Early Rising Simon, I have been following the early riser program for 8 months now. I wrote about my experience some time ago. It still is working well for me, although I had a little trouble with it when I moved to Edinburgh. However, my headaches warn me and make sure I stay in the program. GNOME It has been quite a meme to bash GNOME the last few weeks. Since bashing generally doesn’t help the motivation of any hackers and people working hard to accomplish a goal, I want to rebuke it a bit. Two and a half years ago I got my PowerBook. After five years of using a Pentium-233 with 64MB I suddenly had some CPU power. Since my old environment (WindowMaker) was broken on PPC at the moment, I decided to go with GNOME. Coming from WindowMaker it really felt like things were done quite differently, but being open-minded I tried to let it all go. The thing is, do I really want to configure everything? I liked configuring a lot back then, it was like an addiction. Now that I have gotten used to GNOME (let’s call it The GNOME way™), it just feels bothersome, getting in my way. When I encounter a GNOME desktop I immediately can work with it and don’t feel the need to redo the complete setup. When I look back, the only things I really want to change are the programs I use, the information I see and the way I control it all. This basic stuff I easily can do with launchers, applets and keybindings. Also have I been observing and helping some new users. And somehow I still keep reaching the moment that I can hear myself say, “Ow, hehe, yeah… that doesn’t work quite right yet. Just open a terminal (eek!) and edit this and that file.” So, we are not there yet. For me GNOME offers innovation, sufficient configurability, and an efficient do-not-get-in-my-way workspace. The change from WindowMaker to GNOME has been to me as my switch from Windows to Linux, a thing I ventured into open-minded and worked out quite well. Won’t this result into a dull monoculture of desktop setups? Maybe so, but I don’t have to be different in every way just to make the statement that I am different. OK guys, bash away now… oh, and thanks GNOME people!

Four years ago, Febreary 7, 2002, some people in Guadalajara, Spain, starts connecting some houses using 802.11b in ad-hoc mode. After 4 years, there are a very interesting network of 89 operational and ready to free use nodes conecting the set of free networks of Guadalajara. You can see it at http://www.guadawireless.net.

A lot of services inside the network are free too, and almost all the servers in the network are hosted by Debian running machines. There are a lot of Linksys WRT54G using diferent versions of free firmwares (mainly OpenWRT), and a lot of SMC/USR access points with LinuxAP firmware.

Thanks to all the people involved in the project and happy birthday.

So, we've all had the e-mails promising us millions... and we all know they're a scam... it appears that now we have ICQ people trying to solicit money...

10:47 <@root> Message from unknown ICQ handle 204857947:
10:47 <@root> Hello, i have a problem, i have a rent debt for apartment where i 
              live, and i cant fix it. Im trying to find somebody who will 
              understand my situation and will agree to help me with money what i 
              need. Maybe you can help ?

(yes, I use bitlbee, yes this is a message from someone that I don't know, yes it just seemed weird to me...)

My internships seems to have passed in an instance. I have been here in Edinburgh for almost three months already and it is time to prepare my return. It still feels kind of strange that everything happened so fast, though my arrival on December 1st 2005 seems ages ago. Two weeks ago I came down with a cold. I have found it to be a rather strange cold. The symptoms were not always there, just sometimes. I had (all mixed) headaches, fever (during a cold?), losing of salt taste, losing my voice, sleeping badly, coughing without reason, sneezing and it took almost 10 days to recover which is kind of long for my doing IMO. People that I seem to have infected though, have “normal” cold symptoms. Visitors As mentioned in a previous post I have received some visitors here. First my parents and then my friends came over. Together we have seen a lot. My aim was to show them as much of what I have been experiencing the past two months in the short period that they were here. I hope I was successful and all enjoyed themselves, at least I have. The photos of when my parents were here and when my friends arrived are available in my Edinburgh album. However, during the visit of my friends, Christian made photos with a far better camera and I have put them in a separate sub-album (see also his own album). London Last weekend I also visited my friends in London. I can’t just be in the UK for three months and not visit them and join a party. So, I planned the trip, bought flight and party tickets. Just before arrival I lost my voice. When I finally met my friends, I couldn’t talk to them at all. At the KnowWhere party it was even impossible to say anything. It was a funny experience to transfer things I wanted to say to them or order drinks using my mobile and T9 input in the SMS application. The party was great, but it completely wrecked my rhythm and prolonged my recovery. Report Last week I started working on my internship report, since the end is near. I have about 10 days left to finish it and it is still a lot of work. I’ve found it to be quite a challenge still, to say exactly what you want to say without cluttering it and in the right order so that it is understandable. Considering that I have written many many reports for my study in the past, I still want to make this one the best.

