I didn't follow this disaster too closely, but here's a short (most probably incomplete) roundup of what happened so far:

1. The Sony DRM installs a rootkit,
2. people use the rootkit to make game cheats safe from the (Blizzard) Warden,
3. trojans start (ab)using the DRM rootkit,
4. Sony gets sued,
5. Sony pulls the rootkit.

Nice bedtime story so far. Now it turns out that Sony s web-based XCP (rootkit) uninstaller seems to open huge, gaping security holes itself... Not that I would care too much, I don't buy any Sony CDs. There's a huge pile of great Creative Commons licensed music out there (shameless plug: check my music podcast for some hand-selected goodies). No need to pay huge corporations for crappy music which comes with funny "extras"...

If people won't do what you want them to do, changing the law to compel
them to behave in the way you want will not result in them automatically
complying. All it does is grant you the authority to punish them for
behaving in that manner. In many cases, it'll also grant them more
sympathy. If you then proceed to punish them anyway, you run the risk
that more people will start disobeying you as well. It's certainly not a
good way of increasing general happiness.

Yes Branden,
I'm looking at you.

Inspired by Matthew Palmer's writings (1, 2) on his experiences about the Australian judicial system, I decided to write a series of essays on the Finnish legal system, mostly to contrast it with the universally familiar United State system (even if that universal familiarity is a little skewed by generally having been obtained from dramatizations and not actual court practice). I will concentrate on criminal cases. I will write based on my personal experience as a part of the judicial system, and I will be supplementing the experience with my personal research into law. I am not legally trained, but I have read a fair bit of law and related literature. I am a lay judge in the Jyv skyl District court. I will explain the significance of that later, but I hope it suffices to say, here, that I have sat on the bench, as part of four-judge panels, since March this year, in ten sessions each a day long, and each containing at least two, usually four or five criminal cases. Some highlights:

• There are no plea bargains. With some minor exceptions, every criminal case is tried in a full court session.
• There is no jury. Criminal cases are tried as a rule by a panel of four judges, of which one is legally trained and three are lay judges, each having an equal vote.

Later essays in this series:

• The main hearing in a Finnish criminal trial (November 16, 2005)

See more ...

A long time ago, I wrote:

In these days of VPN, IPsec, dynamic routing, tunnels, IPv6, and autoconfiguration protocols, one would expect that it would be possible to configure a laptop to find all kinds of hosts automatically, both for those that are network-specific (proxy servers, NNTP-servers), and for those that are not (mail servers, version control systems, ...).

I then went on to say that I could not, at the time, expect my laptop to find those networks by itself; every time I logged on to some network, I had to set up at least two SSH tunnels. I received a lot of feedback to that post, and I now do have my laptop set up so that it configures itself automatically if necessary. Well, almost; see below. This is what I've done: I don't use ifupdown on my laptop anymore. The package is installed and configures my lo interface, but that's it—nothing else. Instead, I'm using whereami to configure my network cards. Whereami is an excellent piece of software that is configured through two configuration files: detect.conf and whereami.conf. The former has a pretty peculiar syntaxis, which you'll need to get used to at first; but it's very powerful. There are a few things you can do in detect.conf:

1. Run tests. A test will check whether a condition is true, and set a location based on the result. An example of a test could be

   testmii eth0 lan
   

   which checks whether the MII detects a cable (testmii) on eth0, and will set the lan location if that is true. Tests are the raison d' tre of detect.conf; the point is to run as many relevant tests as possible, to get as much information as possible about the location where you are; that way, you can configure the system later on from whereami.conf (see below). There's other things like testdhcp (check for the presence and/or the returned IP address of a DHCP server), testap (test for the presence of an Access Point), testmodule (check whether something loaded a given kernel module), or even testarp if you're desperate (to test whether a node with a given MAC address lives on the network).
2. Checking locations. For instance, you might want to run testdhcp on eth0 only if the location lan is set already. This way, you don't get timeouts if you're on the train or anything. Checking locations is done with if <location> ... elif <location> ... else ... fi. Which is to say, you get a multi-line block of if structures, in which you can then run other tests conditionally. I'm just too lazy to write it out here :-)
   Unfortunately, it is not possible to nest if structures in detect.conf; but I don't think it's actually necessary for the detection (it might be nice for whereami.conf later on, but there the issues can be worked around).
3. There's also the possibility to do things like setting environment variables, default locations, and some similar housekeeping things.

It is possible to set more than one location from detect.conf; for example, right now my laptop claims it's at werk,dhcp,lan. At home, it detects it's at thuis,dhcp,lan—unless I use my wireless interface, in which case it detects it's at zd1211,thuis,wlan,dhcp,wdhcp After whereami finished the tests in detect.conf, your network should be working (provided you have a network cable plugged in, or are in the vicinity of an AP that you can connect to). Next, it will process whereami.conf. The genius of whereami probably lies in whereami.conf: this is a simple shellscript, but every line can be preceded by one of +, -, or =, followed by a location. For example, I have (amongst other things) this set up in my whereami.conf:

+lan ln -sf /etc/news/leafnode/config.generic /etc/news/leafnode/config
+werk ln -sf /etc/news/leafnode/config.werk /etc/news/leafnode/config
+thuis ln -sf /etc/news/leafnode/config.thuis /etc/news/leafnode/config

Whereami will check this file for any lines that start with '+' followed by a location it's going to, or '-' followed by a location it's leaving from, or '=' followed by a location it's either leaving from, going to, or staying at. It then removes the +/-/= plus the location, and dumps the rest of the line to a file; that file is then ran as a shell script. In other words, the above code will overwrite my /etc/news/leafnode/config with an appropriate configuration, depending on what network I'm entering. I don't have to reconfigure NNTP servers anymore. Nor do I need to set up any tunnels—whereami does all of this for me, and more. Next, since a few weeks, I've also added ifplugd. Previously, when I would get my laptop to resume from swsusp, I would need to manually run whereami afterwards; with ifplugd, this is no longer necessary—I just removed the ifupdown script in /etc/ifplugd/action.d, and replaced it with a whereami script that I quickly wrote myself (not as if it's hard, obviously). There's just one thing left: the proxy server. There are just way too many programs that one needs to configure to use a proxy server (or not) in Linux; and though it's possible to configure a proxy server by letting firefox "detect" it, I have no clue how that's done. Additionally, programs that use proxy servers through environment variables can not be reconfigured, unless one logs off and on again. I guess I'm looking for something that will do transparent proxying if there's a proxy server on the network, or just forward the requests to the remote server if not. But that's for another time.

I know, I know. A bit early, you might say. But let's face it: The shopping industry is already fully into christmas. You already get advent calendars, christmas cookies and thing in the various stores. And I got my first christmas presents the last week.... First of all I finally tried again to switch to Linux 2.6. Going through the great amount of options in my make oldconfig from 2.4 I finally tried to boot with it. The most deep changes I did was:

• Switching from APM to ACPI: This was one of the things I was worried about. But there was nothing to worry, I now can even see the temperature of the processor!
• Software Suspend: I now can shutdown my system to disk! That rocks, and seems to be more stable than the former APM sleep mode, which occasionally had problems with waking up again...
• The powerbutton now performs a shutdown. Unfortunately it is the only button that seems to get recognized, the key bindings with the function key don't do much. But I am confident that this can be settled out, they are sending keycodes. Calling acpitool manually isn't that much of an annoyance yet.
• Switching from OSS to ALSA: Another thing I was worried about. But I found out about the OSS emulation, so that reduced my worries. In the end I'm now even running without it, programs like mp3blaster I'm running with the wrapper from alsa-oss. Switched the few packages that were OSS specific on my system (like the SDL sound package) afterwards and am happy with it.
• Framebuffer module neofb works now built in! Finally I also can play around with some nice boot logo, and in connection with software suspend this isn't even wasted time. :)

This was my own christmas present. But I got some more, from a dear friend whom I'm working with and helping from time to time. More in a funny way I sent him a christmas wishlist, but he took it serious, and so there I am. Like, with a Gameboy Advance SP Kingdom Hearts Edition, including the game. I really loved the first part on my Playstation 2, am desperately waiting for the second part which shall be released in europe in spring next year... *sighs* The second major part was a Typhoon My Mini DJ music player. Most important thing for me with it is that it plays oggvorbis files natively. Finally I'm not the only one without a portable music player! Last but not least I'm going to attend LWE in Frankfurt/Main, and finishing my LPI Level 1 certification there. I'm not too worried about the test, though it for sure will be a good feeling to finally have something written and not only you lot telling me that I have some knowledge about it.

There's a lot of debate going on across Planet freedesktop.org (okay, so just Havoc), and Planet GNOME (most everyone else) about marketing of media players right now. Discussing iAudios seems pretty timely.

Convinced by Jimmac, and also the shiny look, I skipped off to buy one while I was in the UK late last year. My iRiver was alright, but it was absolutely massive and very heavy, so it just had to go. I grabbed one, and have been very happy with it ever since. But with a few bumps in the road.

In April or so, my remote's display suddenly stopped working. Apparently this was a known issue with that one batch of remotes, and everything else was OK. So I eBayed a new remote at a cost of around $au115. Ouch.

Some time after that, I was attempting to reset it on the train, after it hung. Turns out that the reset button is a relatively small part of a small plastic mount, perpendicular to the mainboard. And if you poke the wrong part of it with a pen, you can snap the whole bloody thing off.

About a month ago, I just lost the ability to charge off AC; you could only do it if you were holding it at a weird angle, and eventually it just lost that ability. Which I found weird, since it's not a direct plug; there's a small breakout adapter which contains the plug for it. So it's not like the contacts on the plug in the device itself are just weird. Same problem with the cradle. So I resorted to overnight charges off USB (gah).

A while ago, the final straw in terms of it finally losing day-to-day usability was that it stopped making proper contact with the 3.5mm headphone plug, so if you held it at an angle, it just barely worked, but you got the occasional burst of awful, loud, electrical noise.

It hasn't been treated especially badly; just a lot of use, in my pocket every day, contending with my phone for space. But in just under a year, it's almost completely disintegrated.

The only reason why I bought it really, was because a lot of my older CDs have been destroyed (two roadtrips with a friend, and his car turned out to have some sand in the tray ...), and I'd really rather not transcode from Vorbis to either MP3 or AAC. But I'm pretty sure my next purchase will be a G3 40G iPod off eBay, because the clickwheel is an utter abomination. Say what you will about their marketing, sales in Europe, or whatever (FWIW: they're mindblowingly popular in Australia), but the G3 design is far and away the best design I have ever seen in any music device since my beloved MZ-R900, which met an unfortunate end when it hit ashphalt at high speed. It's quite beautiful, and the UI Just Works.

Compare this with the iRiver, which is clunky and awful to use, and the iAudio, which is the same, but with some bizzare additions. Such as the two clickable jog wheels. One of them is the 'action' button (think: the Navi key on Nokia phones), and the other brings up a context menu. Except when you go into the options, whereby the action button brings you back to the main screen, and the context menu thing is the 'action' or 'OK' button. Totally bizzare.

A few weeks ago I had a chat to Karin Purser of the Linux Australia Podcast Service. Karin regularly compiles the Linux Australia LUG Roundup, which does an excellent job of keeping people informed about what is going on in other LUGs around Australia, and now New Zealand. This month they decided they wanted to talk about WLUG and one way or another I ended up as the person to talk to. The interview is now online and apart from being a bit long winded and sounding a bit poncy in a couple of places I think I did an OK job of describing WLUG and the state of Linux in New Zealand. I need to remember not to talk so much in response to questions in future! Grab it from the following locations:

• Ogg Format
• MP3 Format

or see the Linux Australia Podcast Service Homepage for links to torrents of both files. I think what I’ve come to realise over the past month is that our efforts to create a Linux NZ type organisation may have been misfounded. Linux Australia is already showing a great deal of support for NZ (LCA’06 in Dunedin, WLUG in the LA Lug Roundup, etc), so perhaps we should be pushing to have this support formalised and extended. Worth thinking about some time in my opinion.

(A continuation of my reminiscences as an expert witness.) In an earlier post, I made brief mention of the unpleasant realities of being a witness in a trial. More details, ahoy! Most witnesses aren't allowed in the courtroom except when they're giving evidence (to avoid bias) and have to sit out in the hallway. Bring a fat book, because you could be out there for days. I don't think much compensation is provided for your time, either. And, as a final indignity, the lawyers might not even end up calling you to the stand. For example, one of the prosecution witnesses in the case I was involved with was called to appear, and sat outside the court for eight (count them, 8!) days, before being told he wasn't needed after all, and he could go home. I don't know about you, but if that had been me, I would have ended up in the dock myself on a charge of mayhem. Another witness, after having been through her time on the stand, made a comment along the lines of "I'm going to make sure I'm overseas next time". Expert witnesses (as I was) get treated a little better. We can watch most of the bantering in court, while we evaluate the technical evidence presented by other witnesses (experts and non-experts alike), and at least the pay is sensible. As an occupation, "expert witness" would be OK. The hours are pretty sweet, the pay is good, and the conditions quite reasonable. For a regular geek like myself, though, it was fairly close to agony by the end of it. I've had three big projects on indefinite hold while I was at court, unable to give my clients a firm date when I could resume work for them. They were all understanding, bless them, but I could have lost out badly. The complete uncertainty as to what is going to happen and when means that you basically end up camping out at the courthouse for umpteen days. At least, in my case, I was being paid regular consulting rates for my camping. When I say uncertainty, I really do mean it. I was originally told I'd be needed for a day or two -- a quick look at what the other witnesses were saying, maybe jump in the box for a bit, and then I'm off. Then the first witness in the stand was there for nearly three days (along with a day or two of procedural stuff in amongst it so I had been there a week before he was finished). Then the defence was going to make a motion for dismissal, because the prosecution were being pummeled by his honour for their lack of case preparation, so I would have been out of there. That never materialised. Then more procedural faffage, another witness that ended up in the box for about 4 days -- each day of which I thought was the last -- and then it was my turn, which lasted nearly four days. At no stage did I have any indication of when it was going to be over, either, so I couldn't say with any sort of certainty when I could start helping anyone else out. While the legal system has a vital part to play, I'm wondering if something could be done to improve the running of trials to reduce this sort of pummeling of witnesses. On the sweet hours: court convenes each morning at 10am. There's usually half and hour to an hour of transcription correction (although I get the impression that isn't a standard thing) then witnesses start going through. There's a half hour morning tea break around 11 or 11:30, and then an hour lunch at 1pm. Usually there will also be an afternoon break of 10 to 15 minutes, before court adjourns for the day at 4pm (if not a bit earlier). I presume that the reason for the short days is that it's mentally very tiring, and there's lots of prep work for the lawyers mornings and afternoons, but it's a lot better life when you've got none of that to do. Unfortunately, the day isn't short enough that I could get a lot of other work done, so it's effectively just a short-paid day.

I previously mentioned in a sidenote to another post that I've been involved in a court case over the last few weeks, and I promised a few people I'd blog about my adventures there. Obviously, not quite everything can be discussed in an open forum, but I checked with the legal beagles and I'm OK as long as I stick to generalities. Which is fine by me, since the detailed specifics are actually immensely boring. Executive Summary: It's the law Jim, but not as the TV shows it. I have to recommend that everybody spend a bit of time watching a case or two at their local court. It's surprising how different reality is to what you see on TV (of course, Australian courts are going to be different to the US courts we primarily see on TV, but even the dramatic representations of Australian courts I've seen are fairly inaccurate). The legal system, while appearing to be out in it's own little world, is a vital and integral part of most societies, so it's useful to have at least a basic idea of what goes on in them -- not because you'll end up in one (and even if you did, your lawyer will tell you what to do) but because it's an interesting insight into a part of our world that often affects us, but we don't like to look at. (Going and watching your houses of parliament, or an abboitoir, is a similar thing). Second, if you can possibly avoid it, don't get involved in a case. Not as a defendant, not as a litigant (in a civil case), and not as a witness. Litigants and defendants get screwed because they're stuck in a small room with a bunch of people they don't know or particularly like, for days or months, with a limited understanding of what's going on. Boooooooring. For witnesses, it's a different kind of pain. But I'll leave the details of that for another post. One of the things that quite surprised me is the general good nature and decent relationship between all of the legal professionals involved. They're willing to help each other out, they concede points graciously, and there's a surprising amount of banter between all of the lawyers and (in some cases) the witness as well. I'm told that this was peculiar in my case because I was involved in a voir dire[1], and everyone's on their more formal behaviour when there's a jury in the room. At times, it was almost a pleasure to watch the proceedings -- like a slightly dry but nonetheless compelling play. Most of the time, though, I characterised as "Snail Racing" -- about the most dull activity one could imagine, but nevertheless you just can't tear your attention away in case something interesting happens while you're blinking. When I say that the lawyers are good natured, that's not to imply that they're not vehemently arguing their case. Toward the end of the voir dire, in particular, counsel for the defence started to get rather vocal as to the lack of proper procedure on the part of the Crown. Over the entire voir dire, too, both counsel were always pressing hard and always trying to get their case seen in the best light. But their vigourous pursuit of the case never got personal or competitive. I think that's actually something that a lot of free software people could take on board (myself included) -- argue strongly for your position, but never internalise it or make it personal. Your position may be rather important (the defendant in my case was looking at up to 14 years if he got sent down) but making it a personal attack isn't going to help your case. I was amazed at the speed with which counsel picked up on new concepts and ideas. Unsurprisingly, the expertise I provided was quite technical, and counsel were not particularly computer literate. However, over lunches, I was able to essentially brain dump fair chunks of knowledge at the barrister, and he then went inside and laid it all out, usually accurately and very good presentation. It's also intensely satisfying to know that the questions that are being presented were suggested by you, and the skillful way that the ideas and queries were weaved together. I guess you'd get a similar buzz writing a play and then watching skilled performers bring it to life -- not necessarily exactly the way you imagined, but with an undeniable skill and vibrance. I've got a lot more material about my adventures in the legal system, which I'll be posting over the next while, but I figure this is probably well enough to be going on with for now.

---

1. A voir dire (as explained to me) is a sort of "trial within a trial", used to determine a point of fact or the admissability of a particular piece of evidence. It is run in the absence of a jury. They're only supposed to run for a couple of days; apparently mine was extraordinary at three weeks, although mention was made of a six week marathon (in the context of "this better not be like $OTHER_VOIR_DIRE").

Ian Murdock's recent piece on the whole Debian/Nexenta controversy contained what is an almost-universal misunderstanding (so common, in fact, that I held the same misunderstanding myself until fairly recently) about what the GPL actually says about linking in other software with a GPL-licenced work. Ian writes:

It seems to me the argument that linking a GPL application to a CDDL library and asserting that that somehow makes the library a derivative work of the application is, to say the least, a stretch&emdash;not to mention the fact that we're talking about libc here, a library with a highly standard interface that's been implemented any number of times and, heck, that's even older than the GPL itself. It's interpretations like this, folks, that give the GPL its reputation of being viral, and I know how much Richard Stallman hates that word.

The core misunderstanding there is that the GPL somehow claims that libraries linked into a GPL-licenced binary are derived works. Nothing in the text of the GPL states that, and a quick scan of the GPL FAQ doesn't provide any opinions of that nature, either. What the GPL does state are a few conditions which you have to abide by in order to be given permission by the copyright holder to exercise rights ordinarily held exclusively by said copyright holder. One of those is that, in order to be given permission to distribute a compiled binary, you must be able to provide source code for the binary itself, as well as all interface definition files, build scripts, and modules contained in the binary, and that all of this material must be provided under terms no more restrictive than those of the GPL. The GPL isn't trying to lay a "derived work" claim on any of those other parts. It's just saying to you, as someone who wants to distribute a binary, "here are some other things that must be OK if you want to do this". A similar clause exists with regards to patents and court judgments (section 7, for those of you playing along at home). This doesn't mean that the GPL is attempting to claim that the patents or court judgments are derived works. A licence could also say "you must delete all copies of any Microsoft product from your hard drive before duplicating this software", but that wouldn't mean that the licence is attempting to claim that all Microsoft products are derived works of the licenced software! As anyone who's looked at a typical proprietary software EULA probably already knows, a software licence can claim pretty much anything (and, apparently, thanks to the DMCA, in the US they can make it stick). The licence doesn't make the claim on the basis of derivation, it makes it because that's just what the licence claims. The GPL is no different in that respect. If you can't fulfill the licence conditions (either because you don't want to, or because -- as in the case of the clause under discussion -- the module you are including in your binary can't be licenced under terms equivalent to the GPL) then you can't do whatever it is that the licence would otherwise allow you to do. To be fair to Ian, some of the comments he made to his blog post indicate that he does understand the distinction between a claim due to derivation and one due to a simple licence term, but I thought it worth making the point crystal clear to everyone out there in the blogsphere, because it's a very common misunderstanding, and I'd hate for it to spread any further than it has already.

Hanno B ck asks which free clients are available for receiving and subscribing to video podcasts, videoblogs, vlogs, vodcasts or whatever you want to call them. I was asking myself the same question for a number of reasons lately, and here's what I have found:

• Armangil's vodcatcher is a video podcast client for the command line. Written in Ruby, cross-platform, GPL'd, no GUI (obviously).
• PenguinTV, an RSS feed reader which supports podcasts and video blogs. Written in Python, cross-platform, GPL'd, GTK+ GUI.
• kmplayer, proposed by Hanno B ck. Haven't tested it, yet.
• DTV (DemoTV), a "free and open-source platform for internet television and video. An intuitive interface lets users subscribe to channels, watch video, and build a video library". This looks like the most mature client right now (for Mac at least), and it has been ported to Linux just yesterday. It's written in Python, cross-platform, GPL'd, GTK+ GUI. I have filed an ITP and hope to have a Debian package ready in a few days. The DTV Linux code itself is pretty beta, any helping hands with porting would be nice (contact Nick Nassar and/or the devel mailinglist).
• Kitty, a podcast and videocast client for KDE. Written in C++, GPL'd, Qt/KDE GUI.

As for the content, there's lots of videoblogs out there, and I will blog about that in more detail later on. As an appetizer, you can now subscribe to the new (German) Tagesschau Video Podcast (thanks Tim Pritlove). Update: Added Kitty.

David Berlind: “[P]icture a world where, instead of carrying a notebook computer with you everywhere you go, and instead of having power-drinking desktops in every corner of your house, all you have is a USB key that you take from one dirt cheap thin client to another. On that key is not just all of your personal data (that is stored in the cloud but replicated to your USB key for offline usage), but perhaps a small Web server and some applications, both of which are thin-client friendly.” I’m in complete agreement that the thin client/web application computing model is the wave of the future, and that the days of the fat client as the primary mechanism for monetizing software are numbered. However, I don’t buy into the notion that software-as-a-service displaces the traditional fat client entirely, for one very simple reason: It’s going to be a while yet before we have truly ubiquitous network connectivity. Sure, perhaps if you live in the San Francisco Bay area or in a similarly technology centric place, it’s easy to buy into the notion that it won’t be long before we’ll all be connected all the time. However, we can’t lose sight of the fact that a vast majority of the population doesn’t live in a world where technology billboards dominate the morning commute. Heck, my cell phone doesn’t even work when I visit my grandfather in rural Indiana—the notion of an omnipresent wifi fabric built from community hotspots is a long way off there, to put it mildly. And even when we do get to the day when we have ubiquitous connectivity, we’ll still want caching for optimization and replication to eliminate the single point of failure problem, not to mention the ability to retain control over our own digital lives. So, I view the thin vs. fat client juxtaposition as being not so much about user experience—AJAX has shown us that remarkably good user interfaces can be built on the web. It’ll be more about caching and data replication, two very important considerations in any distributed system. I think most people are missing that. David, as usual, appears to get it. My prediction: Applications will increasingly move to the web, so you’ll be able to get to your data anytime, anywhere, and from any connected device. No surprise there. But the majority of the time, when you’re using “your” client device (whether it’s a PC in your home or office or a handheld device or something that lives on a USB key and securely attaches to the network via some device that’s outside of your administrative control), you’ll still primarily interact with the web through a fat client of some sort. To be sure, the fat clients of the future will look a lot different from the fat clients of today. Hint: “Fat client” doesn’t have to mean “self-administered”. Perhaps the fat clients of the future are delivered on demand or via independently developed components that integrate into some larger framework. Perhaps it’s as simple as running a web server locally. But the fat client in whatever form will still be the primary interface the vast majority of the time. That’s why I don’t buy for a minute that Web 2.0 is yet another death knell for Microsoft. They’ve obviously got a great fat client story, and in case you haven’t noticed, they’ve just woken up to what’s going on around them. By the way, this is the area where I think Linux on the desktop could have the biggest impact—it won’t be about who has the better desktop or who can replicate the popular fat client applications of today in open source. It’ll be about who can mold Linux into the fat client framework of the future, seamlessly integrated with applications and services delivered via the web but open. If I were Microsoft’s competitors in this space, namely Google and Yahoo, I’d be spending a lot of time thinking about this. In today’s fat client world, Microsoft is between them and their customers more often than not, and if the past is any indication, they’ll be able to use this position to tremendous advantage.

So, the D-I team again made it: a new release of the "installer with no name yet" happened. First of all, yet another occasion to publicly reward Joey Hess work. Joey has managed to lead this work for five and a half years. I think that we all agree that without Joey's work, we wouldn't have such a nice installation system for our distribution. Joey now gives the lead to Frans Pop. Knowing Frans as we know him now, I'm confident that the good work will go on. Joey will have more time to hack in various parts of D-I or lead the testing security team. From my narrow point of view, I'm again proud that we cover more and more languages. The official announcement mentions 9 of them. We can add Vietnamese to it, even if the installer has a broken display in second stage because of a now solved localechooser bug. As a consequence, we continue to paint the world map in red. The next big push on that matter will be the release of a graphical version of the installer (an alpha version is already advertised) which will support the rendering of the various languages from india for which translation is on its way.

# metadata <p> I woke, not for the first time today, and there were people all around. Dressed up and talking. And drinking. </p> <p> Ahh! I'd fallen asleep at a bar. <em>Again</em>. Fortunately that is enough off a clue for me to realise that I should go home. Getting home, is where this adventure starts. </p> <p> I started off at <a href="http://www.sydneypubguide.net/pubs/Cruise.aspx">Cruise Bar</a>, which has a great view of the Opera House [<a title="Sydney Opera House in the afternoon" href="/~wildfire/aum/images/opera-house-in-afternoon.jpg">1</a>], [<a title="Sydney Opera House at dusk" href="/~wildfire/aum/images/opera-house-at-dusk.jpg">2</a>], [<a title="Sydney Opera House at night" href="/~wildfire/aum/images/opera-house-at-night.jpg">3</a>] and (somehow) staggered my way to the <a href="http://www.sydneypubguide.net/pubs/Ship_Inn.aspx">Ship Inn</a>. Unable to flag down a cab in this area &ndash; lots of people going home around 23:00 &ndash; I resolved to get myself to North Sydney, where lots of cabs are. </p> <p> For those of you unaware, Sydney Harbour Bridge now has security personnel stationed at all pedestrian entrances and across its length. At least six of them "patrol" the bridge. </p> <p> By "patrol", I mean of course you'll be queried as to why you wish to cross the bridge. <q>Mate [sic], you can't cross the bridge. You aren't allowed here</q>. <q>Mate, are you fucking deaf?</q>. (on radio, to pals)<q>Yeah the fucking wog is crossing, shall I intercept him and hold him?</q> </p> <p> Followed while crossing the bridge. In my case I had (at one stage 3 security personnel behind and adjacent to me and 3 policemen ahead of me). And abused (I was repeatedly cursed at, racially slurred against, by the people from IVS Security) during your walk over the bridge. It amazes me that they even had police waiting to talk to me. Fortunately I know that the best thing you can do when confronted by the police is not to say anything. </p> <p> In this case there is nothing they could do -- since crossing the Harbour Bridge, and not responding to the security guards who harass you is not (yet) a crime. Today, 2 Nov 2005, though the Parliament of Australia is rushing through laws which might mean that I can be "detained" and held incommunicendo indefinitely. </p> <p> These laws &ndash; part of the War on Freedom &ndash; would make the rest of this entry illegal. </p> <p> I've been thinking about terrorism and Australia. How would you get access to restricted locations, determine sensitive areas and generally get information not available to the ordinary public? Become a security guard. </p> <p> In Australia, things like <a href="http://smh.com.au/news/national/braindamaged-man-told-to-pay-up-after-bashing/2005/11/01/1130823210703.html" title="victim of security guards">this</a> are not uncommon. (c.f. David Hooks killed by a security guard; a female security guard shooting someone, etc.). Worse is that security guards often enjoy a fairly close relationship with the Police. Meaning that if you join up, you also get to know some of the procedures that might be applied to deter you. Bottom line: every security guard is a potential terrorist. </p> <p> Terrorists, like modern-day Politicians, seek to curtail the liberty of others for their own purposes. The best way to do this is by planting fear and doubt into the hearts and mind of the general populace. In America, this was done via the September 11 plane hi-jacking; in the UK, by exploding bombs on the mass-transit system there. </p> <p> How, or where, should Australia be targetted? Australians are renowned world-travellers (I believe the figure is that 10% of Australians are outside the country at any one time), so attacking transportation isn't the way to go. You need to go after the life-style. </p> <p> Large community events, like Melbourne Cup day, the various Grand Finals and, of course, Cricket would be the perfect targets. High visibility (the media are already at these venues!), high impact (you are talking 30,000+ people in these stadiums), for minimal cost (a stadium has few seating area &ndash; probably 6 to 8 attackers could bring down most stadiums). </p> <p> Another good location would be to pick your local Westfield shopping centre / mall. Lots of people, lots of fear instilled. Plus we'd be rid of the stupid things. </p>

I’m writing a registration database for Anime Detour, our local anime convention. Normally I would hate this kind of work (does anyone actually like SQL?) but SQLObject, which gesten pointed me towards, is really awesome. It basically turns any SQL database (in my case SQLite) into a Python object database, with classes as tables, instances as rows, and Python class methods for queries. People stuck writing database code should definitely check it out. Another Optimization Lesson
Quod Libet stores a library of your music, like most other players. The most common things the library needs to do, and therefore the most efficient things it should do, are 1) get a list of songs in the library, and 2) check to see if a song is in the library (or equivalently, given some handle, retrieve the song with that handle from the library). Anyone familiar with Python will probably think of a dict keyed to something unique, like the filename or URI. That’s what I did, and that’s what I wrote. When QL saves, it serialize the song list using pickle, and dump it to the library: pickle.dump(library.values(), file). When it loads, it does something like for song in pickle.load(library): if song.valid(): library.add(song) where song.valid() reloads the song if its mtime has changed or removes it if the file no longer exists. So what’s the problem with this code? I sure didn’t see one until this morning, when our Italian translator complained about interestingly long cold cache startup times. The answer’s at a lower level than Python programmers usually have to work at: This sucks for disk cache. library.values() dumps the file in Python dict order, which is not only not meaningful, it’s actually semi-random for security reasons. When I reload the dumped file and iterate through the songs in it, I’m stat(2)ing files in an order designed to be as unpredictable as possible. How is the cache supposed to cope with that? The answer is, it doesn’t. Sorting the songs by filename when saving the dict costs almost nothing (Python out-sorts every other language as far as I know), but saves 10% wall clock time for me when starting - it will probably save even more on filesystems that perform poorly on stats of large files (reiser3), and directory trees that go more than 2 levels deep. Lessons learned: First, CPU profiling is good, but doesn’t have all the answers; profile.py insists the program is slower because of the sorting on exit. Second, ideas that work fine for n=100 don’t work well for n=10000 even if the algorithm you chose scales well with regard to complexity theory. Finally, the fundamentals still matter; fixing slow Python code still makes you consider OS/hardware-level cache effects.

… and for now, it’s 1.5rc2 that got in experimental. I made some changes to the firefox wrapper script so that it should be quicker to launch firefox in most cases. We don’t try to find the JVM version, since the ones we wanted to set LD_ASSUME_KERNEL for have been ABI incompatible for a while, and we don’t remove the XUL.mfasl and other problematic files since it is now correctly (I hope) by firefox itself. And if bugs arise again, we’ll try to fix in upstream code, not in wrapper script… I also fixed the dash bug and another one in xpidl. For what it’s worth, I did some testing with JVMs and firefox. I got success with

• Sun JRE 1.5update5,
• Sun 1.4.2_10,
• IBM 1.4.2SR3 (but not with java-package, see bug #338277),
• Blackdown 1.4.2-02 and 1.4.1-01.

On the other hand,

• IBM 1.3.1SR8 segfaults,
• Blackdown 1.3.1+02a and 1.3.0-FCS are built against libxpcom.so with older C++ ABI, so ld can’t find __vt_17nsGetServiceByCID,
• Sun 1.3.1_10 can’t load libstdc++-libc6.1-1.so.2.

Note: All of this is specific to Australian law. Similar principles may apply elsewhere, but I've got no idea where, if any, they might apply. Also, I'm not a lawyer, nor do I play one on TV, and my writings here (and for that matter, everywhere else) are for entertainment purposes only. If swallowed, do not induce vomiting. In the middle of a cogitation this morning, my thoughts turned (as they occasionally do) to the much loathed EULA for Nobody's Favourite OS. As we all know, this EULA is pretty brutal in the things you agree to allow other people to do to your machine, and the rights you agree to give up. As I was, in general, thinking about issues of copyright law, the EULA got looked at through copyright-coloured glasses. And it was... weird. As we all (probably) know, copyright law is about limiting the actions that can be performed with a work of creation, and giving the author of the creative work the ability to be the sole arbiter of who can perform those actions. The Australian Copyright Council has a nice information sheet on Copyright and Computer Software if you'd like to get the full story. The set of actions which the Copyright holder has exclusive rights to is fairly well proscribed. The statement "All Rights Reserved" doesn't mean "every possible right is reserved", it means "those rights which I can control (by virtue of the legally-protected monopoly of copyright law) are reserved". As far as I can tell, there is no right which allows the copyright holder to control the use of the creative work. It's important to think about what "use" actually means. The Copyright Act and the above info sheet tend to apply the word "use" to include the act of making copies, as well as other dealings (protected or otherwise) in the copyright work, but that doesn't seem particularly useful for this discussion, because I can't think of another appropriate word to use to describe a non-copying action involving the work. So I'll stick with "use" for that, and go with "copying" for any duplication. Obviously, the type of work that we're looking at determines what "using" that work means. A book is read, or perhaps burnt for warmth. A picture is stared at. A computer program is run. I can't find anything in Copyright law that covers reading, burning, or staring, but section 47B of the Copyright Act 1968 (Cth) deals with the "normal use or study" -- basically, the act of using the thing. It says that users are allowed to copy the program into RAM to run it[1]. Goody. So far, it looks like there's no way the copyright holder can stop us from running our legally acquired copies. There are two flies in the ointment, though. The first is s47(2)(b) of the Act:

(2) Subsection (1) does not apply to the making of a reproduction of a computer program:
[...]
(b) contrary to an express direction or licence given by, or on behalf of, the owner of the copyright in the computer program to the owner or licensee of the copy from which the reproduction is made when the owner or licensee of that copy acquired it.

Aaaargh! Does this mean that the copyright holder can force a licence on us, against our will? I really don't know the answer to that. Hopefully, at the very least, the protections of contracts law[2] would apply to such licences. If licences can be treated as contracts, then they can be rejected. If the copyright holder can't restrict the running of a legally obtained copy of the program, then how can they compel the acceptance of a licence? One idea that comes to mind is the process of installation. That is neither an incidental nor an automatic copy, and hence doesn't fall under the allowances of s47. So, without the permission of the copyright holder, making an installation from CD to your hard drive would seem like an infringemnet. On the other hand, the installation program usually runs directly from (for example) the CD, and if it wants to make copies of other copyright material owned by the same person or company as part of it's ordinary operation, then who are we to stop it? But back to the idea of compelling acceptance. Looking at the XPToy Retail EULA for a moment, part of the agreement is that you agree to be bound by the terms by the action of installing, copying, or "otherwise using" the software. But if you don't agree to any of the EULA, I'm not sure how you can agree that you agree to be bound by the EULA by performing an action which the copyright holder cannot restrict you from doing. On the other hand, perhaps I've drunk too much of the GPL "You don't have to accept this licence, but nothing else gives you the right to copy this software" inplied-licence-acceptance kool-aid, and there is provision in law for licences to specify other positive means of signifying acceptance. I know that contracts can be accepted by written agreement between the parties, and with a suitable verbal exchange, so perhaps you can add "Installing, copying, or otherwise using" to that list. I wonder if "You agree to the acceptance of this agreement to give me your first-born child by blinking within 15 metres of me" would be valid? No, I didn't think so either. Does anyone know where the descriptions of permissible means of agreeing to a contract are defined in Australian law? To get back on track, let's assume for a moment that we can refuse the EULA. Can we still use the software? s47(2)(b) says we can't contravene licence terms, but if we can refuse the EULA then it doesn't look like there are any licence terms. So we're back to relying on s47(1), which says copying for running the program isn't a problem. If you can avoid accepting the EULA, and don't do anything otherwise naughty with the software, I can't see how anyone can have any complaint, in Copyright law, with your actions. Of course, the next trick is to avoid clicking-through the EULA "you accept" notice without falling foul of any other provisions, but if we've already knocked the paper-EULA on the head with contracts law or something, then I don't think that your click-through acceptance (coerced, as it were) is going to worth a hell of a lot more. I know the DMCA in the US did a lot to strengthen the power of click-wrap licences; perhaps those provisions got written into AusNSFTA. Of course, this whole thing is based around a lot of conjecture and a lack of real, detailed knowledge of the law. Perhaps there's even some bits of the Copyright Act I've missed. I'd be interested to hear your thoughts on the matter. Do we need a licence to use software we've legitimately purchased? I'm interested in your comments. E-mail me at mpalmer@hezmatt.org.

---

1. I'm not quite sure why this is so majorly different to a person with an eidetic memory reading a book, but I guess it's better to cover the issue to stop lawyers getting richer. 2. There's all sorts of goodies in contracts law, from what I recall -- prohibitions against coercive contracts, and contracts presented as a fait accompli (AKA "take it or leave it") without any ability or intention to negotiate. Certainly sounds like a EULA to me...

Whilst I can’t claim to have done anywhere near as much for Gaim as Christian Hammond has, I did contribute to Gaim some time ago, and for my efforts I managed at least to attain the status of “Crazy Patch Writer”. However, I gave up trying to contribute to Gaim about three years ago. After starting out as the Debian package maintainer, and one of the founders of #gaim (yes, I know, I’m sorry, it wasn’t always like that), I spent about two years submitting patches which were ignored by almost all of the developers, being forced to beg people with access (including the support/bug triaging guy, who doesn’t really code C) to review and commit them. At the time, nobody was being given CVS access because of a recalcitrant and unresponsive former developer holding the reigns of the Sourceforge project. A few developers came and went, and in what I thought was a miracle, the now lead developer was made an administrator of the Sourceforge project and gradually started handing out access to other people who had been contributing. Except… I was passed over time and time again, and other contributors who had around for less time than myself were given access. I could accept this if I was given some justification, but I was ignored when I asked about getting CVS access and never given any reasons, despite having contributed hours and hours of my time and helped rewrite and clean up sizeable chunks of code. It actually had me close to tears on several occasions, and still upsets me a huge deal that no explanation was ever offered to me. After starting out with packaging work in Debian, Gaim was the first project where I became involved with actual development, and I learnt a great deal from hacking on it, but when I started at university I decided I’d spent enough time pouring my heart into such an unwelcoming recipient, and I moved on quietly.