Today, the last piece of the puzzle for roaming laptops in Debian Edu finally entered the Debian archive. Today, the new libpam-mklocaluser package was accepted. Two days ago, two other pieces was accepted into unstable. The pam-python package needed by libpam-mklocaluser, and the sssd package passed NEW on Monday. In addition, the libpam-ccreds package we need is in experimental (version 10-4) since Saturday, and hopefully will be moved to unstable soon. This collection of packages allow for two different setups for roaming laptops. The traditional setup would be using libpam-ccreds, nscd and libpam-mklocaluser with LDAP or Kerberos authentication, which should work out of the box if the configuration changes proposed for nscd in BTS report #485282 is implemented. The alternative setup is to use sssd with libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take care of the caching of passwords and group information. I have so far been unable to get sssd to work with the LDAP server at the University, but suspect the issue is some SSL/GnuTLS related problem with the server certificate. I plan to update the Debian package to version 1.2, which is scheduled for next week, and hope to find time to make sure the next release will include both the Debian/Ubuntu specific patches. Upstream is friendly and responsive, and I am sure we will find a good solution. The idea is to set up the roaming laptops to authenticate using LDAP or Kerberos and create a local user with home directory in /home/ when a usre in LDAP logs in via KDM or GDM for the first time, and cache the password for offline checking, as well as caching group memberhips and other relevant LDAP information. The libpam-mklocaluser package was created to make sure the local home directory is in /home/, instead of /site/server/directory/ which would be the home directory if pam_mkhomedir was used. To avoid confusion with support requests and configuration, we do not want local laptops to have users in a path that is used for the same users home directory on the home directory servers. One annoying problem with gdm is that it do not show the PAM message passed to the user from libpam-mklocaluser when the local user is created. Instead gdm simply reject the login with some generic message. The message is shown in kdm, ssh and login, so I guess it is a bug in gdm. Have not investigated if there is some other message type that can be used instead to get gdm to also show the message. If you want to help out with implementing this for Debian Edu, please contact us on debian-edu@lists.debian.org.

After several other Debian developers convinced me that a ShortURL service, which is under control of a Debian Developer would be useful for them, I've spent some time to write the necessary code for it. And if it will be used regulary, I'll ask DSA if they want to host it on a proper machine. So I'm happy to announce the public beta test of deb.li (also available under go.debian.net)! Please note that neither the content of the pages nor the CSS is finished... As this should not become just another random, spammer-attracting ShortURL service, I will not provide a web based form to add new URLs. Instead new URLs have to be added via a simple JSON-RPC based interface. Other ways to add new URLs will be added on request (or by sending patches ;)), at least an email-gateway similar to db.debian.org is planned. The small piece of documentation which exists so far is available at wiki.debian.org/deb.li And if you want to give it a try now, log into alioth.debian.org and have a look into

/var/lib/gforge/chroot/home/users/bzed/godebian-client

- the usage is documented in the README file and should be pretty straight forward. I hope it will be useful - comments, bugreports and patches are welcome!

I wrote a bit ago a blog post about what debian kde is missing of distribution specific things Some of the more important things includes:

• A Qt based debian installer
• Tools to manage 3rd party modules and firmware and such
• Debconf frontend that fits in
• Report bug interface

Installer
I don t think it is the most important thing. Wether or not the graphical installer is using gtk or qt is not that important. I would love to see it happen, but it is not something I feel like putting my time in. Others are most welcome.
It will give the advantage of giving the installer the possibility to use the framebuffer directly. Modules and firmwares and such
Someone is saying that ubuntu has something called jockey that does this exact thing, with a KDE and a Gnome frontend. Unfortunately, it is python, so it is something I will really avoid. I m hoping that me mentioning it here will make someone into python&debian pick it up and bring it to debian.
It is apparantly some nice magic around discover-data. Debconf frontend that fits
A lot of work has been put into proper perl-qt bindings and they will hopefully be ready for kde4.5, which is unfortunately a series too late for Squeeze :/. But when that has happened, we just need some perl guy to adapt the old frontend to debconf. Reportbug interface
There is already a tool called reportbug-ng that is a qt interface to reporting bugs. All in all, it looks like we are quite far already. We just need to get the last bits put together. Someone: pickup jockey. And note that the comment field isn t a place to report bugs. They will be removed.

