FreeBSD vt(4) -commonly known as Newcons -, which is planned to replace Syscons as the default FreeBSD console, is now available on Debian GNU/kFreeBSD. It is enabled by default, but only in kfreebsd-11 packages from experimental. Newcons provides many interesting new features, such as KMS support, Unicode, double-width CJK characters, etc. More details are available in FreeBSD wiki. Ironically, Debian GNU/kFreeBSD is in a bit more of a hurry to deploy Newcons than FreeBSD is. The reason for this is that Newcons is practically a requirement for using the new KMS drivers. While FreeBSD Ports, in order to ensure a smooth transition, preserve support for UMS (User Mode Setting) in their X11/DRI userland, Debian supports many kernels and (contrary to some ill claims I heard) gives priority to new features on Debian GNU/Linux port, which is the one with most users and developers. In this case, it means KMS is the only option when it comes to X11/DRI userland in Debian. Anyway, we ve been making some nice progress. Here s a screenshot of Newcons in action in a Debian system (running on VirtualBox, thus with VGA backend): The idea is to backport this to kfreebsd 10.0, as FreeBSD plans to merge it into stable/10 anyway. However, it is still in the process of being tested (and being polished on FreeBSD, I hear they plan to merge it on March).

A new maintenance release of the RcppBDT package is now on CRAN. There is no new code in this; it mainly accomodates a request by CRAN to standardize the \code Imports: and \code Depends: relationships in the \code DESCRIPTION file. We also updated the build process now that we can use Rcpp 0.11.0. Having said that, there is a lot of new code in the git repository but I guess I'll talk about that when I can make a new upload. Yesterday, this balked because win-builder felt the need for a long long int in 64-bit mode which we can provide once C++11 will be permitted under R 3.1.0, due out in April. Oddly, no such need arose in 64-bit Linux. Oh well. The complete NEWS entry is below:

Changes in version 0.2.2 (2014-02-21)

• Updates to current CRAN Policy standards for Depends: and Imports: in DESCRIPTION
• Also take advantage of new Rcpp 0.11.0 build options
• New code remains in GitHub repo master branch until R 3.1.0 is release so that we can use C++11 in order to get the long long int support without which the package does not build on Windows (whereas Linux is fine)

Courtesy of CRANberries, there is also a diffstat report for 0.2.2 relative to 0.2.1. As always, feedback is welcome and the rcpp-devel mailing list off the R-Forge page for Rcpp is the best place to start a discussion.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

A pure maintenance release of RDieHarder is now on CRAN. RDieHarder provides R bindings for the DieHarder battery of tests for random number generators by Brown et al. This release contains no new code, but the vignette needed to be moved from inst/doc to vignettes/ to help finalize that transition of the R / CRAN Package Policy. Courtesy of CRANberries, there is also a diffstat report relative to the previous release. As always, more detailed information is on the RDieHarder page.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

So finally I did it, I managed to ride the 2-wheeler in Bangalore roads!. Officially I've got a license to drive 2 and 4 wheelers back in 2011 but I was never confident enough to ride the vehicle on road and in traffic. Partially this is because I don't own a vehicle and I've never practiced driving, and partially because of road and traffic conditions in India I was bit afraid to do so. So today morning my roommate and me planned to go to temple in the early morning. We got up at 530 in the morning and we were ready to drive to Mahalaxmi Layout at 615. Since during this time traffic is very less I asked my roommate shall I drive and he agreed!. So I drove the bike from Malleshwaram to Mahalaxmi Layout and it was fun. I did had hick up in uphill driving as my mind was not co-ordinating well with breaks and gear. I did have hickups in first gear too but I guess this will be alright once I get hold of things. I'm still not having enough confidence to drive during the peak hours because people are not at all following traffic rules. They just change the lane without any hints or just come to middle of road from side roads without looking at other side to see if there is a vehicle is coming from other side of the road (yes they don't have courtesy to wait). And finally they can shout at persons who is actually following rules. In general very less people have traffic discipline in India. But I will adapt to this once I start driving so I'm now all set to get my 2 wheeler soon and ride on!

