The other day I had an incident involving my vision. It has nothing to do with the vision problems many people had the other day, when someone posted some pr0n on various Planets. For some time already, maybe two or three years, I've had this weird vision problem at times, when I'd start seeing some black stains with some flashing lights , even with my eyes closed. These symptoms would go away after a few minutes, and washing my eyes with a good amount of water also helped. It happened a lot during mornings, and I somehow connected it to showering with too hot water, using a certain brand of shampoo (Say no to Revlon!) and shower vapour. When I described the symptoms to my mother, the reaction was the expected in a house of doctors and nurses: indiference. En casa del herrero, cuchillo de palo, for those who understand it. On Sunday I stayed up helping Bel n with her DEA paper until 5AM. I woke up at 7:30AM, and stayed at work like a zombie, until I had a chance to have a needed nap at 6PM. The problem was my nap was a bit longer than I wanted, and woke up at 9:15PM, still tired but no longer sleepy. I wasn't sleepy until 4AM, and next morning I accidentally overslept, and rushed out of the bed to get to work as soon as possible. While preparing, I suddenly noticed my vision went a bit blurry and strange. I thought it just was one of those stains , until I closed my right eye to rub it and all I saw was darkness. I totally freaked out. OMFG, I'm fucking BLIND . I wanted to phone someone, but wireless had broken down and I didn't have my mobile phone with me, so I tried looking at a text file I have in the laptop with some numbers on, when it ran out of battery. I grabbed my old mobile and failed to introduce the correct PIN three times. I went to the bathroom, covered my right eye, and yeah, there was darkness. If I waved my hand over my blind eye, I would barely notice some movement on the left side, but that was all. Still very frightened, I washed my eye thoroughly and to my relief, I was able to see the upper part of my field of vision. After some more, I had recovered all my sight. Whew. I managed to speak to Ra l on the phone, who told me this probably wasn't too bad, just the optic nerve being tired due to stress and so on. My mother also asked an opthalmologist at her hospital the day after, who confirmed this. It's probably caused by my recent whacky sleeping habits (basically non-existing), general stress, and long exposures to computer monitors. The doctor asked her if I had a headache, which I didn't the day before, but I had one the day after, when she asked. How do you know? , I replied. Last night I went to bed at 00:05 and managed to sleep eight hours for the first time in many months. I'm really going to make an effort to fix my sleeping habits, because they were quite fucked up lately, not catching up sleep even during weekends. On Monday I'll visit the doctor anyway, just to confirm all of this. Coincidentally, Russel Coker also had similar symptoms this week, and also blogged about it.

Tomorrow at 6:00 AM I’ll be already sitting in a train in my way to Reus, from where I’ll fly to Dublin to attend aKademy 2006 … and I still haven’t managed to write about my trip to London (Well, in fact, I wrote about my two first days at London some time ago, but I haven’t found time to complete it). I’ve been trying to get some spare time for KDE hacking for a long time but I have only managed to do a dozen commits in the last months. I expect I can get some KOffice work done in aKademy and have a chance to enjoy beer with some KDE fellows.

On a lot of systems, the Debian installation is spread over a set of partitions. This makes it pretty difficult for a package manager to determine whether unpacking a package is possible at all, since assuming the worst case would mean that all partitions have to have Installed-Size kilobytes free. However, the set of "sane" partitioning schemes is pretty small, so I think packages could list the amount of space required on the root, usr, var partitions, respectively, and the package manager would just add the numbers up if it found that some of them are on the same partition.

Today's the festival of Opinion in the French Revolutionary Calendar -- a day for people to speak their minds about various subjects. My current opinion is about the Dunc Tank, a project by various users, developers, and maintainers of Debian to make sure that we hit the 4 Dec 2006 release date for Debian 4.0 (codename 'etch'). (That's 13 Frimaire CCXV for you revolutionaries out there.) One sub-project of Dunc Tank is to raise money to support the release managers for etch -- the people most responsible for keeping the release on schedule. This would free the RMs from worrying about their day jobs and keep them 100% focused on the release. I think this is a great plan. Debian is a fantastic operating system, and we have a lot to be proud of, but the main source of criticism for the project is that we don't hit our release dates. Not the first, not the second, not the fourth release dates. We've built up a reputation as a reliable, flexible OS, and we need to start earning one as a reliable, flexible organization. Projects like Ubuntu have shown that it's not impossible to get code released on time -- I think we can do it in Debian, too. I've already pledged money privately for the Dunc Tank project, and if you're interested in this particular way for getting 'etch' released on time, I hope you consider contributing too. tags: debian dunc tank etch release os deadline