I know for myself that picking up unparsed userdata is teh evil. But we also all know that the usual webpage and mailer script coder isn't thinking. And to my knowledge the php mail() function is the only one that perverted to parse the headers additional to an explicit given recipient list for additional recipients. Yes, you read right. Often enough people use things like mail("myown@addre.ss", "subject", $body, "From: $_POST['name'] <$_POST['email']>") without thinking about it, because, there is this extra to field anyway. Right?
Wrong! SPAMers will come and send things like email="some@jo.ke\nBcc: my@sp.am, list@is.bigg.er, than@you.rs". People that put up such webmail scripts usually don't notice it anyway, they just delete the spam right ahead, not noticing that it was an abuse of their form. And the ISP has to deal with having to get the system out of the blacklists again.... At least none of the hosts on which customers are able to put up such scripts directly affect our own mail system, it's just the shared hosts they use... Still, deadly annoying. And then people are claiming that such misfeatures aren't a problem in PHP but in the coders? If it would at least be documented in the description of the function, but if one can claim it that it is it's at most just very vague hinted...

If you’re having trouble with a natsemi ethernet controller locking up in Linux after complaining about oversized ethernet frames like this:

eth0: Oversized(?) Ethernet frame spanned multiple buffers, entry 0x00ba8b status 0xe0000bd5.

then this patch (or a kernel version which includes it) may be useful. The patch is against 2.6.9+ versions of natsemi with NAPI support but doesn’t use the NAPI support.

So my sister is working at a school where the computers are in a shocking state. All infected with viruses, spyware and malware. The machines either crawl along or are incredibly unstable. Some of them run some sort of virus protection program and I’ve seen one or two computers running two different anti-virus programs. On my travels I have seen countless infected Windows machines. It’s incredible! And the worse thing about it, is that the Free Software geeks and outfits can’t seem to capitalise enough on it. So what can I do? The Computer Scientist. Well, not a lot. For example all the Windows machines are in Korean. I can’t figure out how to change win32 language. Can you? Plus, I don’t want to re-install Windows. I want to deploy some Linux based solution. So what are the requirements? They need to :

• print timetables (via a crappy Epson inkjet) with something like Office
• be able to play macromedia based games
• use a browser

That’s it. It also can’t be more complex. No username or passwords please. We don’t want to have to train people to use a new system. Must be simple. Oh diddums. Can Director macromedia kid games be played in Linux? I don’t think so. Oh I wish these kids’ software was on a N64 or something. There is only like 10 PCs in this school and installing them with Linux would take quite a bit of my time. I need some sort of centralised control tower where I can control deployment of my own customized Ubuntu based distro. I know very well about SkoleLinux but it is simply too complicated. No need for email. Outsource to Gmail and hosted service. Must be simple. All I can think of will be complex and painful. Grrr…

Okay, something bugs me, and it's somewhat irrational, and somewhat rational. I totally hate really long URLs needed to "verify" that the sign-up is valid. There are more than one type of these, sometimes they are required to continue into the site, sometime just for extra features, but they are more often that not, very long. Now, I don't like long URLs in general in emails, because there are many services which allow you to shorten them for public use. Recently I signed up for 30 boxes and they sent me this monstrosity:

http://30boxes.com/signup.php?action=finishSignup&d=aSDFJKLa43da
safjdAL5RLKj4afjrafa45J5kljtyTGJrALKJgFKLsaj5klJ4jkljakljdkalflk
fASJKjdfa4r23890fdfjskl342390fakjlei309dk390ujkal39032kd03j9djd9

