Continuing on from the SCC stuff, which I should probably get in the habit of calling the mirror split, then… At the same time as I’ve been trying to work out ways to fit the mirror split stuff into the AJ market concept, I’ve been pondering on and off what can be done to improve the security situation. My thinking’s probably still biassed by my long time wish for official security updates to testing, but I’m somewhat inclined to think that if we can figure out a way of integrating the testing security team and the official security team we might end up closer to a solution – at the very least that’d provide us with a decent number of people who can actively help out with security updates that aren’t secet and get a few more people familiar with the technical aspects of how security updates are released, who’ll then have less of a learning curve if they end up being added to the security team proper. And heck, even if that doesn’t work, it at least gives people running testing an easier url to remember for security updates. Of course, integrating the teams isn’t that easy, or it would’ve already been done. So after thinking about it, I had a chat with Joey (aka Martin Schulze, aka the guy who’s issued 317 of the 340 security advisories in the past 12 months) about the problems:

<aj> so, the other thing i wonder is what you think of the testing-security-support split?
<Joey> need more input
<aj> as in separate host, funny domain name, not available on security.debian.org/, extra effort to mirror, etc
<aj> i think it sucks :)
<Joey> there are a lot of sucking things…
<aj> it’s true
<aj> so, i figure the reasons for the split are (a) you don’t want to add a bunch of people to team@ and hence vendor-sec, and (b) there’s no way to make it so they can use dak-security without being full team/vendor-sec members; and maybe (c) you don’t want them officially associated with debian security coz they’re newbies
<Joey> a) and b) are true
<Joey> However, with security.debian.org being a push mirror, it would be possible to let it be pushed from a second source into a different directory, such as /testing-security/
<aj> hrm
<Joey> However, that would require all architectures to be supported and not just some.
<Joey> all as in “all that are in testing”
<aj> ah, that’s (c) then – they don’t do enough for the official debian stamp
<Joey> ah ok

Assuming those really are the key factors (which might or might not turn out true, but they seem likely) then that’s something that can be worked on. The first point is completely out of my domain – I’ve never been on vendor-sec, and it’s not likely something that ought to be tweaked much anyway; vendor-sec’s a very closed list by design, and for most security work it’s probably a distraction (testing security as is currently operates without concerning itself with vendor-sec, AIUI); the second points purely technical; and the third point is a combination of technical issues and an issue of training, both of which will be hopefully helped a lot by integrating testing-security and security.debian.org. So the easiest point of attack is obviously the second one, since it’s “just” a matter of expanding dak’s featureset. The problem here is embargoed fixes – the security team needs to be able to prepare fixes for vulnerabilities revealed on vendor-sec, but then keep them secret from everyone not on vendor-sec until the publication date. Which is fine, except that dak takes an all or nothing approach to that sort of secrecy: secuirty uploads go into accepted, get built, and then the security team run “amber” to publish the update. But what that means is the accepted directory and its contents can only be visible to people with vendor-sec access, which means only people with vendor-sec access can do security updates. But we do actually have a different queuing mechanism that allows us to keep some things secret, while not hiding everything: thanks to the crypto-in-main transition, the NEW queue acts like that, more or less, only allowing ftpmaster to see the contents of NEW packages until they’ve passed license inspections and the appropriate export notifications have taken place. And actually, we’d already considered extending that sort of behaviour to add an “unapproved” queue that would prevent uploads from entering proposed-updates without the stable release manager’s prior approval. The idea then, would be to have a couple of queues for the security team: an embargoed queue, accessible only to those with vendor-sec access that would store embargoed fixed ‘til they’re ready to be released, and an unembargoed queue for preparation accessible by a wider group, for preparation of fixes that don’t need to be secret. Both queues would need to be autobuilt (and the build logs for embargoed uploads would need to stay restricted, while the build logs for unembargoed uploads would not), which is an added difficulty, since only accepted can be autobuilt presently. But otherwise, it seems basically plausible, both to myself and Joey. Conveniently, Andrew Pollock’s been interested in throwing some money through the AJ Market to see what happens, and since the initial idea we were tossing around fell through due to his move to the US, he’s put up the dosh to make the above happen. Well, strictly the dosh to make me make the above happen, or something. Anyway, I’m already running behind both in implementation and blogging about it, so back to the grindstone… (Okay, perhaps it’s not quite the feature Mark Twain would most like added to dak, but it’s still nifty.)

