Those of you who follow such things may have noticed that I became SPI President today. The cool part, though, is how I managed to participate in the special board meeting to select officers today. The meeting fell in the middle of the drive from our house up into the mountains to the Rocky Ridge Music Center near Estes Park, Colorado, where my daughter is attending a music camp. About 15 minutes before the meeting was supposed to start, we drove out of the edge of GSM phone coverage just beyond the town of Lyons... I turned the car around and drove back into town and parked adjacent to the surprisingly interesting Sandstone Park, which is part of a sculpture trail in the middle of town. My wife and kids wandered around the park while I fired up my new HP nc2400 notebook and established a GPRS connection through my aging Ericsson T39 phone using gprsec, which sadly is not yet packaged for Debian. Two minor hacks due to my choice of phone. I needed the flag_time=0 option on the ppp_async module command line to work around a bug in the T39 as per the GPRS-HOWTO, and noauth in the ppp config emitted by gprsec. Participating in the meeting was painless, other than delaying our lunch for a half hour or so... It's really nice when things work the way they're supposed to.

Duffman thrusts in the direction of the problem. Oh yeah!

On Debian Policy

When your package contains GDFL docs
or when it break other programs
it stores passwords in mode 666
has incorrect dependencies
that's RC.

When you think that rpath is justified
just because libtool inserted it there
and don't use -fPIC,
libtool is a fool
and you are retarded.

When you have to use Minix
and there are conf files in /usr/local/etc,
Lintian will say,
you had it coming.

The Ottawa Linux Symposium is arguably Canada's biggest conference about Linux and its associated technologies. It happens every year, right after the Kernel Summit, which virtually guarantees that some famous people stick around afterwards to attend OLS. Now the Kernel Summit is a small gathering of Linux developers where they hash out big issues in the kernel. After all, it's a lot easier to get your point across when you're sitting in the same room as the person you're talking to. Mailing lists are just not the same. OLS, however, is a free-for-all. If you pay in time, you get to show up. This makes for an astoundingly large conference, about 850 people in total. I brought along wlach, who had never been to OLS before. So I was doing my part in inflating the number of people there. I think he ended up in the right crowds. Which is difficult, because there are a lot of crowds there. People walk past in a blur and you can never quite remember if you've met someone before. At the conference, there are four tracks of presentations, at any one time. Some of these are perennial talks, like the tutorial on writing your own kernel module. And others change as the years go by. The big topic this year was Xen, the free virtualization software that really got huge in the past two years. Xen allows people to run multiple copies of their operating system inside one computer, with very little overhead. This makes it attractive to a lot of people, be they system administrators, software developers, or people who like fiddling with their machine. I met a consultant from Chicago that sells Xen-based solutions. She builds a big server and runs various virtual servers for small business inside that one box. It's very cost effective and is a good way to make server maintanance easy. Whenever I wanted to find her, I'd just pop into one of the ubiquitous Xen talks. The amount of work that gets done at this conference is astounding. You'll see people sitting around at tables hashing out designs and beating out flaws. Hackers huddle around laptops in an attempt to get the C library building on PA-RISC again. That's because the bandwidth to communication is very high and the latency is inconsequential. There were times when I wanted to pull out my laptop and do some work. But then I remembered that I left it in the hotel. Because it's heavy. There's actually a lot of space at OLS, because it's spread across the three floors of the Ottawa Congress Centre. It's really easy to miss someone for weeks before bumping into him at a party. Like opalmirror, for example, who I was very glad to meet in person. And are there ever parties. Ostensibly, you go there for the talks. And talks there are: some of them quite good and the vast majority are rather mediocre. They're the results of a year of hacking, months of academic research, or inspired observation. I have to admit that I get a bit lax when attending speakers. It reminds me too much of the classroom. And just like university, I buy the course notes to mitigate my guilt. They make for good reading when finals come along. It's the conversation that you go there for. When you get to sit down with Alan and have a good laugh about geeky topics. Or buy Donald a drink for working on those ugly network cards all those years ago. You get to connect with people that you've only seen online, or read as their names flashed past in the boot messages. That's that kind of bonding that people yearn for. I'm looking forward to next year already.

My latest music CDs (of course already ripped to my Ogg Vorbis player... CDs suck usability-wise, actually...):
Sing when you're Swinging Two CDs - the second is titled "(If you can't sing it) You'll have to swing it" - with recordings of the swing era. Some slow, some better for dancing. Rather cheap, and well worth the money unless you have many songs of that era already.
Pop swings This CD is a mixed bag. It's swing covers of well-known songs of the 70s-90s. Some work great, others don't. A lot is personal taste, depending on the memories you have of the originals or how you liked them. If you didn't like the original, you might like the swing cover. If you loved the original, you'll likely hate the cover, just like any cover. The funniest thing is that one artist, Paul Anka, is on the CD in both roles, as cover artist (Smells like teen spirit) and as original artist (Diana). This is a CD you can't really listen to on-block (thats why CDs suck) or play on a party. You'll usually pick some specific songs.
Perfect for parties The full title is

Bear Family
"Perfect for parties
Highlight Album

This CD was the surprise CD. Very cheap, but very convincing. It's odd and fun at the same time. Actually it's probably as much country as it's rockability and swing. But who cares when you can have lots of fun with it? The song I like currently like best is "Burn that candle" by Charline Arthur. Note: above amazon.de links will earn me a tiny commission. It would be nice if you'd use them if you plan to order some of these CDs. Thanks. It will certainly never pay off, but when I set links I can as well set some that might allow me to buy myself a CD from it sometime later, too. ;-)

