Martin, I fully agree that bind should not try to second-guess the admin, but for the simple reason that it is not possible in any sane way to know about all the possible authorisation schemes, so why bother trying? I don't buy the argument that applications need to be able to deal with ACLs either, for exactly the same reason. "scp" for example, could not care less, simply because in the vast majority of cases, it will be used to copy files between computers whose user account databases are not synchronised anyway, so you cannot restore the ACL. If you want that, use tar and explicitly tell i

The Trackback spam on my blog started to get really annoying, even with serendipity’s “invert selection” and “delete” buttons. So I came up with a simple perl script, that looks at all unapproved trackpack pages and deletes those who don’t link to my blog. It’s not perfect, as there might be correct cases where someone trackbacks my post without actually linking to it, but that’s ok for me. Also, the spammers will probably fix this “bug” of theirs, too (and some already have, as someone told us during a lightning talk at the GPN5), but at least for a little while this will save me some work. (See the complete post for the code)

"Deleting spam trackbacks" vollst ndig lesen

irc.debian.org has changed networks, but at least for #debian-boot we've been unable to contact anyone to redirect the CIA bots to there. So I came up with this little IRC bot called watergate, which redirects CIA-speak on the old channel to the new one. Posted here in case anyone else finds it useful, and since I'm for once happy with the name of one of my programs. :-) svn://svn.kitenet.net/joey/trunk/src/misc/watergate.pl

One of my users was having some issues using Outlook to connect to my SMTP server to send mail, so I had a bit of a poke around during the week to try and improve the situation. I used to work in IT security, so I've got a healthy level of paranoia when it comes to network security. One of the things I don't allow is any clear-text authentication. I make users use an SSH/SCP client rather than an FTP client to upload files, web-mail is SSLed, IMAPS and POP3S only, etc. For various reasons, the occasional user wants to relay mail through my SMTP sever, rather than using their local ISP. Furthermore, a lot of the time, these users are on dynamic address space, so whitelisting IPs for relaying isn't feasible. So I use SMTP-AUTH. I also support STARTTLS. During this debugging session, I discovered that one can actually authenticate without using TLS, so I fixed up Sendmail's configuration to only offer AUTH after a STARTTLS (define( confAUTH_OPTIONS', p') in sendmail.mc). The problem that my user was having (and I reproduced myself) was that even with Outlook configured to "Require an encrypted connection" for SMTP, and authentication also specified, relaying was failing. Turns out that Outlook (and Outlook Express) only support the AUTH LOGIN SASL mechanism, which is obsolete, not the AUTH PLAIN mechanism, which was all I had Sendmail configured for (and works fine for Sarah and her Mail.app on the PowerBook). So the first thing was to enable LOGIN so that the applicable lines read as TRUST_AUTH_MECH( PLAIN LOGIN') and define( confAUTH_MECHANISMS', PLAIN LOGIN') in sendmail.mc Then it turns out that Outlook doesn't really handle TLS all that well anyway, it'd rather just talk raw SMTP over SSL (i.e. port 465/tcp), and what was happening was on the first couple of delivery attempts, it would connect to port 25, start spewing SSL negotiation crap, upset the greetpause feature I had enabled, and never succeed in getting anywhere. Then it fell back to using STARTTLS instead. So rather than having this hit and miss approach, I finally enabled SSMTP, by adding DAEMON_OPTIONS( Port=smtps, NAME=TLSMTA, M=s') to sendmail.mc So the following deficiencies in Outlook were highlighted from this exercise:

1. Outlook does not notify the user if authentication is required, but not able to be performed
2. Outlook only supports the obsolete AUTH LOGIN SASL mechanism
3. Outlook doesn't do TLS on port 25 properly

After all this, the user is going to probably switch to Thunderbird, but at least Outlook is now supported as properly as possible.

