Search Results: "will"

4 July 2010

Christine Spang: Christine Spang: [h]ledger rocks my world

I hate keeping track of money. Bank accounts, credit cards, investing it's such a hassle. Hell, sometimes I even hate the fact that money exists and needs to be dealt with in the first place. But I admit that it's an easier system than bartering for everything. In college I pretty much ignored most things financial. I rarely had more money than I needed, and put little financial planning into deciding what I could and could not spend money on besides, "I'm going to make X dollars this summer," and, "think twice." But now that I have a steady paycheck, it seems like a good idea to know where all my money goes, so I can make better decisions about how I'm spending (and saving) it. But I've kept procrastinating starting to do so, because GUI programs like Gnucash and HomeBank seem like such a hassle. Their first screen is dauntingly complex, and if you don't know much about accounting it's scary and difficult to be asked to set up a big set of accounts when first starting to use the program, without having any prior experience with what you personally would find useful to keep track of. Entering data through menus and dialogs is tedious and slow. hledger (or ledger, which came first) had been appearing on my radar recently, not least because Iron Blogger uses it). hledger changed my opinion of accounting software. In about 15 minutes, using only the sample transactions from the manual, I was able to enter all my assets and liabilities bank accounts, credit card, student loans, money I've borrowed from people and never paid back though I said I would, etc. And then, I could run 'hledger balance' and it would tell me what sorts of things I had spent money on in the past few days, as far back as I could bother looking up actual transactions for, rather than entering a single transaction with a balance forward. Duuude, awesome! I'm a geek. I like statistics and data about my life, as long as it's not a huge pain to collect the data in the first place. More data means more on which to base decisions, decisions which will then be freer from the bias of what I find memorable enough to remember having done. Here's what I like best about ledger: I don't think I'd be enjoying keeping track of my money nearly so much without a tool like hledger. It gets out of your way to let you focus on the hard things, like choosing categories for the things you spend money on and remembering to record the data in the first place.

Cyril Brulebois: We need *you*! (redux)

We need you! (redux) The X Strike Force needs you! (redux) This time, the focus is on the xserver-xorg-video-intel driver. KMS and UMS are going to be used heavily below, one may want to check the mode-setting wikipedia article and the modesetting page on X.org. Intel follows a 3-month cycle for its video driver releases. Some comments on the last ones: It d be nice to have users install 2.12 from experimental and see how it goes from here. If regressions are found, we should be able to try hard(er) to get them fixed, so that we can move 2.12 to unstable and release with it. If there are too many of them, and if they re not going to be fixed on time, we might stick with 2.9. Pulling the driver from experimental should be quite easy: libdrm* packages are going to be upgraded, but that s mostly it (meaning the server itself will stay the same, and rolling back should be as easy as downgrading the driver and the libdrm* packages). A note on KMS and UMS: a benefit of sticking with 2.9 was being able to switch back to UMS in case KMS wasn t usable for some cards. Unfortunately, popular/well-spread cards like i8xx aren t well supported yet, that s why Chris Wilson (upstream) is considering introducing UMS support again for that kind of blacklisted cards. This way, it should be possible to move to 2.12 (including Chris work) without leaving some users behind. Feedback appreciated as follows: Thanks already!

3 July 2010

Jordi Mallach: Cinema d'Estiu in Benimaclet 2010

Like other years, Benimaclet's Neighbour Association has organized a new cycle of film projections for the neighbours, by the neighbours, with the intention to get people out of their homes and share a good time with many others. Like in the other two editions, the selected films try to deliver a message to the viewers, and this year the topics are centered about labour and migration social issues. A change in this year's edition is that there will be one more projection, for a total of 5 films, every Sunday of July, at 22:00 in the Pla a de Benimaclet. Last week, we saw El viaje de Teo, a Mexican film describing the migration dramas going on in the Sonora Desert. This Sunday, we'll see Arcadia, which will be followed by Recursos humanos, Hijos de los hombres and La estrategia del caracol. Before each film, some local artists will perform live for us. Make yourself a sandwich, bring a chair to Benimaclet and enjoy some good cinema with your neighbours every Sunday in July!

