, I have compiled some handy resources and tips to get you started. Good luck and I welcome any other tips that you think should be here. Please email them to me at biella(at)gmail(dot)com Can’t get a straight answer when dealing with health insurance representatives on the phone? Are different representatives providing different and contradictory information? Does talking to the representatives leave you with a pounding headache? Then the following may be helpful: 1. Ideally you should tape record all conversations. If this is not possible, get the name or employee number of the person you are talking to and write down what they told you along with the time and date. If they have agreed to something, make sure they send it to you in writing. This sort of documentation may come in handy later when you are trying to contest or prove something. Is your insurance company flip flopping on a claim? For example telling you that the claim is still being “reviewed” but sending you statements that indicate it has not been paid and never will be? What action can you take to inch things forward? The following may help: 1. Most states have a Department of Banking and Insurance and they are there to help you. Many (perhaps all) provide a service for filing a complaint against your health insurance company and other insurance and banking companies too. When I used the service in NJ , I got assigned an investigator and their service was prompt and helpful. It was my experience that even though they were not able to resolve my issue, the insurance company started to make firm decision on many claims and this alone has been helpful. Before this, it was impossible to get a clear answer from them as to the state of all sorts of claims. They said “NO,” & you think they should say “YES, YES, YES, YES!!!!” In other words, appealing a denial: 1. This site has some great information on how to avoid a denial and what you can do to fight one. 2. Included on their site is the Health Insurance Laws and Benefits Tool which will provide specific information about your rights in different states. For example, you will want to know if there is an external or independent grievance system to appeal your plan’s decisions. In the case of NJ, which is the state I am fighting, the tool provided the following helpful information:

Does New Jersey require an external or independent grievance system to appeal your health plan’s unfavorable decisions? Yes, for all health plans.

On what grounds can you file your external grievance?
Investigational treatment appeal, medical necessity. What is the status of the external grievance panel’s decision?
Binding. External grievance systems allow you to take a dispute with your health plan to a doctor or review board unaffiliated with your health plan. Thus, both you and your health plan receive an impartial ruling on its decision to deny coverage of services or treatment. Additionally, you can file a complaint against your health insurer with your state’s department of insurance.

Additional Helpful Information and Resources 1. The message boards on lawyers.com are a great place to hit for information. I have found folks there helpful.
2. You many want to blog about your experience as you may get an unexpected response directly from your insurance company. I think there are pro’s and cons to blogging about your experience but it does provide a public face to your ordeal and allows you to chronicle exactly what has transpired.
3. If your cases is particularly shocking, do not hesitate to hit the local media.
4. If your claim has been denied by an external review panel, you may not have much luck suing but if there is no external review panel, you can and should also try Small Claims Court or other legal action. Further, even if your claim was denied by an external review board, you may have other options for suing, for example, due to their bad faith handling of a claim. And on that note, here is a great legal resource covering the topic.

It appears as though Akerlof's "market for lemons" that Bruce Schneier wrote about has caught on. While hiring is certainly a case of information asymmetry like the "lemons market", there are some other factors at work: The Principal-agent problem: even once you've hired someone, there are some asymmetries at work of a different sort: your motives may not be the same as your employer's, and it may be difficult for the employer to monitor what you're doing. If you're digging ditches, it's pretty easy to see what you've done, and how well you've done it. If you're creating a complex system, on the other hand, it's much harder, even for an expert, to tell what sort of job you've done, let alone for a "pointy haired boss" with little knowledge of the domain at hand. The wikipedia article discusses different schemes and problems with attempting to align the interests of employee and employer. The curious may wonder why anyone hires anyone at all, rather than just having all work be a series of contracts between independant individuals, rather than companies and employees. Ronald Coase asked the same question a number of years ago, and determined that the answer lies in transaction costs - the subtle friction that permeates any real world exchange. Think about having to continuously search for potential contract workers, and bargain with them over prices. It's easier to employ someone, and be able to count on their work, at a steady rate, than to have to outsource important functions continuously and at variable prices. It's also probably cheaper in some ways because of people's tendency to be "risk averse" - they prefer the steady but stable job over a more variable, but higher paying income stream. As we've seen in recent years, as transaction costs have come down, it does become easier to outsource certain kinds of work, and we have seen more of it. Economics provides a fascinating lens through which to view the world of high tech and information goods, and the superficial overview that I've attained has certainly served me well. A good place to start, besides perusing wikipedia, is the book Information Rules by Hal Varian and Carl Shapiro.

