With Kathy being away I thought I'd have a look at setting up webmail so she can get hold of her mail easily whatever setup she ends up with. My only experience so far is sqwebmail but it's not that great UI-wise and ties to Maildir. This is good because it means it's lightweight, but I figured if I was investigating systems I should keep Black Cat (who currently use sqwebmail along with various other bits of Courier) and the (which is largely mbox at present) in mind. apt-cache search webmail produces a list of things to try. My heart sinks as I realise lots of them require PHP. And others want MySQL. I go and have a look at Prayer, which I've vaguely prodded before. It's not packaged, but I decide to try it out. It builds easily enough, I wrestle with roughly packaging it up into a deb to make removing it less hassle and install it. It doesn't like my earth.li CA signed cert on localhost. I eventually find the novalidate-cert option and manage to connect. My home box runs dovecot with Maildirs. This leads to my next problem; Prayer wants to create a folder called .prayer for it's config info. This doesn't work with Maildirs as folder directories tend to start with a . Changing it to prayer-config fixes that, though leaves it visible in the web interface. It's possible I can hide it if I look harder. So, I'm ready to send a mail. I do so. It gets delivered (modulo me remembering not to try to send from my internal domain to the outside world). A sent-mail folder gets created. Prayer failed to show any messages in it. I verify there is a message there by looking on the filesystem. I curse. I try creating another folder and sticking a message in it. No joy. I try Prayer against a Courier server. Same thing; it shows the mail folders as directories but no messages. I try it against a Dovecot server with mailbox. It works fine. I curse some more. At this point I decide the statement "Consequently, the user interface distinguishes between mailboxes and directories: this will not work well with servers which provide dual use mail folders." on the Prayer website should be heeded. So I decide to try postman, which the Prayer docs suggest they'd have used if it had been around when they started (it also does persistant IMAP connections with a backend daemon). I give up once I actually start trying to figure out the config file and how it all fits together. So. Out come the IMAP RFCs. I attempt logins to the different servers I have access to and I find that the mbox server reports \NoInferiors for mailboxes while the maildir server reports [\=HasNoChildren]. And that \NoInferiors implies [\=HasNoChildren]. So I hack Dovecot to always return \NoInferiors. And it works and I can see messages in folders. Yay. But hacking dovecot is annoying and won't help me with Courier. Leading to the following patch to Prayer:

--- prayer-1.0.18.orig/prayer/dirlist.c
+++ prayer-1.0.18/prayer/dirlist.c
@@ -172,7 +172,8 @@
 
     dl->next = NIL;
     dl->name = pool_strdup(callback.pool, name);
-    dl->isdir = (attributes & LATT_NOINFERIORS) ? NIL : T;
+    dl->isdir = (attributes & (LATT_NOINFERIORS   LATT_HASNOCHILDREN)) ?
+               NIL : T;
 
     /* Insertion sort algorithm */
 

ie if there are no child folders we assume the current folder is a mailbox rather than a directory. Now to actually run it for a while and see if it does the job.

I almost submitted this to the excellent Crypto-Gram newsletter, but I think it's not actually all that evil. It's still pretty depressing for what I considered a security-competent online bank, though. The First Internet Bank of Indiana has announced that they will be enabling a new feature next week: First IB Security+. You have to answer additional questions about yourself to gain access to your account. But the questions, or at least the answers, will be selected by the user, from what I can tell - which means probably not hard for a determined adversary to acquire the answers, especially given that they must already have your online banking password. But sometimes they won't be asked the questions: if your account is configured to allow store a cookie on a particular computer, and the cookie is present, the questions will be skipped. They're increasing the security of my online banking experience using _cookies_? Which, if your computer was hacked - one of the most likely ways to get ahold of your password - the hacker could have already copied (along with the question answers, probably)? They can't be IP-based cookies, not with modern web proxy farms used by a number of ISPs and dynamic IPs still in use. I think that what they're trying to accomplish is an anti-phishing technique: if you don't expect to be asked questions, but you are, then there must be a man-in-the-middle attack in progress or something similar. So it's an extension of making sure that you're looking at an SSL-protected web page and that the certificate really is the one you think it is. There really must be a better way to do this - in fact, I think upcoming web browsers (both IE and Firefox) are supposed to have related features. At least they're not making anything worse. You still need the password, of course. So I think this is mostly a benign version of what Bruce Schneier calls "security theater", neither harmful nor especially helpful.

Here it is, I’m now an official Debian Developer. Thanks to my sponsors, Frankie, Neil and Est ban, thanks to Philipp Kern who was my Applicant Manager, thank you all.

