When I created my
on-line photo album, we had the year 2001 and there was nothing wrong with publishing ones photos in the Internet. It has been almost ten years now, and things have changed. Privacy is an issue, especially when it also affects your friends and family.
The problem
So I needed to find some protection. These were my requirements:
- I only want to protect parts of the site, as there are some pictures that I intentionally share with the public. This selection should be possible down to the individual image.
- The solution should work without any dynamic server component besides the web server itself. This rules out any self-written CGI scripts as well.
- One password, given to all my friends etc., is not sufficient as it might leak to unintended audience.
- I do not want my visitors to have to register and remember yet another username and password just for my site. I also do not want to manage this user database.
- I do not want to have do large changes to the file structure of my photo album.
This rules out most common options, e.g. protection by a
.htpasswd file. Requirements 3 and 4 point to a solution based on
OpenID. With OpenID, my visitors can authenticate against a service they already use (Google, Yahoo, etc.), relieving me from the burden of maintaining a user database and them from having to remember a password.
There is a
mod_auth_openid module for the Apache webserver, and it is even distributed with Debian in the
libapache2-mod-auth-openid package. So requirement 2 is fulfilled. The tricky part is: How do we achieve OpenID protection for some images, and not for others.
The solution
I first played around with selectively enabling or disabling mod_auth_openid based on
<FileMatch> directives in the Apache configuration, but it was not elegant and would not scale well. I have more than 20.000 pictures to manage, and have already selected over 5000 pictures to be shown without protection. My solution is based on a partial copy of the whole directory tree that contains all public files. To save disk space, these are just symbolic links to the real file in the protected location. Some
mod_rewrite magic then takes care of giving the user the impression that all files are in the same location. I set up
a small example of my solution, which has this directory structure:
.:
drwxr-xr-x 2 root root 4096 2. Aug 12:03 images
lrwxrwxrwx 1 root root 18 1. Aug 12:05 index.html -> private/index.html
lrwxrwxrwx 1 root root 18 1. Aug 12:05 login.html -> private/login.html
drwxr-xr-x 3 root root 4096 2. Aug 12:03 private
./images:
lrwxrwxrwx 1 root root 33 2. Aug 12:00 pleaselogin.png -> ../private/images/pleaselogin.png
lrwxrwxrwx 1 root root 28 2. Aug 12:03 public.png -> ../private/images/public.png
./private:
drwxr-xr-x 2 root root 4096 2. Aug 12:00 images
-rw-r--r-- 1 root root 267 2. Aug 12:03 index.html
-rw-r--r-- 1 root root 94 2. Aug 12:01 loggedin.html
-rw-r--r-- 1 root root 2091 2. Aug 12:03 login.html
-rw-r--r-- 1 root root 10 18. Nov 2009 protected.html
./private/images:
-rw-r--r-- 1 root root 4074 2. Aug 11:58 pleaselogin.png
-rw-r--r-- 1 root root 2670 2. Aug 11:58 private.png
-rw-r--r-- 1 root root 2043 2. Aug 11:58 public.png
As you can see, real files only reside in
private/, outside of that, only symbolic links exist.
The apache configuration protects the private directory and blends it into the main directory:
<directory /var/www/nomeata.de/openid-test>
RewriteEngine On
# Abuse the login page as an error image
RewriteCond % QUERY_STRING \.(png jpg)
RewriteRule ^login.html$ /openid-test/images/pleaselogin.png
# Ship private files, if they exist, unless public files exist
RewriteCond $1 !^private
RewriteCond /var/www/nomeata.de/openid-test/$1 !-f
RewriteCond /var/www/nomeata.de/openid-test/private/$1 -f
RewriteRule ^(.+)$ /openid-test/private/$1
</directory>
<directory /var/www/nomeata.de/openid-test/private>
AuthOpenIDEnabled On
AuthOpenIDDBLocation /var/lib/apache2/mod_auth_openid/mod_auth_openid.db
AuthOpenIDLoginPage /openid-test/login.html
AuthOpenIDTrustRoot http://nomeata.de
AuthOpenIDCookiePath /
AuthOpenIDCookieLifespan 2592000
</directory>
A special trick handles the login page for protected images: If the login page is requested and the referrer indicates that the user tried to access a
.png or
.jpg file, apache will instead ship an image containing an error message.