As this blog has become one of the top sources of information on the Webloyalty scam, I’m reporting this news about Webloyalty and Marketworks, a third party eCommerce site that supports high volume eBay sellers. Marketworks is apparently throwing the switch to make a Webloyalty subscription the default for the thousands of eBay sellers that use its services:

Over the past two years our users have experienced tremendous success incorporating WebLoyalty in their checkout. For those of you unfamiliar with WebLoyalty, it’s a special rewards program offered by Marketworks that benefits merchants with cash and repeat shopping. Given the success our participating Sellers have experienced, effective June 21, 2006, WebLoyalty will be enabled as a default setting in all US-based users’ StoreFront/Checkout profiles. We’ve updated our Terms & Conditions to reflect this setting (effective June 21, 2006 for existing users). If at any time you wish to discontinue your participation, simply indicate your participation preference by clicking the appropriate radio button on the WebLoyalty settings of your StoreFront/Checkout profile. Note that at this time WebLoyalty is only available to US sellers and buyers. Learn more about WebLoyalty. The Marketworks Team

So now not only will there be millions of Webloyalty subscribers who aren’t even aware they are paying for this useless service, there will also be thousands of eBay sellers who aren’t even aware that they are signing their customers up for this useless service. I understand that a number of Marketworks sellers who actually know this is going on are upset, but the majority of users don’t read the forums where this is being discussed. (Full disclosure: I have nothing to do with Marketworks myself.) To be fair, I should mention that a Webloyalty executive (the “lead Consumer Affairs representative” — Mary O’Reilly) has apparently posted to my blog in defense of the company. The following comment appears about 1,000 comments down on my main Webloyalty entry, and is in response to this entry mentioning inflammatory comments posted by other Webloyalty employees calling Webloyalty customers ‘suckers’:

As lead Consumer Affairs representative for Reservation Rewards, I apologize on behalf of WLI Reservation Rewards for the inappropriate and offensive comments posted by the person identifyingthemselves as “WLI Customer Service Representative”. Our company does not condone or tolerate this type of unprofessional behavior and providing consumers with the highest level of customer service is of utmost importance to us. If we can confirm that the comments were actually posted by one of our customer service representatives, appropriate action will be taken with that employee. As a company, Reservation Rewards takes consumer comments very seriously. We have hundredsof thousands of satisfied customers and we consistently strive to provide our customers with first class membership programs and customer service. In the past, our approach has been to deal with consumer concerns on an individual basis rather than in a public forum. To fully address a consumer’s concerns we need some specific information (e.g. the consumer’s full name or email address) so that the consumer’s record can be accessed. Once the consumer’s record is accessed, we can identify exactly how, when and where the membership offer was accepted and also cancel the membership if that is what the consumer wants. However, it troubles us to see the concern that some consumers have expressed on this blog with regard to Reservation Rewards. At this time, wewant to make an open and sincere attempt in this public forum to clear up the misunderstandings that are generating the concerns. We thought the following Question & Answer type format might be the clearest way to share information and address the primary areas of concern expressed on this blog: 1. How Is The Reservation Offer Presented To Consumers? How Did I Get Signed Up For This? We try to make our offer as clear as possible so that consumers can make an educated decision on the offer. Over the years, we’ve incorporated a number of client and consumer suggestions to clarify the offer even further. Consumers are presented with the ReservationRewards offer when completing a transaction at one of our client’s websites. It’s not a check box that you have to unclick to reject the offer. Instead, the consumer is presented with a full offer page (separate from the client’s transaction page) and is required to take 3 actions to accept the offer and authorize the data pass of personal information. In addition to entering their email address twice, a consumer must also click on a ‘YES’ button to accept the offer. The offerpage includes all the Offer Details, clear mention of the monthly charges, a description of the membership benefits and instructions on how to redeem the Cash Back award. 2. How Does Reservation Rewards Get Consumer Credit Card Numbers? Please be assured that our clients aren’t passing credit card information to us without the consumer’s authorization. The security of your credit card information is of utmost importance to each of our clients. They would never provide a consumer’s credit card information without proper authorization. The security of your credit card number is also important to Reservation Rewards and we require consumers to provide us with authorization. In order to accept the Reservation Rewards membership, we requirethe consumer to provide us with their email address twice to make them pause and take the time to read and understand the offer. Immediately next to the boxes where a consumer is required to enter their email address is the statement: ‘By entering my email address as my electronic signature and clicking YES, I have read and agree to the Offer and Billing Details and authorize to securely transfer my name address and credit or debit card information to Reservation Rewards for billing and benefit processing.’ If a consumer just clicks on the ‘YES’ button without entering their email twice, the membership is not accepted. If a consumer does not want to accept the offer, there is a ‘No Thanks’ option right under the ‘YES’ button. 3. Reservation Rewards customer service said they sent me multiple emails about the membership before billing. What emails? I never got any. Once a consumer accepts the membership we make a significant effort to make the consumer aware of the membership and send multiple communications to the consumer before the first membership billing occurs. We use sophisticated monitoring tools to track the deliverability of these emails and our records show a very high delivery rate. We actuallyhave these records audited by a third party to ensure we are consistent in sending them to consumers.We also work with two outside companies to assist us in maximizing our high delivery rate. If an email bounces back as undeliverable, we send the consumer a letter via U.S. postal mail. However, we do understand in this day and age of spam, some of our email communications maybe filtered out and not read by some consumers. So, in addition to the email communications, each member is also presented with a membership acknowledgement page immediately upon acceptance of the membership. Our intent with this acknowledgement page is to make the consumer immediately aware theyaccepted the membership and to give them an opportunity to cancel it if that is what they want. We have hundreds of thousands of members that happily use the Reservation Rewards benefits and we don’t want people to be in the membership that they didn’t intend to join. 4. Why didn’t I get my Cash Back Award or access to membership benefits? I don’t believe there really is a Cash Back Award or Membership Benefits. We apologize if some consumers find it unclear how they can redeem their Cash Back Award or take advantage of the membership benefits. We have many members taking full advantage of the membership benefits and redemption of their Cash Back Awards. We encourage members to redeem their Cash Back Award and use the membership benefits by immediately presenting them with the membership acknowledgement page. In addition to instructions on how to redeem their Cash Back Award, the membership acknowledgement page also includes a password to log into the Reservation Rewards website. We also send each customer an email 13 days after accepting the membership that reminds them to redeem their Cash Back Award. We encourage you to go to www.reservationrewards.com to review the array of membership benefits. We think you’ll find that we partner with many top names in leisure, dining and theme parks to provide our members with significant discounts. At the lower left-hand corner of the home page you can review positive comments from Reservation Rewards members who regularly use the benefits. When a misunderstanding occurs, we’re more than willing to cancel the membership and provide a refund. Wecan assure you that our customer service representatives are all trained to respond to consumers in afriendly and accommodating manner. When you contact our customer service department to cancel a membership, you won’t be faced with a rep trying to convince you to keep the membership ’ our reps aren’t allowed to do that. The rep will just need some basic information from you such as your email address, full name and/or zip code to access your record and immediately accommodate your request. Once your membership is cancelled, you can be assured that we will not bill your credit card again. We value consumer comments whether positive or negative. They help us consider ways we can further improve the communication and value of the Reservation Rewards offer to consumers and they also gives us the opportunity to clear up any misunderstandings. If anyone would like us to provide more specific information on the actual offer that was presented specifically to you, just send your full name and email address directly to consumeraffairs@webloyalty.com. We’ll be happy to assist you and address any further concerns you have. Sincerely,
Mary O’Reilly
Consumer Affairs
Reservation Rewards