I've been watching the Lebanese bloodshed since it started. It really makes me sick. I have discussed this with many friends. There was little discussion though: we all thought this is a plain war against civilian targets. I tried discussing with people who could maybe be more supportive of the Israeli points of view. I tried talking to some of my right-winger relatives... and I haven't been able to find anyone that can say a word of support of what Israel is doing in Lebanon. In three weeks, I have seen how Hizbullah killed some Israeli soldiers in some area around the border between Lebanon and Israel. As far as my (as an international online paper reader) judgement can tell, the location where this happened is disputed. Some say it was inside Lebanese territory, the others say it was an Hizbullah incursion into Israeli soldiers. I really don't care. The immediate result of this action was a campaign of air strikes against Beirut and other Lebanese cities aiming to give a measured response (cache, and beware this is explicit) to Hizbulla's aggression. This, apparently, included destroying any vital infrastructure in heavily populated areas of Beirut, including bridges, power plants, hospitals and apparently random buildings. While the Israeli army said the military operations were aimed to get rid of the Hizbullah camps and infrastructures around the border where they fire their rockets against Haifa and other Israeli cities, and their headquarters in Beirut and other southern cities, what the world espectated during the first three or four days of air strikes was pure horror. Hizbullah-controlled areas were like ghost quarters, so any bombing of those were very unlikely to take any Hizbullah victims. On the other hand, the rising number of civilian victims was the first bits of news that I could hear in my radio as I woke up every morning. All of this, with a great amount of cinism and unlimitted cruelty. The Israeli army declared that the civilian population in the South should be leaving their homes (measured response), while they knew they were doing exactly what was needed to prevent this, by locking them up around destroyed bridges, harbours, airport and roads. The first columns of the lucky refugees who could afford fleeing to the North were greeted by Israeli bombs, leaving a good number of scattered bodies. In Spain, the news shocked the public opinion and Zapatero, along with Chirac (IIRC), declared those actions were untolerable and unproportionate, and should be stopped immediately. This brought some local politics fun, when on one side the Israel ambassador in Spain accussed Zapatero of being antisemitic, and the right-wing leader Rajoy called the thousands of people who spontaneously demonstrated against the war in a few cities "clowns" and "ignorant". Watching what the UN has done to stop these warcrimes, I really think it's a great moment to shut down that useless organisation and let some big corporation buy their nice building in New York City to build their offices in it. Once again, when some countries tried to come up with some resolution that forced Israel to stop, the United States waived their vetto flag. Once again, the Security Council has done nothing to put an end to another chapter of violence in the Middle East. The vettoing powers of some of the members is so ridiculous that it makes it totally inoperative. So, as the UK and US governments were not going to do anything to stop the air strikes, Israel had carte blanche to do whatever they wanted for a week. And then, Israel's measured response destroyed one of the UN's buildings in Lebanon, killing four annoying observers, despite their calls warning that the bombs were falling too near their location. Only then, the United States decided to send Condie to have a look around the area, surprise visit to Beirut included. I wonder, what phone number must the innocent women and children who cannot escape their cities and towns dial in order to warn the Israeli army about the proximity of their bombed targets? After two visits of Condie to the region, nothing has changed, as the fourth week of operations starts. This is getting on my nerves. I don't, and won't, justify any of the Hizbullah attacks on civilian targets using Katyushas, or the kidnapping of soldiers, or whatever. What I see is that unless Israel takes a radically different approach to their problem, nothing will change either. Violence isn't at least. Apparently, their military operation isn't going well at all, and is not damaging much of Hizbullah's military capacity. What are they going to do? Will they occupy southern Lebanon for 20 more years? The social movements this kind of actions are generating is also very, very worrying. On one hand, I read that around 85% of the Israeli population approve this war and think this is what their government needs to do to make them safe. This is pretty shocking. On the other hand, everyone still in Lebanon, even the Christian community, are united against the attack, helping each other in their survival quest, while the popular support to Hizbullah is rising, with big concentrations of people cheering them in the streets. This is just two years after similar demonstrations in Beirut forced the Syrian military out of the country. While the Israeli war against Lebanon (I won't buy the "It's against Hizbullah" bullshit), sadly all the media, cameras and journalists have given their back on Gaza, which is under similar, but probably more brutal and savage military operations by Israel, as another soldier was kidnapped just one week before all of the Lebanon stuff started. The press doesn't have any news of how things are going in Gaza. The last thing I remember is that the UN was warning about the threat of a humanitarian disaster due to the lack of any kind of supplies in Palestine. If Palestinian kids are starving, the media are not letting us know. Yesterday, 54 civilians were killed in an improvised underground bomb shelter in Qana, most of them being children. The Lebanese civilian death toll must be well over 500 as of this writing, with a ratio of at least 1:10 compared to Israeli military victims. When will Olmert have enough? The only way I see this will end up for good is when the Israeli public realises being at war in three fronts is quite expensive and damages their home economies. Maybe, at that point, people start hearing what the Meretz party minority in the country have been saying for years. Israel has the right to defend itself. This is the official motto of Israeli and American leaders. When this right is extended and abused to the point the main targets and victims are civilians, Israel walks quickly away from a perdurable solution. Today, hostility against the state of Israel is even greater than last month. Hizbullah in Lebanon, Hamas in Palestine, will probably be the winners of the conflict when the bombings end. Not the best recipe for a peaceful future.

Tenth day in Addis Procedure to check if all the services of Dream University are up and running If a machine blocks pings, use arping instead.