Petter Reinholdtsen: Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop

Here is a short update on my my Debian Lenny->Squeeze upgrade testing. Here is a summary of the difference for Gnome when it is upgraded by apt-get and aptitude. I'm not reporting the status for KDE, because the upgrade crashes when aptitude try because of missing conflicts (#584861 and #585716). At the end of the upgrade test script, dpkg -l is executed to get a complete list of the installed packages. Based on this I see these differences when I did a test run today. As usual, I do not really know what the correct set of packages would be, but thought it best to publish the difference. Installed using apt-get, missing with aptitude
at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin libgtksourceview-common libpt-1.10.10-plugins-alsa libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip python-4suite-xml python-eggtrayicon python-gtkhtml2 python-gtkmozembed svgalibg1 xserver-xephyr zip
Installed using apt-get, removed with aptitude
bluez-utils dhcdbd djvulibre-desktop epiphany-gecko gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50 libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3 libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9 libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3 libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9 libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2 libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0 libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0 libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50 libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10 libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4 libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5 libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3 libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8 libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1 libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3 mysql-common swfdec-gnome totem-gstreamer wodim
Installed using aptitude, missing with apt-get
gnome gnome-desktop-environment hamster-applet python-gnomeapplet python-gnomekeyring python-wnck rhythmbox-plugins xorg xserver-xorg-input-all xserver-xorg-input-evdev xserver-xorg-input-kbd xserver-xorg-input-mouse xserver-xorg-input-synaptics xserver-xorg-video-all xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati xserver-xorg-video-chips xserver-xorg-video-cirrus xserver-xorg-video-dummy xserver-xorg-video-fbdev xserver-xorg-video-glint xserver-xorg-video-i128 xserver-xorg-video-i740 xserver-xorg-video-mach64 xserver-xorg-video-mga xserver-xorg-video-neomagic xserver-xorg-video-nouveau xserver-xorg-video-nv xserver-xorg-video-r128 xserver-xorg-video-radeon xserver-xorg-video-radeonhd xserver-xorg-video-rendition xserver-xorg-video-s3 xserver-xorg-video-s3virge xserver-xorg-video-savage xserver-xorg-video-siliconmotion xserver-xorg-video-sis xserver-xorg-video-sisusb xserver-xorg-video-tdfx xserver-xorg-video-tga xserver-xorg-video-trident xserver-xorg-video-tseng xserver-xorg-video-vesa xserver-xorg-video-vmware xserver-xorg-video-voodoo
Installed using aptitude, removed with apt-get
deskbar-applet xserver-xorg xserver-xorg-core xserver-xorg-input-wacom xserver-xorg-video-intel xserver-xorg-video-openchrome
I was told on IRC that the xorg-xserver package was changed in git today to try to get apt-get to not remove xorg completely. No idea when it hits Squeeze, but when it does I hope it will reduce the difference somewhat.

Joerg Jaspert: ftp-master.debian.org move to another machine

As I wrote to d-d-a this morning, we are currently moving the ftp-master service from ries to franck. At the same time the release team moved their service over too. This was going on whole day, and we are still not done. There are bits and pieces we still have to check, but it is looking good. The new machine is also much much faster than the old one, for most of the tasks. For one it has 4 times the amount of CPU, double the RAM, but also something like a million times the disks. Well, not a million times, but it has much more storage on many many more disks. From the current state I think we will have the service fully back to normal level tomorrow, Sunday.

Kees Cook: gdb turns off ASLR

Starting with GDB version 7, first appearing in Ubuntu with Karmic (Ubuntu 9.10), ASLR is turned off (via the ADDR_NO_RANDOMIZE personality flag) for the debugged process. If you want a more realistic view of how a process will appear in memory, you must set disable-randomization off in gdb:
$ gdb /usr/bin/something
...
(gdb) show disable-randomization
Disabling randomization of debuggee's virtual address space is on.
(gdb) start
...
(gdb) ^Z
$ cat /proc/$(pidof /usr/bin/something)/personality
00040000
$ grep 0040000 /usr/include/linux/personality.h
    ADDR_NO_RANDOMIZE =     0x0040000,  /* disable randomization of VA space */
$ fg
(gdb) set disable-randomization off
(gdb) show disable-randomization
Disabling randomization of debuggee's virtual address space is off.
(gdb) start
...
(gdb) ^Z
$ cat /proc/$(pidof /usr/bin/something)/personality
00000000

Peter Eisentraut: Increasing the priority of Debian experimental

Many people run Debian testing or unstable or some mix thereof. This works pretty well for a development system or a general desktop system if you know a bit about what you're doing (note: nonetheless officially not recommended). Sometimes you throw packages from experimental into the mix, if you want to get the latest stuff that isn't yet fully integrated into the rest of Debian.