After a lot of discussion on -private, and a fair bit more discussion off list, a bunch of Debian developers, including myself, have launched dunc-tank.org. The idea is that we think getting etch out on time is important enough to be worth paying the release managers to work on it full time, so in the free software spirit, we’ve gone ahead and done something about it. We’ve already put up some of our own money, as have some other developers, and if you’d like to join us, there are more details at the website. We’re currently hoping that SPI will agree to accept funds on our behalf, and thus provide a good level of accountability. The board meeting later today will hopefully shed some light on whether that’s feasible. There’s also some information in press release form, and some interesting background detail for people who don’t follow the Debian release process as closely as some of us do. The first article on the topic’s already been published; with one somewhat inaccuracy – this is not a Debian project, and is being specifically handled outside of Debian to both ensure that any conflict of interest that might occur can be decided by Debian in Debian’s favour, and to allow other groups that have different ideas about what priorities are important to encourage contributions to those areas. A question that has been raised is whether the organisation can be sufficiently “outside” of Debian when the DPL is intimately involved. I don’t have the answer to that – in my opinion it can be, but whether this one is will be up to Debian to decide.

Recently I've been unfortunate enough to be the sys-admin of some systems running CA software, the specific horror in this case is Siteminder.

The latest excitement was when an important machine stopped working abruptly and gave the error "ff ff ff ff" in the Apache error log. I have been familiar with the error message "ff ff ff" which means that the Siteminder policy server can not be contacted. But it took me a while to discover a message in the policy server logs indicating that a client was connecting to it with an invalid shared secret. It seems that the policy server had suddenly changed it's shared secret for no reason I could determine.

A google search for this issue turned up a single blog entry about it, which reports the "ff ff ff ff" error message as appearing in the case where the "ff ff ff" error occurs on the machines I run. Maybe I'm running a newer version, or maybe drax0r wrote the wrong error message by mistake. My colleagues have seen the error message "ff ff", we are still unsure of what that means.

For people who haven't used Siteminder I'll briefly describe how it works. There is a 2MB Apache module (larger than httpd and all the modules shipped in the RHEL package) that implements the access control and content management (compiled with -g, presumably because it will SEGV if compiled with -O2). This module spawns a daemon from Apache. Unfortunately the daemon code drops the root UID but does not drop the root GID (fun for security), I wrote a patch to the runuser program that can be used to address this by changing GID before running Apache. Then all communication between Apache and the policy server goes via the daemon process via sys-v IPC. Of course if the daemon crashes then the IPC resources are not freed and then it won't restart unless the system is rebooted or the semaphores are manually removed.

Yesterday was the international Software Freedom Day, and the Linux Accra User Group, which I just found out about last week, held a small expo in the "India-Ghana Kofi Annan Center for Excellence in Information and Communications Technology". On the program was a keynote speech by the group members, introducing the concept of Free Software, an exhibition of Linux installations and some programs as well as the showing of the first Open Source movie, blender-made movie "Elephants Dream" and its making-of.What I did not expect at such a meeting would be such a Linux guru: Swedish guy, who was an Amiga fan but had to start using PCs in November 1991(!) and looked for an operating systen, heard of Linux and used it since then. For all those newbies as myself: That was when "Linux From Scratch" did not exist, but you had to do it that way anyways, since there were no distributions. He has been living in Ghana vor 10 years now, bound by a family, the warm weather and by a job where he get's paid to do OpenSource development. Envy, anyone? Read more about him on his recently opened blog.
Someone already uploaded his pictures of the event, my pictures will be uploaded in a short while.In other news: At the College in Tema, where I am working at the moment, we agreed on installing Linux on the library computers to let the students have a shot at it, if they want, and after that the enrollment in the regular labs will be discussed. I shall also give an introction lesson to the IT teachers so that they can help a student during class, should he try to use Linux.