1. Test DHCP:

   $ sudo ifdown eth0
   $ sudo ifup eth0
   $ ifconfig
   

2. Test the DNS:

   # See if the DNS machine is on
   # The network
   $ ping -n 192.168.0.1
   # See if the DNS resolves names
   $ host www.dream.edu.et
   

3. Test the gateway:

   # Ping the gateway
   $ ping gateway
   # Ping an outside host
   $ ping -n 10.4.15.6
   

4. Test the proxy:

   # Ping the proxy
   $ ping proxy
   # Open a web page and see if it displays
   # See if it caches
   http_proxy=http://proxy.dream.edu.et:3030/ wget -S -O/dev/null http://www.enricozini.org  2>&1   grep X-Cache
   

5. Test the mail server:

   $ ping smtp
   $ nmap smtp -p 25  grep 25/tcp
   $ if nmap gateway -p 25  grep 25/tcp   grep -q open ; then echo "It works"; fi
   $ send a mail and see if you receive it
   

To do more advanced network and service monitoring, try nagios:

• http://www.nagios.org/
• http://en.wikipedia.org/wiki/Nagios

New useful tools seen today

wget - The non-interactive network downloader.

Special devices

• /dev/null:
  • On read, there is no data.
  • On write, discards data.
• /dev/zero:
  • On read, reads an infininte amount of zero bits.
  • On write, discards data.
• /dev/random, /dev/urandom
  • On read, reads random bits.
  • On write, discards data.
  • Difference: /dev/random is cryptographically secure, but it can hang waiting for system events

Example uses:

wget -O/dev/null http://www.example.org
dd if=/dev/zero of=testdisk bs=1M count=50
mke2fs testdisk
sudo mount -o loop testdisk  /mnt

Tiny little commands

• true - do nothing, successfully
• false - do nothing, unsuccessfully
• yes - output a string repeatedly until killed

Example uses:

• while /bin/true; do echo ciao; done
• Using /bin/false as a shell
• yes boring-tool-that-asks-lots-of-silly-questions

Some more shell syntax

• 2>&1 Redirects the standard error in the standard output
• 2> Redirects the standard error instead of the standard output

Some people run commands ignoring the standard error: command 2> /dev/null this causes unexpected error messages to go unnoticed: please do not do it. What to check if a machine is very slow

• See if the ram is full: $ free If it is, you see what are the fattest programs using top, pressing M to sort by memory usage.
• See if there are lots of programs competing for CPU: $ top
• Check if you have I/O bottlenecks: $ vmstat (but I don't know how to read it)
• For a desktop on older hardware, you can try xubuntu instead of ubuntu

More VIM command mode Command mode allows to perform various text editing functions. You work by performing operations on selected blocks of text. Some common operations:

• y: copy ("yank")
• p: paste
• P: paste before
• d: cut ("delete")
• c: change
• i: insert
• a: append
• .: repeat last operation

Some common blocks:

• w: word
• : paragraph
• left and right arrow: one character left or right
• up and down arrow: this line and the one on top or below
• f letter: from the cursor until the given letter
• v: selection
• V: line selection
• ^V: block selection

Examples:

• yw: copy word
• dw: cut word
• yy: copy line
• dd: cut line
• V (select lines) y: copy a selection of lines
• V (select lines) d: cut a selection of lines
• p: paste

The best way to learn more vim is always to run vimtutor. Installing squirrelmail To install squirrelmail:

1. apt-get install squirrelmail
2. /usr/sbin/squirrelmail-config and configure IMAP and SMTP. In our case, since we use IMAPS, the IMAP server is imap.dream.edu.et, port 993, secure IMAP enabled and SMTP is smtp.dream.edu.et.
3. Read /usr/share/doc/squirrelmail/README.Debian.gz (with zless) for how to proceed with setup. A short summary:
   • link /etc/squirrelmail/apache.conf into the apache conf.d directory
   • customise /etc/squirrelmail/apache.conf for example setting up the virtual hosts, or running it only on SSL

To have different virtual hosts over HTTPS, you need to have a different IP for every virtual host: name based virtual hosts do not work on HTTPS. You can configure multiple IP addresses on the same computer: use network interfaces named: eth0:1, eth0:2, eth0:3... These are called interface aliases. You cannot setup interface aliases using the graphical network configuration and you need to add them in /etc/network/interfaces:

    iface eth0:1 inet static
          address 192.168.0.201
          netmask 255.255.255.0
          gateway 192.168.0.3
    auto eth0:1

This is the trick commonly used to put different virtual HTTPS hosts on the same computer. Links squid documentation:

• http://www.squid-cache.org/Doc/
• http://www.squid-cache.org/Doc/FAQ/
• http://www.deckle.co.za/squid-users-guide/Main_Page

Shell programming:

• http://www.freeos.com/guides/lsst/
• http://www.tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html
• http://www.tinker.ncsu.edu/LEGO/shell_help.html

Performance analysis:

• http://flaviostechnotalk.com/wordpress/index.php/2005/06/05/performance-analysis-on-linux/
• http://www.cyberciti.biz/faqs/2006/07/linux-performance-tools-to.php

Setting up mail services:

• http://wanderingbarque.com/howtos/mailserver/mailserver.html

Ninth day in Addis SSH To enable remote logins with ssh apt-get install openssh-server Then you can login with:

$ ssh efossnet@proxy.dream.edu.et

To verify the host key fingerprint of a machine:

$ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub

Note: you need to verify it before logging in! More information at http://www.securityfocus.com/infocus/1806 Example ssh usages To log in:

    $ ssh efossnet@proxy

To run a command in the remote computer:

    $ ssh efossnet@proxy "cat /etc/hosts"

To copy a file to the remote computer:

    $ scp Desktop/july-18.tar.gz efossnet@proxy:

To copy a file from the remote computer:

    $ scp efossnet@proxy:july-18.tar.gz /tmp/

Beware of brute-force login attempts Warning about SSH: there are people who run automated scans for ssh servers and try to login using commonly used easy passwords. If you have an SSH server on the network, use strong passwords, or if you can it's even better to disable password authentication: in /etc/ssh/sshd_config, add:

    PasswordAuthentication no

To log in using public/private keys:

