Fascinating New Yorker interview with Brent Scowcroft, National Security Advisor to Bush 41. I wonder how the author, Jeffrey Goldberg, gets this degree of access: he’s apparently emailing back and forth with Bush 41, having coffee with Colin Powell, and engaging in frank discussion with Scowcroft for a significant period of time. This sort of reporting is the antithesis of what you see in most newspapers, where the reporter probably spends no more than a few hours piecing together information that is widely available. This is also consistent with everything I’ve seen in the New Yorker for the past few months I’ve been subscribing—high quality writing and primary source information that you won’t pick up just from reading blogs. In any case, it’s interesting to see all these conservative ideologues from the Reagan-Bush era turn on the neoconservatives. If Brent Scowcroft thinks the war in Iraq is misguided, does the current administration have any hope at all?

I was just experimenting with Google Print and discovered that a book I contributed to has been translated into Italian! Here’s the first page and last page of my essay. That’s kind of a funny way to find out you’ve been translated. I wonder if it the translation is accurate. In any case, I can safely say that I am a member of that overwhelming majority of authors who can only benefit from Google Print. Not that I receive any royalties for that piece, but it’s still nice to think someone might discover that book who would otherwise never have heard of it. (Incidentally — do Google Print links persist over time? I guess we’ll find out).

GNOME 2.12 is mostly in experimental now (for i386, builds for powerpc are very welcome), only missing a control center and gnome-panel upload, plus gal being ACCEPTed so evolution 2.4 can be installed. Trying these packages is easy: on an up to date unstable system, just issue: apt-get install -t experimental gnome-desktop-environment Due to a dbus transition, you might get some packages removed if they don't have an experimental build using the new versions. In many cases, there's nothing we can do about it so it's a matter of waiting. The good news is that KDE has finally entered testing, so I'd expect that we'll be able to upload all of these packages to unstable quite soon. Hopefully before April, when GNOME 2.14 is due. :) Update: By the way, in case you're still cursing about that major evolution breakage the other day... yes, it was totally me to blame. :)

Being almost friday and having a little bit of time and all i decided to create a new blog. Since my debian account was created recently i though 'why not' and added it to Planet Debian, among the best of the best.

Reading today the slashdot article about Nokia and opensource i remember about a project i did this summer. Following a question i posted about handling private keys on debian-security sometime in june someone emailed with this reply, which i found very interesting. And i actually wrote that, even though it's pretty rudimentary (authentication using mobile devices and assymetric keys).

Basically when you enter a username at the login prompt, the PAM modules looks up information about that user from a configuration file which contains the hwaddress of his assigned device and a path to a public key (either GPG or SSL). The PAM module then generates a temporary password, encrypts it with the users public key and sends it via bluetooth to the mobile device.

The Symbian part was a little tricky, and my first encounter with java. I implemented only SSL decryption capabilities because it's a faster decryption time (~4 sec on my 6630) , and because BouncyCastle's cryptography support for pgp is impossible to port to j2me with my java knowledge. Anyway i haven't seen assymetric key cryptography (oss) on mobile devices until this. Being in java it doesn't really use anything fancy, and it _should_ work on any mobile device supporting FileConnection API (jsr-75).

If you feel adventurous, you can find the source code here.

Broken News is absolutely fantastic, and I just discovered that there is a third series of Peep Show "coming soon". Cashback! Update: just found out that the new series will start on the 11^th November. Back of the net!

On Wednesday I got up way too early in order to go to Heathrow in time for my flight to Osaka. The flight went via Frankfurt and wasn't terribly spectacular. I was a bit disappointed in the flight entertainment system (only shared monitors in the middle of the plane, mostly showing movies I've seen before) but I had Hodges' biography of Alan Turing with me and slept for a while, so it wasn't a bit issue. Arriving Thursday morning, Yabuki-san, who had originally invited me to the Japan Debian Mini-Conf (JDMC), picked me up from the airport. Shortly afterwards I met up with Imai-san, who was so kind to go sightseeing with me in Kyoto. I wanted to go there because I heard that it's quite different to Tokyo, where I stayed for about 10 days for a conference three years ago (incidentally, that trip was in October too, so it was three years ago almost to the day). Kyoto was surprisingly close to Osaka — it was faster to get there than to go from Kansai airport to the city center of Osaka. We first went to Nijo Castle, followed by some temples, including Kiyomizu-dera, one of the most celebrated temples of Japan. We had sushi and noodles for lunch, and in the afternoon we returned to Osaka so I could rest for a few hours before meeting up with the interpreter of the conference. This we did at a restaurant specialized in tofu. The food was surprisingly good given that I'm normally not a big fan of tofu at all. The following morning, I had my keynote speech, talking about release management. I covered various insights learned from my research and then tried to apply some of them to Debian, asking the question whether something like time-based releases would make sense for the project. A big issue is obviously planning, and I think the new release team does a much better job at this than we did in the past, even if many improvements are still possible, such as better coordinated NMUs when major transitions take too long. All of the other talks where in Japanese, so I was either working on my laptop or walking around the city. The first day, Hatta-san and I went to Osaka Castle; Roland Mas, who briefly turned up for the JDMC, joined us as well. The second day I did some shopping before going to the conference where I participated in the key signing session. On Sunday morning I had to leave again... it was a nice trip, even though much too short and influenced by jet lag. I think there could have been more people at the JDMC but on the other hand it's nice to see some efforts to attract new developers in Japan and this conference was certainly a good first step in that direction.

I’m trying to accomplish what I believe should be a simple task with iptables—replace my DSL router with a linux box. The linux box also routes packets to other machines on the LAN based on destination IP address (the box receives packets for multiple IP addresses from the Internet) and port number, and blocks other packets based on originator IP and port number, but as I understand the firewalling and inbound routing chains are totally separate from the outbound NAT functionality. In any case, the inbound stuff works perfectly now. It seems simple enough to set up a box, where eth0 faces the Internet and eth1 faces the LAN, to act as a gateway or proxy to the LAN:

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 

And that actually works perfectly, except that a Windows box inside my LAN is unable to connect to a VPN outside the LAN, while it worked fine with the Buffalo router I had in place before. All other services are properly accessible through the gateway. So I posted a description of my situation to comp.security.firewalls. I admit that I have, at best, a basic understanding of iptables, but I have read the manpage and documentation and gotten it to do 99% of what I need with the exception of this VPN issue. In response, a “Wolfgang Kueter” called me clueless multiple times, said that I had no idea what I was doing, and that I “misunderstand almost everything,” and that I should pay a professional to do it for me and read books on TCP/IP and the IPSec protocol specification itself. Other newsgroup postings by this fellow have a similar tone, e.g. building a security suite (Q: What combination of software firewall, anti-virus, etc., are you using and have you noticed any discernable effect on performance? A: None, because they are useless crap. … I don’t use such crap, so how could I?). Steve suggests that Web 2.0 should have some way to tag people like this as jerks, and their reputation would then follow them around on the web. Since that technology doesn’t yet exist, the next best thing, I suppose, is to just blog about it and hope this entry turns up in a search on the person’s name. Abrasive responses to legitimate requests for help from people hoping to learn something don’t do anything to advance the free software movement. I suppose this kind of person will always exist, but I wish they didn’t. I don’t want to be petty about this sort of thing, but I actually don’t think I need to hire a professional or read books about TCP/IP and the IPSec protocol specification itself to configure a Linux box as a residential gateway. Does anyone disagree?

Today, a UPS delivery guy delivered a largish box, containing the Quadra 700 that had been donated to me by Sebastiaan Couwenberg (thanks!). The box was much larger than I expected, however. At first, I was afraid; if it ended up very large, I wouldn't have any space to put it anywhere. Fortunately, on opening the box, I found that it was, in fact, not very large, as the case is the same as that of the IIci (which is the smallest case I have—people who went to DebConf5 may remember what it looked like, since it stood in the hacklab the whole time); instead, the box contained more than I expected. Aside from the Quadra, the box also contained a keyboard, a three-button ADB mouse (I didn't even know those existed in the first place), and a monitor. Whee. I had four macs (of which one has a broken LC040, so is not usable), but only two ADB keyboards (of which only one is in perfect working order), one ADB mouse, and one monitor (which beeps annoyingly if it's been powered on for more than a few minutes). With this, that amount has suddenly doubled, which is very welcome. I'll probably move this monitor to the office, and move the one at the office home some time. Not just yet, though.

A colleague introduced me to Hamachi, a software that claims to be able to connect computers without a fixed internet connection to a VPN between them… The authors say their software is secure, because no communication passes through their server, that serves just as a way to establish the connection. Apart from the fact that in some cases I don’t see how it would be possible for it to work (eg, if both ends are behind a nat…) I also don’t think their protocol is as secure as they say! It seems that if the server wants to lie about the other endpoint public key and ip address it can, and so it is able to create VPN with a man in the middle with absolutely no effort… :( So their protocol is secure only if you put complete trust in their server… What do other people think? Am I right or wrong?

Sony DRM rootkit love.
RIAA/MPAA broadcast flag on steroids love (PDF). Now, tell me what you will do with your computers and personal pictures/videos when they belong to you no more...

So, many people have had many things to say about Gobby, the much-vaunted app with the most phenomenally awful and unfortunate name I've ever seen in a free software app. This tends to be either hype (oh my god, it will enable us to leverage synergies to maximise shareholder value like we've never leveraged synergies before!), or disappointment (is that it?). Mine is neither, really.

I don't find that collaborative editing is hugely groundbreaking; a small IRC channel which everyone uses to document things, then assembled into a text document from there, can do roughly the same job. One thing we've been using it for at Ubuntu Below Zero is taking notes in BoFs. Most people in the BoF log in and the main note taker does the bulk of the work, and either him or the assignee steers conversation.

Normally in BoFs, I either get so involved in it that I forget that I'm supposed to be taking notes and thus don't, or tune out somewhat and forget to take any notes, and have to reconstruct it from vague memories later on. What Gobby is useful for in this case, is keeping the note-taker honest. If the notetaker is writing down anything inaccurate, you can just fix it; if they're forgetting to take notes at all, you can stop talking and throw some Mentos at them.

I think this alone makes it tremendously useful for stuff like note-taking in BoF sessions, and could be useful for minuting conference calls also. Adding the IRCalike interface is useful too as an out-of-band channel to throw URLs around (and to give Seb crap about using azerty) also. So I'm pretty sure I'll keep using it for that.

itv4 launches tonight on freeview and ntl cable, but it seems that Sky have an administrative problem that will stop it being on Sky until next week. Anyone else suspicious? To compensate, itv4 launch night is being broadcast on Men and Motors too (which is visible across Europe, I think). The talk on the newsgroups suggests that itv4 is on satellite and it's only the non-standard Sky EPG which won't be updated. If you want it sooner, you may be able to use a standard DVB-S receiver or "Add Channels". Eutelsat float price falls. The report suggests it's because of other floats, people not wanting to invest so much in communications and bad bank practices. BBC World closes 10 radio services, opens 1 TV service which might suggest how much more expensive TV is to make. Meanwhile, a report says:

"Public service broadcasters are compromising quality to compete with commercial channels, and many of them depend on Governments or political parties. Meanwhile, ever-larger concentrations are developing in the commercial sector, often with clear political affiliations."

(Television across Europe report from OSI EUMAP) There's a guide to what I'm planning to do Real Soon Now: konekti la komputilon al televido If you want to get involved with radio instead, you could answer this call for help with rampART radio, from ram radio. I think they were interesting listening during G8 and on 7 July, but maybe they need a different approach for the rest of the time. RampART broadcast over the internet, which was how I listened. Many of the documents describing the internet are non-free, which is a silly silly pain. I've supported the petition about Problems with the IETF's copying permissions, by Simon Josefsson (author of libidn and gnutls) but I haven't done more yet. Moving to games, Sam Hocevar's post about Monsterz is unhappy with the difficulty of finding items for it:

"it makes me feel like coders are years ahead in terms of sharing their digital work for everyone to use and improve."

He's not alone. Want a big example? Stuart Yeates noticed that ibiblio's torrents have poor copyright info. I've also spotted Sourceforge and BerliOS hosting non-free data in the past. That's really annoying: you can't adapt everything you download from them and you have to read the terms really closely if you want to develop free software. It surprises me that Sourceforge and BerliOS stick so closely to the FSF's software=programs myth. It might be surprising that ibiblio's torrents seem blind to copyright metadata, but it's probably little surprise that a European Commission group assumes that strong, standardised, zealously-enforced copy controls are The Only Way and has meant the EFF Urges Fresh Inquiry Into Ramifications of DRM. There's news of a peer-to-peer technology that honours copyright law, by Derek Sooman. Will it work? Will it support liberal copyright terms as well as Big Media Grabs? Might Big Media outdo ibiblio? I doubt it.

There are lots of cases where you can have a positive view of a stock, but still want a bit of investment protection. A fairly typical way of getting some protection against a drop in price is to place a stop-loss order with your broker, so that if a stock hits a certain price that you set, the broker will automatically sell the stock. This limits your loss (known as downside protection), and if the price doesn’t go down, then you keep all the stock, and you get to take full advantage if the price goes up (known as upside participation). Also, it should be free to place a stop-loss order with your broker, unless the price is hit and the stock is sold. So, stop-loss orders have three benefits: downside protection, upside participation, and no up-front cost. Unfortunately, there are a couple downsides (no pun intended) to stop-loss orders. The first is that if a stock is really plummeting (there aren’t any buyers at all), then it may be difficult or impossible for your broker to get the price that you’ve specified. That’s sort of an extreme situation though and only happens about once every thirty years (think October 19, 1987). The other, much more likely, scenario is that the stock goes through a temporary decline (causing your stock to be sold), but then recovers. In that case, you’ve sold for a loss and you miss out on the recovery. So instead of placing a stop-loss order with your broker, you can purchase what’s called a protective put. A “put” is a contract that says the buyer of the put has the right (not an obligation; it’s the buyer’s choice) to sell stock on (or before, in most cases) a predetermined day at a predetermined price to the person who sold (”wrote”) the put. For example, today RHAT closed at $23.22; you can buy an option to sell 100 RHAT shares at $22.50 (the strike price) anytime between today and November 18, 2005 (the option expiration date) for $55 (as reported by Yahoo!). So you get downside protection and full upside participation, for a price. (There’s also a married put, which is the same thing as a protective put, except you buy the stock at the same time as the put; a protective put implies that you already own the stock.) But there is still the annoying up-front cost. If you’re willing to risk missing out on some of the potential upside though, you can offset the costs. A collar is when you buy a protective put and at the same time selling a call option. By selling (writing) a call, you give someone else the right (again, not the obligation) to buy shares on a predetermined date for a predetermined price. For example, say you do buy the protective put above, and at the same time, write a call option for 100 RHAT shares that expires on November 18, 2005 for a strike price of $25. The proceeds from this sale will be $30 (again, minus fees). So for a cost of $25 ($55 to buy the put minus $30 to write the call), you’ve got downside protection, and upside participation up to about 7.7%. All of this assumes that your preference is to keep the stock. But say that your stock has done very well and it’s gotten to be a sizeable part of your portfolio, and you’d like to diversify a bit. That means that you’re serious about selling it, regardless of what you think the price is going to do. (There are lots of good reasons to sell a stock that’s enjoyed nice gains, not the least of which is that nice gains are generally caused by nice growth, and a company can only grow so big.) Selling the stock outright is one technique; another is a variant of dollar-cost averaging, but instead of buying a fixed dollar amount, sell a fixed number of shares. But you can combine either of these with writing call options to potentially achieve even better results. A covered call is when you own a stock and write a call option on it (like a married put, a buy-write is when you buy the stock and write the call at the same time). Instead of selling the stock immediately, you give someone else the option to buy it from you at a predetermined future date. Because the date is in the future, there’s a bit of a premium that buyers will pay (which means more money for you). For example, November 18, 2005 calls for RHAT with a strike price of $22.50 are selling for $120 for 100 shares; that means that if the option is exercised, you make $22.50 from the sale, plus $1.20 per share from the option, for a total of $23.70 as your effective sale price. If the option is not exercised though, then your shares are not sold, but you get to keep the $120, and do the whole thing over again. (Unfortunately for me, Brocade has a company policy prohibiting collars and covered calls. But fortunately for me, I don’t own very much BRCDE stock.)