For the past few years I've hosted all my websites in a "special" way:

• Each website runs under its own UID.
• Each website runs a local thttpd / webserver.
• Each server binds to localhost, on a high-port.
• My recipe is that the port of the webserver for user "foo" is "$(id -u foo)".
• On the front-end I have a proxy to route connections to the appropriate back-end, based on the Host header.

The webserver I chose initially was thttpd, which gained points because it was small, auditable, and simple to launch. Something like this was my recipe:

#!/bin/sh
exec thttpd -D -C /srv/steve.org.uk/thttpd.conf

Unfortunately thttpd suffers from a few omissions, most notably it doesn't support either "Keep-Alive", or "Compression" (i.e. gzip/deflate), so it would always be slower than I wanted. On the plus side it was simple to use, supported CGI scripts, and served me well once I'd patched it to support X-Forwarded-For for IPv6 connections. Recently I setup a server optimization site and was a little disappointed that the site itself scored poorly on Google's page-speed test. So I removed thttpd for that site, and replacing it with nginx. The end result was that the site scored 98/100 on Google's page-speed test. Progress. Unfortunately I couldn't do that globally because nginx doesn't support old-school plain CGI scripts. So last night I removed both nginx and thttpd, and now every site on my box is hosted using lighttpd. There weren't too many differences in the setup, though I had to add some rules to add caching for *.css, etc, and some of my code needed updating. Beyond that today I've setup a dedicated docker host - which allows me to easily spin up containers. Currently I've got graphite monitoring for my random hosts, and a wordpress guest for plugin development/testing. Now to go back to reading Off to be the wizard .. - not as good as Rick Cook's wizardry series (which got less good as time went on, but started off strongly), but still entertaining.

I made some changes on http://llvm.org/apt/ for the last 2 months.

• Added trusty, Ubuntu 14.04, as a new supported distribution (on the request of Michael Larabel, Phoronix)
• Support both the stable and development version. Currently, that means that the release_34 branch and the trunk are built. So, for example, clang-3.4 and clang-3.5 can be installed.
  release_34 are only built when a new commit is submitted in this branch. trunk is built twice a day.
• Add a new package llvm- 3.4,3.5 -tools which contains various tools to build software/packages on top of llvm. Contributed by Martin Nowack in the context of Klee.
• Since a C++ 11 compiler is now mandatory, I had to force the usage of a backported gcc/g++ 4.8 (thanks Doko).
  This is the case for Ubuntu Precise (12.04), Quantal (12.10) and raring (13.04).
  The thing is that it triggers a dependency on the libstdc++ 4.8 causing the PPA to be mandatory.
  deb http://ppa.launchpad.net/ubuntu-toolchain-r/test/ubuntu $DISTRIBUTION main
  
  For now, because of the lack of backport of gcc 4.8, I am not providing support for Debian stable (wheezy).

Did you ever want to be able to tag your files, and use the tags to query and select the files you want? For many sorts of files we use, this is clearly better than being locked into a single hierarchial view of nested directories. Semantic file systems are a way to do things like this. But that's an entire separate filesystem, often implemented as a FUSE layer. I have never wanted tagging enough to take on that layer of complications. A week ago I realized that there was a way to do this without using an entirely separate filesystem. When we use git, we're used to having different views of our files, called branches, that we switch between. What then, if a git branch were generated from tags and other metadata that meet a query, providing a custom view that meet the user's current needs and could be incrementally refined. Here's a short screencast demoing these views.
And here's a walkthrough for setting it up. To build this, I needed a nice way to store metadata in git, and since git-annex happens to have a very nice way of using git as a database, I naturally built it on top of git-annex. This means that the tags and other metadata are automatically synchronized between different clones of the repository. Multiple users can be tagging and setting other metadata at the same time, and their changes will merge in a consistent way. I have a long list of things to do to fully integrate views into git-annex. However, they're already basically usable, and I'm very pleased with how these dymanic views of the contents of a repository are working out. Today's release of git-annex includes views support, so give them a try!