Today, as it was widely anticipated, the Superior Tribunal of the Judicial Power of the Federation (TEPJF) declared Felipe Calder n, of the currently right-wing governing PAN party, elected as president for the 2006-2012 period.
My regular readers will know that my political views are against his party's, and that I completely oppose him - Of course, being consequent, in June I started, together with some friends, FeCal.org.mx, a site destined to show the incongruencies and incoherences in the official version - and that evolved to a site I am quite fond of, having good and deep analysis of the political situation. Of course, it is time now to redesign and think forward for this site, now that FeCal is no longer a candidate - but lets leave it aside for now.
Today, we are mourning. We are not mourning an electoral loss - Wherever there is democracy, there are losers, and it might be right that we lost this time. Furthermore, in political systems such as ours, it is practically guaranteed that the majority of the citizens will lose (this means, it is terribly hard for any candidate to get over 50% of the votes - If Calder n wins with almost 35% of the votes, or if L pez Obrador wins by a similar amount, we will anyway have 65% of losers). But what we are mourning goes far beyond that: We lost faith in our electoral institutions, which we were so proud of a couple of years ago. They proved not to be serious, not to be adequate for a hard decision. Why am I saying this? Lets analyze a bit.
First of all, the Federal Electoral Institute (IFE)'s main function is to organize the federal elections, and to make sure they are run with neutrality. Since the early months of the formal competition (as the campaigns themselves started way too early and we Mexicans are sick of the eternal electoral climate), the IFE has not acted in time to stop a dirty campaign, made not only by the PAN party but by the nation's President himself and by groups that, being privately owned, are said to be outside the reach of the IFE's regulatory spectrum. The IFE's general council should have been built with representants of all of the main political forces, but only PRI and PAN (which means, center-right and right wing) were represented.
Secondly, over the last six years, President Fox seems to have made constant efforts not only to prove us all he is a complete fool and inept as a statesman (examples abound, there is no rush to prove Vicente Fox just cannot be trusted to run a country), but that his fight for democracy was nothing but a race for personal power. He took every oportunity he could to promote his party - while the Mexican law requires him to remain neutral during the electoral period. There are many proven examples of irregularities and corruption inside his cabinet (most notably those carried out by Josefina V zquez Mota, who was in charge of all of the federal programs to fight poverty, and was the coordinator of Calderon's campaign) leading to inject resources into the campaign. Yes, this should have been stopped by IFE as soon as they were detected - But it was not. And, thank you Mr. Fox, by doing this you severely undermined the respect there should be for the Presidential figure.
Now, IFE's role ends shortly after the elections. After that, it is TEPJF's role to qualify the elections - To ratify they complied to the required equity, legality and certainty. Many of us had more trust in TEPJF than in IFE, mainly because of the series of personal and group connections that came up between IFE and the power groups. Most of us were quite vocal on the voto por voto, casilla por casilla front - Demanding from TEPJF to request to recount all of the votes. Having only 0.58% distance between the top candidates, with lots of statistical anomalities, with tons of reports of illegal tampering of the ballots, having a wide recount would surely make many among us believe and accept the results - Of course, the PAN repeated ad nauseam that the ballots had been counted and we should not go again over the same excercise, quoting all kinds of arguments that came from a too narrow interpretation of the law. And, in the end, too narrow was the response of TEPJF - Only 9% of the booths were reinspected, and not all of them were recounted. In fact, one week ago, they decided to discard over 300 appeals (this means, 300 requests for trial on a specific booth or on a whole district), without yet disclosing which appeals were they, on what basis were they discarded, what geographical areas did they impact, or anything. They nullified about 235,000 votes - And this number is quite scary, as it practically matches the official difference between the two lead candidates (244,000 votes before this partial recount, 233,000 after it). We can now state for certain that the difference between the candidates is smaller than the error margin.
Today, with a very important portion of the country in doubt on whether their decision was legal and correct, TEPJF ratified Felipe Calder n as the elected president. This would be good news. I would like to accept Felipe as my president - Sadly, I cannot, just because all of the TEPJF's principles were violated:

• Equity: The process didn't progress with equity. Illegal publicity was repeated over and over. Just as one example, the Presidency has had the equivalent of 24h a day of ads in the national electronic media for over six months - And IFE acknowledged it was used in a way that promoted the vote for their candidate. The final message was very subtly changed, many people were left unsatisfied, and... That was it.
  Andr s Manuel L pez Obrador was often protrayed as a puppet of Fidel Castro and Hugo Ch vez, and there are still people who believe he was setting to create a communist regime in Mexico. Of course, this was also a direct result of what is now known as the hatred campaign that the ruling party and an important group of industrials pushed. So, no, we had no equity.
• Legality: Most of this posting has dealt with the ilegalities of the process, they are really not in short supply. The sad and alarming thing is that it was the TEPJF itself which commited the last and most important illegal acts.
• Certainty: In a strongly contested electoral scenario, I perceive this to be the sole most important principle. How many votes were cast for each of the top candidates? We have repeatedly stated that the difference between them is below the statistical error margin for a process where a million people counted the votes. And after last week's results where nearly 240,000 votes were discarded, the difference is objectively and undoubtely smaller than the error margin. Even if no fraud was made, people make mistakes, and it is too na ve to assume not even one out of each 200 votes was incorrectly accounted. And even if no fraud was done, not allowing the society to ensure the results of the process really match the reality is by itself a fraud. We will now probably never know if Felipe Calder n cheated, the same as we still don't know who won in 1988 and by how much. Then, official records say that Carlos Salinas had over 50% of the votes, Cuauht moc C rdenas almost 30% and Manuel Clouthier close to 20% - But both C rdenas and Clouthier were sure they had won. And while C rdenas (founder of the PRD, which now supports L pez Obrador) called off the civic resistence to start creating a strong political movement for future, PAN's Clouthier did exactly what his party criticizes L pez Obrador for. In fact, our president Vicente Fox was the Agriculture Secretary in Clouthier's parallel government. Only that Clouthier had a misterious accident some months later and died - giving way to the dark period of PRI-PAN concertacesiones led by Diego Fern ndez de Ceballos.