Recently, I ve been working on an exciting project with JaNet(UK) on a project to bring federated authentication to non-web applications. I ve worked on authentication projects a lot, although this is the first federation project I ve worked on. The big difference appears to be an emphasis on credential independence: the subject (person trying to authenticate) and service will not share a common credential type. Within their organization, the subject and their identity provider share a credential. Then, the federation has some credential mechanism such that the user s organization and the service share some (probably completely different) type of credential. The other emphasis is on providing personalization. For web applications, there are a lot of options to achieve this: Information Card, Open ID, SAML, and OAuth all provide solutions in this space. However there are not good options for non-web applications. If you out-source your mail and chat infrastructure but want to use your own chat client or IMAP client, then you will not get the same federation benefits you can get with the web. If you re using usernames and passwords and don t mind the potential problems with your out-sourcing provider being able to impersonate all your users, you can simply synchronize usernames and passwords. Within an enterprise, you can do better using Kerberos. JaNet(UK) runs the UK Access Federation, which is a SAML-based web single-sign-on federation. In order to better meet the needs of their customers they d like to expand this offering to non-web applications. This demand is apparently shared across the European academic community. I suspect there is also some demand in the US academic community and in enterprise situations. With the web, it turns out that you have a convenient platform for interactions with the identity provider: you can simply direct a web browser to the identity provider and need not specify the user interaction with the web browser at all. This is seen as a significant branding and usability advantage. With other environments, it becomes necessary to specify the interaction with the identity provider. Consider an automated client that wishes to examine a mail box and provide advanced mail sorting or aggregation. That automated client cannot directly use a web browser. OAuth solves this issue with an enrollment step that does typically involve a web browser that produces a consumer key and an authentication step that does not. However for non-web clients it seems like avoiding reliance on the browser authentication will be important. It turns out we already have widely used technologies that do this: the Extensible Authentication Protocol (EAP) mediates the interaction between a subject and identity provider for obtaining network access. It also turns out that we have fairly good technologies for abstract security services within non-web applications: thanks to Kerberos and Active Director, many application protocols and a fair number of applications support GSS-API. JaNet(UK) proposes to combine these technologies with SAML in order to produce a solution for federation beyond the web. I prepared a feasibility analysis of this proposal. At a technical level, the proposal is sound. There s a lot of standardization and implementation work, but there appears to be sufficient motivation to form the seeds of a standards activity and put together a proof-of-concept implementation. However, the big question is Will anyone use it? In particular, to be useful beyond fairly small communities, support from client vendors and application framework vendors will be needed. It s taken massive money and around 20 years to get Kerberos support to a point where it is effective within an enterprise. Moonshot can leverage that work to a large extent, but moonshot may also have greater usability and penetration goals. It s interesting that I m advocating EAP for application layer authentication. When I was a Security AD, I made a strong statement that EAP must only be used for network access. I ve been fairly consistent about that since then. I think there are two huge problems with using EAP for application authentication. The first is that EAP only authenticates the home realm; it does not authenticate what service you re going to. So you might try to connect to your e-mail and end up giving something access to your stored files and pictures instead. That is, EAP has a phishing exposure in the federated context. If the only thing you can get by using EAP is network access, that exposure is only moderate. However in a fully federated environment that is a huge exposure. Moonshot will address this problem by using EAP channel binding and by doing the necessary work to make that a viable solution. The second concern is that interoperability is reduced when you have multiple authentication approaches for the same problem. If EAP is going to be used for application authentication, we need to understand how it relates to the rest of the application authentication metasystem. Moonshot proposes such a relationship, addressing my objection. Moonshot is designed to work well with the objectives of the Identity Metasystem and its laws of identity. It uses a different technology, but does have an approach for dealing with claims-based identity and hopefully will have a user experience very similar to the identity metasystem. It uses a different underlying technology. However one of the main beliefs behind the identity metasystem is that is the user experience and universal interoperability that is important, not any specific technology. In its domain, the technologies Moonshot selects will be a better fit than a web services stack. It s strange not to be working on Kerberos; Moonshot uses some Kerberos technology, but its core is definitely not today s Kerberos. In some ways it is fun to be working on something new. There s one aspect of Kerberos I really miss: Moonshot has nothing like tickets. There s no place to remember state or exchange to directly involve the client in what the server learns. My analysis talks about ways to make Moonshot more like Kerberos; there are some potential advantages, but so far, the tradeoffs do not justify changes. We re hoping to have a bar BOF at IETF 77 and a BOF in the summer at IETF 78.

At IETF 77, we re having a get together to discuss federated authentication beyond the web. The meeting will be in the Mahattan room starting at 9 PM US Pacific time. I think audio streaming will be available; I will post a link closer to the meeting time. In the last entry, I mentioned that a preliminary spec would be available; see the preliminary EAP GSS-API mechanism. A use case paper and slide set are being reviewed internally and should be ready early next week. We may even have preliminary versions of the binding between RADIUS and SAML available before IETF. There have been a number of great discussions on the moonshot-community list and with others interested in the broader area.

In a surprise move Apple today announced a new product closely related to the behyped iPad. This move went completely unexpected with technology analysts, who were expecting a new iPhone dubbed "iPhone 4G" to be released next.The new product is called iPad mini, and features most of the iPad functionality in a lot smaller form factor, with extended battery life and without the overheating issues. It will focus on gamers, instead of the deprecated community of newspaper readers. The smaller form factor allows the users to bring the device along at any time.Get all the specifications of the new iPad mini here [www.apple.com]. There is also a special edition with voice-over-3G functionality [www.apple.com].Yes, I'm referring to the iPod touch and the iPhone. Just goofing around.

The fact that it's only two weeks feels totally surreal. I think it's the feeding approximately every 3 hours. That's approximately 100 interactions that we've had with her in only 2 weeks. We had her two week weight check at the paediatrician's today. She's now weighing 6 lbs 12 oz (3061 grams), so she's made back her birth weight and then some. We're still largely bottle feeding her with pumped breast milk. The paediatrician said that once she's 7 pounds she should have enough strength to breastfeed exclusively, so we'll get a lactation consultant involved if that isn't the case in another week or so. Other than that, everything's going swimmingly. She eats, sleeps and poops. She sleeps amazingly well. I keep telling myself it won't last, but we're making the most of not needing to tip-toe around the house. In the last week, we had a new stove installed, which involved the contractor using a hammer drill to install the anti-tip brackets. He also used a drop-saw to modify one of the drawers. Didn't bother her. We had some shutters installed in the kitchen, which involved a lot of cordless drilling. Also didn't bother her. The gardeners for the complex were mowing the lawn and using a leaf blower right outside her window. Not a peep. Today, after the paediatrician's appointment, we dropped in to Palo Alto Animal Services, the animal shelter where Sarah has volunteered for the last 4.5 years, to show them Zoe. They threw a bit of a surprise baby shower, and gave us a ton of baby clothes, which was very nice and totally unexpected. Zoe slept in her car seat on the table in the lunch room while a good dozen people or so made a lot of noise around her, and she was oblivious to it all. Sarah's Mum arrives on Wednesday. Tomorrow will be a busy day of final cleaning up in preparation.