1. Create your key:

   ssh-keygen -t rsa
   

2. Copy your public key to the machine where you want to log in:

   ssh-copy-id -i .ssh/id_rsa.pub efossnet@proxy
   

3. Now you can ssh using your RSA key

If you use ssh often, read these:

• http://mah.everybody.org/docs/ssh
• http://www.securityfocus.com/infocus/1812
• http://www.sshkeychain.org/mirrors/SSH-with-Keys-HOWTO/SSH-with-Keys-HOWTO-6.html

proxy Problems we had today with the proxy: ssl does not work Reason: squid tries to directly connect to the ssl server, but the AAU network wants us to go through their proxy. Ideal solution: none. There is no way to tell squid to use a parent proxy for SSL connections. Solution: update the documentation for the Dream university users telling to setup a different proxy for SSL connections. Longer term solution: get the AAU network admins to enable outgoing SSL connections from the Dream university proxy. Other things that can be done:

• report a bug on squid reporting the need and requesting the feature
• download squid source code and implement the feature ourselves, then submit the patch to the squid people

Browsing normal pages returns an error of 'Connection refused'. In the logs, the line is:

1153294204.912    887 192.168.0.200 TCP_MISS/503 1441 GET http://www.google.com.et/search? - NONE/- text/html

That "/503" is one of the HTTP error codes. Explanation of the error codes:

• http://www.w3.org/Protocols/HTTP/HTRESP.html
• http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
• http://offline.web.cern.ch/offline/web/http_error_codes.html

Reason: the other proxy is refusing connections from our proxy. Solution: none so far. Will need to get in touch with the admins of the other proxy to try to find out why it refuses connection to our proxy, and how we can fix the problem. postfix on smtp.dream.edu.et Basic information is at http://www.postfix.org/basic.html. Difference between mail name and smarthost:

• The mail name is the name of the mail server you're setting up (TODO: need more details on what's it used for)
• The smarthost is the name of the mail server that will relay mail for you.

Quick way to send test mails:

apt-get install mailx
echo ciao   mail efossnet@localhost

To configure a workstation not to do any mail delivery locally and send all mail produced locally to smtp.dream.edu.et:

1. install postfix choosing "Satellite system"
2. put smtp.dream.edu.et as a smarthost.

To setup a webmail: apt-get install squirrelmail (on a working apache setup). To setup mailing lists: apt-get install mailman, then follow the instructions in /usr/share/doc. Mail server issues we encountered When a mail is sent to efossnet@localhost, the system tries to send it to efossnet@yoseph.org Investigation:

• "yoseph.org" does not appear anywhere in /etc or /var/spool/postfix
• postfix configuration has been reloaded
• postfix logs show that the mail has been 'forwarded'

Cause: the user efossnet had forgotten that he or she had setup a .forward file in the home directory. Solution:

 rm ~efossnet/.forward

Apache To add a new website:

1. cd /etc/apache2/sites-available
2. sudo cp default course
3. sudo vi course:
   1. Remove the first line
   2. Add a ServerName directive with the address of your server: ServerName course.dream.edu.et
   3. Customize the rest as needed: you at least want to remove the support for browsing /usr/share/doc and you want to use a different document root.
4. sudo a2ensite course
5. sudo /etc/init.d/apache2 reload

More VIM Undo: u (in command mode) Redo: ^R (in command mode) You can undo and redo multiple times. To recover a lost password for root or for the ubuntu admin user Boot with a live CD, mount the system on the hard disk (the live CD usually does it automatically), then edit the file /etc/shadow, removing the password:

enrico:$1$3AJfasjJFHa234dfh230:13343:0:99999:7:::

becomes:

enrico::13343:0:99999:7:::

You can edit the file because, in the live CD system, you can always become root. After you do this, reboot the system: you can log in without password, and set yourself a new password using the command passwd. Installing packages not on the CDs To get a package for installing when offline:

1. apt-get --print-uris install dnsmasq
2. Manually download the packages at the URLs that it gives you

Otherwise, apt-get --download-only install dnsmasq will download the package for you in /var/cache/apt/archives. You can install various previously downloaded debian packages with:

dpkg -i *.deb

Backups There are various ways:

• dump (for ext2/ext3 file systems) or xfsdump (for xfs file systems). Makes a low-level dump of the file system. It must be used for every different partition. It makes the most exact backup possible, including inode numbers. It can do full and incremental backups. To see the type of the filesystems, use 'mount' with no parameters. To restore: restore or xfsrestore.
• tar Filesystem independent. It can work accross partitions. It correctly backups permissions and hard links. It can do full and incremental backups. Example:

  tar lzcpf backup.tar.gz /home /var /etc /usr/local
  tar lzcpf root.tar.gz /
  

  To restore:

  tar zxpf backup.tar.gz
  

• faubackup Filesystem independent. Uses hard drive as backup storage. Always incremental. It cannot do compression. Unchanged files in new backups are just links to old backups, and do not occupy space. Any old backup can be deleted at any time without compromising the others. It can be used to provided a "yesterday's files" service to users (both locally and exported as a read-only samba share...). To restore, just copy the files from the backup area.
• amanda

  apt-get install amanda-client amanda-server
  

  It is a network backup system. It can do full and incremental backups. You can have a backup server which handles the storage and various backup clients that send the files to backup to the server. It takes some studying to set up. To restore: it has its own tool.

