Search Results: "will"

16 December 2009

Holger Levsen: Debian Wine soon to be sold out?

In case you want to buy some (more) bottles of wine made for DebConf9, you need to hurry up. Also a bit more hurry is appropriate if you want it to be delivered til XMas :-)



(Picture credit belongs to Chris.)

I'm planing another (offline) sale at the 26C3 congress in Berlin at the end of the year, which might or might not work out. If it does, the number of bottles available for online ordering will be reduced significantly, and basically I'm only waiting for some details to be finalized for announcing this for real, so hurry up and mail order now - unless you have enough Debian wine bottles at home already :-)

Information how to order is available in our wiki at DebianWine. The profit made will be given to DebConf9, and as that has been dealt with finacially successfully, it will be given to DebConf10!

Wouter Verhelst: Grrr

struct  
	char str[4];
	char sc1;
	char str2[3];
	char sc2;
  foo __attribute__((packed));
snprintf(foo.str, 5, "%04X", data);
foo.sc1 = ';';
snprintf(foo.str2, 4, "%03X", otherdata);
foo.sc2 = ';';
Yes, I know that both snprintf() calls in the above snippet will overflow their immediate buffer. Yet this code is safe; the network protocol for which this code is written does not actually need nor expect NUL bytes; instead, it wants semicolons. I could of course use a "char foo[9]" rather than a struct as above, but I find this to be slightly more convenient than to count offsets. However, this code does not work with glibc, because the buffer overflow detection kicks in. Solution:
char buf[5];
snprintf(buf, 5, "%04X", data);
memcpy(foo.str, buf, 4);
In other words: add a stupid and useless memcpy, because someone thinks they're smarter than me. Stupid morons.

15 December 2009

John Goerzen: Review: A Christmas Carol

I guess you can say that A Christmas Carol by Charles Dickens has been a success. It was published in 1843 and has never been out of print since then. It s spawned all manner of plays, films, adaptations, and spoofs. It s been adapted at least twice by Disney, once featuring Mickey Mouse and another time featuring Jim Carey. We re almost inundated with the story I m not sure how many ways I ve seen it. Yet I had never read the original story by Dickens until just now. And I must say, what a treat it was. Despite knowing the plot in advance, it was a very good read. The 19th century London setting was done well. It wasn t some idealized London as is often portrayed in film adaptations. It had depth, as did the characters. Dickens Scrooge had a troubled childhood, the son of poor and apparently abusive parents. He turned to business, with which he was successful. Along the way, he lost sight of family, and really of his humanity in general, striving to be a richer and more successful businessman at the cost of all else. How apropos this story is for us in the 21st century. Our large banks define success in terms of profits made for their shareholders, while adding more gotchas to the terms of the credit cards held by their customers. Our governments play geopolitical games over weapons, oil, and gas, while unwilling to sacrifice anything to prevent a climate disaster. Our politicians, even in the season of Christmas, turn a blind eye and a cold heart to the suffering of those that can t afford health care for naught but political reasons, rather than trying their hardest to make a plan that will help them reality as soon as possible. And what of us, the citizens of the 21st century? We consume ever flashier cars, houses, computers, and cellphones with data plans, while poverty intensifies across the globe in this economic downturn. Well, count me among those many inspired and reminded by Dickens to be a more empathetic person, to remember how good even many of the poor in the West have it compared to other parts of the world, and to try to do more for others. And that, perhaps, is part of the genius of Dickens. He inspired a complete change of how people looked at Christmas in his time. And his work is no less relevant today; perhaps it hits even closer to home these days. He invites us to carefully consider the question: what does it mean to achieve success in life? And he deftly illustrates that wealth is wrong answer. Here s hoping that many others will also learn a small bit about life from Dickens. How to find it: A Christmas Carol is available for free from Project Gutenberg for reading online, printing, or reading on an ebook reader such as the Kindle. Be careful when buying printed editions. Many have been abridged or improved for a modern audience , and thus lose a lot of the quality of the original. I found at least one edition that looks true to the original; I m sure there are others. [This review also posted to Goodreads]

Tollef Fog Heen: N900 first impressions

Collabora was kind enough to buy N900s for all its employees. Yay! I got mine on Friday and has been playing around with it quite a bit. It's very shiny and the user experience is a lot better than the N810. There are a few graphical glitches, it seems it's XDamage damaging a bit of a window and it's just not quick enough to repaint. Not a problem, and it has far fewer instances of just hanging for half a second which my iPhone has. That is, it hasn't had any of those yet. The screen is good, but resistive. Takes a short while to get used to when you're used to capacative, but it's not a problem at all. The keyboard is good, but I need to map something as the compose key. Having US/UK key caps and using the Norwegian layout is a bit confusing. Not really the fault of the device though. The web browser is generally quite good. The gestures take a bit of time to get used to, but they're not hard as such. Some of the default "applications" are implemented as just links to the web pages of services like Twitter, which is a bit silly as you don't even get a version that's optimised for the N900. They're not useless, but they are absolutely nowhere near a real application. Also, the "Store" (Ovi Store) application/web page says "coming soon", which is quite odd. I'm not sure if I can change the selection of applications on the default application list, but modifying the desktop is easy. There seems to be few themes and background images available so far, at least in anything resembling official repositories. Hopefully this will improve over time. So far, I haven't actually written any code for the N900. I have some applications I want to write, mostly widget-style apps like "when does the next bus home leave from a bus stop close to me and where is the bus stop", but also some other ones. Battery life is not great. It almost did 48 hours today with a bit of use underway, and I did charge it before it ran completely out, but when I'm used to closer to a week, it's not that good. Camera seems good and is quite fast, I think it took less than five seconds from opening the camera shutter until I had taken a picture. Shutter delay is quite bad at about a third or half a second, but this is a mobile phone (or mobile computer, as Nokia likes to call it) and not a DSLR, so I'm quite happy with it. As a phone, it seems fine so far. I can make calls and accept calls and there's no noticeable problems with it. It also functions as a modem/DUN over bluetooth, which is quite useful. Build quality seems good, there's a good feeling when sliding the keyboard in and out, but only time will tell how good it actually is. So far, I'm happy with it, it's a big step up from my previous UK phone (which is a Nokia E70; my iPhone is a 2G phone so I can't use it here with the provider I'm using). Hopefully I'll post more happy stories about it in the days to come.

14 December 2009

Jo Shields: FOSDEM 2010

I will be at FOSDEM in February next year. It should hopefully be awesome. Anyone who packages Mono on any distro should definitely come, or does any Mono-related stuff in general, since not only will I be there, but the fabulous Mirco Bauer too and perhaps other wonderful people. Definitely a fine use of your moneycash.

David Welton: File Selector for Java ME

I recently did some work to make Hecl read files, which also means that it can execute Hecl scripts from the phone's memory. This is especially important for environments like Blackberry, where we will be distributing a signed version of the Hecl application. To create your own Hecl applications, instead of simply replacing the script in the .jar file, you can point to a script on the device's file system. This is also available for normal Java ME phones, but unfortunately, for an open source project, the cost of a code signing certificate are prohibitive (on Blackberry, it's only $20, so I bought one with my own money). In any case, as part of this effort, I developed a very simple 'file browser', which is used in Hecl to select a script to execute. The results are, like all of Hecl, available under an Apache license, which means that you can use it pretty much wherever you want: http://github.com/davidw/hecl/blob/master/files/org/hecl/files/FileFinder.java http://github.com/davidw/hecl/blob/master/files/org/hecl/files/FileFinderCallback.java Of course, if you spot any ways to improve it or fix problems with it, I'd appreciate it if you sent patches back.

Phil Hands: arduino for the java challenged

Having excitedly bought an Arduino from the nice folks at tuxbrain.com while they were at DebConf9, I was then a little deflated to discover (while attending the UKUUG's Arduino Workshop in August), that the IDE is written in Java. While I can see that the authors might perceive this as the easiest way to provide cross-platform pointy-clicky-ness, JREs have a half-life of about an hour on my systems.Anyway, I fought with Java to show willing, until I'd determined that the IDE didn't seem to be happy running under xmonad (rendering menus so that they were unclickable) and gave up -- spending the rest of the tutorial proving to myself that I could compile and upload C code for the little beastie, but failing to compile Arduino sketches on the command line.Ever since, I've been meaning to work out the required CLI incantations, and finally made time over the weekend. The incantations turn out to be rather simple, if not very obvious, so I thought the world could benefit from a package that encapsulates the required knowledge.I've pared the source tree down to the c++ code and some examples and tweaked the Makefile so that it'll do it's work out of tree, referring to the files that the package installs for you, which allows you to apt-get install aurduino-core and then cut&paste a few lines from the contained README.Debian in order to get an LED blinking for the first time.The resulting git repo is now on Alioth. The binary-indep package it produces I've called arduino-core -- hopefully I've left enough room for any fan of the Java IDE to shove that back into the upstream branch and add packages for the full IDE, and maybe throwing in another package for the GTK IDE that's out there.I'm very mildly concerned by the fact that Arduino is a trademark of the Arduino Team, but that trademark is for the circuits, not the software, so this is probably irrelevant. If you think I should care enough to rename the package to freeduino, say, please get in touch.Anyway, if you have an Arduino (or similar) please grab a copy and test it.

Ondřej Čertík: ESCO 2010 conference

An interesting conference 2nd European Seminar on Coupled Problems (ESCO) will be held on June 28 July 2, 2010 in Pilsen, Czech Republic.
Among the topics are solving PDEs and applications and using Python for scientific computing. In particular, Ga l Varoquaux is the keynote speaker.

Unfortunately, it was later announced that the SciPy 2010 conference is going to be at the same time, which is really unfortunate. But here are some reasons why you should consider going to ESCO 2010 instead:


If you have time, I can fully recommend to go to ESCO 2010.

Kumar Appaiah: For Hindi Debian users

(English translation below. Indian Debian community, please spread the word!) ! , , KDE, GNOME . . (Debian Installer) Lenny , . , , . , , , . ! ; . : akumar@ . ( ) ;-) !TranslationFellow Debian users (who know Hindi)! Maybe you aren't aware yet, but several parts of Debian have been localized and are available in several Indian languages, and KDE and GNOME and several programs are available natively in those languages. This has been possible only due to dedicated volunteers spending time in translating the programs. I have been translating the strings in the Debian Installer to Hindi, since Lenny, and will continue with the translations. But like others, I am short on both time, and my knowledge of technical Hindi words and phrases is limited. So, I'd request fellow users to chip in with some translations to the Debian Installer strings, if they have the time. That way, not only will you earn fame and glory, you'll also earn the gratitude of the Hindi Debian user community.You don't need to be an expert in the language and grammar to help out with the translations. All you need is some working Hindi knowledge and a bit of time.For more information, email me at akumar followed by debian.orgThank you!

Joey Hess: two films

I've been watching some good films recently. Two I especially liked. baby camel in sidecar man in taxi Goodbye Solo starts in Winston-Salem and ends up at Blowing Rock. Both settings, as well as the taxi in between, are very familiar. The characters could easily be people I've met. Tulpan is set in a steppe in Kazakhstan. The desert and dust devils mostly reminded me of Mars. Particularly of this amazing shot taken by the Spirit rover. dust devils on Mars! Still, I felt so much more at home in Tulpan. Kept pausing it to check out how the family had their yurt set up and furnished, and watched their very real-seeming life unfold, right down to the lambing scene. While Solo took the very familiar, and confounded expectations and biases at every step. They're both fine films, from directors I want to see more of. I've seen Ramin Bahrani's work before Solo, and especially liked Man Push Cart. Don't know if I will ever find any of Sergei Dvortsevoy's earlier films.

13 December 2009

Russell Coker: Links December 2009

Dan Gilbert gave an insightful TED talk about our mistaken expectations of happiness [1]. Don Marti has an insightful post about net neutrality and public property [2]. When net access requires access to public property then it should be sold in a neutral manner. Rachel Pike gave an interesting TED talk about the scientific research behind a climate headline [3]. The people who claim to be skeptical of the science should watch this. Mark Peters wrote an interesting article A Happy Writer Is a Lousy Writer about the correlation between emotional state and work quality [4]. Apparently watching a film about cancer will make people more careful and focussed on details. CERIAS has an interesting short article about Firefox security as well as some philosophy on why web browser security generally sucks [5]. Cory Doctorow writes in the Guardian about Peter Mandelson s new stupidity in trying to legislate against file sharing [6]. This is going to seriously damage the economy of every country that implements it. Charles Stross has been blogging a series of non-fiction essays about space colonisation, in The Myth of the Starship he describes how most ideas of space travel are bad and how the word ship is always going to be unsuitable [7]. Brent T. White is an associate professor of law at the University of Arizona who has written an interesting paper about mortgages [8]. He says that anyone who is underwater (IE owing more than the value of their house) should walk away. The credit damage from abandoning a bad mortgage apparently isn t that bad, and there is the possibility of negotiating with the bank to reduce the value of the loan to match the value of the house. Mako is working on a project to allow prisoners to blog [9]. It s basically a snail-mail to web gateway as the prisonsers are not allowed Internet access. PracticalEthicsnews.com has an article about the special status that homeopathy is given [10]. It also notes that homeopathic medicines include arsenic and mercury. Such quackery should be outlawed, a life sentence for homeopathy would be appropriate IMHO. Cory Doctorow wrote an interesting essay about why he is not selling one of his books in audio form (he s giving it away) [11]. He concludes by noting that he wants no license agreement except don t violate copyright law . The fact that he can t get anyone to sell an audio book under such terms is a good demonstration of how broken the marketplace is. Thulasiraj Ravilla gave an inspiring TED talk about the Aravind Eye Care System a program to bring the efficiency of McDonalds to eye surgery [12]. Hopefully that program can spawn similar programs for other branches of medicine and spread to more countries. In many ways they are providing better service (both in quality and speed) than people in first-world countries who pay a lot of money can expect to receive. Scott Kim gave an interesting TED talk about his work designing puzzles [13]. He is also a big fan of social networking, unfortunately (for people like me who don t like social networking) his web site ShuffleBrain.com relies on Facebook. Gordon Brown (UK Prime Minister) gave an inspiring TED talk about global ethic vs the national interest [14], with a particular focus on the global effort required to tackle the climate change problem. Now if only we could get Kevin Rudd to listen to that. Brough has written an interesting analysis of the AT&T network problems that are blamed on the iPhone [15]. His essential claim is that the problem is due to overly large buffers which don t cause TCP implementations to throttle the throughput. This seems similar to my observations of the Three network in Australia where ping times of 8 seconds or more will periodically occur. One particularly nasty corner case with this is when using a local DNS server I can have a DNS packet storm where basic requests time out while BIND uses a significant portion of available bandwidth (including ICMP messages from receiving ports that BIND has closed). To alleviate this I am now using the Google public DNS service [16] (the Three DNS servers never worked properly).

Benjamin Mako Hill: Upcoming Travel

As is becoming my custom, I'm planning to spend much of December and January on the road. This time I'll be in Seattle, Japan and Wellington, New Zealand. Here's the rough schedule: Mika will also be around for everything but the NZ leg and SJ seems likely to make an appearance in Japan during the first week of January. Feel free to get in contact if you'd like to meet up in any of the places above for a coffee or beer. I'm also open to hanging out with giving talks at LUGs, GLUGs, Wikipedia groups, free culture groups, colleges or Universities along the way. Most of my time in Japan is still basically unstructured so I'm quite open to suggestions during the first couple weeks of January.

Julian Andres Klode: APT2 progress report for the 1st half of December


This week was successful. I have pushed some changes from November to the repository which change the license to LGPL-2.1+ (which makes bi-directional sharing of code with other projects easier, since most Vala code is under the same license) and implement HTTP using libsoup2.4 directly, instead of using GIO and GVFS for this. I also added a parser for the sources.list format which uses regular expressions to parse the file and is relatively fast. The code needs a current checkout of Vala s git master to work correctly; as released versions had a bug which I noticed today and J rg Billeter fixed in Vala 25 minutes later; thank you J rg. While nothing else happened in the public repository, the internal branch has seen a lot of new code; including SQLite 3 caches; Acquire text progress handling; and capt; the command-line advanced package tool. Most of the code will need to be reworked before it will be published, but I hope to have this completed until Christmas. It will also depend on Vala 0.7.9 or newer, which is yet to be released. The decision to use SQLite 3 as a backend means that we won t see the size limitations APT has and that development can be simplified by using SQL queries for filtering requests. It also means that APT2 will be very fast in most actions, like searching; which currently happens in 0.140 seconds (unstable,experimental and more repositories enabled), whereas aptitude takes 1.101 seconds, cupt (which has no on-disk cache) 1.292 seconds, and apt-cache 0.475 seconds. Searching is performed by one SQL query. I also want to thank Jens Georg <mail@jensge.org>, who wrote Rygel s Database class which is also used with minor modifications (like defaulting to in-memory journals) in APT2 as well. Rygel.Database is a small wrapper around sqlite3 which makes it easier to program for Vala programmers. The command-line application capt provides a shell based on readline with history (and later on command completion) as well as direct usage like capt config dump or capt search python-apt . Just as with Eugene s cupt, capt will be the only program in the core APT2 distribution and provide the same functionality currently provided by apt-get, apt-config and friends. The name is not perfect and can be easily confused with cupt , but it was the closest option for now; considering that the name apt is already used by Java (for its Annotation Processing Tool ). That s all for now, I ll tell you once all those features have passed my QA, and there is really something usable in the repository. In the meanwhile, you can discuss external dependency solvers, database layouts and other stuff in their threads on deity@lists.debian.org. And a screenshot from capt:
jak@hp:~/Desktop/APT2:temp$ capt
apt$ help
APT2 0.0.20091213 command-line frontend
Commands:
  config dump               Dump the configuration
  config get OPTION         Get the given option
  config set OPTION VALUE   Set the given option
  search EXPRESSION         Search for the given expression
  show PACKAGE              Show all versions of the given package
  sources list              Print a list of all sources
  version                   Print the version of APT2
apt$ search python-apt
build-depends-python-apt - Dummy package to fulfill package dependencies
python-apt - Python interface to libapt-pkg
python-apt-dbg - Python interface to libapt-pkg (debug extension)
python-apt-dev - Python interface to libapt-pkg (development files)
python-aptdaemon - Python module for the server and client of aptdaemon
python-aptdaemon-gtk - Python GTK+ widgets to run an aptdaemon client
apt$
Posted in APT2

Debian News: Debian is moving sieve to its IANA allocated port

The IANA port allocated for ManageSieve is 4190/tcp, and the old port used by timsieved and other managesieve software in many distros (2000/tcp) is allocated for Cisco SCCP usage, according to the IANA registry.

Starting with the version 4.38 of the Debian netbase package, the sieve service will be moved from port 2000 to port 4190 in the /etc/services file. This affects to those using Debian Squeeze, and Debian Sid. Debian Etch and Debian Lenny users are NOT affected.

Any installs which used the sieve service name instead of a numeric port number will switch to the new port number as soon as the services are restarted/reloaded, and in some cases, immediately after /etc/services is updated.

This will affect Cyrus IMAP. This may also affect other sieve-enabled software such as DoveCot.

In order to avoid downtime problems, mail cluster administrators using Debian are urged to verify their Cyrus (and probably also DoveCot) installs, and take measures to avoid services moving from port 2000/tcp to port 4190/tcp by surprise in either servers or clients.

It is worth noting that:

  1. /etc/services will only be automatically updated if you never made any modifications to it. Otherwise, you will be presented with a prompt by ucf or dpkg asking you about the changes.
  2. You can edit /etc/services and change the sieve port back to 2000 if you want (this is not recommended, though).
  3. You can edit /etc/cyrus.conf and any other relevant config files for your mail/webmail cluster (e.g. on the sieve web frontends) ahead of time to force them all to a static port number.
  4. You can configure cyrus master to listen on *both* ports (2000 and 4190) at the same time, and thus avoid the problem entirely. This also allows for a much more smooth migration from port 2000 to port 4190.

Henrique de Moraes Holschuh

David Welton: Mysql, Oracle and the European Commission

I am a bit of a cynic, and my cynic-sense definitely lit up when I read this: http://monty-says.blogspot.com/2009/12/help-saving-mysql.html He wants to have his cake and eat it too. Or as they say in Italian, he wants to have his wife drunk and the barrel full (really!). He sold Mysql to Sun for a great deal of money - around one billion dollars. Even if his share is only 1% (which I doubt), that is still 10 million dollars, which is enough for anyone normal to live the rest of their life without ever having to work again. If he walked away with 10% of the deal, that's 100 million dollars. Monty writes:
I have spent the last 27 years creating and working on MySQL and I hope, together with my team of MySQL core developers, to work on it for many more years.
Since it's under the GPL, he can do that himself for as long as he wants - he doesn't have to worry about making a living, after all. If he took away something closer to the 100 million number, he can also fund several of his friends to work on it for years and years, without worrying much about income. They could always do consulting if they wanted to make a few bucks, in any case. Now, what he's worried about is that Oracle will no longer put money into Mysql. I agree that that's a real risk. However, I also think that since it's Oracle's money that is being spent, they have the right to do as they see fit, within certain limits, and this case is well within those limits. My view is that there are plenty of cases when governments should intervene. For instance, if Mysql were the only competitor to Oracle in the database market, it might be quite unhealthy to let them buy it. But that's not the case - not at all. There are numerous competitors, both closed and open. So the risk to 'the public' is relative: people bought into a product that may now stagnate, but if they really want, they have plenty of other places they can jump without too much pain (SQL is a standard, after all). It's like if FreeBSD disappeared tomorrow: you could switch to OpenBSD or Linux or something else. Perhaps not painlessly, but it wouldn't be the end of the world, either (let's hope FreeBSD has a long and happy future ahead of it, though). We're back to wanting to both have and eat the cake: Monty seems to want the EC to force Oracle to divest itself of Mysql or impose various restrictions on its development. If he had imposed those conditions on Sun when that sale was made, they might not have done the deal, or placed a smaller value on it. He didn't, but now he is back and trying to impose them on a deal in which he is not a participant (although I suppose he may have some Sun shares). That doesn't strike me as being entirely fair: if he really wanted to ensure the future of Mysql, he would not have sold the company. In terms of open source, keep in mind that Mysql was not released under the GPL until 2001: http://www.mysql.com/news-and-events/generate-article.php?id=23 For many years it was under a "sort of open" license that was not proper open source. Then there's the Richard Stallman angle: that somehow, Mysql "deserves" to have developers funded to work on it. I don't buy that, either. Mysql is a nice project, but I don't think that there's any moral imperative that the government should step in and fund some open source projects. Should the EC step in and say that Oracle should also fund Postgres development while they're at it? There are plenty of deserving projects that could use some cash to fund their development. For instance, my friend Salvatore is looking for donations for Redis development. It's not as big or "important" a project as Mysql, but it's good code and already being taken up by various companies. For that matter, I'd like to keep working on Hecl full time. In short: I hope that the EC approves the sale "as-is". I also hope that Oracle continues to take good care of Mysql, but if they don't, that is ultimately their decision as long as there remain plenty of competitors in the market. I think that our time as "the open source community" is better spent fighting for more important things: against bad software patents, for open standards in governments, and that sort of thing, that will benefit everyone, rather than trying to wrest control of Monty's code back from Oracle after he's already been paid handsomely for it.