The default APT priority of the Debian experimental release is 1, which ensures that it is never automatically installed or upgraded. This is not always ideal, in my experience. Of course, you don't want a package from experimental to take precedence over a package from stable, testing, or unstable by default. But I think when you have in the past installed a package from experimental, you probably want to pull in upgrades to that package from experimental as well. Otherwise, you will end up with completely unmaintained packages on your system. That is because in practice many packages in experimental are not actually experimental or broken or unmaintained, but just an advance branch of some software that is just for some reason not ready to go down the unstable-testing-stable road.

To make this work better, I have set the priority of experimental to 101 in my /etc/apt/preferences:
Package: *
Pin: release experimental
Pin-Priority: 101
Now the following will happen: If you just apt-get install a package, it will come from whatever "normal" release you have in your sources.list, say stable or testing. You can override that using -t experimental as usual. If you install a package from experimental and later an upgrade is available in experimental, apt-get upgrade will install that automatically. Also, if an upgrade in a "normal" release appears that has a higher version number, that version will be installed.

Of course, caveats apply. Some software in experimental is really experimental and should only be installed under close supervision. If a package is available only in experimental, this setup will install it when you ask for the package, even if you might not have actually wanted it if you had known that it was in experimental. Figure it out yourself. :)

Similar considerations apply to backports. I use
Package: *
Pin: release a=lenny-backports
Pin-Priority: 102
On the system I have in mind here, the standard distribution is stable, testing is 101, and backports is 102, taking precedence over testing. Because for some architecture-independent packages you don't need backports, so you can pull them directly from testing that way.

In general, the APT priority business is relatively powerful and often a good alternative to, say, manually downloading packages from various distributions, installing them manually, forgetting where they came from, and never upgrading them.

2 July 2010

Colin Watson: GRUB 2: With luck ...

... this version, or something not too far away from it, might actually stand a chance of getting into testing. I've just uploaded grub2 1.98+20100702-1. The most significant set of changes in this release is that it switches /boot/grub/device.map and the grub-pc/install_devices debconf question over to stable device names under /dev/disk/by-id (on Linux kernels). The code implementing this is reasonably careful, and it should make it quite difficult for people to accidentally fail to upgrade their installed GRUB core image; I explained the problems that tends to cause in the previous post in this series. There will probably be a few small glitches I need to clear up, but I've given this much more extensive testing than usual so I hope I won't break too many people's computers (again). I did this work first in Ubuntu as one of my major goals for 10.04 LTS, which exposed a few problems that I wanted to fix before inflicting it on Debian as well (fixes for those are now under testing for 10.04.1). Most significantly, I felt it was necessary to start offering partitions in the select list for grub-pc/install_devices, but I went a bit overboard and offered all partitions in a giant list. This seemed like a good idea at the time, but it tended to confuse people into just selecting everything in the list, which in particular tended to make Windows unbootable! So I dialled that back a bit, and in the version I just merged it will only offer the partitions mounted on /, /boot, and /boot/grub (de-duplicating if necessary). This seems like a reasonable compromise between confusing people too much and forcing them to install only to MBRs. My next priority will be making whatever fixes are necessary to get this version into testing, since the problems with /dev/mapper symlinks in testing aren't getting any less urgent, and this is finally a version that shouldn't break for most people due to the kernel's switch to libata. I expect that I'll try to get mdadm 1.x metadata sorted out immediately after that. Other improvements since my last entry have included:

Gunnar Wolf: Debian by its numbers, as seen by keyring-maint

At keyring-maint, we got a request by our DPL, querying for the evolution of the number of keys per keyring This can be almost-mapped to the number of Debian Developers, Debian Maintainers, retired and deleted accounts over time since the keyrings are maintained over version control. Stefano insisted this was more out of curiosity than anything else, but given the task seemed easy enough, I came up with the following dirty thingy. I'm sure there are better ways than cruising through the whole Bazaar history, but anyway - In case you want to play, you can clone an almost-up-to-date copy of the tree: bzr clone http://bzr.debian.org/keyring/debian-keyring/
  1. #!/bin/perl
  2. use strict;
  3. my ($lastrev, @keyrings, %revs, $fh);
  4. open $fh, '>growth_stats.txt' or die $!;
  5. @keyrings = sort qw(debian-keyring-gpg debian-keyring-pgp
  6. debian-maintainers-gpg
  7. emeritus-keyring-gpg emeritus-keyring-pgp
  8. removed-keys-gpg removed-keys-pgp);
  9. system('bzr unbind'); # Huge speed difference :-P
  10. $lastrev = bzr revno ;
  11. for my $entry (split /^---+$/m, bzr log )
  12. my ($rev, $stamp);
  13. for my $line (split(/\n/, $entry))
  14. next unless $line =~ /^(revno timestamp): (.*)/;
  15. $rev = $2 if $1 eq 'revno';
  16. $stamp = $2 if $1 eq 'timestamp';
  17. $revs $rev = stamp => $stamp ;
  18. spew('Revision', 'Date', @keyrings);
  19. system('bzr bind')
  20. for my $rev (sort $a<=>$b keys %revs)
  21. system("bzr update -r $rev");
  22. spew($rev, $revs $rev stamp ,
  23. map my @keys=<$_/*>;scalar(@keys) @keyrings);
  24. sub spew
  25. print $fh join(' ', @_),"\n"
And as a result... Yes, I fired up OpenOffice instead of graphing from within Perl, which could even have been less painful ;-) I had intended to leave graphing the data raw (also attached here) as an excercise to the [rl]eader... But anyway, the result is here (click to view it in full resolution, I don't want to mess your reading experience with a >1000px wide image): A couple of notes: Anyway, have fun with this. Graphics are always fun!
AttachmentSize
Debian by its numbers, as seen by keyring-maint62.79 KB
Raw data31.78 KB

Steve McIntyre: Fuse-music, a transcoding filesystem

Now that disk space is cheap, it makes more and more sense to rip music and store it in FLAC format. I used to use abcde to encode directly to Ogg Vorbis, but a while back I decided to re-rip. The disks in the server at home now have lots of hours of music in a nice lossless format ready for easy playback on various machines on the network. However, that's not all I need. I also want to be able to create Ogg Vorbis files for my own music player with limited space. And Jo's Ipod won't play either .ogg or .flac (yay for closed devices!)... At least I now have readily-available original quality music already on hard disk, so I don't need to go and find CDs again. But I really don't want to have to work through my directories of music by hand, re-encoding individually. My solution: write a filesystem that will read in the .flac files and convert to .ogg or .mp3 on the fly. Now I can simply read the files I want off the server (via sftp/rsync/whatever) and it will create them for me! So, fuse-music is my first attempt to do this. It's a simple perl program that works using the perl FUSE bindings to generate a pseudo-filesystem where a tree of .flac files will appear as a tree of .ogg or .mp3 files instead. It's not wonderfully fast (as encoding takes time), but it works. The only major difficulty I have at this point is calculating the sizes of the output files: if I want rsync to work reliably then the reported sizes need to be static and correct. But it's not possible (AFAICS) to predict the size of an MP3 or Ogg Vorbis file without actually doing the encoding and measuring the output size. So (ick!) that's what the code currently does when necessary. It caches the output size in a perl hash DB so the work is only needed once per file; ideally I'd like to not to have to do this at all! If this sounds interesting at all, feel free to have a look at and play with the code: http://git.einval.com/cgi-bin/gitweb.cgi?p=fuse-music.git;a=summary and I'd love to hear your feedback. TODO:

1 July 2010

Russell Coker: libcsoap/libnanohttp

Recently I have been doing a bit of work on libcsoap (the C library for making SOAP XML calls over http) and the libnanohttp library that it depends on. The most important part of my work on it was making it thread-safe with the technique I described in my post about finding thread unsafe code [1]. But I also did some work to make the code faster, reading data one byte at a time is very inefficient. There has been no upstream release of this software for years, email to one of the maintainers bounced and the other one indicated that they are no longer involved in the project. So I m thinking of taking over upstream development. The previous Debian maintainer for the packages in question has recently resigned so I ve taken over the packaging. But for this one I think I can do better work in an upstream capacity, so I d like to get a co-maintainer for the Debian package and possibly someone who will help with upstream work. I would appreciate any offers of assistance with these things.