So... In short, what comes now? We are exhausted by this long process. As too many people, I just cannot accept the imposition of yet another fraudulent president. I had the hopes that Mexico had changed in the last 18 years - But it has not. We are still in a strong presidentialist regime, and we still don't have hopes of getting a democratic government. If we do have a democraticly elected president, perfect, I will accept it. Of course, criticizing and keeping a close eye on his government, as I don't think the social and economic principles they push, but accepting. But there are too many signs of a fraud, there are too many stinky bits in the decision. The stinkiest of them all, the refusal of their opportunity to shut us up. Is it better to have millions of angry citizens closing important streets and giving Mexico a bad name by writing about our trip back to the stone age than to allow for a legal recount? Is it too much asking giving some certainty to our elections? Is there any doubt we will keep fighting this imposition?

I need to deploy a content management system that is to be used by a number of technically not overly savvy people, so I am thinking of basically using a wiki and locking it down. However, wikis' big strength is mostly unstructured information, like texts. However, in a few cases, I'd like to have a few database views on pages, or even a way to submit new data to a database from a form. So in essence, I need a wiki form of Access. Is there anything similar to that already, or is this entirely new territory?

Or, BEID of the same version. Oh well. It took me a while, but I finally managed to jump through all the hoops[1] required by backports.org correctly and in the right order for the package of the above version to appear there. So if you're running sarge, have an electronic ID card and a smartcard reader, and want to see what the government knows about you, then go ahead and install them. More info on how that works can be found on the backports.org website. There are two known issues as of now: first, you may get wrong root certificate errors; second, you need to install all packages from the belpic source package, or some things may fail. I intend to properly fix these two bugs Real Soon Now(TM), but I'm having issues reproducing the first one and am trying to wrap my head around being policy-compliant and produce working packages at the same time, which is required to fix the second one. It's slightly ugly; believe me, you don't want to hear the details. Speaking of ugly, SCons is not ugly. It's downright hideous. I'll have autotools any day. If you're not running sarge but are using Ubuntu 6.06 'Dapper Drake', then you will need different backports. Luc Stroobant was kind enough to provide them; use deb http://www.stroobant.be/eid ./ in your sources.list to get them. [1] they are not many, but I managed to break my upload three times or so before it actually worked. And since I don't know about any status page or so, I needed to ask people every time—which I don't want to overdo, so I give them a while before investigating. Next time I probably won't...

Or, BEID of the same version. Oh well. It took me a while, but I finally managed to jump through all the hoops[1] required by backports.org correctly and in the right order for the package of the above version to appear there. So if you're running sarge, have an electronic ID card and a smartcard reader, and want to see what the government knows about you, then go ahead and install them. More info on how that works can be found on the backports.org website. There are two known issues as of now: first, you may get wrong root certificate errors; second, you need to install all packages from the belpic source package, or some things may fail. I intend to properly fix these two bugs Real Soon Now(TM), but I'm having issues reproducing the first one and am trying to wrap my head around being policy-compliant and produce working packages at the same time. It's slightly ugly; believe me, you don't want to hear the details. Speaking of ugly, SCons is not ugly. It's downright hideous. I'll have autotools any day. If you're not running sarge but are using Ubuntu 6.06 'Dapper Drake', then you will need different backports. Luc Stroobant was kind enough to provide them; use deb http://www.stroobant.be/eid ./ in your sources.list to get them.

I'm still browsing around (Google doesn't want you to google for such things, but "search", remember?) for a laptop to buy next, when my thinkpad finally dies (or I need to be mobile again, which might be in some weeks). I've found another wishlist candidate: the Panasonic Toughbook T4. It's small and tiny, extremely solid, it needs no fan, has a touchscreen (and you can carry it book-like, since it's light and comes with a hand strap) and extreme battery life. Apparently it does actually run over 9 hours in third party benchmarks. But it also has some drawbacks:
There are next to no reviews, especially no information on Linux compatibility (which shouldn't be an issue, embedded Intel graphics, and very little hardware in it, but e.g. the touchscreen might or might not work) - and it's not very widely used or known. It's also very expensive (Thinkpad X60 1500 Euro, Toughbook T4: 2500 Euro with the two big plusses for me being better battery life and the touchscreen, thats too much) and said to be quite ugly. I sent an inquiry if there will be a successor with maybe a Core CPU - I don't know if there is an ultra low voltage core - or if there will be a version without windows (it's expensive enough, I'm going to use Linux, I don't want to pay 200 Euros for Windows). I got a quick reply - that my questions will be answered when a certain colleque is back from vacation... This probably means that despite me loving the idea of being able to read papers on the laptop just like with a real book (with a pen, and as mobile), another candidate has dropped off my list... Guess I won't be buying a new laptop until my old one is completely dead and then I'll be going for something used and cheap as "temporary" solution... I guess I'll browse the web for the HP tc4400 and Toshiba M400 next. I didn't actually intend to go for a tablet PC, but apparently these are more designed for weight and power consumption than regular notebooks with their nvidia and ATI power wasters. P.S. Yes, I am aware of Thinkpads. But they are either to heavy for my liking, have too bad battery performance or have too low screen resolution (X series).