I don’t know whether or not the above description is currently true, but it is certainly entirely inconsistent with my experience. I did not enter my email address once — or twice — to “confirm” my subscription. My server logs from that time period showed that no confirmation emails were ever sent by Webloyalty (regardless of whether they might be caught by a spam filter), and the customer service representative I spoke with did try to keep me to keep my membership (and moreover was exceedingly rude). Hopefully my experience with the company is no longer true, but based on the comments on my blog that’s not the case. Webloyalty seems to have found a novel and profitable solution to the opt-in vs. opt-out tradeoff — don’t give the customer any option at all!

David, you wrote about Class::DBI performance. Even without benchmarking you could have found out, that Class::DBI is quite slow. Fortunately there are some alternative object-relational mappers available in the perl universe. The best ones I found so far are Rose::DB::Object and DBIx::Class. I took a closer look at both and would like to share my experience. As this shows, RDBO is faster than DBIC in most of the case. The generated SQL doesn't differ too much and therefor it must be the perl side of things that makes the difference. Matt S Trout <dbix-class@trout.me.uk> says:

  However, RDBO achieves its perl speed by aggressive inlining of stuff
  etc. - for example the main object retrieval function in RDBO's manager
  class is >3000 lines in a single sub. DBIC values extensibility over a
  few extra sub calls, so methods are much more broken out and there are
  many more ways to hook into the DBIC execution process to extend.