Okay, so lets look at this rationally for a bit. How many unique strings can they have from that huge behemoth of an identifier. There are 145 characters. They are using the entire uppercase (26), lowercase (26) and numbers (10), so there are a total of 62 unique symbols for each spot. That gives us a total of 62¹⁴⁵ different strings. That's

78848779858160540639233408124436328679807474352650645474403652978
77812230999983634922053904324829205441837830921209410767866820350
39259149646534571887966722870103317751633817974743087029882020930
78213775489032524047364643001443429901072761743321026356976812032

different combinations. In scientific notation, thats 7.8 × 10²⁵⁹. Just for comparison, the entire number of atoms in the universe is high-balled at 6 × 10⁷⁹ (on this page). That's more than a googol of identifiers for EACH ATOM, EVERYWHERE. Isn't naming each atom once enough? Then you would only need 45 characters, which would nicely fit in one line of my email client if you just shortened your "finishSignup" to "fS" and action to "a". As a bonus, it also saves you approximately 117 bytes of bandwidth per email. UPDATE: Apparently it has ALL the information, in addition to being completely too long. I replaced it with random crap.

Dear Lazyweb, Anyone aware of a nice blog software that

• Uses some kind of proper XML to store all data (and thus always create valid output,
• Allows me to enter stuff using some StructuredText human-writeable markup and copy HTML fragements from other pages in there.
• Does reasonable caching instead of doing XSLT transforms over and over again...
• Allows me to tag posts, and provide customized RSS feeds (e.g. all english, non-personal, XML-related posts
• Doesn't force me to use the web to blog (like WordPress)
• Doesn't use PHP or ASP or JSP and a MySQL database which I consider bloated and potentially insecure - should be nice and clean code, which PHP rarely ever is.
• Doesn't use extensive frameworks such as Ruby on Rails or TurboGears either... I don't want to have to install these.
• Doesn't bring with it another stupid user management (like WordPress and all these fancy php thingys do)
• Preferrably doesn't require CGI at all...
• Doesn't need to have comments, and lets me disable them. It's my blog, I don't want to have to care about spam and you are supposed to read it using a RSS reader (and no UI-hell Internet Exploder 7), actually. :-)
• Is OpenSource, obviously. I will certainly want to remove some things I consider stupid. I've yet to see a commercial software I'm happy with.

And I bet I forgot some additional restrictions... Thanks for any suggestions..

Well, it's finally time to announce my new podcast, Sound of History! The Sound of History is a weekly podcast featuring full-length, unedited, and uncut historic audio. You'll hear speeches, broadcasts, and events from around the world. Sometimes you'll hear famous people, sometimes not. Episode 1 is up now. On this episode, you'll find John F. Kennedy cracking jokes about Marx in front of a bunch of newspaper publishers, Ronald Reagan talking about the Challenger, some blues from 1922, and an Edison recording from 1902. Thanks to Cliff for mentioning that Reagan speech in a comment. That prompted me to go find it. I'm finding material for this podcast from around the Internet. Some of that music comes from archive.org, and there are various sources for presidential speeches. I'd like to find some British prime minister's speeches as well, but I'm having difficulty with that. If any of you Brits reading this know of a good site for uncut audio, accessible to Americans, please do let me know.

As Robert Schuster stats in his blog we are looking for people who can help with porting issues of GCJ and other free runtimes for Java. For example we have problems with GCJ on arm, hppa, mips/el and m68k in Debian. I extend Robert’s offer to all architectures Debian supports. Earn a beer or another drink at your choice at FOSDEM.