Kees Cook: reporting all execs

I recently learned about the process event connector, and went looking for an example program that could report all the exec()s that happen on my system to help with debugging things like AC plug/unplug scripts, etc. After cleaning it up and adding some features to do a simple best-effort cmdline reporting, I ve now got a tool that will report every program run on a system:
$ sudo ./cn_proc
sending proc connector: PROC_CN_MCAST_LISTEN... sent
Reading process events from proc connector.
Hit Ctrl-C to exit
event: exec 17514 17514: ls -AF --color=auto (unconfined)
event: exec 17516 17516: date +%H:%M (unconfined)
event: exec 17518 17518: whoami (unconfined)
Change the values show_event, show_seq, show_cpu, show_security_context to set the reporting defaults. Or, if someone is feeling bored, it would rock to add getopt support instead. It seems strange to me that only CAP_NET_ADMIN is needed to get access to this information.

Robert Collins: Subunit and nose

Looks like someone has come up with a nose plugin for subunit excellent! http://www.liucougar.net/blog/projects/nose-subunit In their post the author notes that subunit is not easy_installable at the moment. It will be shortly. Thanks to Tres Seaver there is a setup.py for the python component of Subunit, and he has offered to maintain that going forward. His patch is in trunk, and the next release will include a pypi upload. The next subunit release should be pretty soon too the unicode support in testtools has been overhauled thanks to Martin[gz], and so we re in much better shape on Python 2.x than we were before. Python3 for testtools is trouble free in this area because confused strings don t exist there :)

Leo 'costela' Antunes: Quantum Bogosort

Sometimes Wikipedia shows it even has a somewhat humorous side. My finding it funny may be a product of late night learning sessions and semi-random clicking-sprees, but still, worthy of a chuckle for those with the right (wrong?) inclinations.
Quantum computing could be used to effectively implement a bogosort algorithm with a time complexity of O(n). It uses true quantum randomness to randomly permute the list. By the many-worlds interpretation of quantum physics, the quantum randomization spawns 2^N (where N is the number of random bits) universes and one of these will be such that this single shuffle had produced the list in sorted order. The list is then tested for sortedness (requiring n-1 comparisons); should it be out of order, the computer destroys the universe implementation of this step being left as an exercise for the reader. The only observers will then be in the surviving universes and will see that the randomization worked the first time and that the list is in sorted order. Note, however, that while this algorithm is O(n) in time, permuting the list requires O(n log n) bits of quantum randomness. It also assumes that destroying the universe is O(1) in operation.
Found here.

Thibaut Girka: Fourth GSoC report

This week's report is unfortunately even lesser interesting than the previous week, but it doesn't mean nothing has been done. The main work of this week have been to fix an outstanding bug with the glamo-mci driver. What I'll do next week will depend on the acceptance of my last patches in the OpenMoko kernel tree, but I'll probably submit the glamo drivers upstream. Other than that, I plan to work on flash-installer and uboot-envtools-udeb/uboot-installer, which has already been worked on by Per Andersson, to provide automatic u-boot configuration at the end of the installation process, in a way similar to what is done for GRUB on a regular PC.

Christian Perrier: Care about D-I translation in your language?

If you do, then please read the current status of D-I localization, 3 days before the official end of the string freeze. You should do it particularly if you care about Belarusian, Ukrainian, Hungarian, Tagalog, Kurdish, Croatian, Macedonian, Wolof, Serbian, Welsh. (Brazilian Portuguese was also mentioned in that post but updates happened today and I'm confident that Felipe will soon catchup. Croatian is also likely to be OK as Josip is often updating at the last minute...).

Sylvain Le Gall: 5 years old CD-RW...