Also its idea of resultsets is something I really love. Here's a small example to illustrate that:

  my $user_rs = $schema->resultset('User')->search(  registered => 1  );
  $user_rs    = $user_rs->search(
		    comment.title => 'Foo'  ,
		   
		  	join     =>   'article' => 'comment'  ,
			order_by => 'user.name',
		   ,
  );

  # no sql executed yet.
  # now you can use your resultset as an iterator or query a list of User
  # objects from it or ..

  while (my $user = $user_rs->next)  
	  ...
   

  # or

  my $count = $user_rs->count;

Using these resultset makes it extremely easy to built up queries piece by piece and to work together well with, for example, a templating system. You don't need to fetch all row-objects and give them to your template. You can just pass the iterator to the template library. There's a lot more to say about this two object-relational mappers (for example RDBO supports prefetching of multiple one-to-many at once, which DBIC doesn't), but maybe you just should take a look yourself. I personally prefer DBIx::Class for its vast extensibility.

I had long thought that Sexism was a thing of the past; that women would have the ability to do what they wanted, and would mostly not be discriminated against. And while I was not so naive to think that there was no discrimination at all, I was under the impression that any such discrimination would mostly be something the discriminator did not think of consciously. That things like people being rejected outright for a job because they were women, and, well, "women can't work as well as men", were stories of the past. At least if I did ever discriminate against women, it never was intentional. Little did I realize how far away from the truth that was. As some troll's recent mails show, there are actually people out there who do thinkn that the influx of Women into Debian should be stopped, and that Debian should be a men only club. Our coward is too afraid to post under his real name, instead relying on tor and throwaway yahoo accounts to mask his identity. So let's call him 'Anonymous coward'. Occasionally, this is the main reason why I don't like tor; full anonymity should not be allowed, one should be able to have people stand up for what they say, and face the consequences. Anyway, that's a different story, for another time. What puzzles me is how anyone would think that there could possibly be a correlation between orphaned packages and the existance of Debian-Women. Personally, I've been happy that there is a Debian-Women which strives to make our community more complete; the lack of women (or any considerable part of the world population, for that matter) is a serious disadvantage for any community that tries to do something for the "greater good". Personally, I'm disgusted and offended by the mails this moron is sending; and even though I realize that there probably still is some (unconscious) discrimination against women, I can hope to safely say that Debian is tolerant regarding people that represent a minority amongst its community members. Even Jonathan Walther, whom we kicked out for (amongst other reasons) trolling on the debian-women mailinglist, never (to the best of my knowledge) said anything which implied that he thought Debian-Women should be disbanded (although he, err, had a "different" idea of what they should be doing). I guess all this only means we don't live in a utopia, and that Debian is not free of the plagues that will hit any sufficiently large community. But that doesn't negate the fact that I'm still offended by this lunatic.

I’ve seen several people writing here about using different kinds of network configuration depending upon where they are. This is fine and dandy, but for the more general case is there a simple mechanism for switching system configurations depending on “environment”? I use Xen a lot on my systems, but sometimes I boot into a normal kernel. If I’m running a normal kernel I want to use the non-free nvidia driver for X, since this has better performance when viewing DVDs, etc. If I’m running Xen I need to use the free nv driver, since the non-free driver isn’t available. Can I make this switch automatically? I could add an init script to symlink the right file into place depending on whether xend is running, but that just seems fragile and suboptimal.

• I have started looking into SELinux on Debian recently. SELinux provides mandatory access control for Linux, which gives you great control over which process may do what with which files, other processes, network connections etc. I've still got a lot to learn and read (more posts will probably follow), but if you're inclined to try it yourself here are a few tips:
  • First, read the SELinux and especially the SELinuxSetup pages in the Debian wiki. Also checkout the SELinuxStatus page.
  • There are currently a few bugs I noticed, which cause some trouble: bug #369852 prevents a correct install of the selinux-policy-default package, but the work-around mentioned in the bug report works fine. I reported bug #372543 yesterday, but there's an easy work-around for that, too.
  • I had to change "SELINUX=enforcing" to "SELINUX=permissive" in /etc/selinux/config (at least for now), otherwise my system won't boot up anymore because of SELinux denied permissions (I think). I'm pretty sure this is either a bug or me doing something wrong, but I haven't figured out yet what that is.
• Robert Nunnally (a.k.a Gurdonark) has created a photo collage video (YouTube, requires Flash) for Marco Raaphorst's "Blowing Snow" song. He used some of the Creative Commons licensed photos from my photoblog for the video.
• Wow! Today the number of people subscribed to my music podcast (via RSS) exceeded 200 for the first time! Thanks everyone for listening!
• GNU/Hurd 1.0.0 has been released. Finally! And they've built it on top of an interesting "middleware"...