Yesterday we did meet zufus and gravity for lunch, then mika joined us for bubbles tea. There also was a somewhat unexpected couple joining the group at that point: kiko and his sister. gravity and zufus had to go back to work though, so it was mika, micah, kiko, zuzi and I who went for some Freedom Trail discovery. The weather wasn't that good, and I didn't have too much time either, but we did manage to see a few things around the centre, like the memorial grave yard and a park with tons of fearless squirrels. We headed back to the Acetarium, I quickly took a shower and packed, and we left to the metro, a bit behind on my planned schedule. mika left me two stops before the one I needed to get down in, and instructions to get to the airport from there, using the shuttle. It's not amusing how slow something can appear to be when you're in a hurry. The driver of the bus said it took 5 minutes, but I had to go to the very last stop at terminal E, and it was like an eternity. In the end, I arrived at the terminal at 18:40, when my idea was 18:00, and I ran and ran until I found Air France's desk. There was no queue or anything, only me. During the flight, I tried killing time with War of the Worlds, which was a timekiller but nothing more, and The Island, which I wouldn't recommend unless you care too much about hot female characters. After 6 hours of flight, I was in Paris, apparently on time. But the doors opened much later that when we landed, so my connection started to be endangered. Again, I ran and ran, from one terminal to the other, around the chaos that is CDG. In vain, as my checkin was closed after arriving only 20 minutes before the departure. Much annoyed, I went to the transfer desk, to discover the next flight to Val ncia was cancelled, so the next one was the next morning. The quick alternative via Madrid was full, so I now have tickets for CDG-BCN-VLC, which is extending my travel plan in 7 very nice hours. I have no idea of where my luggage is, but at this point I don't care. I only wonder at what time I'll get sleep. What I do know, is that these fucking idiots claim there is free wireless in this spot of Terminal 2F, but it's not true at all.

So, on Clint's list of 20 geek books, I've read 15. And I've been planning to read 4 of the other 5 for a while too...

This essay is part of my Finnish criminal court series. See the introductory essay for more information and an overview of the Finnish criminal court system. There are no juries in Finnish criminal courts. Instead, there are lay judges, trusted lay people who actively take part in deciding criminal cases and can in some cases completely override the legally trained judge's opinion. See more ...

I have read 13 of the books on the list that Clint mentioned. I had begun to write about all the ones which I expected to be there but weren't and then realized I might as well make my own list. So here it is in alphabetical order not in any particular rank. Some entries are actually series.

• 2001: A Space Odyssey, Arthur C. Clarke (But the sequels get progressively worse.)

• Alice In Wonderland/Alice Through The Looking Glass, Lewis Carroll

• Baroque Cycle: Neal Stephenson

• Behold The Man: Michael Moorcock

• Breakfast of Champions, Kurt Vonnegut

• Dictionary Of The Khazars, Milorad Pavic

• Earthsea Trilogy: Ursula Le Guin

• Gloriana or The Unfullfill'd Queen, Michael Moorcock

• Gormenghast Trilogy, Mervyn Peake

• Gravity's Rainbow, Thomas Pynchon

• Jonathan Strange and Mr. Norrell, Susanna Clarke

• Lord Of The Rings, J.R.R. Tolkien

• Naked Lunch, William S. Burroughs

• Ringworld, Larry Niven

• The Computer Connection, Alfred Bester

• The Dune Encyclopedia, Willis E. McNelly (The real backstory to Dune. Brian Herbert should be fed to Shai-Hulud.)

• The Futurological Congress, Stanislaw Lem

• The Island Of The Day Before: Umberto Eco

• The Moon Is A Harsh Mistress, Robert Heinlein

• Ulysses, James Joyce

All pretty damn geeky I think if not stereotypically so.

This essay is part of my Finnish criminal court series. See the introductory essay for more information and an overview of the Finnish criminal court system. The main hearing is the only part of the trial which directly affects the court's decision. It is immediate and oral and usually lasts no longer than a couple of hours. The current system is fairly young. There were several fairly substantial reforms of Finnish court procedure in the 1990's. I will discuss this history in a later essay. See more ...

So it seems I cannot uphold my word - Well, yes, it was because of the trouble it would represent to the fine Moquegua guys - But anyway, I ended up accepting the invitation practically at the last minute, and went to Moquegua, Per , probably for my life's most tiresome journey.
Saturday, after lunch, we headed for the airport. I left Mexico at 17:30, and arrived five hours later in the Lima airport. Thanks to Antonio, Jos and Laura, who picked me up at 23:30 and arranged me a room in a hotel. I met the DebianPeru crowd, a very nice group, Sunday morning - We had breakfast, chatted for a while, and went for Lima's famous ceviche (assorted seafood cooked in cold in lemon. VERY good). At 3:45PM, I took the bus to Moquegua... For 17 long hours.
Got to Moquegua at ~8AM, went to the Jos Carlos Mari tegui University. I met the other guest speakers for breakfast, went with them to meet the Univerity Rector, hooked up some minutes to the net, went to a typical Moqueguan restaurant, gave my talk... Then hurried up to get the bus back to Lima. We got there five minutes before it left. I don't know why or how, but the bus back took 14 instead of 17 hours - I will not complain ;-)
Back in Lima, Carlos met me at the bus station, we went for breakfast, and hurried to the airport. I crossed the gate at 12PM, hurried by the airline personnel (and didn't manage to see Rudy/Stone_Head, who was on his way there)... Just to find the plane was delayed, although by little. Sat down for a while, hacked for a bit, and took the plane back home.
Summing it all up, I traveled roughly 40 hours, out of the 72 hours I was out of Mexico. Of course, you could add 1hr travelling to the airport and 1:30 back home... Anyway, 40/72 is quite close to 42/74 :)
I am tired. Plain tired. I am just waiting for Nadezhda to get home, as I want her to find me alive, and I'll crash down in bed.

Who can resist a good rhyme? Or a bad one? So this round of dak hacking turned out to make the AJ Market scheme another notch more confusing – hence the delay in blogging, and the teaser in my last post. The issue leading to the confusion is that the major item on the list to start hacking on was SCC, which unlike the projects I’ve undertaken so far, is more than a day’s hacking. In fact, due to the need to give mirrors a chance to adapt to the new system between it being implemented and actually used, it’s actually more of a multi-week task. And doing it as a one-day-a-week project would extend that into a multi-month task afaics. I guess that’s still better than never, but obviously it’s worth looking into alternatives. Naturally, then, the first phase of a longer project like this is threefold. We’ll call it “the three P’s”. Planning My theory at this point was to come up with a plan for what to do, try figuring out how much work it’d take, and then see what sort of financial arrangements might be plausible – not involving me cutting a few weeks out of my life for spare change, but without making the whole thing an unleapable chasm from what the AJ Market’s currently managing either. I figured writing it up as a semi-formal proposal makes most sense:

Summary Implementation of the outstanding mirror split proposal for the Debian archive to allow new architectures, particularly amd64, to be included in the archive. Benefit In spite (or perhaps because) of its simplicity, this project has been languishing for over two years, and is not currently being worked on; so at present it’s not even possible to estimate when it would otherwise be completed. It is most notably preventing amd64 from being integrated into the normal Debian development environment, causing derived distributions to maintain amd64 specific patches themselves. In the longer term, reducing the constraints imposed on the archive size may allow the introduction of additional suites, such as backports or volatile, as well as additional architectures; though significant further discussion on this would be needed. Background Since at least mid-2003 the Debian archive has been closed to new architectures due to the already large amount of space and bandwidth required to become a Debian mirror. At present, the archive uses some 158GiB of disk, and about 1GiB per day; additional architectures are expected to require approximately an additional 10GiB each, and there are likely around half a dozen architectures that will be considered for addition once the moratorium on new architectures is rescinded (incl amd64, armeb, sh variants, kfreebsd and possibly partial architectures for arch variants such as s390x and ppc64). The primary work needed to fix this involves:

• ensuring the mirror network operates correctly when a majority of mirrors are partial; this reduces the impact on bandwidth and storage capacity
• optimising portions of the archive maintenance software, particularly apt-ftparchive; this reduces the load on the archive server
• providing appropriate guidelines on the qualification criteria new architectures need to meet in order to be added to the archive; this provides a limit on future increases, allowing growth to be appropriately controlled

Actual work I expect there will be six phases to the project:

1. cleanup of the archive as it stands, and establishing a clear categorisation of its contents to define what a partial mirror by architecture or suite should officially contain
2. providing appropriate scripts to ensure mirror sites can easily comply with the previously defined expectations for partial mirroring
3. devise an appropriate structure for the new mirror network, that can easily incorporate existing mirrors, and coexist with the existing structure
4. provide information on the new structure to both mirror admins and users; assist with the transition, and resolve any problems found
5. ensure the archive management software is appropriately optimised, and that archive inclusion criteria have been debated and established
6. add new ports that have passed the qualification requirements to the archive

In theory, a couple of days for each of those sound plausible, so making that twelve days actual work (with a couple of week’s delay in between for mirrors to have some time to adapt to the new network). On the downside, twelve days at a day a week is over three months of real time, not counting the possibility of doing other things with the one day a week, or Christmas, or the aforementioned delay for mirrors. Yick. So much for planning. Preparation So the next “p” is preparation. In this case that’s finally getting around to fix dak CVS, which has been slightly broken since May. The extent of the actual breakage was just the loss of the ChangeLog history, aiui (or at least, that was the unrecovered breakage), but the result of that was months of uncommitted changes on both ftp-master and security (and reportedly from Ubuntu’s dak installation too). The changelog for the first set of commits (not counting buildd changes from ftp-master, security changes or Ubuntu changes that haven’t made it to ftp-master) looks like:

        * tiffani: new script to do patches to Packages, Sources and Contents
        files for quicker downloads.
        * ziyi: update to authenticate tiffani generated files
        * dak: new script to provide a single binary with less arbitrary names
        for access to dak functionality.
        * cindy: script implemented
        * saffron: cope with suites that don't have a Priority specified
        * heidi: use get_suite_id()
        * denise: don't hardcode stable and unstable, or limit udebs to unstable
        * denise: remove override munging for testing (now done by cindy)
        * helena: expanded help, added new, sort and age options, and fancy headers
        * jennifer: require description, add a reject for missing dsc file
        * jennifer: change lock file
        * kelly: propogation support
        * lisa: honour accepted lock, use mtime not ctime, add override type_id
        * madison: don't say "dep-retry"
        * melanie: bug fix in output (missing %)
        * natalie: cope with maintainer_override == None; add type_id for overrides
        * nina: use mtime, not ctime
        * katie.py: propogation bug fixes
        * logging.py: add debugging support, use   as the logfile separator
        * katie.conf: updated signing key (4F368D5D)
        * katie.conf: changed lockfile to dinstall.lock
        * katie.conf: added Lisa::AcceptedLockFile, Dir::Lock
        * katie.conf: added tiffani, cindy support
        * katie.conf: updated to match 3.0r6 release
        * katie.conf: updated to match sarge's release
        * apt.conf: update for sarge's release
        * apt.conf.stable: update for sarge's release
        * apt.conf: bump daily max Contents change to 25MB from 12MB
        * cron.daily: add accepted lock and invoke cindy  
        * cron.daily: add daily.lock
        * cron.daily: invoke tiffani
        * cron.daily: rebuild accepted buildd stuff
        * cron.daily: save rene-daily output on the web site
        * cron.daily: disable billie
        * cron.daily: add stats pr0n
        * cron.hourly: invoke helena
        * pseudo-packages.maintainers,.descriptions: miscellaneous updates
        * vars: add lockdir, add etch to copyoverrides
        * Makefile: add -Ipostgresql/server to CXXFLAGS
        * docs/: added README.quotes
        * docs/: added manpages for alicia, catherine, charisma, cindy, heidi,
        julia, katie, kelly, lisa, madison, melanie, natalie, rhona.
        * TODO: correct spelling of "conflicts"

Ugh. Still, that’s enough to start work. And the final “P”? Come on, be honest with yourself, you know what it’s going to be. Procrastination Okay, that’s not entirely fair; the irrelevant bit of work was actually on to TODO list before SCC (mostly because it was something that I could get done reasonably quickly) and in fact was this line of the above changelog:

        * dak: new script to provide a single binary with less arbitrary names
        for access to dak functionality.

All the various model/actress names have been getting more than a little confusing recently, with almost forty in the dak suite, and another two dozen or so in use elsewhere – and then there’s the fact that the whole hot babes thing is both a bit offensive, and getting a bit old. OTOH, you need something to rename them to. We ended up deciding on the “version control solution” and introducing a “dak” command that’d launch all the different little bits of functionality depending on arguments, in the same way cvs, svn, tla, bzr, darcs etc do. The implementation’s kinda neat: we have a list of commands (like “ls”) and their description (“Show which suites packages are in”), along with the python module and function they’re in (“madison”, “main()”). That let’s us not actually have to change any of the other scripts immediately, and lets “dak ls foo” work the same as “madison foo”. It also means that down the track we don’t need to have separate modules for each subcommand, and that we can rename modules and functions without affecting the user interface. Of course it also means that all the internal scripts haven’t changed to use the new names yet, leaving the new interface a bit underused, but hey, “dak ls” at least manages to be one character shorter than “madison”, so that’s a win! To be continued…

We had some troubles with a broken computer, slow internet connection, no available storage room and some smaller problems. Interesting visitors, ranging from "I'm using SuSE why should I change to Debian?", some "I'm using Debian and would like to thank you!" and some really hard technical questions. Quite mixed visitors... In the afternoon the Linux New Media award (URL doesn't work yet, should be in a couple of hours) was given away. For those who aren't familiar with it: It's the only free software related award I know of in Germany. It's given away yearly in several changing categories by a jury of over 200 people of the Free Software community and industry. A small history: 2002 one category was "best distribution" - Debian won it. 2003 one category was "distributions" - Debian won it. Bored by that, in 2004 Debian one no award itself - but in the category "best newcomer distribution" 4 out of 5 nominees were Debian based - Skolelinux / DebianEdu won it. 2005 we didn't one any award again - but is was again a success for Debian for two reasons:

1. One category was "best Debian derivate" - it's so boring to give awards to Debian, that they made a "who's doing as good as Debian" award ;) (Not surprisingly Ubuntu won it.)
2. In all but one of the six laudations for the winners in this years categories Debian was mentioned :))

This year they had one special award for "Outstanding contribution to Linux / Open Source". It was hard to decide, so many nominees... The City of Munich, the BBC, several country or state governments... it ended in a tie! This years winners are Mark Shuttleworth and the anonymous developer! Yes, everyone of you out there, who ever submitted one line of code, submitted one useful bug report, wrote one line of documentation.. all you got an award! Congratulations! Personal note: Somehow managed to hurt my knee... I'm too old for this... Personal note 2: Special greetings to Meike who can't be here with us :(

Yesterday

I missed a holiday

I managed to fail to go away on holiday for four days by virtue of being asleep and missing the train. That sucks. Although on balance probably for the best, I was very tired.

xine-ui bug triage

I did a minor amount of triage upon the xine-ui package. There’s been an annoying bug in the package for about 40/50 days - where if you right-click upon the screen the GUI would crash. This had been reported four or five times, so I merged all the bug reports together added a patch which I’d tested. Then I mailed the maintainer asking if they’d object to an NMU to fix it. Today I got a go-ahead, so I’ll be making an upload shortly.

Debian Admin webstats

Almost more hits upon the website in the first four days of this month than in last month combined. Wow. We’re averaging close to 50,000 hits a day. When I think things like that I get all paranoid and have to remember that it doesn’t matter how good the writing is ..,

Security Updates

A new version of GNUMP3d is out. This is primarily a security update. Install it now if you use it publically. (Local mirror in case you’re running from source and the gnump3d.org site hasn’t updated yet)

Apt Updates

I’ve updated my personal APT repository. This now uses reprepro to create/update/manage it. The reprepro tool is utterly wonderful. (Although I used the backported Sarge version, rather than the older one). Expect an article on the Debian Administration website shortly. Now I have an “incoming” directory I can upload new package builds to, and have them magically migrate into the relevent section. The other significant change is that now I can host packages with Arch: All, as well as i386. This is useful as I distribute several perl scripts/libraries which were previously unavailable to non-x86 users. Talking of which I still have to finish my review of The Debian System written by Martin Kraft - I’ve been sitting on that for too long. (Summary: Great Book, buy it if you can’t get one donated to review ).

As predicted, the morning was not productive at all. At one point I slightly became concious and saw sladen fetching his bike, opening the door and saying me "Back in two hours!". We didn't know anything about him until 24 hours later. As we started waking up, we tried to think of a plan for the day. The morning was gone, though. Clint took us to a restaurant two blocks away for breakfast, or actually brunch, because that was the only food in many hours. I ate some "pancakes" with banana in them, and barely could finish them; they are very filling. We went to the promenade for a last look at the Manhattan skyline and took some pictures while we tried to figure out what to do.

A last view over Manhattan Mako was developing a plan in secret, though, which involved micah and his car. Micah found out soon after. We went back to Clint's, expecting to find sladen somewhere, but we didn't. I packed my things, and when we really needed to go, we resolved to put his things in the entrance so he could find then and do whatever he wanted on his return. We went on the Metro to Union Square, where, hear this helix, I saw TONS of raperos doing their break-dance thing (ok, maybe not tons, but I did see them). And two blocks away, we arrived to the most incredible book store. Mako has blogged many times about buying very rare books at the Strand for ridiculous prices, but this was totally unexpected. The Strand is huge. On the outside, there's carts with hundreds of second-hand books, all for one dollar. Mako used to go there and browse the books to find interesting stuff. The Acetarium is full of them! Most of the dollar books are total crap though. A very high percent talk about god, religion, "our troops" and stuff like that. Mentally filtering what might be good and what is not is not easy when you haven't done it before. Mako started scanning the shelves as soon as we arrived, and every now and them he'd pick some totally stupid title. I was on my own shelf, missing many good stuff, while mika, Clint and mako did their own. Clint found quite a few titles, but mako didn't find anything good. I got lucky though, and found the precious book of the day: The Spanish Anarchists. The heroic years 1868-1936, by Murray Bookchin. Although old, it was in very good condition, and mako immediately asked if I was taking it. :) I won! The inside of the Strand was incredible too. Three very big floors packed with books, plus the half-priced "reviewer's copies" at the basement. I was totally overwhelmed by the amount of books I'd be interested in buying, and the limited weigh I should be carrying back, so I did my best not to look too carefully. For a few hours, I didn't have a too clear idea of what mako's plans were. At some point, micah phoned him and we rushed to the PATH, the train that goes to New Jersey. Apparently we were meeting micah at Newark, but I still didn't know why we had to go there. During our ride, I could see how pleasant New Jersey is to the human eye. Miles and miles of heavy industries. I'm pretty sure it's the ugliest place I've ever seen. What I couldn't see, and I'm still disappointed, is any of the viciously arrogant rats of the New York metro system. Mako had told me about how they look at you, like saying "if you come down here, you'll be left with 9 fingers", and the incredible number of them on the tracks. Unfortunately I couldn't see any. I blame Michael Bloomberg. At Newark, micah appeared in his car, and we all hopped into it. We apparently were going by car to Boston... including Clint. I was puzzled, as he had to work on Monday, but he'd said that he'd simply "come back". There was a problem though, mako had dilinger's keys, and he was going back to NYC from Boston, and we didn't have time to get to Boston before he left, so we had to find a way of leaving the keys in NYC so he could get into his appartment. Finally, mako resolved that Clint would be left in a cold street, in a rough area of NYC, and he would handle the keys problem. I still didn't understand what was going on. We headed North, and I quickly fell asleep on mika's nap. I'm getting old. When the car stopped again and I suddenly woke up, I looked ahead and... HORROR! We were at the door of a McDonads. WTF WAS GOING ON? So it seems that when you're on the road, there's no much other choice than shit food. After a quick discussion with mako about how badly those burgers taste, I quickly went back to sleep, until we were in Boston. It took a while to find a parking spot, because all of them "permit only". It's impossible to park if you come from somewhere else. I was finally at the Acetarium, a very cool flat in Cambridge, 15 minutes away from the MIT. It was 3:30 in the morning. The day after, we woke up pretty late, and as I opened my laptop and found a privmsg from sladen, he was was knocking at the door. This man has an incredible ability to disappear and reappear when he's most unexpected. Apparently he managed to grab his stuff in NYC, fetch the bus and arrive at 2 in Boston, meeting dilinger at the station, and mako as he went out to MIT. micah and I went to explore Boston, but never managed. We consumed a few hours when trying to ship some equipment to micah's colo, and then trying to find food. When we were ready to go, micah got a very badly timed call, which made him go back to the Acetarium: a server at work was dying or dead. At one point, it was late enough that going to Boston wasn't worth it, so we went to visit the Media Lab instead. On our way there, micah and I kept chatting about this and that, and found out how small the internet is. We both know a bunch of common people from uncommon places like Per , from our involvement in social projects in the net like Indymedia and Sindominio.net. The MIT is incredible, specially the Stata Center by Frank Gehry. We wandered around as we only got voice mail from mako, until an hour later we found we was like 20 metres away from us. He gave us a tour through the Media lab, and it was incredible. I had never seen something like that. Every lab was colourful and fun, and very cool developments were going on everywhere. I also saw the coolest mame box ever, with an arcade case and everything.