The "Debian board" has been discussed a lot recently. I'm not so convinced it will improve matters that much. I don't think Debian is lacking a central authority to keep the vision. Most people have some overall vision; these visions might disagree on some points, but a board is bound to have the same disagreements. What is taking the fun out for me is not that some technical matters don't work out the way I want them too, but usually it's lack of manpower in certain files of particular interest to me. For example SELinux has been rather frustrating for me, since I felt like fighting alone on a lost position. Often applications would change faster than the policy could be updated etc. And trying to support sarge made that even more so. Sometimes bugs were fixed upstream, but the packages in Debian weren't updated yet, etc. When I was maintaining galeon back then, the must frustrating things were that on one hand, you had lots of people complaining about galeon 2 being different from galeon 1 (and not accepting that galeon 1 was dead upstream, I preferred galeon 2 and so obviously packaged galeon 2) - and on the other hand that there were tons of open bug reports noone even had time to verify. Working on such a package can be very frustrating. I've been keeping out of flamewars and such for quite some time, so I'm not so much bothered by that. I've blogged about that before. But I don't see where a "board" or "steering commitee" would come in helpful. Especially not in comparison to DPL-named release managers etc. IMHO it would be helpful to bring more people in. Our process of becoming a DD is very demotivating, and actually we could use more people - especially - for things like bug verification. Contributing to Debian can be demotivating for several reasons:

• Packages where the maintainer doesn't respond
• Packages the maintainer doesn't really care about
• Packages where you don't understand the packaging, because it's too different from what most packages use (i.e. please use debhelper and maybe CDBS for your packages, don't build your own 20k makefile buildsystem)
• Often not easy to create proper patches
• Roundtrip times of bugtracking etc.

Stuff I've been enjoing:

• "Thank you"s at the end of bug reports
• Occassional teasing by helix for complaining too much in my blog
• Real life meetings of debian-MUC
• Team-maintained packages

What I'd love to see on the long run is some kind of central package repoistory. Many other distributions use some kind of huge version control system for managing all their packages. Maybe we could have something like this with two "default" branches. With very little effort you can get write access to the "public" branch, and only full developers can pull patches over to the "authorative" branch. Packages should be built from that branch, and use some uniform way for this (e.g. debian/patches/ directories!) But people with more experience in team maintainance, e.g. the Gnome team, can hopefully comment more on this.

In a recent post I mentioned that my scalp is adorned with 14 titanium staples. While some may think that I have them because an odd accident incurred during my recent move, I have them because I live in mole-ville and some of them were causing a small disturbance in the hood. Living here means I have a lot of moles on my body and well, these little masses of brown pigment, while they can be somewhat attractive, and unproblematic, can be unruly creatures that can change on short notice and cause a lot of problems. Now I usually don’t blog about personal things like my moles, but I thought it is worth writing about this as a public service announcement… So if there are any other readers who live in a crowded mole-ville, this is little reminder to check up on your moles, sooner than later. I have never had a problem with my moles and there is no history of problems in my family but I do have more than the average number of them. In fact, anyone who has met me knows this because they are all over my face, and there is one distinct one, under my left eye that is shaped like a tear, and often mistaken for dirt, more graciously as a tattoo, and most oddly as that black stuff that football players smear under their eyes. About a year ago, after one of my friends was diagnosed with melanoma (thankfully he is ok), I started checking my moles more frequently and did a full check at the dermatologist. All was ok and when I went to another dermatologist in February, all looked good. Then this summer, as I was running my hands through my hair, I felt a mole and started obsessing over it. I was pretty sure I did not have it a year ago as it was not on my chart and if was, it was probably flat and since I could feel it, it had changed, which is not a good sign… I was traveling most of the summer and it was first in South Africa where I had it checked in a fancy dermatological office in Durban. They dermatologist took a close look and said, looks fine but have it removed because you can’t track it. That made me feel a lot better so I enjoyed the rest of my time there and then as soon as I got back I saw a RN at a dermatology office in NJ (it is near to impossible to get a derm appointment without a month’s wait in the US but since they had RNs, I could see someone quick.. More on this in a second). This person also confirmed what the dermatologists in SA had said but also decided to remove it because I could not track it. A week later a pathology report came back that showed it was dysplastic and that the cells were changing, and thus considered abnormal. Some dermatologists consider this as pre-cancerous, some don’t, but it seems to be that there is more likelihood that this type of mole can turn into cancer. So the “treatment” is a full excision where they remove 1cm all around the mole. I got word of the report around the 8th of August and the only time they could fit me in for surgery was the 25th, a day after I was supposed to leave for Edmonton, which changed my moving plans (and explains why I arrived here so late, making getting my stuff complicated given school is in session and parking is tight). I then scheduled an appointment for a a full body check and removed another mole that once biposed was confirmed as dysplastic and though not as abnormal as the other, the recommendation was to also remove the surrounding dermis. Now, when I called the surgical coordinators, they could not fit me in another time slot to expand my appointment for 2 surgeries because they were “full” even though I explained I was moving away from the U.S. They said that it was up to the surgeon to decide whether to operate on the second area and since I was leaving to Canada the NEXT day, he would probably agree but no guarantees.
So of course, I wanted the stuff out because I was not sure how to go about getting the procedure done in Canada. My insurance does kick in the second I sign up and there is no Bull-Sh*t pre-existing clause stuff here but because I could not get an appointment in time, I would probably have to go to a medicenter that performed these operations and not all do. Though I was confident I could get it done eventually, it would take a lot of inquiring and after a 7 day drive and all that follows a big move, I decided it was not the thing I wanted to do. So I got to the office early on the 25th and one of the first things that comes out of my mouth when I saw the nurse was that I was leaving the next day to Canada and I did not know when I could get care there. Of course the first phrase that pops to mind for many Americans when you say Canada and health care is “socialized medicine” which most people in the U.S. associate with bad healthcare and long waits. Now on the one hand, I have to admit I, to some degree, share those fears, which is one of the reasons I wanted the extra dermis removed asap. On the other hand, I think that the claim is a big fat red herring because in fact for many Americans, they *do* have to wait a long time for many procedures (dermatology is classic for this, and even my first procedure took a 3 week wait and if I wanted to schedule the second one, it would have taken 5 weeks) or worse, they have no insurance, which KEEPS many people from going to a doctor in the first place. So American medicine is not necessarily “fast track” and in a dual sense: in the literal sense because HMO healthcare is like socialized medicine with capitalist prices, and because many people without insurance also probably avoid the doctors until they are in bad shape… And even though I have insurance, they would not pre-approve anything as I am in some awful pre-existing clauses because my insurance had lapsed for 2 months this year. And even though I have never had a problem with a mole in my life and did not even see one doctor in the 6 months before I got my insurance (which is when the pre-existing diagnosis would pertain to) and even saw a dermatologist in my HMO network in February who found nothing wrong, the insurance wants to make sure to add as many roadblocks as possible in the hopes of never paying up. Great. Now I am very grateful the nurse at the derm office proceeded to get the doctor to perform the 2nd surgery and he also was more than ok to do it. I wanted to give them big fat hugs after the procedure but you know, you just don’t do that type of move in your blue robe after the surgery. Before the surgery I naturally “hit” the net to gather a lot of information on moles, cancer etc… I join the millions around the world who–for better or for worse–use the Internet to supplement (some I am sure supplant) their doctor’s medical advice. In fact, a key part of my second project on psychiatric survivors looks at how patient communities are building a sphere of amateur but expert medical knowledge exchange. It is an enormous sphere of vibrant peer-to-peer knowledge production but one that many are uncomfortable portraying as such because it involves a lot more risks and ambiguities than exchange knowledge about, you know, how to get your blue tooth working…. But if we bracket the realm of alternative remedies (which admittedly is a HUGE part of this type of exchange), I think in fact, patients are pretty savvy and are engaging in risk-averse behavior by going on the net and illness forums. A lot of what is exchanged are warnings about side-effects, detailed accounts of experiences with procedures, and yet a lot of red flag raising that one’s experience may not match another persons but may be still helpful. It is a lot of information that often may be missed during the exchange with the doctor and derives from what is another type of expert knowledge: one’s bodily experiences with medicine, illness, and other related procedures. But I have to say that when researching melanoma and moles on the Internet, I was somewhat stumped. There is just too much variation out there to make informed judgments and abnormal but non-malignant moles have the same characteristics as melanomas. The Internet, in this case, seemed helpful to provide some baseline information and then just served to freak me out more than necessary so I turned away for the time being. For now I am just adjusting to the staples, which come out in another week. The procedure did not hurt much but the first week after the removal my head was much more sore than I had expected. Not so fun when on a marathon road trip, which is finally over!