Romain and I are happy to announce the release of Rcpp version 0.8.0. It has been uploaded to CRAN. A Debian upload is delayed until the now-required inline package is accepted into Debian. The source package is also available from here. This release brings a number of changes that are detailed below. Of particular interest may be the much more robust treatment of exceptions, the new classes for data frames and formulae, and the availability of the new helper function cppfunction for use with inline. Also of note is the new support for the 'LinkingTo' directive with which packages using Rcpp will get automatic access to the header files. An announcement email went to the r-packages list (ETH Zuerich, Gmane); Romain also blogged about the release. The full NEWS entry for this release follows below:

0.8.0   2010-05-17
    o   All Rcpp headers have been moved to the inst/include directory,
	allowing use of 'LinkingTo: Rcpp'. But the Makevars and Makevars.win
	are still needed to link against the user library.
    o   Automatic exception forwarding has been withdrawn because of
	portability issues (as it did not work on the Windows platform).
	Exception forwarding is still possible but is now based on explicit
	code of the form:
	
	  try  
	    // user code
	    catch( std::exception& __ex__)  
	    forward_exception_to_r( __ex___ ) ;
	   
	
	Alternatively, the macro BEGIN_RCPP and END_RCPP can use used to enclose
	code so that it captures exceptions and forward them to R. 
	
	  BEGIN_RCPP
	  // user code
	  END_RCPP
	
    o   new __experimental__ macros 
	
	The macros RCPP_FUNCTION_0, ..., RCPP_FUNCTION_65 to help creating C++
	functions hiding some code repetition: 
	
	  RCPP_FUNCTION_2( int, foobar, int x, int y) 
	    return x + y ;
	   
	The first argument is the output type, the second argument is the 
	name of the function, and the other arguments are arguments of the C++ 
	function. Behind the scenes, the RCPP_FUNCTION_2 macro creates 
	an intermediate function compatible with the .Call interface and handles 
	exceptions
	
	Similarly, the macros RCPP_FUNCTION_VOID_0, ..., RCPP_FUNCTION_VOID_65 
	can be used when the C++ function to create returns void. The generated
	R function will return R_NilValue in this case.
	
	  RCPP_FUNCTION_VOID_2( foobar, std::string foo ) 
	    // do something with foo
	   
	  
	The macro RCPP_XP_FIELD_GET generates a .Call compatible function that
	can be used to access the value of a field of a class handled by an 
	external pointer. For example with a class like this: 
	
	  class Foo 
		public:
			int bar ;
	   
	
	  RCPP_XP_FIELD_GET( Foo_bar_get, Foo, bar ) ;
	  
	RCPP_XP_FIELD_GET will generate the .Call compatible function called
	Foo_bar_get that can be used to retrieved the value of bar.
	
	
	The macro RCPP_FIELD_SET generates a .Call compatible function that 
	can be used to set the value of a field. For example:
	
	  RCPP_XP_FIELD_SET( Foo_bar_set, Foo, bar ) ;
	
	generates the .Call compatible function called "Foo_bar_set" that 
	can be used to set the value of bar
	
	
	The macro RCPP_XP_FIELD generates both getter and setter. For example
	
	  RCPP_XP_FIELD( Foo_bar, Foo, bar )
	  
	generates the .Call compatible Foo_bar_get and Foo_bar_set using the 
	macros RCPP_XP_FIELD_GET and RCPP_XP_FIELD_SET previously described
	
	  
	The macros RCPP_XP_METHOD_0, ..., RCPP_XP_METHOD_65 faciliate 
	calling a method of an object that is stored in an external pointer. For 
	example: 
	
	  RCPP_XP_METHOD_0( foobar, std::vector<int> , size )
	
	creates the .Call compatible function called foobar that calls the
	size method of the std::vector<int> class. This uses the Rcpp::XPtr<
	std::vector<int> > class.
	
	The macros RCPP_XP_METHOD_CAST_0, ... is similar but the result of
	the method called is first passed to another function before being
	wrapped to a SEXP.  For example, if one wanted the result as a double
	
	   RCPP_XP_METHOD_CAST_0( foobar, std::vector<int> , size, double )
	
	The macros RCPP_XP_METHOD_VOID_0, ... are used when calling the
	method is only used for its side effect.
	
