I Found this on a both of the SFD at San Jose Costa Rica,The Sauce was really good, but I actually was amused for the really good name(picante) and the funny design of the bottle. BTW, the recipe is license under CC-BY-SA The three photos taked by Daniel C spedes are here. UPDATE: The actual recipe is attached to the bottle, but here is a picture

RCBW - week #3 And this week we have a new player, welcome on board David! This week summary of mine follows
(As usual, dates are not strictly the day in which a bug has been dealt with, but rather the day of the week I assigned a bug to).

• 14/09/2009 bug #526579 - elisa - change CDBS hook to which register cleanup actions (FTBFS)
• 15/09/2009 bug #535299 - gambc - fix debian/control line continuations (patch from KiBi)
• 16/09/2009 bug #527789 - apertium-es-pt - fix build w apertium 3.1 (it's incredible how slightly different the various apertium thingies are ...)
• 17/09/2009 bug #518745 - cbmplugs - use pkg-config in place of b0rken sed magic (patch from Tzafrir Cohen)
• 18/09/2009 bug #529872 - kaffe - generalize build-dep on gcj: gcj-4.2 is gone
• 19/09/2009 bug #533959, bug #527514 - turbotinymce - obsolete with TG2, trigger RM/RoM
• 20/09/2009 bug #534024 - apertium-tolk - fix build w apertium 3.1 (build-deps and configure.in)

Comments / ponderings of this week:

• Sometimes, a NMU for a package which is otherwise rotten can help also in the sense that it can force the maintainer to realize that the package should be removed and file a RM/RoM request. It happened wtih turbotinymce this week (not listed above)
• David, you sure about ann? Did you try the resulting package? I give it a try last week, but the trivial patch attached to the bug log, while it fixes the build problem, gave a non-working package to me. I ran out of investigation time before being able to post any useful feedback to the buglog.

The NYT has an interesting article about research into treating insomnia over the internet [1]. I wonder how many other psychological issues can be effectively treated over the net. From next year all Cadbury Dairy Milk Chocolate sold in Australia will be made from fair-trade cocoa [2]. Cadbury Dairy Milk Chocolate is the most popular type of chocolate sold in Australia so this is a significant market shift. For a long time Cadbury has sold fair trade chocolate under the name Green and Black. Of course we now have to wait for Cadbury to use fair trade cocoa in all their other chocolate varieties. Mike Rowe gave an interesting TED talk about the value of manual labour [3]. He suggested that there should be a PR campaign for skilled manual labour jobs and noted that his observation (through his work on his Dirty Jobs TV series) was that the people who do some of the less popular jobs appear to be happier. The GapMinder.org web site has some interesting analysis of statistical information on countries and regions [4]. It is based on the work of Hans Rosling who is well known for his high quality TED talks [5]. Unfortunately the web site requires Flash, I will probably try it out with Gnash some time. Miru Kim gave a TED talk about her work photographing herself nude in abandoned buildings and industrial spaces [6]. Among other things she photographed herself lying naked on a pile of bones in the crypt underneath Paris which is fairly dangerous. I ve visited the crypt, it s an interesting experience but I was very careful to touch nothing you never know which of the bones came from victims of smallpox and other nasty diseases. Strangely they have an ongoing problem of visitors stealing bones, when I visited there were several bones at the exit that had been confiscated from visitors some of which had mummified flesh attached Steinar H. Gunderson wrote a good description of the basics of how the TCP protocol works [7]. He also links to a web page he wrote that will measure your potential TCP throughput and give you information on the link. This is really handy if you are behind some sort of firewall and want to know what is being done to your TCP stream when it s in transit. Apparently Christian couples tend to use a shared email account to reduce the risk of cheating [8]. It s hardly a surprise that Christians have a much higher divorce rate than atheists and agnostics [9]. The NY Times has an interesting article about iPhones overloading the AT&T network [10]. Recently I ve been having some problems sending MMS with my Three phone, some relatives who use Three have been having connection problems in certain areas with marginal signal quality, and the download speed of my Three data connection is significantly reduced (used to be ~70KB/s, now I m lucky to get 20KB/s). I suspect that the new smart phones that are being sold are largely to blame. But the up-side is that when they engineer their network to work properly with the smart phones then my Internet use (ssh and basic web browsing) will work really well. Michael Tieman wrote an interesting blog post about software patents which compares them to Land Mines [11]. Of course this analogy falls down badly while the US is still leading the world in manufacturing land mines. Rebecca Saxe gave an interesting TED talk about how brains make moral judgeents [12]. In her research she did some tests with using magnetic pulses to decrease the function of the region of the brain that allows people to judge the others and she was able to significantly affect the results of judgement tests. Brendan Scott analyses the netbook wars and concludes that it has been a significant loss for Microsoft [13]. ArsTechnica has an analysis of the real word-processing requirements [14], they suggest that in most cases MS-Word (and other word-processor) documents could be replaced with HTML or Wiki pages for a better end result.