So Whatsapp has been acquired by Facebook and this news is still hot and people are discussing it all over the twitterverse. So I took this opportunity to stop using Whatsapp and removed it from my phone. Possibly I could have deleted my account but who cares. Anyway I've been searching for a secure and FLOSS alternative for Whatsapp for quite some time now, few days ago I found about Telegram but after reading post by Tincho on planet Debian, I decided not to use it. Recently while going through the talk list for fossmeet.in I found link for Kontalk in a privacy awareness talk proposal by Praveen and thought I should give it a try. So below is my first feelings about Kontalk.

Wanna-build, wanna-build, which packages spent most time on armel buildd's since beginning of 2013?

         package           sum(build_time)
-------------------------+--------------
 libreoffice               114 09:16:34
 linux                     113 02:58:50
 gcc-4.8                   064 01:21:09
 webkitgtk                 059 19:09:27
 acl2                      043 16:40:50
 gcc-4.7                   028 14:03:53
 iceweasel                 026 19:02:13
 gcc-snapshot              026 01:31:21
 openjdk-7                 020 02:41:53
 php5                      019 16:13:22
 llvm-toolchain-3.3        017 19:05:38
 qt4-x11                   017 02:57:09
 espresso                  016 03:50:37
 pypy                      015 07:07:25
 icedove                   014 18:57:08
 insighttoolkit4           014 17:16:43
 qtbase-opensource-src     014 12:39:09
 llvm-toolchain-3.4        012 03:06:15
 mono                      011 22:30:13
 atlas                     011 20:40:54
 qemu                      011 17:11:09
 calligra                  011 16:05:55
 gnuradio                  011 15:19:35
 resiprocate               011 10:14:56
 llvm-toolchain-snapshot   011 02:04:44
 libav                     010 13:52:03
 python2.7                 009 18:58:33
 ghc                       009 18:28:48
 gnat-4.8                  009 13:59:57
 axiom                     009 12:40:24
 cython                    009 00:47:04
 openjdk-6                 008 16:38:14
 oce                       008 10:29:20
 eglibc                    008 06:04:26
 ppl                       007 20:48:45
 root-system               007 17:32:16
 openturns                 007 10:12:53
 gcl                       007 08:02:42
 gcc-4.6                   007 02:50:48
 k3d                       007 00:36:11
 python3.3                 007 00:25:42
 llvm-toolchain-3.2        007 00:17:59
 vtk                       006 17:53:28
 samba                     006 17:17:27
 mysql-workbench           006 14:36:46
 kde-workspace             006 07:31:12
 gmsh                      006 04:32:42
 psi-plus                  006 04:30:08
 octave                    006 04:17:22
 paraview                  006 04:13:25

Timeformat is "days HH:MM:SS". Our ridiculously stable mv78x00 buildd's have served well, but has come to become let them rest. Now, to find out how many of these top time consuming packages can build with parallel make and are not doing so already.

Instances of the for those who care about X snowclone on Debian mailing lists:

• their packages in Ubuntu (the original!)
• lesbians
• Andrew Suffield
• debian-devel-announce
• their packages in klik
• the [GFDL] GR
• stable updates
• bits from [press and events] teams
• glib applications
• experimental
• Debconf
• Policy 7.6
• Switzerland/Liechtenstein
• X
• firmware
• bts-link
• lesbians (reloaded)
• pam-ssh
• Mercurial
• manpages
• their packages in Debian
• unbound
• irker
• [team metrics] statistics

When starting to work on a new project I start from an empty git repository right away so I can try out different ideas, revert easily, can diff against old versions (to check if I missed something) and have a commit history to record fixmes and todos. However when making the repo public these things are not of much interest anymore so I truncate the history. To be on the save side I want to keep that history locally though. Assuming the repo is on master, I do:

# 1.) Move the old master out of the way
git branch -m branch master oldmaster
# 2.) Get the current tree at HEAD
tree=$(git rev-parse HEAD^ tree )
# 3.) Create a new commit without ancestry
commit=$(git commit-tree -m "Initial commit" $tree)
# 4.) Make this the new master
git branch master $commit
# 5.) Switch to the new branch
git checkout master

Done. One can now add a remote and push the master branch. The old history is still there locally on the completely detached commit history ending at oldmaster:

$ git log --pretty=short --graph --decorate master oldmster
* commit d5cf3371eaefbaa8efac10c0fb9e7597da17b423 (HEAD, master)
  Author: Guido G nther <agx@sigxcpu.org>
      Initial commit
* commit 64103ff72bde13d7ec4cf0489ad2a80f3ac249d3 (oldmster)
  Author: Guido G nther <agx@sigxcpu.org>
 
      Another uninteresting commit message
 
* commit bd7332a79380bb217eca09cbd7f6ff0e5174deb8
  Author: Guido G nther <agx@sigxcpu.org>
 
      Uninteresting commit message
 
... <more old history>

Update: Uli Heller pointed out that this is the same as using git checkout's --orphan option.

Wowsers, today was a pretty full, but laid back day. Zoe has this small wrist-sized ring with a bunch of different coloured long ribbons on it that she got from a birthday party a while ago. She plays with it every now and then, and uses it to torment Smudge. This morning she was dancing around with it, and it made me think of rhythmic gymnastics, so using my trusty Chromecast, I dug up some Youtube coverage from the 2012 Olympics. Zoe loved the sparkly costumes and the routines. The first video alternated between ball and hoop routines. Zoe went out and rummaged around her craft drawers and came back with a styrofoam ball and was using her crown from yesterday as a hoop. It kept her occupied for about an hour. I watched the first three competitors with her and she continued to watch it while I had a shower. I see a hula hoop in her future. We biked over to her Brazilian Jiu Jitsu class and had another really good class. I think Zoe's really enjoying the mix of gymnastics-style activities and game play. She also got to tackle me today, which she thoroughly enjoyed. The instructor suggested we might like to try out one of the 4-7 year old proper martial arts classes, so we'll try that in the coming weeks. We biked home the scenic way again and picked up a few additional supplies for lunch. When we got home, Zoe went off and played with some of her toys on her own. It's great that she's getting more independent and self-directed like that. I'd invited Zoe's great-grandparents (on her mother's side) over for lunch today. I think it's wonderful that Zoe has great-grandparents who are still alive and able to be in her life. We had a nice lunch and they wanted to see the kinetic sand I'd blogged about, so we got that out after lunch for a play. Then Zoe wanted to watch some more rhythmic gymnastics with them, so we did that for a bit. After they left, I swapped over to rhythmic gymnastics with the ribbon and clubs. The ribbon is my personal favourite one to watch, and I think Zoe enjoyed it too, because she immediately started waving her ribbons all over the place. I trialled skipping her nap today, and instead called watching the gymnastics "quiet time". After quiet time, we did our Science Friday activity, which was messing around with conductive play dough. Zoe had about as much fun just messing around with the play dough as she did running electricity through it, and enjoyed mushing the non-conductive white play dough in with the conductive blue play dough. We did a few experiments, notably one with three LEDs in series, and then shorting the play dough at either end of the series to see what it did to the lights. She enjoyed wearing her lab coat and safety glasses. I'd wanted to do bottle rockets today, because we'd built a cardboard box rocket earlier in the week, and that seemed like a good theme to stick with, but I was ill-prepared, and it was too hot anyway. I want to do Diet Coke and Mentos and reuse the Coke bottles for the bottle rockets, so that'll have to be in a few weeks' time. I prepped dinner on and off while Zoe played with the play dough, so it was all ready to pop in the oven nice and early. After I cleaned up the mess from the play dough, we played with her coloured peg board game for a bit, and then she wanted to see how the sofa bed folded out, so we did that I used it as an opportunity to give it a thorough vacuuming. After that she watched a bit more TV while dinner was in the oven. After dinner, we walked down to the Hawthorne Garage for a babyccino. Zoe had to pat every dog that crossed our path. Zoe didn't seem too worse for wear for having dropped her nap (which was to be expected, it's only a recent phenomenon for her to nap at home), but she was showing signs of possibly coming down with a cold (being a bit sniffy, without having obvious signs of a runny nose) so I put her to bed about half an hour early. She went down pretty easily, which was a pleasant change. I did miss the 2 hour opportunity to get things done during the day though. C'est la vie. The thing I liked most today is Zoe's independently going and playing with toys that she's had for ages, but not really shown much interest in. She's had this Melissa and Doug board with interchangeable sheets with animals on them and a bunch of different colour octagonal plastic pegs that you're supposed to match the coloured pegs to whatever colours are on the sheet you put on the board. We did that this afternoon, and this morning she played a lace up game where you thread shoelaces through some thick cardboard outlines of animals. I think she got both for Christmas in 2012.