Maplin Electronics wrote:

"Maplin Electronics has launched National Solar Week (18th - 24th June) providing solar advice online and in store for eco-minded shoppers who want to do their little bit for the environment without making major changes to their lives or bank balance! The solar advice day on Thursday, 21st June [...] the government should show a commitment to the environment [...] By removing VAT on all energy-efficient products, the Government can do their bit too. We're committed to making solar technology affordable and amenable to every customer, so we're counting on you to sign our petition and pledge your support."

A tax break for renewable energy seems like a good idea to me. I recently increased the insulation of my home. Southern Electric run a funding scheme and it was charged only 5% VAT, so tax incentives for energy-efficiency are obviously possible. I've done the insulation before things like installing renewable energy collectors because the tax breaks make insulation much more attractive. Finally, I took the Co-operative Group Climate Challenge yesterday, but there seems to be little detail about it online, apart from Sam's announcement. I'll probably comment more on tCG's strange web services elsewhere soon.

The newer version of Gnash, that is 0.8.0, is about to be released. Though it has many improvements, it is still not modular (that’s a goal for the next release). That means that the decision about the backends have to be made at compilation time, not in runtime. As the backend for graphics, the most appealing options are AGG and OpenGL. While OpenGL might seem quite attractive for people who have graphics cards with hardware support for OpenGL, AGG seems to be the better option for those who doesn’t. In fact, AGG works quite good for me. The second problem is that KDE support only works with OpenGL for the moment. In fact, if some KDE Developer wants to help Gnash Developers about that, I think they would be really welcome. In any case, if I compile gnash with both OpenGL and KDE support, everything seems to depend on kdelibs, which is not reasonable for the diversity of users out there. Therefore, I had to build the whole stuff two times, once with AGG, and without KDE support, and another one with both OpenGL and KDE. The next problem would be that the generated libraries have the same places and the same directories in both of the configurations. I had to change its –release parameter from 0.8.0 to 0.8.0.agg and 0.8.0.gl. That seemed to do the trick. So, I have two set of packages for Gnash right now:

• libgnash0 (AGG) -> gnash, cygnal, gnash-tools and mozilla-plugin-gnash
• libklash0 (OpenGL and KDE) -> klash and konqueror-plugin-gnash

Hmmm, maybe I'm missing a point, dear lazyweb, but it seems as if proftpd in Etch is somewhat broken.
Ok, I have a setup with proftpd, SQL backend (psql) and quota. First the SQL backend:


Table "public.users"
Column Type Modifiers
---------+------------------------+-----------
userid character varying(30) not null
passwd character varying(80) not null
uid integer
gid integer
homedir character varying(255)
shell character varying(255)
clear character varying(80)
Indexes:
"userid_pkey" PRIMARY KEY, btree (userid)
"users_uid_key" UNIQUE, btree (uid)
"users_userid_key" UNIQUE, btree (userid)


Proftpd.conf:

[...]
RequireValidShell off
DefaultRoot /home/%u
AuthOrder mod_sql.c
#PostgresInfo localhost dbadmin dcf1330 vftp
SQLAuthTypes Plaintext
SQLAuthenticate users* userset
SQLConnectInfo vftp dbadmin dcf1330
SQLDefaultGID 65534
SQLDefaultUID 65534
SQLMinUserGID 2100000
SQLMinUserUID 400000000
#SQLUserInfo users userid clear "uid" "gid" homedir shell
SQLNamedQuery userinfo FREEFORM "SELECT userid, clear, uid, gid, homedir, shell
SQLUserInfo custom:/userinfo


The problem is now, that those files that are uploaded by ftp get owned by uid 65533 instead of the uid defined in the SQL table, whereas the gid is being set correctly. Example:


-rw-r--r-- 1 65533 2101 14838 2007-06-11 15:34 front.jpg


Both, uid and gid, have the same value within the database (exampel is "2101" here), but only gid will be used correctly by proftpd when uploading files. I would prefer to use usrquota instead of grpquota, though.
I'm appreciating tips to solve this problem or to confirm that this is a proftpd bug! :-)