This blog post is a kind of followup of a previous blog post about reading 10 years old CD-R. Today, I get a new shiny ASRock ION 330 to play with, in itself this PC has nothing particular. As usual, I begin by using System Rescue CD to check bad blocks on the hard drive, before working with it (badblocks -v -s -w -c 4096 /dev/sda). Once done, I will check the memory (memtest). This is my standard procedure when receiving a new PC. But I don't have my System Rescue CD at hand. No problem, I download it and and write it on an old CD-RW, bought 5 years ago but still sealed into his blister. For your information, this is a Memorex CD-RW 700MB 16-24x. I blank it (wodim blank=all). I write it at speed 16x, because I don't know how to lower the speed. After writing the CD, I re-read it to check everything is fine (readom dev=/dev/cdrw1 f=test.iso). Ooops:
$ readom dev=/dev/cdrw1 f=test.iso
[...] 
Errno: 5 (Input/output error), read_g1 scsi sendcmd: no error
CDB:  28 00 00 01 3C 00 00 00 40 00
status: 0x2 (CHECK CONDITION)
Sense Bytes: 70 00 03 00 00 00 00 0A 00 00 00 00 11 05 00 00
Sense Key: 0x3 Medium Error, Segment 0
Sense Code: 0x11 Qual 0x05 (l-ec uncorrectable error) Fru 0x0
Sense flags: Blk 0 (not valid) 
cmd finished after 6.614s timeout 40s
readom: Input/output error. Cannot read source disk
readom: Retrying from sector 80896.
.............
readom: Error on sector 80908 corrected after 9 tries. Total of 0 errors.
..............---
OK, I re-blank it (wodim blank=fast) and rewrite it. The CD seems to be readable this time. But when I try to boot with it my new ASRock, it fails. Enough is enough, I get an heavy used Verbatim 8cm CD-RW. Just to show you how old he is: the first ISO written on it was "Debian Sarge". And the magic happens: it works on the first try!!!! You will probably think that I work for Verbatim. This is not true but I must admit that first-price CD-RW/CD-R seems to be very low quality and don't hold data in time. This is probably related to the chemical compounds of the CD. The failing Memorex CD-RW will end up in a trash and I will continue to use my 5 years old Verbatim CD-RW. Dear reader, in order to find a way not to dump this failing CD-RW, do you know a way to make it to work? What you should now about the failing CD-RW:

Petter Reinholdtsen: Caching password, user and group on a roaming Debian laptop

For a laptop, centralized user directories and password checking is a bit troubling. Laptops are typically used also when not connected to the network, and it is vital for a user to be able to log in or unlock the screen saver also when a central server is unavailable. This is possible by caching passwords and directory information (user and group attributes) locally, and the packages to do so are available in Debian. Here follow two recipes to set this up in Debian/Squeeze. It is also possible to set up in Debian/Lenny, but require more manual setup there because pam-auth-update is missing in Lenny. LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir This is the traditional method with a twist. The password caching is provided by libpam-ccreds (version 10-4 or later is needed on Squeeze), and the directory caching is done by nscd. The directory lookup and password checking is done using LDAP. If one want to use Kerberos for password checking the libpam-ldapd package can be replaced with libpam-krb5 or libpam-heimdal. If one is happy having a local home directory with the path listed in LDAP, one can use the pam_mkhomedir module from pam-modules to make this happen instead of using libpam-mklocaluser. A setup for pam-auth-update to enable pam_mkhomedir will have to be written until a fix for bug #568577 is in the archive. Because I believe it is a bad idea to have local home directories using misleading paths like /site/server/partition/, I prefer to create a local user with the home directory in /home/. This is done using the libpam-mklocaluser package. These packages need to be installed and configured
libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
The ldapd packages will ask for LDAP connection information, and one have to fill in the values that fits ones own site. Make sure the PAM part uses encrypted connections, to make sure the password is not sent in clear text to the LDAP server. I've been unable to get TLS certificate checking for a self signed certificate working, which make LDAP authentication unsafe for Debian Edu (nslcd is not checking if it is talking to the correct LDAP server), and very much welcome feedback on how to get this working. Because nscd do not have a default configuration fit for offline caching until bug #485282 is fixed, this configuration should be used instead of the one currently in /etc/nscd.conf. The changes are in the fields reload-count and positive-time-to-live, and is based on the instructions I found in the LDAP for Mobile Laptops instructions by Flyn Computing.
	debug-level		0
	reload-count		unlimited
	paranoia		no
	enable-cache		passwd		yes
	positive-time-to-live	passwd		2592000
	negative-time-to-live	passwd		20
	suggested-size		passwd		211
	check-files		passwd		yes
	persistent		passwd		yes
	shared			passwd		yes
	max-db-size		passwd		33554432
	auto-propagate		passwd		yes
	enable-cache		group		yes
	positive-time-to-live	group		2592000
	negative-time-to-live	group		20
	suggested-size		group		211
	check-files		group		yes
	persistent		group		yes
	shared			group		yes
	max-db-size		group		33554432
	auto-propagate		group		yes
	enable-cache		hosts		no
	positive-time-to-live	hosts		2592000
	negative-time-to-live	hosts		20
	suggested-size		hosts		211
	check-files		hosts		yes
	persistent		hosts		yes
	shared			hosts		yes
	max-db-size		hosts		33554432
	enable-cache		services	yes
	positive-time-to-live	services	2592000
	negative-time-to-live	services	20
	suggested-size		services	211
	check-files		services	yes
	persistent		services	yes
	shared			services	yes
	max-db-size		services	33554432
While we wait for a mechanism to update /etc/nsswitch.conf automatically like the one provided in bug #496915, the file content need to be manually replaced to ensure LDAP is used as the directory service on the machine. /etc/nsswitch.conf should normally look like this:
passwd:         files ldap
group:          files ldap
shadow:         files ldap
hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files
protocols:      files
services:       files
ethers:         files
rpc:            files
netgroup:       files ldap
The important parts are that ldap is listed last for passwd, group, shadow and netgroup. With these changes in place, any user in LDAP will be able to log in locally on the machine using for example kdm, get a local home directory created and have the password as well as user and group attributes cached. LDAP/Kerberos + nss-updatedb + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir Because nscd have had its share of problems, and seem to have problems doing proper caching, I've seen suggestions and recipes to use nss-updatedb to copy parts of the LDAP database locally when the LDAP database is available. I have not tested such setup, because I discovered sssd. LDAP/Kerberos + sssd + libpam-mklocaluser A more flexible and robust setup than the nscd combination mentioned earlier that has shown up recently, is the sssd package from Redhat. It is part of the FreeIPA project to provide a Active Directory like directory service for Linux machines. The sssd system combines the caching of passwords and user information into one package, and remove the need for nscd and libpam-ccreds. It support LDAP and Kerberos, but not NIS. Version 1.2 do not support netgroups, but it is said that it will support this in version 1.5 expected to show up later in 2010. Because the sssd package was missing in Debian, I ended up co-maintaining it with Werner, and version 1.2 is now in testing. These packages need to be installed and configured to get the roaming setup I want
libpam-sss libnss-sss libpam-mklocaluser
The complete setup of sssd is done by editing/creating /etc/sssd/sssd.conf.
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = INTERN
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/INTERN]
enumerate = false
cache_credentials = true
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ldap
ldap_search_base = dc=skole,dc=skolelinux,dc=no
ldap_tls_reqcert = never
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
I got the same problem here with certificate checking. Had to set "ldap_tls_reqcert = never" to get it working. With the libnss-sss package in testing at the moment, the nsswitch.conf file is update automatically, so there is no need to modify it manually. If you want to help out with implementing this for Debian Edu, please contact us on debian-edu@lists.debian.org.