• [1] http://www.nytimes.com/2009/08/11/health/11slee.html
• [2] http://www.news.com.au/story/0,27574,25985054-29277,00.html
• [3] http://www.ted.com/talks/lang/eng/mike_rowe_celebrates_dirty_jobs.html
• [4] http://www.gapminder.org/
• [5] http://www.ted.com/speakers/hans_rosling.html
• [6] http://www.ted.com/talks/lang/eng/miru_kim_s_underground_art.html
• [7] http://blog.sesse.net/blog/tech/2009-08-30-11-33_trying_to_understand_tcp_performance.html
• [8] http://www.smh.com.au/technology/technology-news/christian-couples-share-email-accounts-to-stay-faithful-20090907-fdaw.html
• [9] http://www.religioustolerance.org/chr_dira.htm
• [10] http://www.nytimes.com/2009/09/03/technology/companies/03att.html
• [11] http://opensource.org/node/465
• [12] http://www.ted.com/talks/rebecca_saxe_how_brains_make_moral_judgments.html
• [13] http://brendanscott.wordpress.com/2009/08/10/netbooks-microsoft-a-turning-point/
• [14] http://arstechnica.com/microsoft/news/2009/08/microsoft-word-1983 2009-rest-in-peace.ars

So, I was reading some random mumblings on the interwebs, and the pigeon with USB stick being a quicker method of data transfer in SA than their intertubes... then there was a thread on a mailing list discussing this, and someone mentioned using stacks of microSD cards... so then my brain decided to launch itself orthogonally, as it often does. What we end up with is wondering just how much storage you could fit in to the space a 3.5" drive would normally take - not taking in to account any method of attaching it at this point. So, a 3.5" drive is approx 102mmx147mmx26mm, a microSD card is 11mmx15mmx1mm, so, assuming that we're just lying them side by side, and not optimising the way they're stored at all, you can fit (with space round the sides) 9*9*26 = 2106 microSD cards in the area of a 3.5" drive. Assuming that each of those is 16G that's just shy of 33.7TB of storage! So, that set me thinking a bit further... I reckon that in that space you could do a 6*6 grid of cards with room for connectors, and just about get it to 10 high...so, that's 360 microSD cards, and probably enough room for some control gear (haven't worked out quite what we'd use for that), I then went in to wondering if we could then create a small embedded system to talk to those 360 microSD cards, if we did that then you could potentially do RAID0 across the "platters" with RAID6 on each platter. Now, to my poor head that meant that there should be 340*16G of available storage, which is 5.44TB... of course, that involves somehow interfacing the 360 microSD cards... I'm thinking that it might be possible with some form of embedded system... Unfortunately, it appears that to actually build this with consumer components... and without including the interface gear which I haven't even begun to work out yet... we're talking around about 26 per microSD card, so, erm, 9360... but I still think it'd be a really neat project... now, if someone can arrange for me to win the lottery, have lots of spare time, and some more brain power... :) Oh dear... my brain appears to have ticked further through, and I've realised that with spacing between each microSD card, you could, in theory, easily fit 400 of them upended in the space available. Erm. Of course, this still doesn't answer the "how the hell do you then get them all to talk in any sane manner" question... but I'm sure that will work out in my head sometime...

Over the last months, I have been asking people in KDE irc channels and in Debian KDE channels wether they have heard from Matthew Rosewarne, on irc known as Mukidohime. No one had. Very recently, I uploaded one of his packages with the following changelog entry:

* Switch Maintainer field to krap team and remove Matthew, he seems absent.
We hope he comes back.