I think I have reduced the "SQL pony" problem to something manageable, by identifying the error in my thinking. To recap: I want to store bits of public, semi-public and private data about people in a database, with the private data living on another host for security. The error in my thinking was that referential integrity would be needed in both directions; in my case, it is however sufficient to ensure it in one direction, which is the private data pointing at the rest. This means I can (or should) not delete from the non-private database except when I also have the private database accessible; this is an acceptable restriction as the server is not supposed to delete stuff on its own anyway. So in essence, I just need something that can combine the local (private) and remote databases for me. I think I should probably look at some ODBC stuff here; however writing an SQL query splitter that builds a local and a remote query doesn't sound too hard either.

Rapha l: I mostly agree with your post. Having something closer to a steering committee seems saner than having a single leader for projects such as Debian, due to a single person not able to fully follow everything such a large and diverse mass of people works on. I was among the supporters of Project Cabal^W^Wthe DPL team experiment, and of our 2IC role.
However, you state that a release should determine the time a DPL team (call it committee, cabal or whatnot. I like the title, in fact: "I am an Elected Member of the Whatnot of Debian". Whee!) - I disagree on this one. Like the fact DPL is not chosen for technical but for political work - The DPL (and so should the team) mediates between parties, brings order (controversial, sometimes) to discussions, pushes forward some controversial decisions, reports on the general status of the project - That should be the Whatnot Team work (hmmm... Should I file for trademark on that name?).
In any case... Were we to change our model towards this formal DPL team thingie, I advocate slow changes over strong ones - I prefer a board like this one to be replaced one person at a time, at rates not more frequent than one month, and having them there for a fixed amount of time.
Of course, this would lead to a mess on managing the voting, and each vote being less important for the developers. Besides, we have had DPL elections with as little as two candidates, and topping at seven IIRC - Do we have enough people interested in being responsable for our administrative chores? Would this scheme work? Or would it lead us closer to administrative stagnation? Quoting our not-very-beloved-but-anyways-wise dictator (for the 1876-1910 period) Porfirio D az: "If I want something done, I do it myself. If I want it to take some time, I appoint a delegate to do it. If I don't want it ever done, I form a committee".