	  RCPP_XP_METHOD_VOID_1( foobar, std::vector<int>, push_back ) 
	
	Assuming xp is an external pointer to a std::vector<int>, this could
	be called like this :
	
	  .Call( "foobar", xp, 2L )
	
    o	Rcpp now depends on inline (>= 0.3.4)
	
    o   A new R function "cppfunction" was added which invokes cfunction from
	inline with focus on Rcpp usage (enforcing .Call, adding the Rcpp
	namespace, set up exception forwarding). cppfunction uses BEGIN_RCPP
	and END_RCPP macros to enclose the user code
    o	new class Rcpp::Formula to help building formulae in C++
    
    o   new class Rcpp::DataFrame to help building data frames in C++
	
    o   Rcpp.package.skeleton gains an argument "example_code" and can now be
	used with an empty list, so that only the skeleton is generated. It
	has also been reworked to show how to use LinkingTo: Rcpp
	
    o   wrap now supports containers of the following types: long, long double,
	unsigned long, short and unsigned short which are silently converted
	to the most acceptable R type.
	
    o	Revert to not double-quote protecting the path on Windows as this
	breaks backticks expansion used n Makevars.win etc
        
    o   Exceptions classes have been moved out of Rcpp classes,
	e.g. Rcpp::RObject::not_a_matrix is now Rcpp::not_a_matrix

As always, even fuller details are in Rcpp Changelog page and the Rcpp page which also leads to the downloads, the browseable doxygen docs and zip files of doxygen output for the standard formats. A local directory has source and documentation too. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page

I find it surreal to have people guessing at my motivations when they could just ask me. On top of all that, I find it weird that people spend so much time with in-fighting. I just want my system not to suck. Some time ago (during in the Ubuntu Karmic development cycle maybe in September 2009), I started having giant problems with my build system. All I/O would start to stall, wait times would surge, and usually my entire system would just go unresponsive with the disk light on solid. This scared the crap out of me, and it wasn t entirely obvious what was triggering it. No one else seemed to be seeing it. I managed to start tracking things using latencytop , and saw stuff like liferea going crazy. As I eliminated more and more things, I eventually settled on it being a problem with umount, and I reported an Ubuntu bug. It seemed to look like an upstream bug that no one else but the reporter could reproduce either. Since no one else was seeing this issue, and it seemed related to LVM snapshots, I migrated off of snapshots, and started using aufs overlays for my builds. For a while, it seemed like things went away. It didn t, and I started hitting it again. I opened a new (now famous) bug in Ubuntu, since now snapshots weren t in the picture, and I didn t want to confuse the earlier history. I managed to find a relatively minimal test-case too. A few other people commenting on the bug were seeing the problem now too, but it was less pronounced for them. As an aside, this wasn t a just wait a few seconds longer kind of issue on my system. A single umount would last 30-40 minutes. And when I m doing parallel builds of security updates, this would turn into my system being unavailable for hours at a stretch. Since none of the kernel developers I was in contact with were able to track down the root cause, I asked Ted Ts o in email if he could just quickly peek in on this for me, since I figured he d be in a good position to confirm or deny it. I didn t want to start wasting upstream time with this if it wasn t reproducible (see earlier upstream kernel bug). To my great relief, Ted found a few minutes to check it, and was able to immediately confirm it and give me a viable work-around ( sync; umount ) for the time being. I confirmed the work-around, and went off to do other things. A while later, Ted came back to deliver a bit of a rant, the purpose of which was not clear to me, but I ultimately ignored it I didn t seem directed at me. I just wanted my system operating normally, and he d done me a favor to check in on it and got me a work-around. More time passes, and I eventually get caught in another I/O-wait melt-down. On investigation, it seemed that the in-kernel work-around in the Ubuntu kernel totally back-fired on me in some cases, rendering even the user-space work-around useless. After investigating the Ubuntu-specific work-around, I re-read Ted s rant in the course of researching what had happened during this bug s triage. It seemed that Ted was basically saying:
this is an upstream problem
RedHat hasn t run into it and he didn t know why I figured I should confirm for myself if Fedora was affected, so downloaded and installed Fedora to double-check there. Since I was able to reproduce it there, I opened an upstream bug, linking back to the original Ubuntu bug, and then went to open a bug in the Fedora tracker, linking back to upstream. And it seems to be these actions that everyone has jumped on. I will now bore you with the reality of my motivations: I wanted to fix the bug so no one would end up experiencing the same pain I d been through over the last 6 months. The bug was, from my perspective, a serious issue. Since I d managed to reproduce it in another distro, it was my duty as a Free Software developer to report it to them. And, in what I felt was an unambiguous gesture, I made sure to include the link to the upstream kernel bug. Reproducing it in Ubuntu, in Fedora, and with a stock kernel had me confident that it was an upstream issue. While Ted did correctly suspect the issue was upstream, I really didn t want to just open an upstream bug and have it be ignored. I wanted some additional proof of reproduction, which I got when I tested it on Fedora. So, I m rather saddened that so many people spent so much time questioning my motivations, making fun of Canonical, or doing anything other than trying to just simply solve this problem. I m totally disinterested in inter-distro fighting. Instead, I continue to assume we re all on the same team, fighting a philosophical battle against close-source software. And in that regard, I think it s still true. If I ignore the rants and jeering, I come away thankful for all the people that spent time trying reproduce the issue at Canonical, at RedHat, and in the larger community. I m hugely thankful that Ted made some time to let me know I wasn t crazy, and there was actually a problem. I m thankful for having some work-arounds, and I m thankful that the root cause was eventually ferreted out, with some possible solutions. I m even thankful that some people on the LWN thread saw that, far from malicious, I was trying to be helpful with the bug. I just wanted my filesystem not to eat my computer. And I was hoping other people could maybe help me, since I m not a filesystem expert. The drama around this bug is pathetic, and now by talking about it for almost 1000 words, I m just as guilty.

I spent last week at the Ubuntu Developer Summit in Belgium, where we kicked off the 10.10 development cycle. Due to our time-boxed release cycle, not everything discussed here will necessarily appear in Ubuntu 10.10, but this should provide a reasonable overview of the direction we re taking. Presentations While most of our time at UDS is spent in small group meetings to discuss specific topics, there are also a handful of presentations to convey key information and stimulate creative thinking. A few of the more memorable ones for me were:

• Mark Shuttleworth talked about the desktop, in particular the introduction of the new Unity shell for Ubuntu Netbook Edition
• Fanny Chevalier presented Diffamation, a tool for visualizing and navigating the history of a document in a very flexible and intuitive way
• Rick Spencer talked about the development process for 10.10 and some key changes in it, including a greater focus on meeting deadlines for freezes (and making fewer exceptions)
• Stefano Zacchiroli, the current Debian project leader, gave an overview of how Ubuntu and Debian developers are working together today, and how this could be improved. He has posted a summary on the debian-project mailing list.

The talks were all recorded, though they may not all be online yet. Foundations The Foundations team provides essential infrastructure, tools, packages and processes which are central to the development of all Ubuntu products. They make it possible for the desktop and server teams to focus on their areas of expertise, building on a common base system and development procedures. Highlights from their track:

• Early on in the week, they conducted a retrospective to discuss how things went during the 10.04 cycle and how we can improve in the future
• One of their major projects has been about revision control for all of Ubuntu s source code, and they talked last week about what s next
• We re aiming to provide btrfs as an install-time option in 10.10
• In order to keep Ubuntu moving forward, the foundations team is always on the lookout for stale bits which we don t need to keep around anymore. At UDS, they discussed culling unattended packages, retiring the IA64 and SPARC ports and other spring cleaning
• There was a lot of discussion about Upstart, including its further development, implications for servers, desktops and the kernel, and the migration of server init scripts to upstart jobs
• After maintaining two separate x86 boot loaders for years, it looks like we may be ready to replace isolinux with GRUB2 on Ubuntu CDs

Desktop The desktop team manages both Desktop Edition and Netbook Edition, on a mission to provide a top-notch experience to users across a range of client computing devices. Highlights from their track:

• A key theme for 10.10 is to help developers to create applications for Ubuntu, by providing a native development environment, improving Quickly, improving desktopcouch, making it easier to get started with desktopcouch, and enabling developers to deliver new applications to Ubuntu users continuously
• With more and more touch screen devices appearing, Ubuntu will grow some new features to support touch oriented applications
• The web browser is a staple application for Ubuntu, and as such we are always striving for the best experience for our users. The team is looking ahead to Chromium, using apport to improve browser bug reports, and providing a web-oriented document capability via Zoho
• Building on work done in 10.04, we will aim to make simple things simple for basic photo editing
• Security-conscious users may rest easier knowing that the X window system will run without root privileges where kernel modesetting is supported

Server/Cloud The server team is charging ahead with making Ubuntu the premier server OS for cloud computing environments. Highlights from their track:

• Providing more powerful tools for managing Ubuntu in EC2 and Ubuntu Enterprise Cloud infrastructure, including boot-time configuration, image and instance management, and kernel upgrades
• Improving Ubuntu Enterprise Cloud by adding new Eucalyptus features (such as LXC container support, monitoring, rapid provisioning, and load balancing. If you ever wanted to run a UEC demo from a USB stick, that s possible too.
• Providing packaged solutions for cloud building blocks such as hadoop and pig, Drupal, ehcache, Spring, various NOSQL databases, web frameworks, and more
• Providing turn-key solutions for free software applications like Alfresco and Kolab
• Making Puppet easier to deploy, easier to configure, and easier to scale in the cloud

ARM Kiko Reis gave a talk introducing ARM and the corresponding opportunity for Ubuntu. The ARM team ran a full track during the week on all aspects of their work, from the technical details of the kernel and toolchain, to the assembly of a complete port of Netbook Edition 10.10 for several ARM platforms. Kernel The kernel team provided essential input and support for the above efforts, and also held their own track where they selected 2.6.35 as their target version, agreed on a variety of changes to the Ubuntu kernel configuration, and created a plan for providing backports of newer kernels to LTS releases to support deployment on newer hardware. Security Like the kernel team, the security team provided valuable input into the technical plans being developed by other teams, and also organized a security track to tackle some key security topics such as clarifying the duration of maintenance for various collections of packages, and the ongoing development of AppArmor and Ubuntu s AppArmor profiles. QA The QA team focuses on testing, test automation and bug management throughout the project. While quality is everyone s responsibility, the QA team helps to coordinate these activities across different teams, establish common standards, and maintain shared infrastructure and tools. Highlights from their track include:

• There was a strong sense of broadening and deepening our testing efforts, mobilizing testers for specific testing projects, streamlining the ISO testing process by engaging Ubuntu derivatives and fine-tuning ISO test cases, and reactivating the community-based laptop testing program
• In support of this effort, there will be projects to improve test infrastructure, including enabling tests to target specific hardware and tracking test results in Launchpad
• There is a continuous effort to improve high-volume processing of bug reports, and two focus areas for this cycle will be tracking regressions (as these are among the most painful bugs for users) and improving our response to kernel bugs (as the kernel faces some special challenges in bug management)

Design The design team organized a track at UDS for the first time this cycle, and team manager Ivanka Majic gave a presentation to help explain its purpose and scope. Toward the end of the week, I joined in a round table discussion about some of the challenges faced by the team in engaging with the Ubuntu community and building support for their work. This is a landmark effort in mating professional design with free software community, and there is still much to learn about how to do this well. Community The community track discussed the usual line-up of events, outreach and advocacy programs, organizational tools, and governance housekeeping for the 10.10 cycle, as well as goals for improving the translation of Ubuntu and related resources into many languages. One notable project is an initiative to aggressively review patches submitted to the bug tracker, to show our appreciation for these contributions by processing them more quickly and completely.

New apt-xapian-index plugins Besides a fair bit of refactoring and cleanup, I've recently added two new plugins to apt-xapian-index: app-install If app-install-data is installed, information about .desktop files will now enter the index. This allows, for example, to limit query results to only those packages that contain .desktop files, which is quite useful, for example for building desktop-oriented package managers. aliases It reads term->aliases mapping from files in /etc/apt-xapian-index/aliases/ or /usr/share/apt-xapian-index/aliases/, and feeds them as synonyms in the index. apt-xapian-index ships an example alias file, to give people who know the wrong software names a chance to find the right ones:

# Aliases expanding names of popular applications
excel       XToffice::spreadsheet
powerpoint  XToffice::presentation
photoshop   XTworks-with::image:raster
coreldraw   XTworks-with::image:vector
autocad     XTworks-with::3dmodel

Notice how it is possible to use index terms that happen to be Debtags tags as synonyms, which yields better results, language independence and extra coolness.

On Wednesday I saw a group of people wearing nothing but underwear walking through the Melbourne CBD. They were promoting Pants To Poverty which is a UK based underwear company that sells Organic Fair-Trade underpants [1]. The corporate web site seems equally divided between the purposes of selling underpants and lobbying for a variety of social issues including fair-trade, better working conditions in factories, and the abolition of pesticides that kill farmers. The web site itself is worth a look in terms of it s design, for what it does it works really well. When viewing a picture of a model wearing underpants you can scroll your mouse over the picture to see an enlarged view of a particular area of interest. This works really well on a Netbook display (everyone should carry a Netbook with 3G net access when shopping), I would like to see car companies use the same technique for displaying pictures of cars on small screen devices. It s unfortunate that it doesn t just show the full sized images when you use a large display, it would all fit on a 1680*1050 display. The underwear in the UK costs between 10 pounds ($16.40AU) and 15 pounds ($24.60AU) a pair for adults and 18 pounds ($29.52AU) a pair for a pack of three for children. The Little Green Bag Co [2] sells the adult underpants in Australia for $22AU per pair. These appear to be the cheaper items from the range, so it seems that it would be cheaper to order from the UK if you were buying a few pairs. Also if the items you wanted happened to be the more expensive items from the range then you would have to order from the UK. A quick check of the Myer web site shows that even $22 per pair isn t particularly expensive for women s underwear, but it is really expensive for men s underwear. The Australian web site for Pants to Poverty lists a bunch of resellers, but a quick scan of the list didn t turn up anyone cheaper than the Little Green Bag Co. According to the sizing information on the home page of the UK site the largest underpants that they sell are size 14 (in the Australian size range for women which is apparently 78-83cm). According to a variety of news reports the average size of an Australian women is either size 14 or 14-16. Apparently women s clothing is often not made to standard sizes due to the practice of vanity sizing, so it s difficult to determine how these things compare. But it does seem that a significant portion of the women in Australia won t be able to buy products from Pants To Poverty in their size. I don t think that many men will buy from them, $22 is really expensive. So while I think it s great to have a bunch of men and women running around the CBD wearing only underwear I don t think that the future of their Australian business is particularly good. The difference in price between Pants To Poverty products and other underwear would allow you to buy a significant quantity of Organic Fair Trade chocolate or other food.

• [1] http://www.pantstopoverty.com/
• [2] http://www.littlegreenbagco.com.au/

Actually, on second thought, this isn t a farewell. There is no goodwill on either side of this bitter parting. Facebook doesn t care about my privacy or consent, and I don t care about their shady and anti-competitive profiteering. It s over between us. So, here s what I did:

1. made a list of all of my connections on Facebook (via copy and paste from a browser window)
2. confirmed that I have alternate contact information for all of them, either by email or other social media
3. deleted all of my photo albums
4. deleted all of the information from all sections of my profile
5. removed all applications
6. deleted everything under My Links
7. deleted all of my notes (this was tedious, as my blog was syndicated there)
8. followed the WikiHow instructions to delete my account

Obviously, I can t really control whether they hold onto my data in spite of this. This should provide a clear statement of intent on my part, though, if it comes up in future shenanigans.

