Aargh. Yesterday I spend hours trying to find out why SERefpolicy would not build. There was a suspicious message in the build process, about a circular dependency being removed, and it was obviously due to this dependency that the build did not work. But: I couldn't find anything like a circular dependency. The dependencies for this file were trivial, just two input files that are not being modified or generated or anything. Today I decided to downgrade make to the stable version (which unfortunately conflicts with current kernel-package...) - and now it compiles. Smells like "make bug" to me... You can grab the completely untested (last build didn't work, and my test machine is currently down) packages at http://selinux.alioth.debian.org/serefpolicy/ in case you want to try SERefpolicy yourself. I'd love to have a SELinux policy system which does not involve any such make and m4 black magic. The makefiles are a PITA to read, the whole thing is totally unmanageable IMHO.

Conan O’Brien came to Finland on Saturday to shoot some stuff for his show. Today, he was a last-minute guest in one of our national-television talk shows. The interview lasted for about fifteen minutes. I made a transcript. An excerpt:

Arto Nyberg: So how are your feelings now, when you remember yesterday’s crowd waiting for you outside the airport? Conan O’Brien: I’m still getting over it, that was a high point of my life because I’ve never… Arto Nyberg: Be honest. Conan O’Brien: I’m being honest, I’ve never… I’ve been in front of some happy, excited crowds before, but the intensity of that reaction, there were, I think, several thousand people… I’m just going to say fifty thousand… I don’t know if that’s the exact number, but let’s go with eighty thousand. Arto Nyberg: Let’s… Conan O’Brien: There were many, many people at the airport, and they were extremely excited, and they were very nice, and they seemed to genuinely like the show and… like what we’re doing, and I was excited. Arto Nyberg: Did you expect one hundred thousand people coming greet you?

Given that next weekend is a long weekend on account of President's Day, we've decided to go visit our friends Craig and Sarah in Phoenix. My manager has kindly allowed me to work from Phoenix for the remainder of the week, so we'll head back again on the following weekend. I just fed all the relevant data into Google Earth, to get a bit of a perspective on how long and how big the trip is going to be (and it looks big). I've never used Earth for routing before, and it's really cool to "play" the trip's route and have it zoom into each turn. So from home to Craig and Sarah's place is 727 miles (1169 kilometres), but we're going to meet up in the desert, which is only 575 miles (925 kilometres), and then we'll do the remaining 216 miles (347 kilometres) on Sunday night after we've stayed with them in their enormous caravan (or trailer as I guess they call it over here) and fool around in their dune buggy. Here's the direct route from home to Craig and Sarah's place in Phoenix, for perspective. The desert stopover (marked) is a little bit south of this route: We're planning on stopping over in Los Angeles (Hollywood to be precise) on the way back so we can briefly check it out.

No news for almost 3 months.. well, I am back now. Some things that happened during this time:

• new root server I bought a server from Hetzner. It's called weedy.perldition.org and now hosts my personal page as well as some other things.
• Net::SSLeay maintaince I already maintained this Perl module for Debian a while, got some bug reports, forwarded them to the upstream author and nothing happened. Also the last release happened years ago in 2003. Therefor I asked the author if he may needs help or if he wants to pass the maintainership to someone else. He did so and I'm now maintaining Net::SSLeay together with Mike McCauley. The project is now hosted on http://alioth.debian.org/projects/net-ssleay. Please use our Mailing List if you have any questions.
• Geek Tour I'm planing to make a geek tour in middle europe in the next weeks. I'll visit FOSDEM, GPW, CLT and an Amsterdam.pm meeting. Wanna join? Mail me!
• Some events During the last months I visited some exciting events. I took some pictures and put them here.
• Bug squashing I worked a bit on my Debian packages and managed to fix almost all important bugs. The only missing ine is #346474, which is at least forwarded to upstream.
• I'm on the planet I'm now part of Planet Debian.

I'm sure I've missed important things, but that's it for the moment. I hope I'll manage to do more frequent updates in the future.

Amaya points out to Jonathan why people like to use SSL for their mailing list archives. The silly thing is that quite often people still have the monthly password reminder emails switched on, which go out in the clear. The same hypothetical bad guy who might be sniffing your password when you might log into the web management system just has to sniff at the right time of the month when everyone's password is being emailed out...

The following haiku poem was written some days ago. I wasn't too sure about including the final two paragraphs, but after letting it rest for a while I think they don't fit too bad into the overall view.

Lazyness — a pain?
It helps you to optimize...
or do just nothing. Some say it is art —
a required skill for some,
e.g. syadmins. To notice repeats
and work on scripts to ease them.
It truly helps there. But then the downside:
when you don't manage anything
you are lazy stunt. Not able to do
what you are expected to
and just waste big time. I strive for former
but fall into latter group
I am but sorry. The expectations
that I built — to some degree
all by myself — hurt. I have no idea
why people believe in me,
I don't do myself.

Jonathan McDowell wondered "WTF is the point of SSL mailing list archives?", and I have a very simple reason: people manage their mailing list subscriptions using a web interface. They use passwords, and we all know plain text passwords travelling through the network are evil. So I guess it's easier and KISS to have everything, including the archives, under SSL.

I turned 30 recently. For the last five years I have felt my body change (sometimes in undesirable ways, ie. first wrinkles, gravity in full effect), and I have also neglected my health like I would live forever. I have not gone to the doctor since 2000. Haven't got my blood tested for that long, nothing at all. I felt well, so who cared?

I don't know why I went to the doctor last week. Maybe because I am not comfortable with playing this health lottery game anymore. He wanted blood tests and the results are a bit worrying. Everything is within the average ranges, but it is a bit fucked up to be a vegetarian and still have high cholesterol. I have lost from 10 to 15 Kg since last May, I do moderate activity most weekends (skating). I walk home from work (25 min, slow pace) most days. But this sheet of paper reads:

Cholesterol (HDL)...0,56 g/L [0,50 - 1,20 for women] -> This is good cholesterol, and it is low.
Cholesterol (LDL)...1,27 g/L [1,3 max]...............-> This is bad cholesterol, and it is high.
Triglycerides.......1,42 g/L [0,40-1,50].............-> Also high!
Iron..................35 g/L [40-150]................-> Ground for anemia?
Glucose..............0,91 g/L [0,65-1,10].............-> Ground for diabetes?

And no surprise: I have low iron levels. And high glucose. This means I (still) eat too much fat and sugar. I can hear jbailey whisper to me: "more green, more green!", which was what he told me when I showed my dish to him for advice, in the first vegetarian meal I had when I decided to "switch". I have not been eating enough green.

So, why is this happening? I thought I was drinking too much whole milk with my coffee, but there seems to be a much better and funnier explanation: 29 Common Reasons Why Your Vegetarian Diet Isn't Working. I love it :)

As regular readers of my blog should know by now, I’m a big fan of SaaS (software-as-a-service). I’d go so far as to say it’s the future of software. Like all things, though, SaaS has its drawbacks, the biggest of which are questions of reliability, as the recent outages of salesforce.com have made painfully clear to its customers. It’s great if your data lives on the network, but what happens when your data isn’t available, either because the network isn’t available or because the servers it lives on are down? (The rhetorical question brings to mind Leslie Lamport’s famous observation that “a distributed system is one in which the failure of a computer you didn’t even know existed can render your own computer unusable”.) Security and trust are important too. Prime example: saleforce.com’s less than forthright acknowledgment of the recent outages. Another: Just today, Google launched version 3.0 of its desktop search software, which gives users the incredibly useful ability to search their local documents from any computer in the world. Of course, it does this by storing the index (and, apparently, the documents themselves) on Google servers. Hmm. Do I really want my business plans stored somewhere on the web outside of my direct control? Then again, an increasing number of people keep their email on the web, so chances are, if I’m collaborating with someone, they’re already there. As much time as I’ve spent thinking about SaaS, though, this was a new one: A friend of mine managed to get himself locked out of his Yahoo account, and after hours on the phone with Yahoo support, he seems unable to convince the Yahoo bureaucracy he is who he says he is so they will let him back in. He even offered to fly to Sunnyvale to present his driver license. Apparently, the zip code Yahoo has on file is different than the zip code he’s had his entire life, and the support staff say they can’t unlock his account until he gives them the right answer, which he’s already doing. (Apparently, the best one particularly dim bulb in Yahoo customer service could come up with is that he call back each day with a different guess till he gets it right.) In short, there seems to be some sort of an immovable object/irresistible force thing going on, and he’s not sure how to break the deadlock so he can get back to his data. The most pressing problem is that he’s got some tax related information in his email account, and on the current path, there seems to be no way for him to get to it by April 15. So, I pose two questions here: First, if you work at Yahoo, how in the hell can my friend get his access back? As already stated, he’s spent hours on the phone to no avail. I’ve tried inquiries on the backchannel but have received no responses. Second, for the larger SaaS community, if our data lives on the network, what happens if Google, Yahoo and the like become the phone company?

Dear Lazyweb, Anyone aware of a nice blog software that

• Uses some kind of proper XML to store all data (and thus always create valid output,
• Allows me to enter stuff using some StructuredText human-writeable markup and copy HTML fragements from other pages in there.
• Does reasonable caching instead of doing XSLT transforms over and over again...
• Allows me to tag posts, and provide customized RSS feeds (e.g. all english, non-personal, XML-related posts
• Doesn't force me to use the web to blog (like WordPress)
• Doesn't use PHP or ASP or JSP and a MySQL database which I consider bloated and potentially insecure - should be nice and clean code, which PHP rarely ever is.
• Doesn't use extensive frameworks such as Ruby on Rails or TurboGears either... I don't want to have to install these.
• Doesn't bring with it another stupid user management (like WordPress and all these fancy php thingys do)
• Preferrably doesn't require CGI at all...
• Doesn't need to have comments, and lets me disable them. It's my blog, I don't want to have to care about spam and you are supposed to read it using a RSS reader (and no UI-hell Internet Exploder 7), actually. :-)
• Is OpenSource, obviously. I will certainly want to remove some things I consider stupid. I've yet to see a commercial software I'm happy with.

And I bet I forgot some additional restrictions... Thanks for any suggestions..

Joel Spolsky: “Listen, I know that everybody is saying that the cool thing to do these days is Ship Early and Often, but when you ship half-baked ajax calendars that don’t do much and then get Scoble to go nuts about how great they are, well, you’re going to have a lot of people like me checking it out and realizing that, for example, no thought whatsoever has gone into printing, which is fine, it’s a 1.0 release, but you know what? I’m not going to look at 30 Boxes again — I’ve spent enough time evaluating it. G’bye. I’ve talked about this before — it’s the Marimba phenomenon — when you get premature publicity, lots of people check out your thing, and it’s not done yet, so now most of the people that tried your thing think it’s lame, and now you have two problems: your thing is lame and everybody knows it.” “Release early, release often” is a strategy that works because it allows for incremental improvement—you don’t have these “big bang” releases every few years where you try to anticipate what your users will want, because your users are telling you what they want every step of the way while the thing is coming together. That said, Joel makes some very good points, and companies following the “release early, release often” formula would do well to consider them. In short, for “release early, release often” not to backfire, its proponents need to do a better job differentiating between the users that want to actively participate in the development of a new product and the users that are simply looking to solve a problem, because that latter group is ultimately going to be disappointed if the thing isn’t fully baked.

How nice. The FCC wants "a "back door" be built into all Internet-communications hardware and software to provide access for law enforcement agencies". This and similar horror scenarios for the freedom and privacy of the people are nothing unusual these days. A more general (and more paranoid) question: How do we know whether our software or hardware is backdoored/wiretapped? We all know that using a certain OS from Redmond opens a lot of security holes in itself. Add to that all the now-public attempts of agencies and companies ranging from the FBI, NSA, Sony to antivirus-software vendors who install backdoors on your PC, and you've got some very good reasons to never trust any closed-source software again. This is not a problem for most of us using Free Software and free operating systems (Linux, *BSD, etc.). Theoretically, we can read the source code of almost every single instruction being executed on our hardware, and verify that the software doesn't do any funny things like phoning home, logging keystrokes, opening backdoors and so on. However, how can we know whether or not our hardware has been backdoored/wiretapped/trojaned (or whatever you want to call it)? Given that almost all devices we own nowadays (PDA, iPod, cell phone, hardware VOIP phone, and all the other gadgets) as well as most parts of our PCs and laptops have some sort of microcontrollers on them, how can we be sure that there is no secret code hidden in there which spies on us or provides hidden backdoors to them (whoever that may be)? With some devices you can dump the firmware and analyze that, but most parts are probably not easily analyzable by mere mortals. Think network cards, builtin wireless cards, sound cards, bluetooth chips and so on. IMHO, a good first step in the right direction are things like OpenBIOS (Free Software firmware/BIOS) and OpenEZX (Free Software GSM phones). Alas, I think DRM will pose a major threat here in future, as we probably cannot easily replace custom firmware/software anymore if DRM in the worst form becomes reality. So, how would you go about to ensure that your hardware has not been backdoored? How can we detect such things? How can we defend against such things? How can we remove backdoors if we find any? Do you know of any relevant research, papers, documents, HOWTOs? Any cases you know of where such things happened? Any practical tips or advice?

Julien Danjou and others replied to my "please don't obfuscate BitTorrent" post, pointing out providers in France, Canada that already filter BitTorrent one way or another. I've read similar things about some DSL providers in Germany (Telekom however is proud that they don't do that). But basically this only shows my point: by having the major p2p filesharing protocols use non-standard ports and non-detectable protocols, more and more providers take measures like doing QoS for non-standard ports or filtering them altogether. And just as you reported, this has bad side effects on the ability of other users to e.g. use VoIP or play online games. Remember: my point is to make P2P protocols easy to filter/limit by routers, so provider do NOT block/throttle all non-HTTP connections, but can selectively throttle only P2P filesharing when they think they need to. Because otherwise they'll break other stuff such as online games and VoIP. Now by putting your BitTorrent on ports such as 80 or some VoIP port which isn't throttled, you only cause these providers to e.g. install a transparent proxy for these services. You make it only worse. I agree that you don't have that much choice in countries where there is some kind of monopoly there. But then this increase in filtering will probably allow new companies to enter the market.