For my photo album I have a small Perl script that, given a directory with a
private/ directory therein and a list of rules in form of
glob patterns, will symlink matching files and remove symlinks that are not allowed any more.
What s next?
As you can see, this does not actually protect the content. It only requires the user to authenticate, then everything is visible. To select which OpenIDs are allowed to access which code,
some bugs will have to be fixed in mod_auth_openid first. There was little activity there recently, I hope that the project is not dead.
Just noticed about an hour ago on debian-announce: Squeeze entered into freeze tonight. Hurray! What this means in practice is that, unless a new version of something fixes a serious bug, it will not be allowed to trickle down from Sid into Squeeze on time for the actual release.
Still, I cannot help but feel sad that it happened just a few days short of upstream releasing the Geode 2.11.9 driver for X.org, because AMD recently committed a lot of resources towards fixing all outstanding issues on this driver and yet one major Linux distribution is about to release without those fixes, unless the Release Manager agrees to let us squeeze 2.11.9 into, well, Squeeze. Doable? Possibly, if enough people calmly ask the Release Manager for it.
After Arjuna Rao Chavala successfully completed enough of D-I
translation, I just activated support for the Telugu language in
Debian Installer.
Given the currently planned released, that will be available in the
next release, so hopefully for Squeeze.
Telugu is spoken in Andhra Pradesh, one of the largest states in
India, on the south-eastern coast of the country. The main city of
Andrha Pradesh is Hyderabad, the 6th largest city of India. Telugu is
the third most-spoken language in India, with about 74 million native
speakers.
As of now, out of the 29 languages in India with over 1 million
speakers, we do support 9 of them that represent over 70% of the
population of India. We indeed now support the five most spoken
languages in India (of course, all this by excluding English).
I've got a pretty packed August.
I just wrapped the 
Science and Math Track at DebConf10
This year's 
In the evening today (Tuesday), the Debconf organizers arranged for a screening of the Creative Commons licensed film "Sita Sings the Blues" by Nina Paley. I went to see it as I had missed it when it was first released among tales of trials and tribulation at the hands of copyright meanies.
So first let me say yay Free Culture!, boo Intellectual Property! etc. etc. Now we have that out of the way...
"Sita Sings the Blues" has two main narrative threads: The breakup of Ninas relationship with her boyfriend and the Ramayana particularly a story from the uttarakanda about how after Shri Rama returned from Lanka, Sita had to undergo the agnipravesha to prove her chastity and even after she passed that test was eventually banished to the forest. I had an adverse reaction to this film. In fact I stayed to the end to be polite but I left afterwards as soon as I could. I had almost a physical feeling of nausea and I was surprised by this. Since then I have been pondering why this is so.
It's not that its blasphemous. Shri Rama is not just a "perfect man", he is God (an avatar of Vishnu Bhagavan as is briefly touched upon in the film) for millions of people so, well, yes it is blasphemous but its more Rowan Atkinson style rather than Norwegian Black Metal style blasphemy. One never gets the impression that the author hates Hinduism or Indian culture the opposite in fact. And in fact it is not uncommon in our culture to speak of Sita and Rama in this way. They are not remote authority figures but as familiar to us as our own friends and family and the Ramayana is not just about events that happened long ago it is relevant to our lives right now. Even the "good woman done wrong by big dumb male jerk" narrative is not unknown. (See the Uttararamacharita of Bhavabhuti for instance.) though I would suggest reducing the Ramayana this way is akin to treating the Hitchhikers Guide to the Galaxy as a book about towels.
Even the milder criticism that it is not accurate is offbase because although the Sanskrit poem by Maharshi Valmiki is the canonical rendition of the Ramayana, there are other well-known versions. Not just in Sanskrit, the Hindi retelling by Sant Tulsidas called Ramacharitamanasa is more popular than Valmiki. Also speaking as someone who has preached Ramakatha "professionally" I can tell you that even the priests do not stick to the letter of the text. It is encouraged and expected that they will riff on the basic stories adding or removing details according to the needs and taste of the audience. And the device of the three narrators made me smile as this is exactly the kind of discussions that go on after hearing the Ramakatha. (I must say Paley picked a notably illiterate trio though.) One place where this fell flat was when they discussed the alleged discrepancy between Sita living simply in the forest and dropping a trail of jewellery on the way to Lanka. Although I can imagine someone at some point saying, "Do not question these stories" not at this point. Even the most retarded westernized Indian would know that removing ones ornaments is a sign of widowhood. A married woman would only do that in extremis certainly not just merely because she was a hermit. In a few cases some extra details might have helped the story. It was not explained that Ravana does not just have rakshasas in his command but he is one himself. (And he certainly wasn't a good guy until one day he got up and kidnapped Sita.) Shri Ramas brother Lakshamana accompanied the couple into the forest to Lanka and back but he only pops up (for no apparent reason) at the end. But look at me, I'm turning into one of those people who rant about Star Trek continuity errors or complain that the Romans in a gladiator movie have the wrong helmets for that time period etc. One has to cut a storyteller some slack and I entered the screening determined to be charitable.