There’s a new idea floating around: creating a steering committee for Debian. I like the principle but I think we should aim for a broader change in the constitution. I don’t think creating a new separate structure is a good idea, because in my opinion the DPL should be the steering committee. Of course a single individual can’t play that role. And in fact, this is true for almost any task that the DPL currently has to handle. So we need to get rid of the DPL and to replace it with a board. And that board would be the steering committee and would also have the responsibilities that come currently with the DPL hat. Why? First of all, the role of DPL is to provide a vision but most recent leaders have not been able to do that as they tend to get overwhelmed by simple administrative work. If you remove the hope to effectively lead Debian by giving that power to a committee, then you scare everybody that wanted to be DPL because it effectively become an administrative position with no interest. Then, in recent years, the DPL position tended to become a multi-person thingie, first with the DPL team idea and this year with the 2IC (sort of a “DPL assistant”). So it looks like we’re ready to switch to a fully multi-personal leadership: one of an elected board. And last point, since the DPL tends to be active only on internal organizational issues, for most persons he’s only working on “political” stuff and he’s not valued as contributor leading the distribution where it needs to be lead: to the next release. That’s why I suggest that the board should be elected for an entire release with a maximum of 21 months. After each release we elect a new board and it should be in place for 18 months ideally. Tying the term to a release seems like the right approach to me: at the beginning the board is effectively doing most of its work as steering committee (setting/approving release goals) and at the end, during the period where we’re freezing it has more time to concentrate on organizational issues. The questions is now: how is that going to work with the release managers? Will that position become only an administrative work of low-level coordination without any influence on the whole distribution?

I was in a multiple-car accident yesterday. I've been having to tell this story a fair amount in person and on IRC, so I thought I'd blog about it. Short version: it was a fender-bender. I'm doing fine, nobody was hurt, Michelle wasn't in the car, and 75% of the cars involved were driven away from the scene — including mine, by me. Want the long version? Well, I'm gonna tell it anyway. I had just pulled to a stop at a traffic light, heading northbound on Keystone Avenue where it intersects 106th Street, in Hamilton County. The line of cars at the light was pretty long, and people love to try hauling ass on the stretch between 96th Street and 106th. Apparently the person behind me was one of them. The line of cars stopped in the left lane (where I was) at the light was pretty long, and much shorter in the right — the cars over there were still moving at a good clip. I looked in my rearview mirror, thinking "if someone's trying to match pace with the cars in the right-hand lane, they're gonna need to brake pretty hard to stop." It was about 1815, so it was starting to get dark. A pair of headlights approach. Fast. Oh boy. I don't stop right up on people's tails, so if I'm hit, hopefully I won't go into the car ahead. I look forward again. Yeah, there's some room here. Screech. I didn't tense up; I felt a strange sense of calm and curiosity, as I'd never been in a car accident before. I bought my car, a Volkswagen Golf, in part because of its fairly good safety ratings. It has lots of air bags, and I always use a seat belt. Plus, in this instance I figured I wouldn't get hit a high speed. "Strange Deja Vu" by Dream Theater, from the Scenes from a Memory CD, was playing. Normally I listen to All Things Considered while commuting home, but I was annoyed because when I got in the car, I heard Nina Totenberg signing off a report, which means I'd just missed some Supreme Court coverage. Damn. Anyway. BONK. I got hit. Ouch. My teeth had chomped together too hard. Maybe they should install rubber mouthpieces in the doors of cars so you can grab them right before a crash. You know, car crashes never sound like the stock sound effects that have been around for about 50 years. I guess that's because they build cars to crumple these days instead of act like steel shrapnel bombs. Damn that Ralph Nader. My wreck doesn't sound cool and stuff. And I get to walk away, well, get back in the car and drive away, instead of my wife collecting on my life insurance policy. But I digress again. A middle-aged woman in a Honda Civic skidded into me, and knocked me into the Buick Park Avenue ahead of me, which in turn tapped the minivan ahead of him. I blinked a bit and tried to reorient myself, and then turned off the CD player. We all got out of our cars. The woman in back was very distressed, and immediately and repeatedly said the thing your insurance card tells you never to say after an accident. Oh well. Being a middle-aged woman, she'd probably have to wreck a school bus full of children — twice — before her premium would go up. Mine, on the other hand — we'll see. Called 911. Reported the incident. Tried to call my wife, but she decided not to answer. I later found out she was gabbing it up with my mom. Isn't it nice when your wife gets along with your mother? I COULD BE BLEEDING OUT ON THE COLD ASPHALT, BUT YOU TWO JUST KEEP ON TALKING. Michelle and I have the same model of cell phone, and we have call waiting with caller ID, so I know she knew it was me. Anyway, I try a couple of times, then give up and leave voice mail. Turns out the guy in front, in the minivan, was a Deputy Prosecutor for Hamilton County. He said something about being experienced in car wrecks, but I don't clearly remember it. Anyway, perhaps in part because he decided he was only "tapped" and didn't need to file an insurance claim, and perhaps in part out of professional courtesy, when the cops showed up, they let him go very quickly, so I didn't get any of his information. Everybody was fine, polite, and decent about the whole thing. The couple ahead of me, whom I got knocked into, didn't have their insurance info on them (or maybe this is a euphemism for "don't have insurance"). But, except for the deputy prosecutor guy, who was outta there, we all traded names, addresses, and phone numbers. I hope the Debian Project doesn't mind that I used my Debian Project Leader business cards for this purpose. These people (and the Carmel Police Department) now have my GPG key fingerprint. Uh oh. Anyway, that's about it. Appointment tomorrow with the insurance agent, to get help filling out INDIANA OPERATOR'S VEHICLE CRASH REPORT, State Form 38656 (R6/7-91) Stock 301 Effective 1-92, which has to be filed with the Indiana State Police within ten business days, or my driver's license will be suspended. Aww, yeah. Gotta move fast, because on Friday I leave for Mérida, Spain, to attend the 2nd Annual Open Source World Conference in Extremadura. Also have an appointment with the claims adjustor tomorrow. Then I'm hoping to just leave my car at the dealership so they can work on it over the week when I'm gone. My wife and my mom, those talkative two from a couple of paragraphs ago, will be coming along with me. My mom's got a jones to visit Spain, and I've had a jones to take my wife to Europe. We'll have a couple of extra days to see what Spain is like — I'll be there from 22 October to 28 October. I hope one day to visit Barcelona and hang out with some proper anarcho-syndicalists.