The Stata Center, right next to the Media Lab After the tour, micah and I headed back, while sladen stayed to have a look at one of mako's projects. When we got back to the flat, there were a few people already there for mika's sushi party, and I rolled my first sushi rolls, which was fun. A bunch of Debian people joined us, including zufus and gravity, and had a great chat with them. The party ended way too late and after too many beers. sladen used his secret disappearing abilities, and a few colleagues from mako crashed, so there was a bit of overbooking. Mako's solution was simple. mika, him and I could share their bed. I can't say I have slept too much, because mako would keep pulling the blanket and leave me out in the cold, and I was trying not to squish mika. But it went ok, although we discovered too late that mika was hot while I was cold, and we swapped our places too late. Today, we'll go find the Freedom Trail and walk a bit around it, meet gravity and zufus for lunch, and I will sadly have to go back to Cambridge, quickly pack and head to the airport to catch my plane. My hours in North America are expiring.

In what can only be described as a massive display of SCO-you-worked-on-Linux-2.7-grade stupidity, it appears that the infamous Sony shiny-disc-that-pretends-it's-a-CD DRM is not only bad for your computational health, but is in fact a copyright-infringing work, as it looks as though it contains chunks of the LAME MP3 encoder/decoder library. I don't think my commentary can beat what BoingBoing had to say on the matter:

Sony claims that it needs to install dangerous, malicious, underhanded software on its customers' computers to protect its copyrights, but in order to write this malware, it has no compunction about infringing on the copyrights of public-spirited software authors who make their works available under free software licenses like the GPL. I suppose it's natural to believe that everyone is at least as sleazy as you are: for Sony's rip-off artists, assuming that paying customers are planning to rip them off must come easy.

How can anyone even vaguely involved in the tech industry possibly believe that anything they write can't be popped open and peeked in, to find out what naughtyness they've done? The mind boggles. Sony, you are on my official shit list. It's a long and prestigious list, but you've managed to climb very quickly to the upper echelons. May the fleas of a thousand camels infest the nether regions of every Sony executive who may have had anything to do with this whole fiasco. The original article is available, and is quite informative. Yay for BoingBoing, also, who provide me with so much of my daily interesting news.

Inspired by Matthew Palmer's writings (1, 2) on his experiences about the Australian judicial system, I decided to write a series of essays on the Finnish legal system, mostly to contrast it with the universally familiar United State system (even if that universal familiarity is a little skewed by generally having been obtained from dramatizations and not actual court practice). I will concentrate on criminal cases. I will write based on my personal experience as a part of the judicial system, and I will be supplementing the experience with my personal research into law. I am not legally trained, but I have read a fair bit of law and related literature. I am a lay judge in the Jyv skyl District court. I will explain the significance of that later, but I hope it suffices to say, here, that I have sat on the bench, as part of four-judge panels, since March this year, in ten sessions each a day long, and each containing at least two, usually four or five criminal cases. Some highlights:

• There are no plea bargains. With some minor exceptions, every criminal case is tried in a full court session.
• There is no jury. Criminal cases are tried as a rule by a panel of four judges, of which one is legally trained and three are lay judges, each having an equal vote.

Later essays in this series:

• The main hearing in a Finnish criminal trial (November 16, 2005)

See more ...