It's also not because I don't really see much connection between the two stories. Getting dumped by someone who simply loses interest in you hardly seems equivalent to being trapped by a moral code that doesn't allow for individuals feelings. Paley could have easily made "Princess Leia Sings the Blues" and it wouldn't have changed the significance much. But in India people make far more tenuous connections between the epics and events in their own life so one can hardly complain about that.
Aesthetics are not the problem either. The first version of the Ramayana I ever read was the Amar Chitra Katha comicbook version which partly influenced the visual style of this film. (In fact you briefly see it in one scene when different editions of the Ramayana flash by.) Hindu popular culture is very gaudy. (See Ramanand Sagars '80s Ramayana Hindi TV serial, which was very reverential, insanely popular and tacky beyond belief.) The animation in this film is very good and quite artistic.
"So Jaldhar", you might be asking if you've read this far, "what exactly is your problem with this film?"
I have read the Valmiki Ramayana in Sanskrit with the commentaries from beginning to end. I've read other Ramayanas in Sanskrit, Gujarati, and English. I have read the comicbook, I've read anti-Ramayana polemics. When you learn Sanskrit in the traditional way the first lesson, in the declension of masculine gendered nouns ending in vowels is rAma.h rAmau rAmA.h ... I am well aware there are different emphases, different interpretations in various versions. Why can't I accept this as just another take on a story that has shown its fluidity over and over again? It's just...wrong on a subrational level. How can I put this? Imagine you are flipping through the TV channels and you see your grandparents amongst Lady Gaga's backup dancers. Or you came home one night to find everything that was on the floor meticulously glued to the ceiling. Over the course of my life (to hear my mother tell it my first exposure to the Ramayana was before I could speak.) I have developed a mental bond with this story a certain idea of how it should be. I think so has Nina Paley. And this is the problem. "Sita Sings the Blues" is Nina Paleys Ramayana not mine.
Again, there's been this surreal time warp effect. 3 months has passed, and it
feels like both a long time and a blink of an eye. It more feels like a long
time though. I've mostly forgotten what it was like before Zoe came along.
Zoe is growing well. She weighs around 11 lbs 11 oz (5.3 kg), and I swear she's
getting very long. When I'm holding her in my arms, there's legs everywhere.
She started being able to roll from her stomach onto her back at 2 months, and
her neck strength is pretty good now. I guess her next significant milestone
will be being able to sit up properly. When she's on her tummy, she can prop
herself up on her elbows and look around. She smiles all the time.
We had a few nights of 8 hours of sleep, then everything went completely out
the window, and we had about a week of very disrupted sleep at night. I think
she's starting to settle into a routine now though, with a few 5 hour stints
the last few nights.
Her US passport arrived yesterday. We still need to get everything together to
lodge her Australian citizenship application, which is the first step towards
getting her an Australian passport.
Sarah's back studying now (two subjects this semester), which is proving to be
a bit of a juggling act.
If you have seen me anywhere near my computer at DebConf, you probably have seen the face of a hurried, worried developer. Still, if you monitor my Debian-related activity, you will notice it is still quite low, even given my (much needed and very much enjoyed) vacations pre-DebConf. Yes, orga-team work is very time consuming, even if my role is far from central this year. And yes, DebCamp+DebConf are known for sucking time into social interaction, which is great but not so (formally) productive. And yes, I even took 1.5 days off to visit my family and a friend who live in the area...
Still, I managed to release! \ /
Release what?
I have been working with 
I have been quite busy the few last months. But anyway, I found time and solved various technical pitfalls to be able to bring you the first movie of the OCaml Meeting: