The following was written by Stefano Cosentino in regard to the ongoing efforts of the Australian government to censor the Internet with protecting the children as an excuse. All these Internet filtering ideas that have been in the news lately has made me voice my own opinion on the matter as a non-expert. I m an IT advisor. I take someone s problem and help them fix it. I have a few clients who provide laptops to their students, everything is done with these laptops. The students have no books. The school provides laptops to their primary school students as well as their high school students. They have done this long before the public system started to hand out laptops to a select number of high school students. When you provide a child with anything, there are always areas where a child will find that you may have overlooked. In fact, a young kid will probably find a host of things that you might have totally missed or didn t ever know about. One of these things is the inappropriate nature of information you may find that are associated with computers. This can be anything. But specifically, what the filtering argument has been about has been leaning towards Internet pornography and I would imagine, more specifically content of a pedophiliac nature. I m not against child pornography being banned or filtered. I personally think this is one of the most cruel, inconsiderate, disrespectful and self centered behaviors a person could display. Their psychological makeup isn t the scope of this article. However these ideas must be conveyed when discussing the Internet as a modern technological device that can be used for both good and bad. The primary school students that I attend to aren t very interested in this stuff and as it has been mentioned long ago by others who have joined this argument, are more interested in online flash games that include characters such as Ben 10, Pokemon and Yu-Gi-Oh. When I m called in to scan these computers during the school holidays and hand the laptops back to the kids or when they get handed back after 3 years for new ones, I find that the older primary school kids computers are usually more prone to the adult orientated content. To me this is the first sign of a filter s failure. This customer of mine spends more money on the filtering devices they use on campus than I charge them for a few days of work. Does it work? Sadly, I hate to report that no, it does not. It s completely useless. The kids still have files and traces of files on their computers that isn t suitable for young children. Not only pornography but also content of a violent or morbid nature. As young and impressionable people, everything they read, see and hear is absorbed. This shapes the way society will become in years to come. Since no one can realistically tell the future, wouldn t it be nice if we could make sure that the people looking after us and our lives forty or fifty years from now have a sane mind free of blemish? It s a different story for the high school children. While scanning their laptops I have to contact the police on a daily basis because of the nature of the content I find during my day. Some things you can let slip, today s version of a pinup girl, or a provocative pic of whatever skimpy clad girl the record companies are flogging off these days as musicians. But sadly that s rare. I won t go into detail of what I find on these laptops of 14 year old boys, but it ranges from some innocent growing up curiosity right to perverted, sick and most if not all of the time, illegal content. The filters fail again. The kids find a way around it. And they find it easily. I ve seen filters work and not work at all with young kids right through to young adults. All the filters do is either hinder the poor kids actually trying to do research of scholastic nature or prolong the inevitable and temporarily block a determined child s interest in the search for some adult related material. The filter might prevent accidental viewing but it doesn t stop the deliberate finding of pornography and other illegal content. How does a filter stop this from happening? How does a filter stop a child taking their parents adult videos and copying them to their laptop or finding dad s stash of Penthouse? How does it stop a school mate bringing this stuff to school to show everyone at lunch time or to trade for other content they found by other means. Remember back to when you were their age and caught a glimpse of your big brother s room wall. How many times did you try and catch a peak at that Samantha Fox poster hanging off the wall? Where s the filter now? Here s some thing to think about. The filter shouldn t be a thing, it should be a person. They re called responsible . They re called parents. What priorities do parents have if their child feels that what they look at online that is of an adult nature is acceptable? Or maybe the kid knows better, knows it isn t acceptable but still goes out of their way to get the stuff on their computer? Sneaker Net still exists, USB memory sticks are cheap and can now have two or three straight DVD rips on them, or perhaps five or six encoded films on there. Hundreds and thousands of images and so on. Filter failure again. When the kids go online, they know of the technology used to block them from gaining access to what they want to see. Chances are, they ll know what a proxy server is and does. Then they ll figure out what they need to do to get around the filter. I, myself did this back in high school and TAFE when I couldn t find photographs of a particular device I was researching. Turns out the name is also a form of sexual activity, in another language, but still. The filter stopped me from not only looking the offending content but also to look at the legitimate data that I needed to complete an assignment. I got around the problem by researching some more information and the following day I was breaking through firewalls and proxy servers with easy. Filter failure. How do I get around this issue when speaking to younger kids that need guidance and knowledge on how to deal with this situation? I hold talks at the school I provide my services to. I talk to the parents, no kids. The talk costs less than a broken filter they keep throwing money at keep up-to-date. The school puts these filters in place to appear responsible, because while the kids are attending their school, the school is in fact responsible. In fact, there is nothing more the school can do. They could educate the children, but you can tell someone what to do, and the chances of them doing it are pretty dismal. Music is not allowed on their computers either. Yet we constantly find iTunes on there and a host of music that traces to certain peer to peer applications where they acquired the stolen music. If a kid can learn how to do that, imagine what sort of influence can be placed on them from a more positive angle. Like maybe parents providing an explanation for starters of what it is they re looking at. What it is they ll find online. What material is inappropriate. What material should you tell an adult about. Why do I get stupid emails with Russian girls wanting to marry me. Kids absorb everything. Parents have relegated responsibility but not delegated it. This filter idea might help slow down a child s enthusiasm to learn about everything, both good and bad. But educating the kids from an early stage in life about morals and the modern world where lets think about it, we have absolutely everything we need and want at our finger tips will be more valuable than any filter. But the fact that we have so much available makes it difficult to say what is and isn t appropriate for a child to see. It is up to us to inform the children of what s out there is the world. It may or may not stop them from seeing the adult related content, but it will help them respond to it in a mature and adult manner. We all know, kids aren t stupid. So, if the filters worked, why am I called in once a year, every year to give my talk to parents?

Last night here at BSP I released nagios-plugins (1.4.14-1), which has a couple of fixes and enhancements. For more information, see the changelog.
The main change may, that with this version, the package should be installable on non-linux archs, where iputils-ping is not available. The downside of using inetutils-ping is, that its behavior is different from iputils-ping. As result of this, check_ping will timeout much often, even if there isn t any problem and you will have false positives. As suggested long ago, at least on this archs, you should consider to replace the use of check_ping with check_icmp.