In another form of "It Never Rains But It Pours", today's ride to work has seen:

• My first ever "Is that Linux?" question from a fellow passenger. Turns out he's interested but has never tried it, so another copy of Ubuntu was distributed to the wider populace. Let this be a lesson, kids: always be prepared for advocacy. <grin> I'm a little surprised that it took six months of All Train Laptop, All The Time, but I suppose most people don't look at other people's laptop screens (and when they do, they either don't realise what it is, or are too timid to comment).
• Getting stuck on my Central-to-Hornsby train at Epping due to a breakdown further up the line. Things that make this OK include the good air-conditioning on these Intercity services (in a non-air-conditioned train, I'd be ready to walk to Hornsby by now), the fact that I have a second battery for the laptop (remember kids: keep that spare battery charged, and use suspend-to-disk when switching -- Matthew Garrett, I didn't buy you enough beer at LCA), and my recently-aquired (by work, thank $DEITY) Vodafone 3G wireless "broadband" card. I could live without it, but being able to wire-up makes these extended stops far more bearable -- I'm effectively starting my work day at the regular time, it's just that at the moment I have air conditioning. <grin>

Most days commuting are straight-forward, no-nonsense, uninteresting days. But when the Universe decides to put on a show, it makes sure it's worth watching.

Since everyone seems to be bashing GNOME for some design choice nowadays, here's my #1 item: the distinction between the clipboard and the X11 selection, paired with the total incapability of a lot of GNOME apps to keep the selection. Sometimes I have to mark text, copy it into some app that speaks gnomish, mark it there so it is in the selection and only then I can paste it into an xterm. Since the selection is not going to in away, why not spare your users from having to learn another thing that is not only annoying as it requires an extra right-click-context-menu-selection action but also d

How nice. The FCC wants "a "back door" be built into all Internet-communications hardware and software to provide access for law enforcement agencies". This and similar horror scenarios for the freedom and privacy of the people are nothing unusual these days. A more general (and more paranoid) question: How do we know whether our software or hardware is backdoored/wiretapped? We all know that using a certain OS from Redmond opens a lot of security holes in itself. Add to that all the now-public attempts of agencies and companies ranging from the FBI, NSA, Sony to antivirus-software vendors who install backdoors on your PC, and you've got some very good reasons to never trust any closed-source software again. This is not a problem for most of us using Free Software and free operating systems (Linux, *BSD, etc.). Theoretically, we can read the source code of almost every single instruction being executed on our hardware, and verify that the software doesn't do any funny things like phoning home, logging keystrokes, opening backdoors and so on. However, how can we know whether or not our hardware has been backdoored/wiretapped/trojaned (or whatever you want to call it)? Given that almost all devices we own nowadays (PDA, iPod, cell phone, hardware VOIP phone, and all the other gadgets) as well as most parts of our PCs and laptops have some sort of microcontrollers on them, how can we be sure that there is no secret code hidden in there which spies on us or provides hidden backdoors to them (whoever that may be)? With some devices you can dump the firmware and analyze that, but most parts are probably not easily analyzable by mere mortals. Think network cards, builtin wireless cards, sound cards, bluetooth chips and so on. IMHO, a good first step in the right direction are things like OpenBIOS (Free Software firmware/BIOS) and OpenEZX (Free Software GSM phones). Alas, I think DRM will pose a major threat here in future, as we probably cannot easily replace custom firmware/software anymore if DRM in the worst form becomes reality. So, how would you go about to ensure that your hardware has not been backdoored? How can we detect such things? How can we defend against such things? How can we remove backdoors if we find any? Do you know of any relevant research, papers, documents, HOWTOs? Any cases you know of where such things happened? Any practical tips or advice?