30 June 2010

Vincent Sanders: Programmers are suckers for a meme

Many Open Source projects have and IRC # for developers. The NetSurf project is no different. During a discussion someone jokingly suggested that one contributor should be asked to take the FizzBuzz test. Can you guess what happened next?

Ten minutes later Michael Drake posted this solid example in C which is where it all ought to have ended.

<iframe src="http://pastebin.com/embed_iframe.php?i=MesmvSjk" style="border:none;width:100%;height:200px;"></iframe>

Being programmers, of course this had a predictable result. The original question, the reason for asking it and any the serious point being made in the original article were discarded. Just so everyone (including myself) could play silly buggers over our lunch break. Coders, it would seem, simply like to produce a solution even if it is only for fun.

None of these programs took more than ten minutes (except the JAVA monstrosity), are reproduced with permission and I am to blame for none of them (ok maybe just the one ;-).

First up was Rob Kendrick with the classic solution in C (his day job is as a support team lead which seems to make those programmers who cannot do this seem even more scary bad.)

<iframe src="http://pastebin.com/embed_iframe.php?i=EaQ2414U" style="border:none;width:100%;height:200px;"></iframe>

Next was Daniel Silverstone who turned this Lua solution out very quickly and berated the rest of us for not following the rules ;-)

<iframe src="http://pastebin.com/embed_iframe.php?i=cYY0YDYM" style="border:none;width:100%;height:220px;"></iframe>

The final C solution was my own uber silly sieve implementation

<iframe src="http://pastebin.com/embed_iframe.php?i=5w5BhKt3" style="border:none;width:100%;height:200px;"></iframe>

Peter Howkins decided the world required a solution in PHP

<iframe src="http://pastebin.com/embed_iframe.php?i=h2aQ5eXM" style="border:none;width:100%;height:200px;"></iframe>

When pointed out that his solution stopped at 50 he presented this vastly superior and obviously idiomatic solution

<iframe src="http://pastebin.com/embed_iframe.php?i=k8T6VtJu" style="border:none;width:100%;height:200px;"></iframe>

Finally after a long time James Shaw caused mental anguish and wailing with this abomination unto Nuggin.