For a long time we had a bug against the archive asking us to export a file similar to the Maintainers index, just for the Uploaders (aka Co-Maintainers). Back then it wasn t that easy, but this changed. A while ago I also got a patch from Emilio Pozuelo Monfort against the first bug asking for it (#120262 !, and so went to integrate it. Of course this told us about a deficit in daks code parsing the Uploaders field. No, it is not good to solely split on a comma, when we have at least one Maintainer with a comma in their name field. We now split on the end of a mail address, followed by a comma. This simple idea is from Alexander Reichle-Schmehl, I was always thinking of a more complicated parser for it But heck, why? Yes, this can easily go wrong, if people, for whatever reason, add a space in there. But it only harms them, not us, so I don t think it is a big problem. Let us help you shot in your own foot. :) The new file will be exported as Uploaders.gz right besides the Maintainers.gz we already have on every mirror in the indices/ directory, starting with the next dinstall run (that will start in 2 hours and some 42 minutes, at time of writing this entry). Until then you can find a version at my space, to poke around and find bugs. A good example is right at the top - a52dec. Bug already filed, they missed a comma between two Uploaders. Feel free to hunt for your own bugs. :) And while I am writing already: Are you working with data generated out of the Debian archive, but have to generate the data yourself? (Like people had with the Uploaders index in the past, for example). Feel free to ask for it to be generated during dinstall. If the data is available (or can be made) and makes sense to have for more than just a personal pet project, we are happy to merge patches, help with it, provide it. (And really, asking cost nothing, we can t do more than deny it).

• OpenOffice.org 3.2 Release Candidate 3 is available in experimental.
• If you run into problems with Java networking, e. g. if your Java apps suddenly start failing to connect to the database. You might be affected by this bug.
• schroot version 1.4.0 has been released
• The security support for Etch will be discontinued next 15th February, exactly one year after the Lenny release. If you are still using Etch, it is time to update to Lenny that have its point release 5.0.4 planned for the end of this month.
• Theppitak Karoonboonyanan has announced a mini-DebCamp in Khon Kaen, Thailand, during March 13-19, 2010.

Good people steal ideas, right? On that basis I setup a static domain to host the javascript and icons I use upon a few different sites & projects. This was preempted by the release of a new version of the excellent jQuery library. I also managed to put together a tremendous hack to solve a pretty annoying problem running multiple distributions from a single external kernel under KVM. Ubuntu users, in particular, will be well aware of dmesg SPAM coming from the use of CONFIG_SYSFS_DEPRECATED. In short the way that the kernel presents information beneath the /sys tree has changed over the life of the kernel - and this has a knock-on effect to the userspace supplied by different distributions and releases of GNU/Linux.

Some distributions need an "old" kernel and an "old" udev with "old" udev rules in order to create the appropriate device nodes such that the kernel will boot & mount its filesystems. (i.e. These need CONFIG_SYSFS_DEPRECATED to be set.) Conversely some distributions mandate a "new" minimum kernel version, and supply a "new" version of udev with "new" udev rules and they absolutely will not function when presented with an "old" kernel. (i.e. They must have kernels without CONFIG_SYSFS_DEPRECATED set.)

I've solved this problem via a kernel patch which is both evil and genius. The details are a little me-specific, but in short:

• devtmpfs is used to setup and mount an initial /dev tree before /sbin/init is launched..
• udev launches later and mounts a tmpfs over /dev such that it can start creating its own nodes.
• At this point evil begins: I've patched the kernel such that any attempt to mount a tmpfs filesystem at /dev is silently changed to mount a devtmpfss filesystem instead.
  • The alternative is that udev creates many nodes, but manages to fail to create the root & swap nodes such that the KVM guests fail to boot.

Ultimately udev doesn't get an empty /dev tree to play with, instead it finds one already pre-populated, such that any devices it cannot create are there regardless - because the devtmpfs implementation has already created them. Genius. And evil. So very evil. Meh. Steal that idea. I dare you .. (I'm impressed at how well devtmpfs works, and how easy I was able to make my "patch of evil"^tm. Just a few lines in fs/namespace.c.) ObSubject: The Last House On The Left

Bruce Everiss who is famous for being threatened with legal action by Evony has been writing about the supposed losses from game piracy, in his latest missive he copies the text from a number of blog comments without citing the original authors [1]. He copied my text without citing me as the author (which is at best shoddy journalism and by a fundamentalist attitude such as his could be considered as piracy). He also copied my text in with a bunch of other comments which he attributes to The thieves . It s unfortunate that Bruce doesn t seem capable of understanding irony, he wrote There is no doubt whatsoever that downloading and playing a game that should have been paid for is theft and then copied part of the text of my comment where I provided a dictionary definition of theft that directly contradicts his claim. If he was at all interested in quality writing he would cite his references and then when a dictionary is cited which disagrees with his opinion he would at least try to find a dictionary with a more agreeable definition. It shouldn t be THAT difficult to find a dictionary that has multiple definitions of theft of which one is agreeable to the MAFIAA [2]. Now if Bruce had properly read my comment he would have seen I ve started watching content from sites such as blip.tv (in the little time I have for such things) and I only play games that are part of the Debian distribution of Linux (free software) which makes it very clear to any reasonable interpretation that I am not a game pirate and probably not even a movie pirate. I did mention in a comment on Bruce s blog that the DVD experience of being forced to sit through a whinge about piracy was a factor that made buying a DVD a worse experience than downloading it, a concept that I expanded into a blog post on the relative technical merits of DVDs and pirate MP4 files [3]. That post received a number of interesting comments including one from Josselin Mouette which had some useful technical detail about subtitles and audio track storage. I had believed that there were some real technical advantages of DVDs but Josselin corrected me on this matter. Also one thing that is noteworthy is that Bruce seems to use a copyright picture in almost every post but he doesn t attribute any of them. It does seem unusual for someone to use commercial artwork without any copyright or trademark notices attached. This usually isn t a big deal for a blogger, a liberal interpretation of copyright and trademark law is usually expected in terms of blogging corporations will tend to be hesitant to invoke the Streisand effect by suing a blogger (EG Bruce blog came to fame when he was sued by Evony). But when a blogger is writing about the importance of not pirating anything it would seem sensible to go to the effort of citing trademark and copyright references and also mentioning the licence agreements under which the IP was used. I believe that any loss of customers and revenue by the MAFIAA and the gaming industry is due to the actions of the companies involved. They should just try to make their customers happy, otherwise they lose the customers. The same goes for bloggers. I read blogs written by people who disagree with me, and sometimes by people who offend me on occasion. But Bruce is making baseless claims while deliberately ignoring evidence. He is calling for strong anti-piracy measures while doing what could be considered as pirating my work. He uses words in ways that conflict with dictionary definitions, and he calls for an end to our current legal system by demanding punishment based on three accusations rather than any legal process. I even pointed out to Bruce that if there was a three strikes law regarding accusations of copyright infringement then his blog would be offline after three accusations by Evony. Sorry Bruce, if I was looking for irrational rants about copyright then I would look at what the members of the Science Fiction Writers of America (SFWA) are doing [4]. The SFWA people demonstrate as much knowledge of computers and the Internet as Bruce does, but they are at least really good writers. If it was just me unsubscribing from Bruce s RSS feed then it wouldn t matter (I m one of tens of thousands of readers). But I expect that a large portion of the new readers Bruce acquired after being attacked by Evony will disappear when they see Bruce as the attacker and everyone who uses the Internet as a potential victim of the Three Strikes law.

• [1] http://www.bruceongames.com/2010/01/22/what-game-thieves-have-to-say-for-themselves/
• [2] http://mafiaa.org/
• [3] http://etbe.coker.com.au/2010/01/06/which-is-better-original-dvd-or-pirate-mp4/
• [4] http://etbe.coker.com.au/2007/09/23/dmca-and-sci-fi/

I know this is quite premature as we're just about to release 3.3, however development on 3.4 has already started in SVN and we've already implemented more than 20 requests from our features tracker. This is even bigger number than release 3.3 will have! Well the fact is that most of these things are cosmetic or tiny improvements, on the other side some of them were requested for very long time (the oldest one currently dates to 2003). The new features bring things such as direct blob download (thing we definitely should have earlier), links to documentation for SQL commands in highlighted SQL (what was quite easy, but nobody requested such thing and I added the feature after seeing that Adminer does this), possibility to directly bookmark most pages or exporting user privileges. See ChangeLog for more detailed list of features. You can try all new features on our demo server.

In the last few days, I found the time to spend some with KVM and libvirt. Unfortunately, there is a subject that I haven t yet found a satisfying solution: Naming of block devices in guest instances. This is surely a common issue, but solutions are rare. Neither an article on Usenet (in German) nor the German version of this blog article has found solutions for the main question. I should have written this in English in the first place and am thus translating from German to english, hoping that there will be some answers and suggestions. KVM is quite inflexible when it coms to configure block devices. It is possible to define on the host, which files or whole devices from the host should be visible in the guest. The documentation suggests that devices should be brought into the guest with the virtio model, which needs suppport in the guest kernel. Importing a device as emulated ATA or SCSI device brings a performance penalty. The devices brought into the guest via virtio appear in the guest s dev as /dev/vd<x> and do also have their corresponding entries in /dev/disk/by-uuid and /dev/disk/by-path. The vd<x> node is simply numbered in consecutive order as hd<x> and sd<x>. /dev/disk/by-uuid is the correct UUID of the file system found on the device, at least if it s a block device partitioned inside the guest and formatted with ext3 (I didn t try anything else yet). The terminology of the /dev/disk/by-path node is not yet understood, and I am somewhat reluctant to assume the PCI paths of emulated hardware as stable. Looks like I am forced to configure inside the guest when I have changed the host s mass storage system (for example, after migration to a different file system or after new block devices have been added) to accommodate for the new order of the /dev/vd<x> or to have the UUID correctly configured. This is like calling for configuration errors. This is a reincarnation of the same issue that has been killed by LVM on Linuxes running on bare metal : The block device itself has a mnemonic name which is constant even in migration and copy actions. This works without file-system specific stuff like UUID or label, and wouldn t even be possible with a UUID (which won t be unique in this case). The mnemonic names of LVs are also available when the data is directly written to the raw device such as a CNFS buffer of a news server. I would love to have something like a paravirtualized device mapper interface which would allow to say in the host s configuration which of the host s LVs should be visible in the guest with which name in /dev/mapper. That way, the guest s configuration could remain stable during data wrangling operations on the host. One solution is to have a single LV for each guest and import this LV as /dev/vda into the guest. /dev/vda would then be partitioned like a real disk and have its own LVM installation. This would however need kpartx if one wants to access the data from the host, and loses flexibility when resizing file systems. These issues appear in every installation of KVM virtualization, and I would expect that there are gazillions of other possible solutions. I am interested in knowing how other people have tackled this issue and whether there are more possiblity that I haven t thought of before. Maybe there is a solution that doesn t leave me with the feeling of having implemented something ugly. Does the interface between the host s KVM and the guest s device mapper that I have been dreaming of maybe exist. Or is there any other possibility of configuring the device node s name in the guest Linux on the host side?

I received news a little while ago that my visa has been approved by the Brasilian consulate so I will be heading to Sao Paulo tomorrow for Campus Party. This enormous event takes place in a conference center filled with thousands of hackers camping out in tents. Apparently the connection speed is on the order of 10 gigabits. I'll be giving a talk on Open for Business, Open Source for America, a panel discussion with Simon Phipps (http://www.webmink.net) about the future of Open Source and a panel discussion about whether the corporate sponsored community model of Ubuntu has rendered the entirely organic community model of Debian obsolete (oooh, a hot one!) Since I'll have a smoking hot net connection at the show and will be camping there (should be interesting) I'll try to send updates. Stay tuned!