Some data requires exporting before backing it up:

• To save the list of installed packages and the answer to configuration questions:

  dpkg --get-selections > pkglist
  debconf-get-selections > pkgconfig
  

  To restore:

  dpkg --set-selections < list
  debconf-set-selections < pkgconfig
  apt-get dselect-upgrade
  

  If you do this, they you only need to backup /etc, /home, /usr/local, /var.
• To save the contents of a MySQL database:

  mysqldump name-of-database   gzip > name-of-database.dump.gz
  

  To restore:

  zcat name-of-database.dump.gz   mysql
  

You can schedule these dumps to be made one hour before the time you make backups. Scheduling tasks As a user:

crontab -e

As root: add a file in one of the /etc/cron.* directories. In cron. hourly,daily,weekly,monthly you put scripts. In the other directories you put crontab files (man 5 crontab). If the system is turned off during normal maintainance hours, you can do two things:

1. Change /etc/crontab to use different maintanance hours
2. Install anacron (it's installed by default in ubuntu)

For scheduling one-shot tasks, use at(1):

$ at 17:40
echo "Please tell Enrico that the lesson is finished"   mail efossnet@dream.edu.et
^D

When and how to automate

1. First, you manage to do it yourself
2. Then, you document it
3. Then, you automate it

Start at step 1 and go to 2 or 3 if/when you actually need it. (credits to sto@debian.org: he's the one from which I heard it for the first time, said so well). Interesting programs to schedule during maintanance

• rkhunter, chkrootkit
• checksecurity
• debsecan
• tiger

Important keys to know in a Unix terminal These are special keys that work on Unix terminals:

• ^C: interrupt (sends SIGTERM)
• ^\: interrupt (send SIGQUIT)
• ^D: end of input
• ^S: stop scrolling
• ^Q: resume scrolling

Therefore, if the terminal looks like it got stuck, try hitting ^Q. Problems we had today with postfix

• Problem: mail to efossnet@dream.edu.et is accepted only if sent locally. Reason:

  $ host -t mx dream.edu.et
  Host dream.edu.et not found: 3(NXDOMAIN)
  

  Solution: tell dnsmasq to handle a MX record also for dream.edu.et: mx-host=dream.edu.et,smtp.dream.edu.et,50
• The problem not solved with the previous solution. Reason: postfix was making complaints which mentioned localhost as a domain name. Solution: fixed by changing 'myhostname' in main.cf to something different than localhost. Note: solved by luck. Investigate why this happened.

Problems found yesterday and today

• there is no way to tell squid to use another proxy for SSL connections: it only does them directly
• if you want to configure evolution to get mail from /var/mail/user, you need to explicitly enter the path. It would be trivially easier if evolution presented a good default, since it's easy to compute. It would also be useful if below the "Path" entry there were some text telling what path is being requested: the mail spool? the evolution mail storage?
• In Evolution: IMAP or IMAPv4r1? What is the difference? Why should I care?
• apt-get --print-uris doesn't print the URIs if the package is in the local cache, and there seems to be no way to have it do it.
• in /etc/apache2/sites-available/default, is the NameVirtualHost * directive appropriate there? It gets in the way when using 'default' as a template for new sites. Otherwise, one can add a new (disabled) site that can be used as a template for new sites instead of default.
• the default comments put by crontab -e are not that easy to read.

For a long time I have considered F-Spot to be a nice concept application, but not really fit to be the center of Linux digital photography experience due to general bloat and (most importantly) due to the lack of many important features that would compensate the interface lock in that this application demands. In this post I will try to list all the deficiencies and lacking features of F-Spot that I have found while using it to manage my photo flow.
First let’s talk about the bloat. I will compare F-Spot to GThumb. There are few points of comparison: first start up, viewing a bunch of photos and importing a bunch of photos. When starting up GThumb uses 17 Mb RSS memory (10 of them shared with all other Gnome programs) while F-Spot uses 33 Mb RSS memory (17 of them shared with other Mono programs, of which I do not have any). When viewing a folder with couple hundred photos GThumb uses 25 Mb RSS memory while F-Spot grows to 55 Mb RSS. On import GThumb calls gphoto that adds 3-5 Mb RSS to the memory usage, while F-Spot seems to implement some/most of the photo protocol internally and can easily grow in memory up to the size of the photos being imported (which is kind of problematic while importing a gigabyte of photos), but usually the memory usage on import hangs around 250-300 Mb and hovers around that level for some time after the import is complete. For me personally it does not make much a difference (I have 2 Gb RAM now), but conservative memory usage is still critical for a good Linux application because people expect Linux to be faster and high memory usage can slow down anything. In my opinion no photo management operation should take more then 50 Mb of private RSS memory (even importing several gigs of RAW files from the camera).
Now let me try to describe the optimal work process of a (semi)professional photographer, so that we can see what is missing in F-Spot to accommodate such work-flow and what is done right.