A new minor release of RcppArmadillo is now on CRAN and in Debian. RcppArmadillo brings the Armadillo templated C++ library for linear algebra to R by means of Rcpp. This release contains both a few minor bugfixes from the 4.000 branch of Armadillo and some enhancements in RcppArmadillo itself that are related to the recent Rcpp 0.11.0 release.

Changes in RcppArmadillo version 0.4.000.4 (2014-02-19)

• Upgraded to Armadillo release Version 4.000.4
  • fix for randi() generating out-of-interval values
  • fix for saving field objects
  • workaround for a bug in the Intel compiler
• Updated for Rcpp (>= 0.11.0) by removing linking step from build process, added appropriate dependency on Rcpp
• Updated RcppArmadillo.package.skeleton function accordingly to use proper NAMESPACE import
• Rewritten rcpparma_hello_world (which is used by the RcppArmadillo.package.skeleton function) to use Rcpp Attributes, and added more examples
• Added two functions to set Armadillo's RNGs (ie the system RNG) from a given value and to randomize it, as suggested by G bor Cs rdi. Note that these do not work within RStudio (which itself also uses the same system RNG).

Courtesy of CRANberries, there is also a diffstat report for the most recent release As always, more detailed information is on the RcppArmadillo page. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Basic configuration There are a few basic things that most admins will already know (and that tiger will warn you about if you forget):

• only allow version 2 of the protocol
• disable root logins
• disable password authentication

This is what /etc/ssh/sshd_config should contain:

Protocol 2
PasswordAuthentication no
PermitRootLogin no

Whitelist approach to giving users ssh access To ensure that only a few users have ssh access to the server and that newly created users don't have it enabled by default, create a new group:

addgroup sshuser

and then add the relevant users to it:

adduser francois sshuser

Finally, add this to /etc/ssh/sshd_config:

AllowGroups sshuser

Deterring brute-force (or dictionary) attacks One way to ban attackers who try to brute-force your ssh server is to install the fail2ban package. It keeps an eye on the ssh log file (/var/log/auth.log) and temporarily blocks IP addresses after a number of failed login attempts. Another approach is to hide the ssh service using Single-Packet Authentication. I have fwknop installed on some of my servers and use small wrapper scripts to connect to them.

Using restricted shells For those users who only need an ssh account on the server in order to transfer files (using scp or rsync), it's a good idea to set their shell (via chsh) to a restricted one like rssh. Should they attempt to log into the server, these users will be greeted with the following error message:

This account is restricted by rssh.
Allowed commands: rsync 
If you believe this is in error, please contact your system administrator.
Connection to server.example.com closed.

Restricting authorized keys to certain IP addresses In addition to listing all of the public keys that are allowed to log into a user account, the ~/.ssh/authorized_keys file also allows (as the man page points out) a user to impose a number of restrictions. Perhaps the most useful option is from which allows a user to restrict the IP addresses which can login using a specific key. Here's what one of my authorized_keys looks like:

from="192.0.2.2" ssh-rsa AAAAB3Nz...zvCn bot@example

You may also want to include the following options to each entry: no-X11-forwarding, no-user-rc, no-pty, no-agent-forwarding and no-port-forwarding.