Yesterday, I was at the UP Engineering Theatre at Diliman to join in the worldwide Software Freedom Day celebration. I was supposed to be there earlier, but due to new work (and some new stuff to learn too I woke up rather late that day. So, I found myself there in UP at around 3 o’clock in the afternoon, rather tired and sweating (note to self: walking around the campus and looking for the venue at that time is not a good idea) but also looking forward to have some FOSS fun with fellow FOSS enthusiasts. I found Dom, Jerome, Paolo, Dong, Charlton, Ian Dexter, and Doc Mana there at the theatre listening on the technical seminars that were held by PLUG as part of the celebration. This time, the TechSem was particularly interesting, due to the new student project presentations’ by UP Engineering students, covering areas as diverse as Embedded Linux and SMS-to-Speech technology. I missed the special video from Richard Stallman though, as it was shown earlier, but I was able to grab a copy thanks to Dom . In between presentations, there were also mini-matchups of Frozen Bubble, which drove the (mostly geeky) crowd crazy with the rocking music and players’ itches. Representative Teddy Casi o of Bayan Muna also dropped by later that day, to observe the goings-on as well as to bring his filing of the draft FOSS bill to the public fore. This bill has been much talked about in the PLUG list, where the especially cynical posters (me more or less included had been taking their time nitpicking many of the details on the draft (especially on the section where it essentially says all your base are belong to us’ Turns out that RMS also saw some things that he thought needs improving (towards the end of his video, he took some time reflecting on the proposed bill,) and he wanted to see more emphasis on promoting FOSS to the education sector. Ubuntu CDs were also given away, as well as custom SFD/UP stickers. I also finally got to meet the UnPLUG hackers who, with PLUG, jointly organized this year’s SFD.

I'm going to set up a new laptop system soonish (more on that later) which shall have a completely encrypted hard drive. Hence, I'm testing a few setups wrt security, performance, manageability and fault-tolerance. Here's a few performance tests I did on an 80 GB laptop hard drive (in an Intel Celeron based laptop, 1.7 GHz, 256 MB RAM, Linux 2.6.17, Debian unstable).
I ran bonnie++ (with no options) and hdparm as hdparm -tT /dev/hda each time. I haven't put too much thought into the test setup, so if I made some stupid mistakes, please let me know. Unencrypted plain ext3 partitions:

• Extra partitions for /, /boot, /usr, /var, /tmp, /home, and swap (no LVM).
• Optionally, SELinux enabled on that system (targeted policy in permissive mode).

bonnie++:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         432M 19857  84 21831  10  9536   4 16355  58 22165   3 148.8   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1650  98 +++++ +++ +++++ +++  1734  98 +++++ +++  3820  96
forest,432M,19857,84,21831,10,9536,4,16355,58,22165,3,148.8,0,16,1650,98,+++++,+++,+++++,+++,1734,98,+++++,+++,3820,96

bonnie++ with SELinux:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         432M 20321  90 21036  13  9473   5 16742  61 21978   4 148.1   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1398  98 +++++ +++ +++++ +++  1473  98 +++++ +++  3305  98
forest,432M,20321,90,21036,13,9473,5,16742,61,21978,4,148.1,0,16,1398,98,+++++,+++,+++++,+++,1473,98,+++++,+++,3305,98

hdparm:

 Timing cached reads:   1416 MB in  2.00 seconds = 707.48 MB/sec
 Timing buffered disk reads:   82 MB in  3.06 seconds =  26.80 MB/sec

hdparm with SELinux:

 Timing cached reads:   1404 MB in  2.00 seconds = 700.59 MB/sec
 Timing buffered disk reads:   80 MB in  3.02 seconds =  26.53 MB/sec

Ext3 partitions on top of LVM on top of dm-crypt:

• One partition which is encrypted using dm-crypt (aes-cbc-essiv:sha256 mode, AES, 256 bit key size)
• On top of that an LVM2 system, with extra partitions for /, /boot, /usr, /var, /tmp, /home, and swap.
• Optionally, SELinux enabled on that system (targeted policy in permissive mode).

bonnie++:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         464M 11149  54 16660  20  6461   5  7472  58 11129   5 136.4   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1564  98 +++++ +++ +++++ +++  1650  98 +++++ +++  2640  97
forest,464M,11149,54,16660,20,6461,5,7472,58,11129,5,136.4,0,16,1564,98,+++++,+++,+++++,+++,1650,98,+++++,+++,2640,97

bonnie++ with SELinux:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         464M  9878  52 12138  11  5457   6  6834  56 11037   5 137.2   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1426  97 +++++ +++ +++++ +++  1451  98 +++++ +++  2433  97
forest,464M,9878,52,12138,11,5457,6,6834,56,11037,5,137.2,0,16,1426,97,+++++,+++,+++++,+++,1451,98,+++++,+++,2433,97

hdparm:

 Timing cached reads:   1408 MB in  2.00 seconds = 704.01 MB/sec
 Timing buffered disk reads:   80 MB in  3.02 seconds =  26.53 MB/sec

hdparm with SELinux:

 Timing cached reads:   1396 MB in  2.00 seconds = 698.06 MB/sec
 Timing buffered disk reads:   82 MB in  3.07 seconds =  26.69 MB/sec

So yes, there is some overhead, but it's nothing too serious, IMHO. And quite honestly, I don't care too much about performance here — security is more important than performance. I think you'll agree; if you don't agree now, you will agree with me on the very day someone steals your laptop ;-)

If there are electronic voting machines where you live, and you've ever considered using one of those... well, you should probably reconsider. In this CNN report (M4V video, 13 MB) Avi Rubin explains why voting machines are a really, really bad idea. To quote some issues raised in the video:

• There's no way for voters to verify that their votes were recorded correctly.
• There's no way to count votes in a publicly viewable fashion.
• Meaningful recounts are impossible.
• Machines must be trusted not to fail (and we all know that computers never fail, right? ... right?).
• The Diebold machines contain gross design and programming errors (a detailed analysis is available).
• The quality of voting machines cannot be determined, because their code is proprietary (closed systems can never be trusted

, especially so in such important scenarios) The CCC Berlin has a very detailed analysis of the topic (German), with many links to further articles. I'd recommend everyone to not use voting machines at all, but rather perform traditional pen-and-paper voting, if you value your vote... Also, make sure to inform relatives and friends about the risks of voting machines, and complain to your local responsible authorities, and ask them to remove these unreliable, insecure machines. Update 2006-09-18: Just in case you thought that maybe you can trust the Diebold machines after all - their locks can be opened with a standard hotel minibar key. (via The Lunatic Fringe)

This is kinda a mix between my list of bookmarks and some things I've been thinking about and following lately. astronomy I've been reading a lot of astronomy stuff lately, a lot more than my usual low-level interest in it. I'm kind of feeling the need for a refresher course, so I can get a better handle on stuff that's happened since I studied this stuff in school. It's hard to get my head around things like dark matter and really grok the evidence. While black holes and relativity and such seem so obviously a natural part of this universe. Does this mean I'm getting old? The chance to bounce questions and ideas off someone would probably help in getting a real grip on this stuff. So would a lot more physics than I know.. (Hurrah for Eris BTW. The name almost makes all that sillyness over a mere definition worthwhile.) Favorite sites: Universe Today and Wikipedia.

---

weather I've been following this hurricane season, to make up for having paid so little attention to last year's disastrous one. I knew about the "New Orleans bowl" scenario well before Katrina, and the night before it hit I actually spent several hours tuning in far-away AM stations from down there and listening to the city not react in time. But despite all that I feel that I missed out on really seeing it happen, so I've been learning about tropical waves, and wind shear and ULL's, and dropsondes, and the satelite data that can be used to follow hurricanes. The nice thing is that instead of the old stereotype of someone watching the weather channel 24/7 with a map and thumbtacks, these days there's a nice mix of pre-processed info and analysis and raw data, easily followed in small amounts of time on Wunderground's blogs.

---

spaceflight Half love and half hate. The recent shuttle mission has been a riot for a shuttle-hater and SF lover. It has all the elements of one of those SF novels where they go down to the cape, dig up an Apollo stack, and use it to save the world / travel to Mars / fight the alien invaders. Except here they're pulling an unused orbitor out of mothbolls. And putting it up on the launchpad with a hurricane bearing down, getting it struck by lightning, pulling it off the pad, changing their mind with the giant crawler half-way through that milti-day maneuver when the hurricane fizzles, putting it back, filling and refilling the tank as sensors fail and they rewrite their safty regs on the fly, barely making the launch window, and proceeding to triumphantly lose nuts and break wrenches .. In Space! Space opera, indeed. Then there's the genuinely interesting stuff. Intentional crashing of a French probe into the moon, probes firing projectiles at asteroids and trying (with great difficulty and many glitches) to return a sample. A mission on its way to Pluto. The rovers still going strong on Mars after all this time. Bigelow launching an inflatable prototype of his planned space hotel. A whole load of microsats tragically blowing up on launch. All the private aereospace stuff, which seems to close to turning into something real. Happily followed at Spaceflight Now.

---

TV Over the past while and a half I've been very happy to discover The Wire and Deadwood, have been working my way through the Sopranos and Lost, been creepily fascinated by Big Love, got a kick out of the Canadian antics of Corner Gas, vegged out to Greys Anatomy, and have been very sad to reach the end of Six Feet Under. BSG, Doctor Who, House, and some other shows haven't held up as well past the first seasons for me. Happily, there's NetFlix, which makes it plausable that I did this legally despite not having HBO or even owning a TV.