Last week, some friends and I played a very exciting and long (6 hours) game of Risk. At the end, I thought: Too bad we can’t rewind the game and play it fast forward, just see how the tides of colors are waging.Well, on Sunday, I though, why not, and started writing “RiskRecorder”. It is my first larger project with python and gtk+, and I am quite content with both of them. The map is stolen from JRisk, and with that the idea of a gif file that maps pixels to countries. The RiskRecorder is meant to be used during a game of regular risk, to - well - record the moves. As a side benefit, you don’t have to calcuate the number of units you get anymore, as the RiskRecorder can tell you that. You can then save the whole game for later review.It should be in a usable state by now, but I plan to add more features sometime, like better animations and graphs showing development of the game.To try it yourself, you need the program itself (one file so far), then get at least the board.map, board_map.gif and board_pic.jpg from the jrisk CVS repository (you can open any other JRisk map in RiskRecorder, too). You might need to download the python bindings for gtk and cairo, too. On debian, I assume that apt-get install python-gtk2 python-cairo will get you what you need.As always, comments, bugreports and patches are welcome. To follow development, have a look at my svn repository.

I wondered where all my diskspace had gone to... Using Baobab, I discovered it was my ~/.thumbnails directory containing 1.1 GB of data. I definitely have way to many pictures... (there were thumbnails of at least of all pictures I shot during my US trip in there) So when you are running out of diskspace, check your Trash and thumbnails folders... ;-)

As I mentioned yesterday, I noted that Blosxom was misbehaving with RSS feeds where a flavour was used to customise the character set of the feed. Tonight I made time to look under the hood, and found:

      if ($content_type =~ m \Wxml$ )  
        # Escape <, >, and &, and to produce valid RSS
        my %escape = ('<'=>'&lt;', '>'=>'&gt;', '&'=>'&amp;', '"'=>'&quot;');  
        my $escape_re  = join ' ' => keys %escape;
        $title =~ s/($escape_re)/$escape $1 /g;
        $body =~ s/($escape_re)/$escape $1 /g;
       

Which I promptly changed to

      if ($content_type =~ m \Wxml(; charset=.*)?$ )  
        # Escape <, >, and &, and to produce valid RSS
        my %escape = ('<'=>'&lt;', '>'=>'&gt;', '&'=>'&amp;', '"'=>'&quot;');  
        my $escape_re  = join ' ' => keys %escape;
        $title =~ s/($escape_re)/$escape $1 /g;
        $body =~ s/($escape_re)/$escape $1 /g;
       

and now I can have my cake and eat it: UTF-8 encoded RSS feeds.

Julien Danjou and others replied to my "please don't obfuscate BitTorrent" post, pointing out providers in France, Canada that already filter BitTorrent one way or another. I've read similar things about some DSL providers in Germany (Telekom however is proud that they don't do that). But basically this only shows my point: by having the major p2p filesharing protocols use non-standard ports and non-detectable protocols, more and more providers take measures like doing QoS for non-standard ports or filtering them altogether. And just as you reported, this has bad side effects on the ability of other users to e.g. use VoIP or play online games. Remember: my point is to make P2P protocols easy to filter/limit by routers, so provider do NOT block/throttle all non-HTTP connections, but can selectively throttle only P2P filesharing when they think they need to. Because otherwise they'll break other stuff such as online games and VoIP. Now by putting your BitTorrent on ports such as 80 or some VoIP port which isn't throttled, you only cause these providers to e.g. install a transparent proxy for these services. You make it only worse. I agree that you don't have that much choice in countries where there is some kind of monopoly there. But then this increase in filtering will probably allow new companies to enter the market.

Gotta love Debian sometimes. ;) My beloved mutt seems a little broken in unstable currently. I’m in the market for a new AM. 3rd time lucky? Ok, so I am packaging Aaron’s web.py library and so I check the license with debian-legal. “Vorlon”, the omnipresent and omniscient got back to me pretty quickly, saying no. Goddam! ;) I’m no legal expert and my brain hurts thinking about these distribution clauses, GPLv3 issues and controversies. I hope debian-legal reaches some agreement. At about 6pm I noticed the Ubuntu crowd were in Seoul. I emailed hastily asking about a meetup or something. Probably too late. Damn. I’m feeling quite alone in my Linux usage here in Korea. I see Mark has been in Japan. I have fond memories of Japan and the debian guys out there. Yeah, if any Korean devs are reading this, get in touch. Part asked me to get in contact with some mail administrators in order to curtail some of the massive amounts of spam coming out of Korea.