In the newest Linux-Magazin, a popular German - well - linux magazine, is a short note on Utnubu. The article is correct and sums it up quite nicely, but I am surprised by this amount of press coverage, a lot in the online news, now even on paper: Utnubu was just a quick idea of mine during DebConf, hasn’t done much besides the patch refomating and the packages diff, and my current time contraints won’t allow me to put enough effort in Utnubu to come anywhere close to justify the press coverage.This can only mean two things: A) The name was too clever for the project and therefore attracts the media attention or B) The press coverage means that Utnubu is something a lot of people do want to see. I hope for the latter.In that case, though, the Utnubu team needs more manpower (and womenpower...)! If you want to help out, just have a look at the missing packages list and see if there is a package you want in Debian, talk to the Ubuntu developers and/or prepare that package for debian. Subscribing to utnubu-discuss@lists.alioth.debian.org helps, too.And for those that for some strange reason like to read my name in the Linux Magazin: Have a look at the next one...

Dear Lazyweb, Ever since I reinstalled my PowerBook a few months ago, after I'd put back on all my software (including the lovely SSHKeyChain), I couldn't get the same SSH agent behaviour I used to have. Specifically, the first time I'd SSH somewhere after logging in (or after awakening the laptop), I'd be prompted (in a nice GUI kind of way) for my SSH passphrase, after which the private key was loaded into my SSH agent, and life was good from then on. That is no longer the case. I get prompted for my SSH passphrase in the terminal window and on a use by use basis, i.e. the key isn't being loaded into my agent after the first time I get asked for my passphrase. I think the root of the problem is that my ssh-agent is being started with the -c option (generate C shell commands) when I'm actually using Bash. So, the crux of my question is where the hell does ssh-agent get started from, and how can I change how it is started? Love and sloppy kisses, Andrew

fisl7.0 - the 7th edition of the International Free Software Forum, is increasing the pace. They've issued their call for papers (please help digging it up) and their website. This year they're moving to a place twice bigger than PUCRS (the place it used to happen). Everything's pointing towards another great event.

I am still playing with GStreamer and Icecast, for this edition the Free Software TV promises to have much more than the 12 thousand people watching fisl. Also, the first speakers invitations have already been confirmed (sorry, but I am not going to mention who confirmed for now... let's see if we can create some expectation atmosphere :-) ).

Reviewing fisl6.0's pictures, I crossed by this one:



... which is a good picture of the cake distribution we had at the "Good Bye Woody Party" the Debian Brasil held there. Those days were a lot of fun! Here is the Debian Brasil Team at the conference:



I am already looking after to meet everybody again...

Rar. I've finally got the Netgear happier. I grabbed an OpenWRT 2.4.30 kernel and hacked that into my OpenEmbedded image. That stopped the init panic messages. I've also done some work on faking up a /etc based on the values from nvram - this should hopefully mean I have persistent data over reboots as well as meaning you can upgrade from a stock Netgear DG834G image and keep your settings. I think I'm going to have to write a very basic bit of C to crypt the password though, as there doesn't seem to be any existing tiny utility in OE that'll do so. Anyway. This post is done from my desktop sshed to the Netgear which is connected to the ADSL and doing IPv6, and I'm then sshed from there to the via IPv6 (I could have setup the routing so I just sshed directly from my desktop through the Netgear, but this was quicker). Yay! That proves the ethernet, ADSL and IPv6 works. Haven't tried the wireless yet. I think I'm at the stage where I need to pull the OpenWRT kernel into the OE framework so I can build it all easily, and then I'll commit it and be able to provide an image in case anyone else is actually interested in this warbling. :)

Clint: I can't believe they're removing the religion from Pullman's Dark Materials in a movie adaption. But then, I can't believe there's gonna be a movie either since I had assumed the religious elements relegated this most excellent series to a niche market, at least in the US. This may come of living in the bible belt. I've only read the first book, and am saving the latter two for very special occasions. PS: Did they take the religion out of the Narnia movie? Just curious.