The Problem I was asked for advice on buying headphones to protect students who have medical conditions that make them sensitive to noise, such headphones would have to allow them to hear human voices. Due to the significant differences in hearing issues (including physical damage and sensory issues) it seems unlikely that getting identical headphones for all students will give an ideal result. The person who asked me the question didn t explain what type of students are being taught. If it s an adult education class then getting everyone the ideal headset wouldn t be particularly difficult. If however it s the special needs class in a high school then students would probably want the most shiny headphones rather than the ones that are a best match to their hearing issues. Also some combinations of hearing problems and ambient noise can t be addressed by such headsets. A friend who developed Noise Induced Hearing Loss from shooting tells me that he really can t stand brass instruments. But the high frequencies from such instruments tend not to be filtered well by noise canceling headphones, so any student who has such a problem would probably need hearing aids that filter out high frequencies I believe that such hearing aids are available but don t have any particular knowledge about them. Test Results I did a quick test on my Bose QC-15 noise canceling headphones [1] which cost me $320US including tax and my cheap Bauhn headphones from Aldi [2] which cost me $69AU (and which apparently could later be purchased on special for $35AU to clear stock). I found that when not playing music they seemed to perform about equally well in terms of allowing me to hear people speaking, although I admit that just having a conversation with the nearest people wasn t the most scientific test. When I was playing music I found that the Bose headset made it significantly more difficult to hear people speak than the Bauhn headset. This is an advantage for the Bose for it s intended use, and I expect that students who need a headset for medical reasons won t want to listen to music while studying so it s never a disadvantage. In both cases, if the headphones are used for just canceling unwanted noise the speaker shouldn t need to raise their voice significantly to be heard. In some situations the noise canceling headphones make it easier for someone with good hearing to hear what people are saying, for example a conversation in a car or plane could probably be held at a lower volume if all people involved were wearing suitable noise canceling headphones. If however the students have damaged hearing then I can t make any prediction as to whether the teacher could speak at a lower volume or whether they would be required to use a higher volume if the students wore such headphones. The Brookstone on-ear headphones that I tested [3] seem particularly noteworthy in this regard due to the way they canceled the melody of the store background music and just left the singing. If someone wants to buy headphones for people with physical damage to their ears then the Brookstone product is really worth investigating. If however the target market happens to be people on the Autism Spectrum then they may hate anything that presses on their ears (as I do) in which case the Brookstone product can t be considered. The Brookstone price of $150US (presumably $160 including tax) was also the best price I saw when shopping in the US but I presume that I could have found something with a similar quality and price to Bauhn in the US if I looked hard enough. Conclusion The big advantage of the Bose for this use is that it blocks a wider range of frequencies than some other noise canceling headsets. They all work really well on regular low frequency noise such as car engine noise (whether a car passenger or a pedestrian) but to stop certain higher frequencies such as those from air conditioning systems the Bose wins hands down. I guess this may depend on what noise is to be blocked, if a class was held in the same room every time and noise canceling headsets were purchased specifically for that class then it would probably make sense to ensure that the acoustic capabilities of the headsets match the unwanted background noise and the hearing issue that each student has. Here s an Amazon link: Bose QuietComfort 15 Acoustic Noise Cancelling Headphones I ve been reading about Sensory Processing Disorder. I m sure that some children are doing poorly in the default school system because they either have an undiagnosed case of SPD or who don t have enough symptoms to get a diagnosis. I think it would make a good experiment to try noise canceling headphones on some of the difficult children, I wouldn t expect a high success rate but if it worked in as little as 5% of cases and did no harm to the children who didn t benefit then it would be worth doing.

• [1] http://etbe.coker.com.au/2009/12/20/bought-the-qc-15/
• [2] http://etbe.coker.com.au/2010/03/25/bose-bauhn-aldi-noise-canceling-headphones/
• [3] http://etbe.coker.com.au/2009/12/04/testing-noise-canceling-headphones/

The systemd projecct is an interesting concept for replacing init and related code [1]. There have been a few attempts to replace the old init system, upstart is getting some market share in Linux distributions and Solaris has made some interesting changes too. But systemd is more radical and offers more benefits. While it s nice to be able to start multiple daemons at the same time with dependencies and doing so offers improvements to the boot times on some systems that really doesn t lead to optimal boot times or necessarily correct behavior. Systemd is designed around a similar concept to the wait option in inetd where the service manager (formerly inetd and now the init that comes with systemd) binds to the TCP, UDP, and Unix sockets and then starts daemons when needed. It apparently can start the daemons as needed which means you don t have a daemon running for months without serving a single request. It also implements some functionality similar to automount which means you can start a daemon before a filesystem that it might need has been fscked. This means that a large part of the boot process could be performed in reverse. The current process is to run fsck on all filesystems, mount them, run back-end server processes such as database servers and then run servers that need back-end services (EG a web server using a database server). The systemd way would be for process 1 to listen on port 80 and it could then start the web server when a connection is established to port 80, start the database server when a connection is made to the Unix domain socket, and then mount the filesystem when the database server tries to access it s files. Now it wouldn t be a good idea to start all services on demand. Fsck can take hours on some filesystems and is never quick at the best of times. Starting a major daemon such as a database server can also take some time. So a daemon that is known to be necessary for normal functionality and which takes some time to start could be started before a request comes in. As fsck is not only slow but usually has little scope for parallelisation (EG there s no point running two instances of fsck when you only have one hard disk), so hints as to which filesystem to be checked first would need to be used. Systemd will require more SE Linux integration than any current init system. There is ongoing debate about whether init should load the SE Linux policy, Debian has init loading the policy while Fedora and Ubuntu have the initramfs do it. Systemd will have to assign the correct SE Linux context to Unix domain socket files and listening sockets for all the daemons that support it (which means that the policy will have to be changed to allow all domains to talk to init). It will also have to manage dbus communication in an appropriate way which includes SE Linux access controls on messages. These features mean that the amount of SE Linux specific code in systemd will dwarf that in sysvinit or Upstart which among other things means that it really wouldn t make sense to have an initramfs load the policy. They have a qemu image prepared to demonstrate what systemd can do. I was disappointed that they prepared the image with SE Linux disabled. All I had to do to get it working correctly was to run the command chcon -t init_exec_t /usr/local/sbin/systemd and then configure GRUB to not use selinux=0 on the kernel command line. Another idea is to have systemd start up background processes for GUI systems such as KDE and GNOME. Faster startup for KDE and GNOME is a good thing, but I really hope that no-one wants to have process 1 manage this! Having one copy of systemd run as root with PID 1 to start daemons and another copy of the same executable run as non-root with a PID other than 1 to start user background processes is the current design which makes a lot of sense. But I expect that some misguided person will try to save some memory by combining two significantly different uses for process management.