Hello, Planet Debian. I'm pleased to have announced about the first Debian event in Thailand: Thailand MiniDebCamp 2010. This is a follow-up to Taiwan MiniDebConf 2009 in last September in Taipei. At the end of that event, we discussed about having a mini-DebCamp in Thailand during the New Year holidays. However, with many factors, it has been moved to this March. And the date has been settled on 13-19 March. The place will be Khon Kaen University (KKU) in Khon Kaen, a north-eastern province of Thailand (close to Lao, if you look for it in a map). In this event, we plan to arrange a Bug Squad Party for the Squeeze release, and some meetings between DDs and local people, to encourage more Debian activities in Thailand and nearby countries. Thailand has started its GNU/Linux development and usage since no later than 1997. Currently, we have projects like Thai Linux Working Group for upstream Thai resource developments; OpenTLE.Org and thaiopensource.org for local distros (Ubuntu-based); and some communities like ubuntuclub, debianclub, and more others for other distros. The user base is slowly growing, while developer base is yet growing more slowly. We have had domestic events occasionally. But certainly, an international one like this would effectively encourage more prospecters, as well as create closer cooperations with the global projects. We also hope this event to be a meeting point for developers from nearby regions. And internationalization, among other issues, can be discussed and worked out. So, please be invited to join and discuss. Please make sure to add your name to the Wiki page so we can prepare things for you, including accommodation. And feel free to propose your agenda in BarCamp style. It will be summarized some time before the event date. We also have a mailing list for updates and discussions.

1. This afternoon I tried to unlock my old Three mobile phones for the purpose of getting cheap net access as described in my previous post [1]. I wanted to use Dodo 3G Internet (via the Optus network) for my parents which would cost them $139 per year and I wanted to use my old Three phone tethered to their PC as the 3G modem (cheaper than buying a new 3G modem). I took in 3 Three phones to the Three store to get unlocked, I actually have 4 old Three phones (my wife and I are each on our third Three phone) but I seem to have misplaced one. It turned out that the two newer phones (LG U890) can t be unlocked as they are permanently locked to the Three network. The older LG U8110 can be unlocked, doing this took 30 minutes of the Three employee speaking to other Three employees on the phone and I will now have to wait 4 days to receive an SMS with the unlock code. So the Three anti-competitive behavior of making it unreasonably difficult to get a phone unlocked and of selling phones that (supposedly) can never be unlocked wasted them 30 minutes of store employee time when other potential customers were queuing up as well as 30 minutes of employee time in their call center. If the call-center employee was based in Australia then as the minimum wage is $14.31 per hour [2] that would have cost them at least $14.31 for 2*30min of work, as a rule of thumb it s generally regarded that the costs of employing people are twice the salary (including costs of maintaining office/shop space, paying managers, doing paperwork, etc). So it probably cost Three about $29 to unlock one of my phones and tell me that the others can t be unlocked, when I find phone 4 it will cost them another $29. As $29 is my typical monthly bill this has got to make an impact on the profitability of Three. If they were smart they would have sent me an SMS when I got a new phone telling me whether the old phone can be unlocked and if so giving me the code to do so. For phones that can be unlocked I doubt that would make anyone unlock their phone who wouldn t do so anyway, and for phones that can t be unlocked they could encourage the owner to give the phone to someone who wants a phone for pre-paid use (thus locking in a new customer). It probably won t be worth the effort of cracking an LG U890 phone to save my parents $10 per annum. As I couldn t get the LG U8110 to talk to my laptop I guess that forces my parents to eventually use Three for 3G net access. But they could have just matched the Dodo price and got the same result without having me spend half an hour in their store. Update: I just enquired about ending my Three contract for 3G net access ($15 per month for 1G of data) in favor of the yearly prepaid option of $149 per annum for 12G. The prepaid option would save me $31 per annum and allow me to use more than 1G in the busy months. But it seems that I subscribed to a two year contract for that one and I have 6 months to go. Over those 6 months they will make about $15 extra in revenue from me while annoying me in the process, this probably isn t a good deal. As my 3G modem is locked to the Three network even if I didn t have a contract I would still be unable to use a different provider.


2. My mother phoned Optus about her Internet connection and discovered that she had supposedly renewed her Optus cable Internet contract in September last year. Presumably someone from Optus phoned my parents and asked what seemed like a routine do you want to keep using the Internet? question but was really a do you agree to a 2 year contract with a $250 penalty clause for exiting early? . This isn t the first time that Oprus has scammed my parents (previously they charged them rental for a phone that they never supplied), I guess that they have a practice of pulling such stunts on pensioners. I guess I ll have to call the TIO, which will end up costing them more than the $250 penalty clause. The irony here is that as Dodo uses the Optus network I would have used Optus by choice for my parents, but now that they are being scum I will willingly pay the extra $10 per annum to use Three (which while annoying aren t actually hostile).


3. Finally while Google is admirably living up to their don t be evil motto in regards to China [3] their conduct regarding Google Talk leaves a lot to be desired. Two employees of a company I work for use Google Talk for their instant messaging, this has a Windows client but also allows general access via the Jabber protocol. So these two guys wanted to talk to me via Jabber but Google would just send me email saying X has invited you to sign up for Google Talk so you can talk to each other for free over your computers , I received 5 such messages from a colleague who was particularly persistent. It seems impossible for the Google Talk server to send a chat request to my personal Jabber server (which works well with a variety of other Jabber servers). So I have now started using my Gmail address to talk via the Jabber protocol to other Gmail users. This means that I have a TCP connection to the Google servers open most of the time and Google can boast of having one more active Gmail user. But it doesn t seem to really provide them a benefit. I am going to keep using my main email address as my primary Jabber ID and only use my Gmail address for talking to Google Talk users and only when paid to do so. But as a result of this I recommend that everyone avoid Google Talk as much as possible. Use open Jabber servers such as the ones run by Jabber.org.

It seems to me that none of these companies are really gaining anything from trying to lock customers in. They would be better off spending their efforts on being friendly to people and making them want to be repeat users/customers.

• [1] http://etbe.coker.com.au/2010/01/15/cheap-net-access-australia/
• [2] http://www.fairpay.gov.au/
• http://googleblog.blogspot.com/2010/01/new-approach-to-china.html

My subject line is a little over-dramatic, but only a little. Like many states, Kansas is facing a severe budget problem. Last year, the state cut many programs to the bone and beyond. Nursing homes, schools, universities, and charities have all been hard-hit. A 10% cut in Medicaid reimbursement rates and similar cuts to education have been devastating. Institutions are wondering how they can survive. Here s the thing: in rural communities, the very survival of the community is often dependent upon the survival of its schools, nursing home, hospital, or college. Take any one of those things away and the community begins a slow and painful death. This has happened over and over, and right now the Kansas legislature has a simple choice: Do they make a temporary 1% increase in sales tax, and also some increases in tobacco/alcohol taxes, or not? If they do, they can get funding back to normal levels. If they do not, funding will be cut even further, which will certainly cripple many institutions. There are a lot of people opposed to this tax. I m not one of them; I think it s key to the survival of our rural communities and the competitiveness of the state as a whole. 98.9% of Kansas is rural. See the gravity of the situation? Please, if you are a Kansas resident, write your representatives and leave a comment here saying you did (and what you wrote, if you like). The easiest way to find your state senator and representative is to go to a state website, then scroll down to information by county , click on your county, and then click on the districts to see a map if you need one. (The find by address feature seems to be hopelessly broken.) Here s what I wrote: Subject: Please raise my taxes I write with a request I don t make lightly: please raise my taxes, and support the 1% sales tax increase with the 3-year sunset provision. The consequences of failing to do so are terrible. Losing nursing homes or schools would mean the long-term death of many rural communities. Our community leaders are fearing not just for nursing homes being gone; there is a real threat of entire communities facing a slow extinction. The 10% Medicaid cuts already made are having a devastating impact on many quality institutions, and if left in place for any length of time could result in quality organizations closing, or refusing to accept Medicaid. And even deeper cuts are being contemplated. Even for those that plan well and have long term care insurance would be harmed if the nursing homes they might contemplate living in one day have closed due to today s Medicare cuts. I fear for our schools as well. Our two boys will be of school age
soon, and we live in a district that is of one of Kansas exceptionally strong rural schools. So far, our school is coping, but I am concerned about the drive to consolidate our rural schools, which would result in unreasonable travel distances and would be unlikely to duplicate the excellence of the schools we have now. I fear for our early childhood and university systems; without a good beginning in life, Kansas will face higher costs later. Without an affordable university system, Kansas will be less competitive. If small communities lose their schools, nursing homes, college students, or hospitals, some of them won t survive as towns. This hurts everyone in the state. When my wife and I moved from Indianapolis to rural Kansas in 2002, we, like many homebuyers, carefully studied the quality of schools and medical facilities available. If Kansas wants to be able to attract residents and the businesses that want a qualified labor pool, it must remain competitive. Forcing our best institutions to close a permanent problem over a short-term budget problem isn t going to help with that at all. It will hurt all of Kansas, rural and urban alike, if vast portions of our state become less attractive due to these problems. We likely would not have moved to the state at all if its rural communities were dead or dying. How many taxpaying Kansans will we lose if we let their communities suffer? Americans these days have plenty of choices where to live. I don t see many people choosing where to live based on a 1% difference in sales tax. I do see plenty of people making decisions based on quality of schools, hospitals, universities, roads, and even nursing homes. Please help save our rural communities and keep Kansas all of it competitive.

I've recently found out a bit more about separating debug info, and thought a consolidated reference might be handy. The Idea Most every distribution now provides separate debug packages which contain only the debug info, saving much space for the 99% of people who never want to start gdb. This is achieved with objcopy and --only-keep-debug/--add-gnu-debuglink and is well explained in the man page. What does this do? This adds a .gnu_debuglink section to the binary with the name of debug file to look for. The first part is the name of the file, the second part is a check-sum of debug-info file for later reference. Build ID Did you know that binaries also get stamped with a unique id when they are built? The ld --build-id flag stamps in a hash near the end of the link. Incase you're wondering what the format of that is... Although the actual file may change (due to prelink or similar) the hash will not be updated and remain constant. Finding the debug info files The last piece of the puzzle is how gdb attempts to find the debug-info files when it is run. The main variable influencing this is debug-file-directory. The first thing gdb does, which you can verify via an strace, is search for a file called [debug-file-directory]/.build-id/xx/yyyyyy.debug; where xx is the first two hexadecimal digits of the hash, and yyy the rest of it: Next it moves onto the debug-link info filename. First it looks for the filename in same directory as the object being debugged. After that it looks for the file in a sub-directory called .debug/ in the same directory. Finally, it prepends the debug-file-directory to the path of the object being inspected and looks for the debug info there. This is why the /usr/lib/debug directory looks like the root of a file-system; if you're looking for the debug-info of /usr/lib/libfoo.so it will be looked for in /usr/lib/debug/usr/lib/libfoo.so. Interestingly, the sysroot and solib-search-path don't appear to have anything to do with these lookups. So if you change the sysroot, you also need to change the debug-file-directory to match. However, most distributions make all this "just work", so hopefully you'll never have to worry about anyway!

Cool, eh? Okay, not that tofrodos has any new features, but at least the following will return zero tomorrow: wget -q http://ftp.de.debian.org/debian/dists/sid/main/binary-i386/Packages.bz2 -O- bzgrep Schmehl grep -v -c Reichle. Just took me a bit more than a year and a half to find a reason to upload all of my packages at least once... Now let's take a look at the team maintained packages, which are still left..

This is the story of a weirdly unfriendly/non-compliant IMAP server, and some nice interactions that arose from a debugging session around it. Over the holidays, i got to do some computer/network debugging for friends and family. One old friend (I'll call him Fred) had a series of problems i managed to help work through, but was ultimately basically stumped based on the weird behavior of an IMAP server. Here's the details (names of the innocent and guilty have been changed), just in case it helps other folks in at least diagnosing similar situations. the diagnosis The initial symptom was that Fred's computer was "very slow". Sadly, this was a Windows machine, so my list of tricks for diagnosing sluggishness is limited. I went through a series of questions, uninstalling things, etc, until we figured it would be better to just have him do his usual work while i watched, kibitzing on what seemed acceptable and what seemed slow. Quite soon, we hit a very specific failure: Fred's Thunderbird installation (version 2, FWIW) was sometimes hanging for a very long period of time during message retrieval. This was not exhaustion of the CPU, disk, RAM, or other local resource. It was pure network delay, and it was a frequent (if unpredictable) frustrating hiccup in his workflow. One thought i had was Thunderbird's per-server max_cached_connections setting, which can sometimes cause a TB instance to hang if a remote server thinks Thunderbird is being too aggressive. After sorting out why Thunderbird was resetting the values after we'd set them to 0 (grr, thanks for the confusing UI, folks!), we set it to 1, but still had the same occasional, lengthy (about 2 minutes) hang when transfering messages between folders (including the trash folder!), or when reading new messages. Sending mail was quite fast, except for occasional (similarly lengthy) hangs writing the copy to the sent folder. So IMAP was the problem (not SMTP), and the 2-minute timeouts smelled like an issue with the networking layer to me. At this point, i busted out wireshark, the trusty packet sniffer, which fortunately works as well on Windows as it does on GNU/Linux. Since Fred was doing his IMAP traffic in the clear, i could actually see when and where in the IMAP session the hang was happening. (BTW, Fred's IMAP traffic is no longer in the clear: after all this happened, i switched him to IMAPS (IMAP wrapped in a TLS session), because although the IMAP server in question actually supports the STARTTLS directive, it fails to advertise it in response to the CAPABILITIES query, so Thunderbird refuses to try it. arrgh.) The basic sequence of Thunderbird's side of an initial IMAP conversation (using plain authentication, anyway) looks something like this:

1 capability
2 login "user" "pass"
3 lsub "" "*"
4 list "" "INBOX"
5 select "INBOX"
6 UID fetch 1:* (FLAGS)

What i found with this server was that if i issued commands 1 through 5, and then left the connection idle for over 5 minutes, then the next command (even if it was just a 6 NOOP or 6 LOGOUT) would cause the IMAP server to issue a TCP reset. No IMAP error message or anything, just a failure at the TCP level. But a nice, fast, responsive failure -- any IMAP client could recover nicely from that by just immediately opening a new connection. I don't mind busy servers killing inactive connections after a reasonable timeout. If it was just this, though, Thunderbird should have continued to be responsive. the deep weirdness But if i issued commands 1 through 6 in rapid succession (the only difference is that extra 6 UID fetch 1:* (FLAGS) command), and then let the connection idle for 5 minutes, then sent the next command: no response of any kind would come from the remote server (not even a TCP ACK or TCP RST). In this circumstance, my client OS's TCP stack would re-send the data repeatedly (staggered at appropriate intervals), until finally the client-side TCP timeout would trigger, and the OS would report the failure to the app, which could turn around and do a simple connection restart to finish up the desired operation. This was the underlying situation causing Fred's Thunderbird client to hang. In both cases above (with or without the 6th command), the magic window for the idle cutoff was a little more than 300 seconds (5 minutes) of idleness. If the client issued a NOOP at 4 minutes, 45 seconds from the last NOOP, it could keep a connection active indefinitely. Furthermore, i could replicate the exact same behavior when i used IMAPS -- the state of the IMAP session itself was somehow modifying the TCP session behavior characteristics, whether it was wrapped in a TLS tunnel or not. One interesting thing about this set of data is that it rules out most common problems in the network connectivity between the two machines. Since none of the hops between the two endpoints know anything about the IMAP state (especially under TLS), and some of the failures are reported properly (e.g. the TCP RST in the 5-command scenario), it's probably safe to say that the various routers, NAT devices, and such were not themselves responsible for the failures. So what's going on on that IMAP server? The service itself does not announce the flavor of IMAP server, though it does respond to a successful login with You are so in, and to a logout with IMAP server logging out, mate. A bit of digging on the 'net suggests that they are running a perdition IMAP proxy. (clearly written by an Aussie, mate!) But why does it not advertise its STARTTLS capability, even though it is capable? And why do some idle connections end up timing out without so much as an RST, when other idle connections give at least a clean break at the TCP level? Is there something about issuing the UID command that causes perdition to hand off the connection to some other service, which in turn doesn't do proper TCP error handling? I don't really know anything about the internals of perdition, so i'm just guessing here. the workaround I ultimately recommended to Fred to reduce the number of cached connections to 1, and to set Thunderbird's interval to check for new mail down to 4 minutes. Hopefully, this will keep his one connection active enough that nothing will timeout, and will keep the interference to his workflow to a minimum. It's an unsatisfactory solution to me, because the behavior of the remote server still seems so non-standard. However, i don't have any sort of control over the remote server, so there's not too much i can do to provide a real fix (other than point the server admins (and perdition developers?) at this writeup). I don't even know the types of backend server that their perdition proxy is balancing between, so i'm pretty lost for better diagnostics even, let alone a real resolution. some notes I couldn't have figured out the exact details listed above just using Thunderbird on Windows. Fortunately, i had a machine with a decent OS available, and was able to cobble together a fake IMAP client from a couple files (imapstart contained the lines above, and imapfinish contained 8 LOGOUT), bash, and socat. Here's the bash snippet i used as a fake IMAP client:

spoolout()   while read foo; do sleep 1 && printf "%s\r\n" "$foo" ; done  
( sleep 2 && spoolout < imapstart && sleep 4 && spoolout < imapfinish && sleep 500 )   socat STDIO TCP4:imap.fubar.example.net:143

To do the test under IMAPS, i just replaced TCP4:imap.fubar.example.net:143 with OPENSSL:imap.fubar.example.net:993. And of course, i had wireshark handy on the GNU/Linux machine as well, so i could analyze the generated packets over there. One thing to note about user empowerment: Fred isn't a tech geek, but he can be curious about the technology he relies on if the situation is right. He was with me through the whole process, didn't get antsy, and never tried to get me to "just fix it" while he did something else. I like that, and wish i got to have that kind of interaction more (though i certainly don't begrudge people the time if they do need to get other things done). I was nervous about breaking out wireshark and scaring him off with it, but it turned out it actually was a good conversation starter about what was actually happening on the network, and how IP and TCP traffic worked. Giving a crash course like that in a quarter of an hour, i can't expect him to retain any concrete specifics, of course. But i think the process was useful in de-mystifying how computers talk to each other somewhat. It's not magic, there are just a lot of finicky pieces that need to fit together a certain way. And Wireshark turned out to be a really nice window into that process, especially when it displays packets during a real-time capture. I usually prefer to do packet captures with tcpdump and analyze them as a non-privileged user afterward for security reasons. But in this case, i felt the positives of user engagement (how often do you get to show someone how their machine actually works?) far outweighed the risks. As an added bonus, it also helped Fred really understand what i meant when i said that it was a bad idea to use IMAP in the clear. He could actually see his username and password in the network traffic! This might be worth keeping in mind as an idea for a demonstration for workshops or hacklabs for folks who are curious about networking -- do a live packet capture of the local network, project it, and just start asking questions about it. Wireshark contains such a wealth of obscure packet dissectors (and today's heterogenous public/open networks are so remarkably chatty and filled with weird stuff) that you're bound to run into things that most (or all!) people in the room don't know about, so it could be a good learning activity for groups of all skill levels. Tags: debugging, imap, perdition, wireshark

I wrote this for the FSF's annual membership drive where it was originally published. I am reposting it here.

At its core, I think of free software as about the ability of computer users to take control of their technology. Insofar as our software defines our experience of the world and each other, software freedom is an important part of what allows us to determine the way we live, work, and communicate. Free software is not really about software in this fundamental sense; it's about bringing freedom to users through software. In free software's incredible success over the last two decades, many people have lost sight of this simple fact. We have created an incredible array of applications, libraries, and tools. We have created vibrant development and support communities. We have created new development methodologies, powerful copyleft licenses, and massive collaborative projects. But these are all how we give users freedom. They are not freedom itself. They are not what we were trying to achieve. They are our instruments, not our goal. This distinction becomes central in a world where technology is in flux. Indeed, we live in such a world. We can see signs of this in how, as most users' primary computers become mobile phones and new types of network services make up most of many users' interactions with computers, the free software movement's old applications, communities, development methodologies, and licenses can become ill-suited to, or ineffective at, protecting user freedoms. And indeed, in the next few years, bringing freedom to computer users will need to involve new software and new forms of advocacy. It will need to involve new licenses and new techniques for their enforcement. It will need to involve new forms of collaboration and organization. If the free software movement is to succeed, it must stay focused on computer users' freedom -- on the question of why we do what we do -- and then work creatively on how to best respect and protect the freedom we are working toward. If we are overly focused on how we've done things in the past, we may lose sight of the most fundamental goal of supporting users' control over their technology in general. There are many organizations that support the how of today's free software in various ways -- they are law firms and companies and nonprofit organizations supporting various free software projects. The Free Software Foundation is, by far, the most important organization focused on why --- on the underlying principle of software freedom. As such, it plays an essential role in keeping our broader community focused on the key issues, threats, and challenges that will affect the success of every free software project, and every computer user, in the present and in the future. In this period of rapid change in computer technology, its role is more vital than ever. The consequence of any failure is more dire. Here are some of the ways that I will be encouraging the FSF to serve the free software movement in the coming year: Mobile Phones In a short essay I wrote earlier this year, I pointed out that there are now billions of mobile phones and that, although these phones are increasingly powerful computers, they represent one of the most locked-down, proprietary, and unfree technologies in wide use. The implications of this fact for users' control over their technology are dire. Although some widely used phones make extensive use of free software, most free phones are locked down and Tivoized and their users remain fettered, divided, and helpless. We must raise awareness of free software issues among users of phones, communicate to users that phones are powerful general purpose computers, and explain that control over these devices has critical implications for individual autonomy in the future. Toward this end, the FSF staff will launch an advocacy campaign around mobile phones and software freedom in the coming year. Network Services As network services -- like those built by Facebook, Google, and others -- have continued to grow both in scope and penetration over the last year, the importance of a meaningful free software responses grows as well. The launch of products like Google's network-centric ChromeOS offers one glimpse of what a future computing platform may look like. The implications for user freedom, and for the effectiveness of traditional free software approaches, are frightening. The fact that many network services are built using free software does not make the effect of these services on users' autonomy and freedom any less catastrophic. In the next year, the FSF is planning to release the first of what I hope will be several statements on software freedom and network services. Building off the work of the FSF-supported group Autonomous, the Foundation will help provide guidelines for those implementing network services, for users deciding whether to use services, and for developers trying to build services that go further to respect their users' freedom. Reaching beyond our traditional communities Successfully fighting for user freedom is going to mean successfully reaching out to users outside the FSF's historical base . The FSF continues to do so with its Defective By Design anti-DRM campaign and its End Software Patents work. In the last year, the FSF has also reached out to younger users through its "GNU Generation" campaign run by and for high school students. Additionally, the FSF convened a summit this year on women in free software. The FSF plans to build on these successes in the coming year and to expand similar outreach projects. Of course, fighting for and promoting software freedom is more work than today's FSF has the resources to accomplish. Each of my three points above represents an ambitious undertaking, and yet just a portion of the items on the plate of the FSF's small but dedicated staff. Even just continuing its existing projects will require that the FSF adds hundreds of new members by the end of this period. Your membership and donations help make goals like this possible. A strong free software movement focused on the principled issues of software freedom -- and a strong FSF in particular -- will determine what freedoms the next generation of computer users will enjoy. At stake is no less than that next generation's autonomy. I know that this is not the first fundraising appeal you've read this season and I know that the weakened economy makes giving difficult for many. I understand that the cost of a membership or donation may be less easy to afford this year. But we also cannot afford a weakened FSF at this important point of technological transition. If you are not an FSF associate member, now is the time to become one. If you've read my appeal the last two years and decided to wait, now is the time to take the plunge. Membership is $120 per year ($60 for students) and payable monthly. If you are already a member, please join me in giving generously through a tax-deductible donation, or encourage a friend to sign up. The FSF is a small, humble organization of passionate individuals working tirelessly for our software freedom. I've seen firsthand that even small gifts make a difference.