1. The photographer takes one (or several) cameras, lenses, flashes, memory cars, spare batteries and tripods and goes to an event/photoshoot/modelling session/walk in the park/wedding/…
2. He takes 3-5 Gb of pictures from lots of different angles with different cameras, different lenses on different memory cards with different settings. Most of them will be the highest quality available on the camera, usually those will be RAW images.
3. Upon getting back to his computer, the photographer wants to drop all the data to a staging place dedicated to this event. He wants to do it fast and simple without sorting trough the photos at the moment, but at the same time he might want to split the staging areas (multiple models within one session) or join them (one model from different cameras). Sometimes he might not even have time for that and would just want to dump the data now and run to another event.
4. After several shooting events the photographer finally has reserved the time to sift trough some of the photos from the staging area (modelling jobs first, then the friends wedding and the walk in the park as last)
5. First the photographer decides to check if the times on the photographs are correct and discovers that at some shooting sessions one of the cameras was set to another timezone. He select all shots from that camera across several (but not all) staging areas and adjusts the time.
6. Now he rechecks the logical groups of photos (which photos should be in which staging area) by dragging the photos around, splitting and joining the staging areas
7. When the overall structure is clear, the photographer selects one (most important) staging area and starts working with images in that staging area not caring about any other images
8. First he browses in full screen trough all the photos rating them in quality scores form 1 to 9 by pressing corresponding number keys. Rating a picture automatically advances to the next picture, which happens very fast because the software precaches several photos ahead for speed and displays without any flicker. Speeds in the order of 2 photos per second are expected on good enough hardware. One key operations for “view 100% zoom”, “rotate”, “view exif” and “quick note” are available. RAW images are automatically translated for preview with default settings.
9. With couple clicks bad photos (with score of 4 or under) are selected and erased
10. Now the photographer starts working with individual photos
11. First step is the RAW->Jpeg conversion. An appropriate tool is brought up with default setting already applied and a preview of the photo showing up (like in dcraw). The photographer adjusts the conversion parameters (including and option to make a HDR-like effect by compressing the dynamic range of high bitness pictures). The converted Jpeg is saved as a version of the original photo and becomes the default for operations that do not understand RAW.
12. A separate plugin is used to reduce digital photo noise from the pictures (new version)
13. Photographer makes adjustments to the image inside F-Spot. Each modification makes a new version.
14. Still not satisfied, the photographer starts Gimp from inside F-Spot and make further edits. Each time Gimp saves the file, F-Spot makes another version.
15. The photographer erases some versions of the picture and also joins multiple near-duplicate shots into one picture as versions of that picture. One version is always marked as the top version and the photographer can easily change it.
16. The good photos are tagged and imported to the main collection
17. A subset of the photos is exported to: Flickr, personal Gallery installation, plain html photo album, a zip file with small (1024x…) versions of the photos, … Only the top versions of photos are exported. If unconverted RAWs are top versions, then they are converted to Jpeg with default settings. In most cases photos are also downsized before export according to the preferences. Highest quality downsizing is used (anti-aliasing) and also additionally small unsharp mask is run on each photo
18. The photographer does advanced searches and advanced tag selections to select and display or export subsets of his main collection
19. The photographer has three instances of F-Spot: his laptop, his main work PC and a backup hard drive that can be attached to either of them. He needs to keep his F-Spot photographs synchronised between the three locations for backups and for distributed work. Also after some point the main photo archive becomes too big to store it (with all versions) on the laptop or even on the main PC, so the photographer selects a set of older photos and selects an option to archive them. The next time a connection is established with the backup drive, all versions of archived photos are copied to the backup harddrive and the laptop and the main PC only keep 90% quality Jpeg format picture of the top version of each photo downsized to exactly fit the display resolution of the device. If even that takes too much space then “Archive Only” option is selected which insures that the backup harddrive has the copy of the photo and then erases it from primary data stores completely.
20. When the backup harddrive is connected it is also very simple to make DVD/HDDVD/Blueray backup copies of subsets of photos from the archive with all the metadata and versions in such a way that other software (and even dedicated media devices) could easily browse the top versions of photos directly from the backup media. Of course, restoring from such backups also must be tested.

So, to summarise, the changes needed for F-Spot are:

• Support for the concept of staging areas and staging area manipulation
• Much better performance on import
• Camera timestamp correction tool (#)
• Quick rating tool (#)
• RAW support for controlled conversion and automatic conversion at export (#)
• Support for external editor with automatic version control and format conversion (#)
• Noise reduction plugin support (#)
• Support for version manipulation - join (#, #) and split (#) version stacks
• Preferences for export methods with resize and quality options and automatic enhancement options at export
• Multiple instances and data sync (#)
• Archival support and total archival option
• Backup (also from archive) support (#, #)
• More powerful search and filter options (#) with automatic options from exif data (#): People/Mike AND Events/wedding AND (camera/RebelXT OR camera/SonyF717) AND setting/noflash AND lens/wide

As you can see, many of those issues are already reported to F-Spot bugzilla, but have recieved little attention. So what shall we do about it?

I'm a little behind having seen my last film on Monday, but here we go:

• Arthouse Ultraman ( ): Four episodes of the latest incarnation of Ultraman (think Superman meets Power Rangers), directed by guest directors, including two by Takashi Miike. It's pretty childish show, but these episodes kept me pretty entertained. I doubt the show would in general though.
• The Glamorous Life of Sachiko Hanai ( ): This movie was basically a soft-core porn flick. When it wasn't being that, it was just being completely strange and random.
• The iDol & Sukeban Boy ( ): Some shortish films that weren't that entertaining. Sukeban Boy was mostly an excuse for toplessness. The iDol was only interesting in that it was written and directed by a westerner.
• Train Man ( ): A nerd who finds true love by asking for advice on message boards, apparently inspired by true events. It was a nice story, but the crowd was relating to it a little too much.
• Synesthesia ( ): An interesting concept of people with a condition where there senses are blended, eg you can see sounds, or hear colors. The ending drags too much and is completely confusing and incomprehensible.
• The Five Venoms: Pretty standard Kung-Fu movie plot, but fun action, with those classic animal styles that are silly but somehow still cool. I'll try to find the sequel.
• The Great Yokai War ( ): A child's movie by Takashi Miike, what could be better? This was definitely a kids movie, but it had enough sophisticated humor to keep me interested. Fun movie.
• Executive Koala ( ): A very strange movie with a man-sized koala as an executive, with a world mostly inhabited by humans but with the occasional giant animal person. Bizarre twists and turns of psychology and homicidal koala behavior. A weird one, but somehow compelling.
• Re-Cycle: Had the fortunate chance to see this with the lovely ndusart. An amazing, visually stunning movie by the Pang Brothers. A writer gets sucked into a strange world of her own creation. It's a bit of horror, drama and suspense rolled into one. Highly recommended.