make World is what you type when you want to do a full build of the X Window System sample implementation. With significant embroidery, it's also the heart of the xfree86 and xorg-x11 source packages' debian/rules files. Today, I got a successful package build of the xorg-x11 SVN trunk. One needs new versions of the render-dev and libxrender-dev packages to do so; the former has been accepted into unstable, and the latter is currently in queue/NEW. There's a bit of housecleaning and QA still to do before uploading to experimental, but the worst of the hurdles are cleared, and that's a mighty good feeling. Hopefully David Nusinow returns from his "forced vacation" soon. :-) There are many things to catch up on on the DPL front (and a few others), and I owe everybody an explanation of why I've been so quiet lately. Strapping on my boots to give xorg-x11 a kick in the ass has been part of it, arena-style bureaucratic combat with the Brazilian Consulate General's office in Chicago was another, and my wife's recent re-hospitalization was the most worrisome. I lost out on my trip to FISL 6.0 in Brazil, but kept my wife, which is, I think, the preferable outcome if I could only have one of the two. (Those of you who are members of SPI can also check out a report from me on recent donations and bank activity.) It's satisfying to make progress on a couple of fronts even when you're fightning an n-front war — it beats the hell out of losing ground. Yup, today was a good day to make World.

I'm probably the only person who ever thinks like this, but what the heck. I recently found myself thinking (itself a noteworthy occurrence)...I've started a what turns out to be a long-running process at a shell prompt and I don't want to visually monitor it. It didn't occur to me that it would take a long time when I started it, and it would be nice to have audio notification of its completion. The problem is, it's already running. Of course if you knew it was going to take a long time when you started, you could have done something like this: long-running-process && xmms $HOME/music/song.ogg. Let's say you didn't exhibit that much foresight. Traditional Unix process management primitives exposed via the shell come to the rescue.

$ long-running-process

Damn, this is taking a while... <CTRL-Z>

[1]+  Stopped                 long-running-process
$ bg
[1]+ long-running-process &
$ wait %1 && xmms $HOME/music/song.ogg

Voilà; I can go back to occupying myself, and when the music starts up, I know my job is done — and I didn't have to kill it and start it over. Once in a while, that's an important consideration. By the way, if you try to wait on a stopped job, you're helpfully told how lame you are:

-bash: warning: wait_for_job: job 1 is stopped

...and the music starts to play even though your job isn't finished. So don't forget to background it first. :) Futhermore, this usage of wait appears to be standard. In Debian, both bash and ash (a.k.a. dash) support both process IDs and job IDs as operands to wait. zsh probably supports identifying the job by its mother's maiden name as well, but I haven't tried that.