Anyone who reads Planet Maemo would have noticed Nokia 770 En Espa ol blog about a leather case for the 770. The case seems like a good idea: it holds credit cards, MMC cards and so on, and folds open to let you use the 770. However, without any PIM apps on the 770 (such as an addressbook, calendar, syncing to your desktop) treating it like a filofax seems a little strange. Did I say no PIM apps? The 2006 release includes Contacts, and OpenedHand has plans. Full PIM capabilities on the 770 coming soon!

Today, I needed to do something that I didn't find a handy method for in Rails. The API has both a send_data and send_file method, but they are both 'one shot' in that you have to send all your data at once.

def generate_file
  @headers["Content-Type"] = "text/comma-separated-values;"
  @headers["Content-Disposition"] = "filename=\"some.file.txt\";"
  i = 0
  render :text => Proc.new    response, output 
    ...
    output.write("some generated text...")
    ...
   , :layout => false
end

I more or less copied that from the send_file method, and indeed, I'll even admit that I'm not entirely sure why it works. What I don't get is what "connects" the output variable in the Proc to an actual file descriptor somewhere. render_text doesn't really clear things up (well, for me, at least!).

  def render_text(text = nil, status = nil) #:nodoc:
    @performed_render = true
    @response.headers['Status'] = (status   DEFAULT_RENDER_STATUS_CODE).to_s
    @response.body = text
  end

In any case, the code does do what I want - perhaps someone else will find it useful. NOTE Comments are broken, as the typo journal system seems to have been somewhat abbandoned... argh!

Another day, another Google product launch, though this one does more than just lay the groundwork for epic battles to come (most recent example: Google Spreadsheets). Google Browser Sync is a Firefox extension that solves an immediate problem that no one to date has adequately solved: It automatically synchronizes browser settings across computers. I’ve been using Foxmarks for a while now to keep my bookmarks synchronized across the various computers I use and have found it incredibly useful. But bookmarks are just a small sliver of the Web 2.0 client problem, and I’ve recently found myself wishing Foxmarks could synchronize saved passwords too, the next maddening bit of client metadata that never seems to be in the right place. Well, I now have my solution, and after using it for a few hours, it seems to work pretty well. My only real complaint is that it only works with one open browser at a time—if you launch a browser on a second computer, it logs you out on the first one. I have multiple computers on my desk with multiple browsers open at any given time, and Foxmarks handled this use case well. Of course, as with all new Google products, this one exposes as many (or more) new holes in the Google platform as it covers, at least for me. For example, why not synchronize my bookmarks with, well, Google Bookmarks? That way, I could get to my browser bookmarks online, add tags (er, labels), etc., with any changes I make online being reflected back on the client side via the browser synchronization. And why isn’t bookmark functionality available in the Google Toolbar? (Actually, it looks like it is available in the IE version, but not the Firefox version, which makes absolutely no sense to me: Shouldn’t the goal be to abstract away the platform underneath, which implies exposing the exact same feature sets in both versions?) And don’t even get me started on Google Notebook, which otherwise looks promising but is completely unintegrated with Google Bookmarks, not to mention the new thing. While I’m at it, why, oh why, doesn’t Google Notebook utilize the very nice word processing functionality acquired with Writely instead of implementing its own rudimentary text editing support? (Ok, that last one’s further afield, but you get where I’m going here.) In summary, I now have three ways to bookmark things using the Google platform—the browser (nicely synchronized across computers via the Google cloud), a star (a la Gmail) next to results in my Search History (but not on plain old Google search), and “Note This” on plain old Google search (but not the Search History). Oh, and they all create bookmarks in different places. The end result? Even though I’m primarily a Google customer these days, none of this mess is usable, and I’m still using del.icio.us to bookmark things. That said, I’m not even using del.icio.us as much as I used to because it’s not as well integrated with the browser as it could be, which is presumably why Google is investing in a saner browser environment. (There, we’ve gone full circle now.) I could go on all day. And, thus far, I’ve only talked about bookmarks. From where I set, this is just an example of a much broader problem for Google: Google has an impressive collection of interesting, but disjoint, features. I’d imagine this is a result of Google’s engineering culture combined with rapid growth. Granted, this approach has served Google pretty well thus far as it pumps new stuff out on a nearly weekly basis while Microsoft struggles to get anything done in less than six years. Of course, Microsoft’s rapidly learning how to be agile, and if there’s one thing Microsoft is good at, it’s assembling disjoint features into platforms. So, heads up, Google: You have a thing or two to learn from Microsoft before that epic battle I referred to earlier begins. They’re certainly learning from you. Technorati Tags: firefox, google, mozilla, platforms, synchronization, web20