Hello Planet Debian! Goodbye University Vacations!:-)

[Debian]

Thanks to Luk Claes, new translate-docformat was uploaded to fix Policy 7.6 Violation. madcoder has a list of affected packages. During the weekend I work on my packages, I'm waiting for my sponsor to get them uploaded to the archive closing the "adoption process" and fixing a few bugs and lintian warnings. There are some news from the DDTP and no news from the CVS pserver for non-DDs (and unfortunately, in this case: no news, bad news). I also sent a mail do debian-l10n-portuguese about the future of our list, we need to change a few points, create and update documentation, change our coordinators in some areas (they are MIA for quite a while now) and structure the team to be ready for future changes and also to work focused to get as much translations as possible in "etch".

[Life]

That's it... end of my University Vacation. Back to classes, busy schedule for the semester, I hope to manage everything in a very good way, so I can keep up-to-date with my Debian work.

Thanks to Cl ment Stenac (zorglub), my nice AM, this diary now appears in Planet Debian. Two old posts already appeared, but this is the first post that I made being aware that it will appear in Planet. :-) Thanks to Cl ment and Paul Wise.

Continuing the saga of the lost wallet, it turns out that my uneasy premonitions about "Sidney"'s phone message were entirely correct.

He called me up at work, gave me a long spiel about how I should be glad he came from such a "respectful" family, mentioned that "someone" had gone through the wallet and taken the cash, and then asked again if there was a reward. Rude, I thought, but hey, rewards for wallets aren't unheard-of and he is doing me a favor...so I said, sure, I'll give you $20. There was a long pause, and then he said "that's really insulting, you know?" Taken aback, I asked what he was thinking of, and he said that he was thinking of more like a few hundred dollars.

A FEW F**ING HUNDRED DOLLARS?

That isn't quite what I said, I just said "No" and "I don't know what makes you think that's a reasonable amount." At this point he started asking again about "don't you want your wallet back?" and making vague threats about what would happen if it got into the "wrong" hands. I made one mistake, raising my bid to $40 (I shoulda just cut him off there), but finally told him I had to get off and get to work. He wouldn't give me a number to contact him at but said he'd call me later.

So, at this point it was obvious that a pretty nasty character had my wallet, so I double-checked that all my important cards were cancelled and started ordering duplicates of the remaining ones. I called my apartment manager (since my provisional license had my home address on it) and warned them to keep an eye out for suspicious people hanging around my apartment, just in case.

I did try calling the police; however, they were just as useless as you'd expect (considering I didn't know how to get in touch with the wannabe extortionist). The only thing they could suggest was that I try making arrangements to collect the wallet, then arrange to have a police officer arrest the guy when he showed up. Given the fact that I have no actual evidence of the extortion, though, I figured the main result would be to leave someone that I already know is a bad character, and who has my personal information and address, a grudge to hold against me. Not a good long-term move.

What depresses me most about all this is that "Sidney" is far more representative of the average person than I am, or (I assume) most readers of my blog; and he may very well be better adapted to the world than I am. People suck, life sucks, and the world sucks; I should be grown-up enough at age 25 to not care by now, but I still do. :-(

Well, I haven't been much active blogging these days. I indeed was quite busy at work with a reorganization taking place in my department and a few more responsibilities to have for me. My biggest holidays of the year begin right now. I'll leave today and visit my mom and my sister's family in the region of St-Etienne, in France. Then back home three days later and we will leave for a 18-days trip in Mexico on Thursday. This year is my mexican year..:-) That means a 3-week break in mail and Debian activities. See you in late August with, hopefully, a new beta of the installer which will have been released by our tireless release manager Frans Pop. I will come back and the base system will already be frozen and all of us on our way to the Etch release. Great. Hugs to those of you I use to hug and kisses to others!

Pictures of weird statues from around the world, pointed out by Danamania.

How good is Linux as a tool for the uninitiated, really? When journalists review Linux, they usually concentrate on the initial installation experience. Given their deadlines, that's logical: they don't often have time to spend months on using it, so installation is all they have time for. I wanted to know how good Linux, or more specifically Debian with GNOME, is for the uninitiated, or more specifically, for someone who has been using Windows for a number of years, and switches to Linux. I'm specifically uninterested in the installation experience. To see what it is like, I recruited a friend of mine, and gave her my old laptop with Linux pre-installed and pre-configured. She has agreed to try switching all her computer use to Linux, and tell me about any problems she has. We'll do this for several months, to make it realistic. Anyone can suffer through a week in a new computer environment. She's now used Linux for a bit over a week. The initial session, when she tried out the new computer at my home, went pretty well, with only a couple of real problems. Here's an edited version of the notes I made:

Bringing up the network (the laptop is configured to use NetworkManager): She found the networking subfolder of the computer folder in GNOME: "Why does it say 'Windows Network'? And why is that empty?". Later: "Why does 'Network tools' not configure the network?". She doesn't know if configuring network in Windows would be as bewildering, never having done it. She can't find anything useful about network configuration in the GNOME help system. Eventually I point out the Network Manager icon in the notification area. She selects a wireless network to connect to and enters the WPA password I give her. She then gets the GNOME Keyring dialog and doesn't understand what it is, wondering why she needs to give the WPA password a second time. She then proceeds to open some windows. "Minimization works, good." She is happy that there is a task bar at the bottom of the screen, and happens to find the "Show desktop" button there as well: "Oh, you can hide all the windows here if you have many." She finds mplayer and thinks it looks OK. She comments that she doesn't really care what player she uses, she uses several under Windows, too, and all of them have quirks. XChat has too many networks to choose from at startup. She's never had to choose an IRC network before, IRCnet being the default for Mirc (or the Mirc installation she has, anyway). She wonders why XChat didn't ask for a server to connect to after selecting the right network (XChat has a lot of servers configured for each network and chose one of them). She continues to configure XChat: "Oh Lord, NO spell checking." She finds the color selector in XChat (the GNOME or GTK+ default one) to be very confusing. The "Nicks not to highlight on" setting is bewildering, does it mean that XChat highlights by default all nicknames, even for other users? She'd like "shut up completely" setting for XChat sounds. Giving ops from a popup is intuitive. XChat in general seems intuitive to her. Next, Bittorrent, using the GNOME torrent downloader. The .torrent file is saved directly to the desktop, which is good. The downloaded file goes there too, which is good, too. Seems intuitive enough, but doesn't seem to have very many settings: it would be nice to be able to prioritize different parts of a multi-file download. She also can't get it to continue a download after restarting the client (possibly related to multi-file torrents). Next, OpenOffice.org. The Windows version doesn't split up into Base, Writer, Impress, etc, but finding the interesting one (Writer) is no problem. That Abiword was installed, too, was a bit confusing. Totem: space doesn't play/pause (except in full screen mode). Sound volume control is a bit confusing, since it has to be done using multiple slidebars (master, pcm, etc) in the GNOME sound control dialog, and also in Totem. After maximizing Totem, quitting it, restarting it, the window is now as big as the whole desktop (minus top and bottom panels), so maximizing and un-maximizing doesn't seem to have much effect, which is weird.