Increasing the amount of logging The first thing I'd recommend is to increase the level of verbosity in /etc/ssh/sshd_config:

LogLevel VERBOSE

which will, amongst other things, log the fingerprints of keys used to login:

sshd: Connection from 192.0.2.2 port 39671
sshd: Found matching RSA key: de:ad:be:ef:ca:fe
sshd: Postponed publickey for francois from 192.0.2.2 port 39671 ssh2 [preauth]
sshd: Accepted publickey for francois from 192.0.2.2 port 39671 ssh2 

Secondly, if you run logcheck and would like to whitelist the "Accepted publickey" messages on your server, you'll have to start by deleting the first line of /etc/logcheck/ignore.d.server/sshd. Then you can add an entry for all of the usernames and IP addresses that you expect to see. Finally, it is also possible to log all commands issued by a specific user over ssh by enabling the pam_tty_audit module in /etc/pam.d/sshd:

session required pam_tty_audit.so enable=francois

However this module is not included in wheezy and has only recently been re-added to Debian.

Identitying stolen keys One thing I'd love to have is a way to identify a stolen public key. Given the IP restrictions described above, if a public key is stolen and used from a different IP, I will see something like this in /var/log/auth.log:

sshd: Connection from 198.51.100.10 port 39492
sshd: Authentication tried for francois with correct key but not from a permitted host (host=198.51.100.10, ip=198.51.100.10).
sshd: Failed publickey for francois from 198.51.100.10 port 39492 ssh2
sshd: Connection closed by 198.51.100.10 [preauth]

So I can get the IP address of the attacker (likely to be a random VPS or a Tor exit node), but unfortunately, the key fingerprints don't appear for failed connections like they do for successful ones. So I don't know which key to revoke. Is there any way to identify which key was used in a failed login attempt or is the solution to only ever have a single public key in each authorized_keys file and create a separate user account for each user?

Today was a pretty good day. I've found that I quite enjoyed it. Zoe woke up a bit early, around 5:30am. She decided that despite the ridiculous heat, she wanted porridge for breakfast, with cherries in it, so we pitted the cherries and threw it all into the Thermomix to cook while she got dressed. After breakfast and the obligatory bit of TV, we biked over to Playgroup. Zoe's got a few toys that she's taken a liking to, and immediately sought them out. She also seems to really enjoy just running the length of the hall after Playgroup is all done and everything has been packed away and most of the kids are gone. Today the craft activity was making paper crowns, and she wanted to that immediately upon arrival. After we got home, while I was preparing lunch, she blinged it up a bit more with some stuff from home. She took a 2 hour nap after lunch, and I did some more work on my taxes, and then, because it was still stupidly hot, we biked over to Colmslie pool for a swim. Zoe's swimming progress continues in leaps and bounds. She's had one lesson at her new level, and she's started with a kickboard and is doing strokes, so I borrowed a kickboard from the pool, and she did really well with it. We also just fooled around with the kickboard a bit. I took it to the bottom of the pool and launched it out of the water with its own buoyancy, and Zoe tried standing on it under water like a skateboard. The sinkies were also popular again. We grabbed a few things for dinner from the Hawthorne Garage on the way home, and I managed to get Zoe to bed a little bit early. I thought I was going to have a smooth bedtime, but unfortunately, as is a common occurrence at the moment, after lights out, she started crying for her mother. It took about 15 minutes to get her from near-hysterical to calm and drowsy. I'm starting to think I might need to either shorten or eliminate the afternoon naps. One of her complaints recently has been that she's had trouble sleeping at bedtime. That said, she still seems to get to sleep relatively quickly once she gets into the right frame of mind.

In my article Contributing on GitHub I recently explained that I can not use certain social features of GitHub on their website directly. I also explained that I make great use of Hub to circumvent some accessibility issues I have with GitHub. Well, it turns out that adding star, unstar, follow and unfollow to Hub was actually a lot easier then I thought. It is long ago (probably 10 years) that I touched Ruby code the last time. However, since I do learn a lot from examples, I was actually able to add what I needed just by looking at surrounding code. Well, I had to lookup how you add an element to the end of an array (push) but that was basically it. You can have a look at the final outcome in Hub pull request #490. The code resides in the social branch of my hub fork. If you already have an OAuth token for hub, you need to login to GitHub and edit your token to add the user:follow scope if you want to use the follow and unfollow commands. Interestingly, this type of operation is accessible enough to still work with Lynx! I hope this gets merged, I don't particularily like to maintain my own forks of quite obvious functionality. Anyway, problem solved, mostly. All I am missing now is the ability to delete a repository. A dangerous feature, so probably controversial. Anyway, something for another day.