<iframe src="http://pastebin.com/embed_iframe.php?i=GFeHdJdr" style="border:none;width:100%;height:200px;"></iframe>

With Luck everyone has now got it out of their system and we will never have to put up with this again (yeah right). And now you also know why Open Source projects sometimes take ages to release ;-)

Dirk Eddelbuettel: Rcpp 0.8.3

A new version 0.8.3 of Rcpp is now CRAN and in Debian. It comes about three weeks after the 0.8.2 release. And even though we promised to concentrate on documentation, it contains a raft of new features: The main thing here is Rcpp sugar for which we also have a new (seventh !!) vignette Rcpp-sugar. As a quick example, consider this simple C++ function that takes two vectors from R and creates a new one conditional on the relative values:
export "C" SEXP foo( SEXP xs, SEXP ys)  
    Rcpp::NumericVector x(xs), y(ys);
    int n = x.size();
    Rcpp::NumericVector res( n );
    double xd = 0.0, yd = 0.0 ;
    for( int i=0; i<n; i++) 
        xd = x[i];
        yd = y[i];
        if( xd < yd ) 
            res[i] = xd * xd ;
          else  
            res[i] = -( yd * yd);
         
     
    return res ;
 
Now, if you use R, you really want to writes this more compactly. And now you can, thanks to Rcpp sugar:
extern "C" SEXP foo( SEXP xs, SEXP ys) 
    Rcpp::NumericVector x(xs), y(xs);
    return ifelse( x < y, x*x, -(y*y));
 
Same great taste, but much less filling! More details are in the Rcpp-sugar vignette. Doug Bates is already a fan of this and is employing it in the lme4a development version of the well-known lme4 package. The full NEWS entry for this release follows below:
0.8.3   2010-06-27
    o	This release adds Rcpp sugar which brings (a subset of) the R syntax
        into C++. This supports : 
         - binary operators : <,>,<=,>=,==,!= between R vectors
         - arithmetic operators: +,-,*,/ between compatible R vectors
         - several functions that are similar to the R function of the same name:
        abs, all, any, ceiling, diff, exp, ifelse, is_na, lapply, pmin, pmax, 
        pow, sapply, seq_along, seq_len, sign
        
        Simple examples :
        
          // two numeric vector of the same size
          NumericVector x ;
          NumericVector y ;
          NumericVector res = ifelse( x < y, x*x, -(y*y) ) ;
        
          // sapply'ing a C++ function
          double square( double x )  return x*x ;  
          NumericVector res = sapply( x, square ) ;
        
        Rcpp sugar uses the technique of expression templates, pioneered by the 
        Blitz++ library and used in many libraries (Boost::uBlas, Armadillo). 
        Expression templates allow lazy evaluation of expressions, which 
        coupled with inlining generates very efficient code, very closely 
        approaching the performance of hand written loop code, and often
        much more efficient than the equivalent (vectorized) R code.
        
        Rcpp sugar is curently limited to vectors, future releases will 
        include support for matrices with sugar functions such as outer, etc ...
        
        Rcpp sugar is documented in the Rcpp-sugar vignette, which contains
        implementation details.
    o   New helper function so that "Rcpp?something" brings up Rcpp help
    o   Rcpp Modules can now expose public data members
    o   New classes Date, Datetime, DateVector and DatetimeVector with proper
        'new' API integration such as as(), wrap(), iterators, ...
    o   The so-called classic API headers have been moved to a subdirectory
        classic/ This should not affect client-code as only Rcpp.h was ever
        included.
    o   RcppDate now has a constructor from SEXP as well
    o   RcppDateVector and RcppDatetimeVector get constructors from int
        and both const / non-const operator(int i) functions
        
    o   New API class Rcpp::InternalFunction that can expose C++ functions
    	to R without modules. The function is exposed as an S4 object of 
    	class C++Function
As always, even fuller details are in Rcpp Changelog page and the Rcpp page which also leads to the downloads, the browseable doxygen docs and zip files of doxygen output for the standard formats. A local directory has source and documentation too. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page

Next.

Previous.