Join now with a $10 monthly donation

Marc Fleury, JBoss founder joins the ranks of Tonnerre, me, and other people requesting that MySQL (and MariaDB!) please finally die. Everyone, don't even fork it. Use a real database instead. Or, at least, SQLite. Really. We're going to FOSDEM 2010 (of course I've been at every FOSDEM that was not just an OSDEM, Benny and gecko2 are regular attendees as well, as are other projects of mine such as FreeWRT and Debian GNU/kFreeBSD, by proxy). There will be a recent MirBSD snapshot I've yet got to build, with the new floppy format ustarfs (idea, but no single line of their stinking ridiculously huge code, stolen from NetBSD ) and other improvements (albeit less than I wanted to get done by then). The days before, I'll attend the first FusionForge meeting to break up the French Cabal, with my work hat on. That is also my first time in France (outside of the Elsa ). People, make a good impression on me to overcome the classic prejudices ;-) This weekend I'm going to meet my Debian Application Manager zack, have some good beer (ugh... first this, then Paris, then good belgian beer...) and fix some bugs, all while learning even more. Sounds like fun, but I almost feel overwhelmed, in contrast to the years of much less travelling from my past. I've also started sort-of mentoring Simon, one of our apprentices at work, into the Debian processes. (On an unrelated side note, formorer recently said bpo will become bp.d.o soon. Great!) Please don't laugh at this excuse for a webpage, as I've yet to fill it in, but my CLI for the KDE Wallet is hereby deemed ready for public consumption, with a bug-fix release 2.01 (bugs actually found during preparation of a port to Debian sid and KDE 4, which is much much worse than KDE 3, plus it looks so absolutely disgusting I'm not even sure Windows Mistda is worse). I hope the package will end up in NEW soon (and once progressed to testing I may be able to make the KDE 3 variant official via lenny backports; my WTF *.deb repo will hold them until then.

There are more webpages I need to fill in... mksh's TaC, arc4random (which needs some major redesign as well) and BSD::arc4random, the RANDEX protocol (entropy exchange over IRC) and its plugins and patches, ... Not just Mac OSX (and, I hope, iPhoneOS) will soon come with mksh(1), but also Android (I prepared patches to make it /bin/sh, which works quite well although I need to find out how to make a hardlink so that #!/bin/mksh scripts will run) and Maemo, for which I wrote an mksh package in a garage project, which also needs some love w.r.t. testing on actual devices, menu integration, etc. (Please contact me if you can help with either of the three.) We also have lewellyn:#ksh making a package for the new OpenSolaris system (thanks again). People persuading Apple to put it on the jesusPhone are also welcome. (This does not mean I endorse any of these right now, I'd probably get the most of a WinCE PDA with built-in GPSr, WLAN and maybe GSM/GPRS.) English and French native speakers, please review, and Dutch native speakers may contribute a translation of, our flyers. (Source code for these is not available, sorry. Benny makes them in Quark on System 7 in Basilisk II, used to be Classic until Apple yanked it. But still, they use only free fonts, free imagery or such the MirOS Project is allowed to use, and beat every single other FOSS project flyer I've ever seen by far!) There's probably more I could write, I bet I forgot half of it anyway, but I'll leave it at that for now. Get yourself a nice cup of hot chocolate, pour an Espresso into it, and enjoy the mix with a piece of cake (I'd say strawberry or mousse-pear but all they had was cassis-cr me) and pity me for not knowing any French next month.

I ve been asked why I dislike surveymonkey surveys, I don t want to reply fully in that forum (because it s off-topic there) and I want to publish this for your feedback now. surveymonkey really frustrates me. In short, it s often confusing, I think it doesn t follow UK accessiblity laws and I m unsure if it complies with our privacy laws. It seems like another triumph of marketing over good sense. It s a free market failure, possibly based on lack of information on the drawbacks of this option. If a survey is on Surveymonkey, it s easiest for able-bodied users of full-fat browsers with low security and privacy settings to answer. Using NoScript or a privacy tool? You ll get an error message (which contradicts the VPAT_SurveyMonkey.pdf description). Unable to see graphics clearly? The forms will be hard to read because they ve replaced the browser form widgets (such as checkboxes and radio buttons) with javascript-driven images for no good reason. Those sort of faults will probably bias results a bit how much will depend on the subject. It s a particular case of a problem I first mentioned in the last-but-one bullet point on my debian surveys page back in 2006. Basically, I think you should keep open surveys as open as possible. Statistics literature is littered with bizarre spurious results from when the survey method accidentally favours some particular subset of the population. Finally, surveymonkey surveys can be left with answer requirements which make no sense, such as ticking Other requiring a text input, but the text box not accepting input. Is that the fault of the survey owner not being able to work the admin interface, or the interface having some subtle flaws? I m not completely sure, but I ve had that experience a few times. So, can I persuade people to use limeservice, doodle or even Google Docs rather than Surveymonkey, please? I think Limeservice is better because it s based in Germany (so EU data protection and privacy laws apply) and is cooperatively-developed FOSS software. Doodle and Google aren t, but are quicker and easier to use for straw polls. If you want something to install on your own site and the downloadable limesurvey software seems a bit heavy, then askpeople seems another good option. Our co-op can host either of those if you re willing to pay. (If someone would be willing to sponsor it, we d host some free surveys too let me know.) Lots of people use surveymonkey, but popularity doesn t always mean it s the best tool. Please consider the alternatives and pick the best tool for the job.

1. My Orange 3G mobile broadband USB modem won't operate properly with gnome-ppp because it doesn't use a real username or password and needs more customised chatscript support than gnome-ppp appears to be able to support.


2. I stopped using network-manager-gnome and started using wicd instead due to problems with nm-applet at that time, which doesn't see the USB modem (and doesn't drop wlan0 for it either). I'm not sure if nm-applet would now work with the USB modem.


3. I've got the modem working with sudo pon orange but I wanted a GUI.

Instead - and, frankly, just as an experiment to get used to auto-detecting things - I decided to write a little program that puts a status icon in place if HAL reports no modem capability, then raises a simple window to manage the connection when the modem becomes available. (I had a shell script using zenity that was almost good enough but without automated launch.)

The window is trivially simple, it just lists the available connections in /etc/ppp/peers and has a toggle button to connect or disconnect the selected connection. Almost no error checking, no configuration support for the pon scripts themselves. I might add a default connection using gconf later. Yes, I know it's HAL but PolicyKit/DeviceKit just seemed too complicated when it was simpler to use libhal's own dbus support.

I'm happy to just use this for me but if anyone else is interested in this kind of app, I might be persuaded to put the source code somewhere public and continue development with a view to uploading to Debian. Naturally, if gnome-ppp or wicd could be adapted to replace it, that would be good too. (I'll file wishlist bugs if it isn't just me who wants this - I only need this functionality for a few months and a quick and dirty version is enough just for me. By the time the bugs are fixed, I probably won't be using mobile broadband any more.)