Other problems have surfaced since. The big one was that I had configured a simple firewall for her that didn't let anyone connect to her laptop, meaning that torrenting was not working very well. I use the same firewall settings on my own laptop, but since I mostly torrent for Debian's ISO images, and those have really fast seeders, I've never noticed that I don't torrent outward. Ah well. She also doesn't like the GNOME torrent client very much. It lacks ways of monitoring and controlling the torrenting process that she cares about: seeder and peer counts especially, or (but less importantly) changing the order in which parts of a multi-file torrent are downloaded. We tried installing Azureus, but the version in Debian etch at the time seems quite broken. Firefox seems to occasionally also work very badly for her, taking tens of seconds to load pages, but this seems to be a known bug that will be fixed in the next upstream version. We'll upgrade when we can, and hope that fixes it. Firefox's default font size was too small. Same for the default window size. And sometimes, maximizing the window still doesn't make the contents become bigger (but it works under the Windows version of Firefox). I haven't seen this myself yet, but if I do and can replicate it, I'll file bugs. Another problem that was due to my bad installation: I had forgotten to install acpid, so every time she booted, she got an error message saying "Can't access ACPI events in var/run/acpid.socket". Her exact words when reporting this were: "I don't want to know. Really, I don't. But, just in case you do." That's it for now. I may write an updated report later, if there's any interest. (For the curious, I'm intentionally not naming her, to let her try the experiment in peace, rather than getting her mailbox full of well-intentioned advice on things to try or do.)

A month between postings. Who needs regular updates? I've got a few of these weekend weeviews piled up, so I'm going to do them two at a time every couple of days. Omega Man Charleton Heston makes this post-apocalyptic world view quite the masterpiece. Considering his current stance on guns, it is easy to throw a couple of cheap shots at the movie in which he plays a gun-crazed doctor. Thinking you're the only one left in existence has got to be pretty hard on the psyche, and it shows in the character. Robert Neville (Heston's character) obviously doesn't think he's really alone, just the only one left who shouldn't be shot on sight. The rest of the human race was hit by a crappy plague, 28 days later-style. This plague apparently doesn't kill all brain functions, but only crams you into a religious sect which could only be described as luddite. Movies aren't interesting without a love interest, so Heston finds out early about Lisa (Rosalind Cash) who is keeping a set of children who are immune. Robert is also immune, and hopes to create a serum from his blood. This 70's end of the world is remarkably watchable, although it has it's moments of Action Movie. The acting is well done, although the cult of luddites is somewhat overplayed and has strange overtones of vampirism for some reason. Omega Man gets a 7. (imdb, amazon) Conquest of the Planet of the Apes As a child of the 80s, I never saw any of the original Planet of the Apes movies, and always assumed they were campy and not well done. Imagine my surprise when I discovered that they actually have a plot and are interesting. This fourth movie in the series of 70s movies presents it's moral message with a generous heaping of.. it's moral message. Years after his parents travelled backward in time in Escape from the Planet of the Apes, Caesar, the only talking ape left, is incognito with the circus master who raised him and comes to the city for the first time. At this time the plague which killed all pets has already ravaged the nation, humans have decided that apes are more useful as slaves than pets, and already have a large monolithic "Ape Management" section of government. Caesar gets thrown through the system when his "owner" gets brought into questioning for.. questioning the treatment of an ape. Being highly intelligent, he quickly gets snatched up for his skills by a top government official. Starting an underground resistance movement is the next step, and dominos start to fall from there. Conquest.. then degenerates into a large-cast action film, with hundreds of extras in a street-level ape vs. human fight. It's not the most interesting movie ever, but considering my expectations I can happily give it a 6. (imdb, amazon)

See Dr Dave Blog Archive Critical Announcement affecting ALL Wordpress users. I don’t know if this is a hoax or for real, but since the price for believing this in the first case is merely a slight embarrassment, I’m taking this advice.

I've been working on some introductory slides on SELinux. They're still far from finished. All I've written so far is some basic terminology, identities, roles, types. I also tried to show how this increases security, though that part is probably still hard to understand unless you know about common attack vectors. I havn't yet written about the actual policy, policy modules, all the fancy UI stuff available, reachability analysis etc. I probably will not do so: The goal of the slides is not to give an exact overview over how SELinux works, how to write good policy etc. I also don't claim to have all facts right - instead I want to provide an easy to understand overview over how SELinux works and why it is a good thing. I guess I won't even be flaming AppArmor. ;-) Thats why I picked the name "gentle introduction to SELinux". Remember, it's just a work in progress, "the best is yet to come". I really need your feedback (and encouragement -- there is still so much to be written). Get the slides as PDF here. Feedback is best via email -- erich AT debian DOT org. I intentionally do not have comments in my blog.