Apparantly he was absent. Permanently. Elizabeth Krumbach writes some nice words in his memory. I remember Matthew for his work on several KDE related packages in Debian, always doing a job that was better than I expected. And I especially remember him at Akademy 2008 where he to much joy brought a black horse whip for the chairman of a talkroom. And he even brouht a spare pink horse whip for when the black one broke. Especially Adriaan had a good use of that. And at last, I will bring a image of Matthew showing off his equipment to Aaron Seigo. Condolences to his family. Matthew will be missed.

After a long time of ignoring (or at least not using) micro-blogging services such as Twitter, I recently tried the Free-Software based identi.ca service, and I'm beginning to like it. The choice of service was pretty obvious while Twitter uses proprietary software and has custom Terms of Service, identi.ca is based on software under the GNU Affero General Public License, and the contents are CC-BY 3.0 licensed. The code behind identi.ca is called Laconica (recently renamed to StatusNet) and is hosted at gitorious:

 $ git clone git://gitorious.org/laconica/mainline.git

My account details are available under http://identi.ca/uwehermann, where I'm posting smaller announcements and notes about random technical stuff I'm working on (slightly more regularly than in this blog). Sometimes I use the web interface for posting, but using the Jabber integration available at identi.ca is even more convenient. You can both be notified of new posts ("dents") in real time via Jabber, as well as post your own dents from within your Jabber client, which is nice. identi.ca seems to become more popular every day, which will hopefully make the proprietary Twitter pretty much irrelevant sooner or later.

---

I met my friend Josef Daberning, who did his Austrian Social Service working with Drupal at the Casa de los Tres Mundos NGO, in Granada, Nicaragua, at the Central American Free Software Encounter, last May. He told me that, when going back to Austria, he would spend some days in Mexico, and wanted to give a workshop on Drupal. The course has just started, and will take place today and tomorrow You can follow the live stream at http://www.iiec.unam.mx:18000/drupal.ogg The videos will be uploaded soon as well, I will post them on this same node. This node will be used for whatever is needed to make public for people following the talk. As of right now, you can download his presentation http://gwolf.org/files/gira-drupal.odp and http://gwolf.org/files/gira-drupal.pdf [update](s):

• If you are following the stream and want to say something, connect via IRC to OFTC (irc.debian.org) and join the #edusol channel.
• The videos for the talks will be made available soon, licensed under CC-BY 3.0 (generic)
• If you want to come, you are more than welcome. There is still space! We are in Ciudad Universitaria, South of Mexico City. Instituto de Investigaciones Econ micas - UNAM. We are starting the second session (16:00-10:00), tomorrow we have a third and final session (10:00-14:00).
• Of course,it is all over by now. I will be processing the videos and uploading them to Archive.org's Open Source Movies archive. The first video is already available, the rest will follow soon.

Attachment	Size
Basic introduction to Drupal presentation (ODP format)	306.07 KB
Basic introduction to Drupal presentation (PDF format)	214.62 KB
Drupal themes presentation	1.09 MB

Alice s Drive from Bengt Anderson on Vimeo. My partner Micah is pretty good with his hands, well, so long as they are attached to a computer. Otherwise, he is a bit lost. His father, however, is a master craftsman, rebuilding old cars, making his own houses, you know, the sort of stuff that really puts me in awe. Thanks to his efforts, his family, notably his sister Emily Anderson, are about to kick off and commemorate Alice Ramsey who in 1909, did the unconventional, which is somewhat an understatement, and drove across the United States in what then was called a horseless carriage. Apparently, she loved to race cars and took that love to trek across what were really gnarly roads and earned the distinction as the first woman to do so. Using the same model (Maxwell Model DA) that Alice drove, one that Emily s Dad, Richard, restored (and it is the very last one in existence!), she will be starting off the drive in just a few days. The whole family is pretty involved, so Bengt Anderson is making a film (short clip featured above), Micah has helped with the website side of things, and the rents will be in the trailer (especially since Emily just had a baby). Anyhow, more to write about cars and this trip but thought some folks might be interested in following her across the US. I am super bummed I am not in NYC to watch her go, but I will be watching with a lot of excitement from the Internets!