Thomas Habets has blogged about using your TPM (Trusted Platform Module) for SSH authentication a few weeks ago. We worked together to get his package simple-tpm-pk11 into Debian, and it has just arrived in unstable :-). Using simple-tpm-pk11, you can let your TPM generate a key, which you then can use for SSH authentication. This key will never leave the TPM, so it is safer than having your key on the filesystem (e.g. ~/.ssh/id_rsa), since file system access is not enough to steal your key anymore. Instead, you ll need remote code execution. To use this software, first make sure your TPM is enabled in the BIOS. In my ThinkPad X200 from 2008, the TPM is called Security Chip . Afterwards, claim ownership of your TPM using tpm_takeownership -z (from the tpm-tools package) and enter a password. You will not need to enter this password for every SSH authentication later (but you may choose to set a separate password for that). Then, install simple-tpm-pk11, create a key, set it as your PKCS11Provider and install the public key on the host(s) where you want to use it:

mkdir ~/.simple-tpm-pk11
stpm-keygen -o ~/.simple-tpm-pk11/my.key
echo key my.key > ~/.simple-tpm-pk11/config
echo -e "\nHost *\n    PKCS11Provider libsimple-tpm-pk11.so" >> ~/.ssh/config
ssh-keygen -D libsimple-tpm-pk11.so   ssh shell.example.com tee -a .ssh/authorized_keys

You ll now be able to ssh into shell.example.com without having the key for that on your file system :-). In case you have any feedback about/troubles with the software, please feel free to contact Thomas directly.

Today was my "clean the house" day. I also had a chiropractic adjustment first thing, and a massage before lunch. I biked to Kindergarten to pick up Zoe, and found her holding court with a bunch of her classmates, giving a show and tell session about the Cinderella snow globe and echidna plush toy she'd taken to Kindergarten. The kids were taking turns to raise their hand and ask questions. I was out of earshot, so I couldn't really make out what was being said, but it all looked very cute from where I was standing. She didn't have a nap today. Sarah's going down to Tasmania until early next month, hiking, and so I've got Zoe for the next 12 nights. This is the longest she will have been away from her mother by quite a significant amount. On top of this, she's been doing rather poorly at bedtime with me the last few nights I've had her. I wanted to try and minimise the emotional impact for both of us as much as possible, so I wanted to make an Advent-style calendar to count down the number of sleeps until Mummy got back. After we got home from Kindergarten, we drove over to Officeworks to pick up some bits and pieces. It ended up being quite a long outing because it took a while for me to figure out how to convince the self-service photo printing kiosk to actually print photos. Zoe parked herself in the kid's colouring area, and she was quite happy there while I went looking for a few things, but after a while wandered off to find me and we spent some time looking for each other. I was pretty impressed with how well she went looking for me. She didn't freak out, and was just wandering around the store looking for me. We had a talk about staying put. Then we called grandma from the carpark to wish her a happy birthday before we headed home. That ended up being quite a lengthy outing, and I started dinner as soon as we got home. Bedtime actually went quite smoothly tonight for a change. No idea if the poster or the lack of a nap helped or not.

In cycling, a ride's Training Stress Score is a function of that ride's duration, average power and the intensity of the ride relative to the rider's capability. This Slowtwitch article provides a good overview on how intensity and TSS is calculated on a bike. However, having TSS values for other sports allows a multisport athelete to take into consideration the physiological cost of activities in different sports. This is achieved by ensuring, say, 50 TSS on the bike "counts" the same as a 50 TSS run. This can be used to simply determine the length, intensity and scheduling of the athletes next workout (to ensure adequate recovery) regardless of the combination of sports, or to identify the athlete's long-term tolerance to and targets for training load using metrics such as Chronic Training Load. To make this possible when using Strava, I wrote a Chrome extension that estimates the TSS score of a run from its Grade Adjusted Pace distribution: Source code is available. If you found this Strava extension useful, you might like my extensions to quickly switch between metric and imperial units or to change the default comparison filter.