After getting back from DebConf and the 1-week trip afterwards, it took me a full week to get out of most of the chaos travelling usually leaves behind. I still haven't unpacked all stuff from the suitcase, but at least managed to wash the dirty clothes. Oh, and I've signed all keys from the KSP - including madduck's, he showed me his proper German ID card when I asked what this funny Transnational Republic was. (Oh, and if you were listed at the KSP, didn't show up, but I've signed your key anyway, that's because we met before and you have a new UID, in case you are wondering.) The pictures I took are still scatered over several home dirs on different hosts, I'll try to sort/rotate/rename them over the next days. (Oh, and DebConf was great, the trip afterwards likewise - I'll try to write a separate blog post on that later...) At the moment I'm slowly starting to get into frontdesk work. I have some notes from Neil's and Enrico's AM BoF and the discussion BoF round around my "NM process future" proposal that I still have to write down once I'm finished with answering my own NMs' mails. Both BoFs went pretty well, the major outcome being that we should discuss much more among AMs on -newmaint and IRC, have older AM reports available for reference by other AMs, and have some sort of "AM report template" that lists the points the DAMs want to see in the report. About the propsal, my feeling is that we shouldn't implement any major NM changes (like the DM idea) until we really understand what the problem with the current process is. (It takes too long, but that can be fixed by throwing out the not-ready applicants more aggressively.) Thanks to all the people who provided very valuable feedback during the BoFs and in the private conversations afterwards. So far, I've assigned a few applicants to AMs, added comments to the database on the level of prior contribution of the new applicants, and worked a bit on the web pages. The major visible change is that the NM graphs are now included on nm.d.o. The 'big' thing I'd like to implement next is to let the applicants write some application email where they list what they've done for Debian so far before the AM assignment, so we can match NM-AM better, and also improve our judgement of the level of prior contribution. Also, we will probably require 2 advocates per applicant in the future, to make sure people have worked with more than a single DD before. Of course, all this must not get excessive, we don't want to make joining Debian harder than it already is. Then there's also the usual 2k+ message backlog waiting in the Debian mailbox...

I stumbled over CC Hits today, which looks like an interesting site with great potential. It's basically a digg-like site (implemented using ning.com, it seems) which doesn't list articles, but rather Creative Commons licensed songs. You can vote for the songs you like, just like you vote for articles on digg.com. The site seems to be quite new, and there's not too much traffic yet, but I imagine it could become a very useful resource to find high-quality Creative Commons music. Which is similar to what I'm doing with my Creative Commons music podcast (subscribe here, yadda yadda), and most of the other CC music podcasts do, for that matter. There's just too much CC music of varying quality out there by now — it's not so much a problem anymore to find some freely and legally available CC music (like it used to be a few years ago). It's more an issue of finding good music and/or music of certain genres you like... Anyways, I'm surely going to checkout CC Hits and use it to find new CC artists and songs for my podcast. Oh, and if you have any suggestions for more sources for good CC music, please leave a comment. </spam> Update 2006-06-05: On a related note, here's a song for all the geeks reading this: Code Monkey (MP3, 3.6 MB) by Jonathan Coulton, Creative Commons licensed, of course.