Well, not really my first patch. But the first thing I tried to mess with when I first started looking at WebKitGTK+ was the WebKitNetworkRequest object, because I was fancing the idea of writing stuff such as HTTP transactions monitoring, and things like that. So I wrote a big patch which exposed the internal WebCore object (ResourceRequest) fully through our own object. That was back in early 2008. We have come a long way since, and through all these months I got a broader perception of what kind of APIs we need, and how WebCore works. We also decided on going soup-only, which had a huge impact on what the final patch actually looks like. The patch which finally got committed this week is, how can I put it, VERY different from what I had originally written. You can take a look at the long discussions about it in the bug report I used to track progress. I think I should point out that Marco Barisione and Christian Dywan were crucial in helping me get going with my contribution to WebKit at that time. What this change gives us is basically the fact that a WebKitNetworkRequest now carries more than just the URI for the request (it actually carries with it a reference to the SoupMessage that will be used later in the request processing, which we are planning to expose in the near future), meaning that when WebKit API gives you a request, and you use it to cause a new load (for, say, opening in a new tab), you still get all the headers that were supposed to go with the request, so you don t lose things such as, for instance, Referer. So, now, after more than 5 years, the bug that complained that Epiphany did not set Referer (and Galeon before that) for new tabs is finally closed. By the way, this problem has been fixed for Mozilla s browser back in 2002, but the embedding API is still buggy up to now. There is still hope, since there s an attached patch that fixes the issue to be reviewed, and landed. If anyone is reading, it might be a good oportunity to get this fixed in there as well, so that users of applications that use Gecko s embedding API can also benefit!

I have just got a LG U990 Viewty mobile phone [1]. It s a 3G phone and came free on the $29 monthly cap plan from Three (minimum monthly spend is $29 - but this is free if you use $29 per month). My previous plan was the $29 cap but had a minimum spend of $20 per month, as I never happened to use less than $29 per month I am not paying more. For a modern mobile phone the actual phone functionality is a sideline. If a device was strictly designed to be a phone then I think it would be very similar to the Nokia phones that were available 5+ years ago - the Nokia I had in 1999 performed every phone function that I desired of it. Like most modern phones the LG U990 Viewty suffers in it s phone functionality from the desire to make it do non-phone tasks and from the desire to cripple it to meet the desires of the carriers (not the desires of the users). For example the home screen will always have at least two buttons for paid Three services and I have no configuration option to remove them. Replacing them with speed dial options for a couple of numbers that I regularly call would be handy. As the main screen is a touch-screen there is no excuse for this, they should allow the software to be reconfigured with more useful options. Eventually the Android will kill most of the other phones and this problem of phones being designed to suit the telephone companies instead of the users will be solved. One of the most annoying mis-features of the phone is that it doesn t properly handle address book entries with multiple phone numbers. One of my friends turns his mobile off when he is at home, so I regularly call his mobile and then immediately call his home number if the mobile is unavailable. With my previous two mobile phones I could press the dial button to bring up the list of previous calls and then use the arrow buttons to select from the other numbers that are attached to the same address-book entry, so with three button presses I would be dialing his other number. With the Viewty I have to go back to the address book. The compelling feature of the Viewty is the camera and display. It has a 5MP camera which makes it the second highest resolution camera-phone offered by Three - the LG Renoir (KC910) has 8MP but needs a $99 plan for it to be free. It also has a 240*320 resolution touch-screen display (in a quick search in January when I bought my phone the best resolution display I could find on a phone is 240*400 in the LG Renoir). While the camera is documented as being 5mp there are no specs available about the resolution of the CCD. I want to use the native resolution of the CCD for pictures (I think interpolation is a waste of space). The CCD might actually be 5mp, a picture of the 1400*1050 resolution screen on my Thinkpad allows me to read all the text even when small fonts are in use, so the CCD resolution must be significantly greater than 1400*1050. This is a really important feature as the Viewty will work well for making screen-shots for bug reports about crashed computers (several of my clients have expressed interest in getting one after seeing such a demonstration). One annoying problem is that the camera software takes a while to load, my trusty Sony digital camera starts a lot faster and the LG U890 phone I used for the past two years is also a lot faster and more convenient. This won t work well for photographing unexpected events. When I am traveling by public transport I will photograph the relevant pages of my street directory as I can zoom in to photos of the maps and read the street names, it saves some weight when traveling. The 2G micro-SD card (which incidentally cost $10 from OfficeWorks) will allow me to store a lot of maps. One interesting feature is the video recording capabilities. It can do 640*480 resolution at 30fps (which is pretty good) and 320*240 resolution at 120fps (they claim that you can film a balloon popping). In my quick tests the standard 640*480*30fps mode works well, but the 120fps mode requires much brighter light than most of my test environments, so I have not yet got it working properly. The phone has a reasonable voice recording function, it can record considerably more than 34 hours of audio and the quality is reasonably good if you use an external microphone. It is however quite poor if you use the built-in microphone for a dictaphone function, it seems that quality is poor at any distance. I had wanted to record my LCA mini-conf talks with my phone but unfortunately forgot to bring the adapter for the external microphone. It s a pity that the phone doesn t have a standard microphone socket as I have misplaced my Viewty microphone, when designing the phone they should assume that misplacing attachments is a common occurrence and design it to use common parts. I recently spoke to a journalist who uses his mobile phone to record interviews. He said that his phone supported phone calls, voice recording, and taking pictures - all the essential tasks for his work. It seems that the Viewty would be better than most phones for journalistic work apart from the issue of low quality voice recording when you have misplaced your external microphone. The text editor is unfriendly in the keyboard mode (I have not tried hand-writing recognition), one thing I don t like is the fact that the letters jump when you press them. This does allow changing a letter by moving the stylus before releasing the press (some people consider this a great feature). There are no cursor control keys (which is a serious omission), and the keyboard doesn t resemble a real keyboard. My iPaQ is far better for writing (I once wrote a full-length magazine article on an iPaQ). The stylus is quite strange and interesting. In the picture of the front of the phone the stylus is compacted with it s lid on. In the picture of the back of the phone the stylus is extended with the lid off. The end of the stylus clips in to the lid so that removing the lid drags the central part out of the body. It s an interesting design and with the string on the lid allows the stylus to be attached to the phone when it s not being used. But I have never used it. Even with an iPaQ (which had a proper stylus that attached firmly inside the body of the device) I often used a fingernail on the touch screen. I have not felt the need to ever use a stylus with my Viewty. One final noteworthy thing is the support for Google services. It seems to have client support for YouTube, Google Maps, GMail, and Blogger. This seems to be a major win for Google, the Viewty is one of the most popular phones at the moment and I expect that lots of people who buy them will now have an incentive to use the Google services. Between these sorts of deals and the Android I think that it will be necessary to have some sort of anti-trust action against Google. Google are generally doing good things for the users. I have been quite satisfied to use Google search, Google advertising on my blog, and Gmail. Also I have been moderately happy with Blogger (it was good when I started blogging) and Google Maps is useful on occasion. So generally I am happy with Google, but monopolies are bad for the users so I think that if things continue on their current trend then Google may have to be split into several little Googlets some time in the next few years.

• [1] http://en.wikipedia.org/wiki/Viewty

These guys could do at least 10 minutes of research before writing an article. The AWS APIs are already 'open source', you're allowed to write free-software tools that use them. They're out in the open, with no NDA or anything attached. Eucalyptus also exists, which is a pretty darn good reimplementation of EC2. The only real impediment to an 'open' (you meant free, right?) cloud is that you can't use ec2-tools with it unless you want to fight off a pack of female Amazon warrior-lawyers. I hear their punches can leave a mark.

I'm too lazy to send them an e-mail, and the Slashdot comments are already calling 'em out anyway.

While I've only skimmed the available protocol draft and whitepapers, I do have a couple thoughts about wave. Firstly, I can imagine something like this supplanting not just email and instant messaging, but also web forums, blog comments, mailing lists, wikis, bug tracking systems, twitter, and probably various other forms of communication. (But not, apparently, version control systems.) While one might have an attachment to a few of those things, I think most of us would be glad to see most of them collectively die (especially twitter and web forums of course) and be replaced by a data-driven standard, with multiple clients, rather than their general ad-hoc, server-side generated nastiness. (The Project Xanadu guys would be probably be proud.) Secondly, while Google are making all the right noises about open protocols, multiple providers, etc, and probably only plan to lock in about five nines percent of users to wave.google.com before competing implementations arrive, wave is not a fully distributed system. Spec says:

The operational transform used for concurrency control in wave is [currently] based on mutation of a shared object owned by a central master. The wave server where the wave is created (IE that has the first operation) is considered the authoritative source of operations for that wave.

If the master server goes away, it sounds like a wave will become frozen and uneditable. There seems to be no way to change the master server after a wave is created, without ending up with an entirely different wave. (Update: The demo, around minute 70, seems to show a private modification to a wave being made on another server -- so I may be missing a piece of the puzzle.)

The concurrency control protocol will be distributed at some point in the future

How many centralized systems have been successfully converted into distributed systems? In a similar vein, after reading this whitepaper, I'm left unsure about whether it will be possible to respond to (edit) a wave while offline. Maybe, as clients can cache changes, but how well will conflict resolution work? It seems it would have to be done in the client, and there are some disturbing references here to clients throwing their local state away if they get out of sync with the server.

Here are a few hints if you want your reports to be treated more promptly. When testing fails, try unstable If you are running testing, not all bug reports are interesting. More specifically, the relevant ones are about insufficient dependencies that let slip into testing a non-working combination of packages. Think of the I upgraded foo, then bar broke category. Otherwise, the reason why reportbug looks for newer versions of a package in unstable is that, in most cases, the bug is fixed in unstable. If you can, always try the unstable version before reporting the bug. Report bugs against the failing package This is related to printing in a GNOME program, so I report this against libgnomeprint. Always file reports against the failing program. If there is a library involved, reportbug will include the necessary information so that the maintainer can easily reassign. If you re not sure of the affected package, use a metapackage (for example, gnome for GNOME-related packages). Do not second-guess the origin of the bug After upgrading libfoo, bar starts crashing, so I m reporting it against libfoo. Unless you can tell which function is at fault and how this is ABI breakage, you should report the bug against the program that crashes. The program s maintainer will reassign if needed, and will hit the library s maintainer with a hammer if needed. Don t forget to explain what s wrong The frobniz in libfrob is broken, you should change /usr/share/libfrob/blah line 13 to something else. I don t know what libfrob is about, but I have some problems that look frobniz-related. Do not second-guess, always start explaining what bug you are seeing first. Your attempts at investigating it can be interesting, but don t forget to explain what bug lead you on investigating. What is the use case we should cover? I m trying to do that with your package and it looks extremely complicated/doesn t work as expected/fails miserably. Your package is clearly broken! If your attempts to do something that should be trivial, given the purpose of the package, fail, then you are probably looking at the problem at the wrong angle. There may be a much simpler, though radically different, way to do what you are trying to achieve. In these situations, always include in your report what you are trying to do and why you want to do it. strace is not a general-purpose debugging tool Whether you observe a crash, a deadlock or a livelock, strace is not the tool that will give us information. The only thing you do by adding a strace log to the bug report is making it unreadable with its thousands of lines of output. For the specific cases that require strace for debugging, these traces are welcome but if you re not sure, don t attach them. The developers will ask them for you. Otherwise, the general-purpose debugging tool is gdb. Use reportbug There is a good reason why some packages include bug control files and scripts. Use a reporting tool that takes them into account. Unless you are requesting an enhancement, always use reportbug. Please avoid reportbug-ng since it only provides parts of the required information.

Some might dread the feature of read notifications supported by certain MUAs; some call it an invasion of privacy ; and yet, it can also be useful in certain situations: When a message is read or seen in a MUA supporting this extension, the programme emits a notification back to the sender saying something along the lines of your message was read on . This is good to know, especially in times when you cannot wait for the failed-delivery-notification that follows four to five days of unsuccessful (but furious) attempts of some delivery agent, assuming it doesn t get trashed as spam. Such a read notification is logically a reply to the original message, isn t it? The RFC 680 proposed in April 1975 defines the header References as a way to point to other correspondence which this message references . This header, along with In-Reply-To (defined in the same RFC), is commonly used in every-day mail traffic to refer to previously exchanged messages, and enables mail readers to thread separate messages together into coherent conversations (it takes a human to remove the coherence, the technical aspect is infallible). Cut. Microsoft was also founded in April 1975, and it took them 20 years to barely manage to squeeze through the Internet door without the proverbial foot in it. They published a browser and several e-mail programmes, and it always appeared as if they tiredlessly tried to be different from the rest, attempting to form a clique of users, a Microsoft league in which to increase their revenue through network effects. Sounds bad, is bad, but yet again, they managed, through unimaginable feats of entrepreneurial genius and ruthless behaviour. Cut. In 1982, STD11 declared the aforementioned In-Reply-To and References headers as standards. At that time, Microsoft software didn t even know what a computer network was. Cut. Does it come as a surprise that read notifications sent by Microsoft e-mail programmes, such as Microsoft Outlook do not make use of either of these standard headers to tag read notifications they send? Instead, Microsoft pushes Thread-Topic and Thread-Index, which are undocumented and thus probably only work in a Microsoft-only context. How am I supposed to assume anything else than Microsoft actively trying to oppose standards. Anyone who boycotts standards is hindering progress and should be left behind. It s good to see that the Internet society seems to follow that trend more and more. Update: I found a way to extract the data to recreate the In-Reply-To with procmail. I don t see a way to do the same for the References header. Also, I ve only verified that this works for message disposition notifications from Outlook 2003, although I expect it to work for other, similarly crippled MUAs too.