• [1] http://0pointer.de/blog/projects/systemd

Today I strapped a kayack on a car (badly) and gingerly drove it out to the country, stopping for Greek food enroute. Now at my yurt, where I hung out and played Agricola all afternoon with my sister. Working on some processing of the 19 applicants for DebConfNewbies sponsorship while amazing venison potstickers are started. Tomorrow morning three kayackers will go out early and float down the river, and maybe find where the underriver creek emerges. Good times! Backing up a bit, the past two months have been significant ones. First, I quit my job. Then I almost bought a lot of land, which would have been huge, especially without an income. But it fell through just before closing, and I've had to push the idea of getting some land in the country back off into the indefinite future, where it probably belongs. Instead, Anna and Mark have been amazing, letting me come out here very regularly to unwind. And I've been very wound up, since there's a secret project under development that I can't discuss yet. Hmm, maybe not being on Facebook anymore will mean more personal blogging. That would be good. Now to go help with the potstickers..

Since AdBlock in Chrome does not block, just hide (the same probably applies to Safari and other WebKit-based-browsers), here's a simple method to actually block Facebook Like tracking:Use a proxy.pac file, also known as Proxy auto-config. Then redirect Facebook Like to a blackhole or filtering proxy. I use privoxy, and this replaces Facebook Like embeds with an error message, which enables me to see which site uses Facebook like and that my filter is working.Here's the relevant excerpt of my proxy.pac file:

function FindProxyForURL(url, host)  
  var fblike = /https?:\/\/([^/]*)\.facebook\.com\/(plugins widgets)\/like.*/;
  if (fblike.test(url))  
    return "PROXY 127.0.0.1:8118";
   
  return "DIRECT";
 

Where "127.0.0.1:8118" is the proxy to use. If you use an unreachable proxy - I've seen 255.255.255.0:3421 used as blackhole server - then it should just time out as "unreachable". Or you use a proxy such as privoxy and block the URL there. Any proxy that refuses to serve the request will do.Note that you can add arbitrary domains and regexps to this filter, if you want to block additional sites, such as Google Analytics, that you do not want to be able to track your surfing behaviour.

I didn't write much about running stuff since my update about Paris marathon. The main point was, in general, to gradually resume running activities, after the marathon peak. Which I actually didn't respect at all, as usual..:-)... I already wrote that my "training program" is mostly made of "run as you feel, with no strongly hardcoded program". So, the week-end after the marathon, I ran 11km on Saturday, followed by an half-marathon (alone) on Sunday which I completed in 1h53'31", very close to my 1h51'31" PB for a "half-marathon alone on trails" run. Definitely not what is generally recommended, but, eh, this is how I was feeling... Then, I could continue during the following weeks with my normal program made of 1 or 2 small runs (between 8 and 14km) at lunch time on weekdays, 1 small 10 or 11 km trail run (on this circuit or a longer variant), and a "long" run on Sunday mornings. The long run usually goes from 15km up to 25km. Now, 6 weeks after the marathon, I'll run a 20km trail named Le Trail des Cerfs ("deer trail"), that starts in my neighbourhood and goes through my beloved Rambouillet Forest. I could have chosen the 35K or even 50K race, but preferred being less ambitious with the distance and rather focus and ahieving what will be my first official trail race. I don't expect much differences with the weekly runs, indeed, as most of these are already done in trails, fields and woods with very few paved roads. My goal for this race is 1h45. Later on, I still have the plan to run a full marathon alone, probably on May 31st. This time, contrary to last year where I ran one by going through a very wide loop in Rambouillet Forest, I'll do 4 loops mostly in the city of Maurepas, on flat roads, with possible pit stops at my home (so, no camel back bag, but more focus on good performance). I plan to target 3h55 if the heat is not too high. Further plans are less precise. I'm not sure I'll be able to run the Sur les Traces du Loup trail in La Ville aux Clercs, 2 hours away from our place. That would mean arranging a small week-end there with Elizabeth. Still, that really looks like a great race, with a start at 18:00 to enjoy the end of the day during the longest days of the year. Also, the race and the barbecue that follows appear to be very friendly events in a small French village. On the other hand, the autumn marathon is decided. This will be the Seine et Eure Marathon, a "small (600 runners) marathon very close to our family house in the Seine valley. The race is one of the flatest marathons in France and has the reputation of leading to great times. That will be on October 17th. Target for me: 3h45 (unless I see changes happening util then).

In the recent Debian Edu versions, the sitesummary system is used to keep track of the machines in the school network. Each machine will automatically report its status to the central server after boot and once per night. The network setup is also reported, and using this information it is possible to get the MAC address of all network interfaces in the machines. This is useful to update the DHCP configuration. To give some idea how to use sitesummary, here is a one-liner to ist all MAC addresses of all machines reporting to sitesummary. Run this on the collector host:

perl -MSiteSummary -e 'for_all_hosts(sub   print join(" ", get_macaddresses(shift)), "\n";  );'

This will list all MAC addresses assosiated with all machine, one line per machine and with space between the MAC addresses. To allow system administrators easier job at adding static DHCP addresses for hosts, it would be possible to extend this to fetch machine information from sitesummary and update the DHCP and DNS tables in LDAP using this information. Such tool is unfortunately not written yet.