Martin F. Krafft blogged about how to rollback firewall changes in the case you managed to lock yourself out from the box It's even easier if you use my Pyroman firewall config tool. (apt-get install pyroman). If you run pyroman safe it will execute the new firewall rules - and if you don't type OK within 30 seconds, it will undo all changes. Note that it can also restore to a configuration set by a different firewall app. (It just restores the old iptables state and feeds it back to iptables - it will support anything your iptables version does.) Oh, and it's much faster than the other firewall scripts I've tested so far, since it doesn't spawn hundreds of iptables processes, but only one iptables-restore for setting the new rules in one transaction. Check the web page for other benefits; should just work on any Linux distribution with iptables and python (read: every). [Update: Martin, I was referring to the instructions you gave, to adding an at job and then running atrm to accept the changes. Yeah, what you script does is basically the same what mine does for rollback.]

Well, I finally have a new laptop. Got it yesterday, spent about 3 hours installing and downloading all the software, and then let rsync run all last night to transfer over my home directory. Of course like any good Debian user I've filed a detailed installation report. I'm fairly pleased with the fujitsu p7120 so far. Compared to my old p1100:

• The keyboard feels larger, and the couple of keys that were moved around all make sense, except for delete. The right shift key is enormous, larger than that key is on a regular full size keyboard, and the other non-alphanumerics are also very nicely sized. Even the spacebar is larger than the usual laptop chiclet. I'd not realised how dead my old laptop's keyboard had gotten until keys started falling off; typing on this new one is just fun. Sorry for the length of the resulting blog entry..
• It runs a little bit hotter, but still seems quite nice for a fanless laptop with a fairly modern processor in it (1.2 ghz).
• The screen is much nicer, very bright. Was worried that it would be too reflective, but situations where it is seem rare. It's very nice to be able to see the screen outdoors; I'm writing this in direct sunlight.
• The touch pad is very small, but very responsive. I can't normally use touch pads and I wasn't able to consider buying this laptop until I got a chance to try it out at DebConf. With that said, the lack of a middle mouse button is very annoying, and I'm looking for some way to bind keys in X to a) paste and b) touch pad disable toggle. I'm still having significant problems with reliably dragging to highlight text too, about 10x as slow at is as I was with the old laptop's pointer. You don't realized how often you copy text around that way until it becomes easier to just re-type it.. The two mouse buttons are not very conveniently placed, their positioning makes it hard to do a one-handed click and drag.
• The case doesn't feel as solid as my old laptop's. It's also an inch longer, which makes it seem less safe to toss it in the bottom of my backpack and run around with it than the old laptop, which was basically an indestrictible little lump. All the other changes made to the case design seem like improveents, except they used a blue LED for the power indicator, which like all blue LEDs is too bright to be comfortable at night. I'll probably use some whiteout on it.
• The battery lasts 4.5 hours real usage without any tuning beyond cpufreqd, which is quite nice. I haven't felt the need to add in a bay battery yet; that battery should bring it up to ~11 hours.
• The drive is one of those new really tiny laptop hard drives, and it's whisper-quiet. I have to put my ear right on the bottom of the case to hear it.
• The speakers are quite a lot better (for laptop speakers). The internal dual microphone array seems to not be very sensative at all, I wonder how much work the windows drivers for it do in software? The keyboard sound controls don't work in linux, which is a pity.
• The fingerprint reader and card reader are the only bits not yet supported by linux. If you care about non-free firmware, only the wifi needs that.
• 3D works; I can finally try out most of the new games that have been written in the past 6 years or so. Whee..

Yesterday I was making some operations on the BTS Control Server and found some nice behaviours that I already reported to owner, and Don answered right the way. If you use reportbug to make an ITP (because, err, you want to) it will say that your mail should be cc’ed to debian-devel, per Policy. It will also cc the report to your address. So yesterday I made an ITP and the mail went out with the following headers:

From: Jose Parrella <joseparrella cantv.net>
...
X-Debbugs-Cc: <debian-devel lists.debian.org>

Everything ok. When it arrived to the BTS, a new header appeared:

Resent-CC: <debian-devel lists.debian.org>,
<wnpp debian.org>, jose parrella <joseparrella cantv.net>

Notice my lowered-case name. I didn’t notice this, and I was merging bugs later, but the merge operation failed because of a case-sensitive mismatch between “Jose Parrella” and “jose parrella”. So there’s an incongruence in what happens when it tries to get the owner from the pseudo headers and when you try to set it through Control Bugs. At least if you use reportbug, be careful if your name is being lc’ed since merges will fail.