You might have noticed that during last week the Mexican Debian mirror, nisamox.fciencias.unam.mx (a.k.a. ftp.mx.debian.org, a.k.a. debian.unam.mx), went offline. The motherboard died on us, and Facultad de Ciencias was kind enough to give us a brand new one. So, excuse us for the blackout, but we are back Meaner and badder than ever before! Now, Sergio (nisamox's main admin) prefered to rebuild the whole mirror, as there was a shadow of doubt regarding the data integrity. So, rsync was pulling as fast as he could for the whole weekend (leading to some people scratching their heads regarding the 404 for the missing files; sorry, we should have left Apache shut down until the mirror was complete!). After three days of sustaining a 10-20Mbps download from the main mirrors, all 364GB of Debian are finally installed and as you can clearly see we are back to normality, with small, regular mirror pulses and a nice sustained 5-10Mbps (with some up to 40Mbps peaks We have seen up to 100Mbps peaks in the past, and I doubt with the current network infrastructure we won't top that). You can see we have currently plenty of disk space still to fill up. Among our plans is to host the most popular ISOs, which are a common request, and... What else? Well, ask us and we shall do so (quite probably). So, if you switched away from ftp.mx.debian.org due to our downtime, readjust your mirror settings. Nisamox is back!

Attachment	Size
Nisamox Ethernet statistics for the last week	23.38 KB
Nisamox disk space statistics for the last week	24.29 KB

Here comes the new 4096 bit RSA key, replacing the old (2002) 8CA99047 1024 bit DSA key:

pub  4096R/29C0FFEE 2009-05-18
  Key fingerprint = 9590 8AA6 E4F7 BAA7 8BD6  C148 F1A6 9BE4 29C0 FFEE
uid  Obey Arthur Liu <arthur@milliways.fr>
uid  Obey Arthur Liu <obey.liu@ensimag.imag.fr>
uid  Obey Arthur Liu <graffit@graffit.net>
uid  Obey Arthur Liu <obey.liu@lzb.fr>
uid  Obey Arthur Liu <arthur.randolph@gmail.com>
sub  4096R/15D7FD9B 2009-05-18

In other news, I found a great flatshare on Riedmattstrasse in Kreis 3 in Z rich with a fellow Google summer intern. Thanks to all (Jeroen, Martin, Jaroslavs, Giacomo..) who gave me pointers about finding accomodation in Z rich. I m looking forward to a great summer there. * It did involve generating about 40 millions gpg keys on a few tr s badass computing clusters UPDATE: Come on guys. Of course I followed basic key management rules. The clusters which generated the actual final keys were under my direct control and the particular slice which generated this published key is on my desk.

Google Checkout recently gained support for taking recurring payments, a frequently requested enhancement for my Xen-based server. However, to use any of the non-trivial features we must provide Google with generate a signed XML file for each transaction. This would normally preclude the use of some server-side scripting, but if the details of transaction are static there is no reason we shouldn't be able to generate the relevant HTML ahead-of-time. The resulting HTML file can be hosted anywhere, is almost completely independent of the server configuration and greatly reduces the attack surface by being a simple static file. The main disadvantage of this approach (and indeed of this submission method in general) is that allows trivial replay attacks of previous transactions. Anyway, first we create our request XML: Next, we construct a simple template: Finally, we generate the final page from the above files using the following Makefile: Non-trivial dependencies are OpenSSL (to generate the HMAC-SHA-1 signature) and make. You should ensure that you don't upload or otherwise reveal your Makefile as it contains your merchant key.