---

literature I've been reading Charles Stross, David Drake, John Twelve Hawks, Kelly Armstrong, Naomi Novik, Robert Charles Wilson, VC Andrews, and, loath though I am to admit it, John Ringo. I'm in the middle of books by Steph Swainston, Geoff Ryman, and Dave Duncan. I finally found a defintion of Science Fiction I like, but I lost the link. (It's the subjective "her world exploded" one.) Anyway, I'm afraid that I may have reached the point where to get much more out of reading SF, I'd have to start going to cons. Which I don't want to do. But I seem to be at a low ebb for it being interesting to me, or just need to finally tackle some other branch of literature. Actually, the most engaging reading I've been doing lately is in the achives (all of them!) of the Idle Words blog. It makes obscure details about Poland and China, and even interpretation of Russian classics seem pretty darn interesting, and has much better rants about the space shuttle. And it proves that blog entries should properly be good and long.

Devido a um projeto no trabalho, bem poss vel que eu tenha que passar as pr ximas semanas (ou meses, quem sabe) me dedicando a produzir muita documenta o. Eu escrevo muito diariamente, mas desde sempre s uso vim. Por m, devido a essa documenta o ter que ser produzida em um formato que possa ser compartilhado com outras pessoas normais (n o t cnicas), me vi obrigado a come ar a explorar as possibilidades do OpenOffice.org Writer, j que o m nimo que eu poderia fazer era dar for a ao padr o ODF. N o estou acostumado com esse tipo de software e n o consigo gostar de processadores de texto complexos como esses, mas pelo que vi at o momento, ele parece at bem completo. O mais estranho perceber que, depois de um tempo lidando com o bicho, voc se d conta de que est fazendo downloads de verificadores ortogr ficos e de dicion rios de termos de inform tica e, o pior de tudo, est realmente usando isso tudo. Uau ! Tenho medo do que pode estar por vir. Acho que vou come ar a virar usu rio comum. Socorro

I am nearly done with the marathon move. After a small hold-up in Canadian customs (for no apparent reason except I got a border official who had incorporated the role, a full 110%), my stuff is here, unpacked, and in decent order. In between unpacking, I have been able to experience some of Edmonton–from the nightlife to its administrative face (signing up for health insurance and a Social Insurance Numbers, for example, both of which were easy as cake) and I have to say E-town gets a far far far worse rap than it deserves. Ok, the weather is nothing to swoon over, and it is already getting far colder than I am used to but bracketing that detail, it is a pretty neat city. Now I tend to like the mid-size cities (Minneapolis, Madison, Philadelphia, Portland are some of my favorites in the U.S) over the mega-gargantuan-city and Edmonton fits this bill with just under a million people. And perhaps it is also just that I am digging some Canada-wide features (affordable and immediate health care, licensed cafes, a saner pace of life, the pleasant and earnest character of many folks) but there are Edmonton-specific attributes that are pretty nice too. Before I get to them, it is worth noting that every time I have told people that I was going to Edmonton, they would either: 1) admit that they did not know exactly where it was and thus could offer no opinion whatsoever (and I was one of those folks until I looked on a map) or 2) blurted some negative reaction like: “do you really have to go there!” though most of those people had never been, but had a sense of its northernly location. Perhaps my favorite reaction came from a blackberry forum where we posted a question about good data plans in Edmonton/Canada. Most of the replies stuck to the topic, but one person decided to spew his unadulterated thoughts on Edmonton:

i feel sorry for u going from NYC to Edmonton “Edmonton sucks” you’ll be happy to go back to NY..
You go from a city that has life to a dead one.. from having good bb plans to sh*ty ones.. hope your getting paid good

Ok, admittedly, the data/cell phone plans are lackluster but I think this person either has had some terrible times in Edmonton (and holds an unhealthy grudge), has never lived in NYC or has a warped sense of what the good life in a city means. Sure NYC is an amazing place, and is my likely future home, so I am not going to trash it but, like any city, it has its shortcomings.. like unfordable housing But time will tell as to how I feel about Edmonton after the winter. Perhaps when it reaches freezing temperatures, it does turn a leaf, and become dead but then you hit the mountains, no? But for now I am digging the HUGE pine trees, rivers, and ample sun of E-town.