On 21 August, Don Armstrong, a Debian developer, accepted my offer to serve as my delegate in handling trademark issues vis-à-vis the DCCA. As an employee of a DCCA member company, I found it wise to avoid the perception of a conflict of interest. I should stress that any such perception would merely have been conjectural, however; at no point have I been asked by anyone to put my thumb on the scales, as it were, and deal with the DCCA or any of its member organizations in a preferential way. It is widely understood within the Debian Project that our existing trademark policy, originally formulated in 1998, is too vague, and has not scaled well to suit Debian's much greater degree of success and market penetration (on its own, and in the form of derivatives) seven years later. However, grappling with the issue has proven challenging for Debian's membership. I believe this is mainly because the Free Software hackers that comprise our organization have tended to self-educate to a far greater extent on copyright law, and even patent law, than they have on trademark law. Recently (within the past year or so), Debian gained access via its U.S.-affiliated charitable organization, Software in the Public Interest, Inc. to a pro bono legal counsel who understands the Free Software culture. Debian's difficulty with trademark management is not unique — we have been on the other side of this problem when dealing with the Firefox and AbiWord trademarks, since we customize the codebases of these software projects in our GNU/Linux distribution, but ship them with their names (and logos) intact. It so happens in these cases that the originators of the software (who hold the trademarks) approve of our modifications. One of the essential pillars of software freedom, however, is the user's right to make modifications that the authors or rights-holders in the software may not agree with. Free Software hackers can feel, with some justification, that it is misleading to uphold the freedom of a work on the one hand (by using a copyright license such as the GNU GPL), and take it away with the other (by asserting a trademark on some essential aspect of the work, such as its name). It is true that a work can be renamed, or descriptive text changed, to identify itself as distinct from an "official" version of the work, but this in turn, it is feared, can damage perceptions of the work through at least two mechanisms. Firstly, disclaimers about unofficial status may be unnerving to users who aren't schooled in the vagaries of trademark law, in which — at least in the United States — you are expected to aggressively defend your mark lest you lose a future infringement case you bring against a well-heeled defendant. Users may mistake strident proclamations of unofficial, unendorsed status in a piece of software as a warning that it is unsuitable for use, or has known severe flaws. Secondly, aggressive use of trademarks, or even just the tension observed above between giving with a copyright license and taking away with a trademark license, may lead some distributors to rename a work, obscuring its origins to the casual user. This can happen pre-emptively, before a distributor even knows whether the modifications they have made (or think they might make in the future) have met with any objection from the trademark holders in that work. The "freedom to fork" (i.e., make a derived version unendorsed by the original author) is an essential part of Free Software, and while Free Software hackers' sense of community generally leads them to eschew forking in favor of compromise and consensus, occasionally a fork ends up growing the userbase or improving the overall quality of the Free Software landscape. A hacker may fear that brash trademark assertions by an author constitute mere lip service towards the freedom to modify the work without changing its name, and may be tempted to fork it, leaving the trademark encumbrance behind. Even among those who do not guard their software freedoms quite so jealously, the fear can exist that a simple difference of opinion over some technical programming detail, such as choice of sorting algorithm or graphical toolkit, will escalate to the point where the trademark license on the work (implicit or otherwise) is withdrawn. This is the inverse of the previous situation — instead of a modifier choosing to fork a work, the original author of a work (or, at any rate, the holder of the trademark associated with it), can force the modifier to fork. The dilemma this imposes upon the people creating the modified versions — revert your existing change or be legally compelled to make an additional one — can rub people the wrong way. When forking occurs, for whatever reason, and even in the relatively benign case of "rebranding" to remove legally protected marks, the threat exists that the competitive strength of the corresponding software will be diluted. Imagine if each of four major GNU/Linux distributors rebranded their version of Mozilla Firefox, calling it instead things like "Lizardfox", "Hatfox", "Swirlfox", and "Hearstfox". How many users would deduce that the web browsers in question were all "really" Mozilla Firefox, each one with a fig leaf placed delicately over it so that the legally-minded types at the Mozilla Foundation and the distributors could wink at each other? Even the somewhat savvy GNU/Linux user may be more confused than one might expect, given that other names used for Mozilla's suite of applications include Sunbird and Thunderbird, yet there is an independent Free Software project called Firebird, which was established prior to the Mozilla Foundation's adoption of its product naming scheme. "What's in a name?", you may ask. They're important because they are simple labels we can use to refer to Free Software success stories. There's a lot of Free Software to talk about; the phenomenon of copyleft does much to ensure a competitive culture. It's difficult to achieve an unnatural monopoly in this environment, because anyone who steers a software project in a direction the users don't want to go has to cope with the prospect of seeing a group of those users organize their own community based around a derived version that does what they want. The hypothetical hydra-headed Firefox situation described above, however, is an example of false competition, because the distributors were compelled to distinguish their Web browsers for legal, rather than technical, reasons. In actuality, Mozilla Firefox is a good example of what's right about Free Software, not just because of its licensing but because a web browser is a familiar concept to nearly every computer user today. Free Software's early successes were more esoteric — GNU Make, the GNU Compiler Collection, the GNU C Library, GNU Emacs, and even the Linux kernel are not pieces of software that the general user can easily conceptualize. It is beneficial — to say nothing of convenient — to refer to the leading freely-licensed web browser as "Mozilla Firefox" rather than "a suite of mostly-compatible, similarly-named Web browsers shipped by the various GNU/Linux distributors". Those who seek to foment confusion and FUD about Free Software would doubtless capitalize on such a situation. These issues are challenging but not insuperable. A coherent policy will enable the community to establish a set of common practices, whereas now there are few conventions in the trademark arena. Ultimately, it is my hope that Debian will be able to promulgate a trademark policy that not only satisfies our needs, but serves as a model for others. To establish a successful policy, I suspect we need to build one up from basic concepts, and formulate explicit answers to fundamental questions.

• Why even have a trademark? Let's understand what protections the law affords and determine which, if any, are applicable to our endeavors. In the U.S., trademarks are managed by the federal government (rather than the states), and regulated by Title 15, Chapter 22 of the United States Code. International treaties result in trademark law being roughly similar across most jurisdictions in the developed nations, but there could exist important differences that we should learn about.
• What level of Debian involvement should be necessary for an "outside" organization to use our mark without a fuss from us? Should there be any situations where people essentially have an automatic trademark license, or should we use trademark law as an instrument to encourage (or compel) anyone trading in our name to contact us? We need to consider small-scale garage-based redistributors who simply move physical copies of our official ISO images as well as commercial derivative distributions.
• Is it feasible to apply the copyleft concept to trademarks? That is, is there some way we can turn the restrictive aspects of trademark law into a kind of compact that upholds the freedoms of a sharing community, while penalizing the activities of those who would prey upon that community?

Originally published 2005-09-14.
Updated 2005-10-15 to add licensing in comments.

Thanks to the hard work of Debian's Release Management, Archive Administration, and Security teams, as well as Debian's developers generally, Sarge has now been frozen (don't let the modest title fool you). ;-)