Clint Adams: Sanjana Kumar goes to the movies

I have an imaginary automobile. It is the finest hybrid of German and Japanese engineering. It has a peppy little engine and a turning radius so small it would make a baby camel cry, and a six-speed manual transmission, and it is powered by the urine of vegan bears. My imaginary father asked me why I would possibly want to buy an imaginary car with a manual transmission. Obviously, whichever marketing campaign brainwashed him in the first place wasn't strong enough on the memetics, because after borrowing my imaginary car, he shut the hell up. You see, it's considerably more fun to drive than an automatic. There are other benefits as well, of course. The primary one is that the transmission does what I want. An automatic transmission is configured for maximum comfort , so it wastes a lot of power when shifting. With a manual, you can slip from gear to gear with minimal clutch time, or in some cases, if you're feeling sassy, without using the clutch at all. You can control your engine speed so that your shift will be just as smooth as an automatic without the egregiously long clutch disengagement or shift overlap. You also can see the road in front of you, so you're always going to be smarter than an automatic transmission, unless you don't understand how slopes work or what collisions with other cars mean to your well-being. Now some NRA member is going to point out that you can get a shift kit and tweak your automatic to be less awful. While spending money on this type of thing sounds like a great idea, a shift kit is not going to bring an automatic into the same league as my car. I can still start the car when the battery's dead. I can get higher fuel efficiency (vegan bears don't exactly urinate for free). I can shift into fifth gear, and coming from a full stop, drive up a hill without stalling (this is particularly useful when a squirrel has gnawed the teeth off of all your other gears). Furthermore, shift kit or not, an automatic is absolutely no fun. Someday, when transmissions have advanced into the realm of liquid hyperspace buckminsterfullerene cones that commune with the unicorns, and they'll have cameras and radar feeding the car's computer with useful information about its surroundings so it can make intelligent shift decisions faster than a human. Then I'll have to choose between saner and more fun. That era has not yet arrived. This is a lousy metaphor for debhelper.

12 December 2009

Daniel Kahn Gillmor: dealing with entropy on a virtual machine

I've been using virtual machines (KVM, these days) as isolated environments to do things like build packages as root. Unfortunately, some of these activities require decent-sized chunks of random data (pulled from /dev/random). But /dev/random pulls from the kernel's entropy pool, which in turn is replenished from "hardware" events. But a virtual machine has no actual hardware, and if it is only doing isolated package builds, there is very little activity to feed the kernel's entropy pool. So the builds and test suites that rely on this randomness all hang for a long long time. :( My current way to get around this is to replace /dev/random with the /dev/urandom device, which does not block if the entropy pool is depleted:
mknod /dev/newrandom c 1 9
chmod --reference=/dev/random /dev/newrandom
mv -f /dev/newrandom /dev/random
This has the consequence that the "randomness" these commands use doesn't have as much "real" entropy, though some operating systems (like FreeBSD) have a non-blocking /dev/random by default (and it's also questionable what "real" entropy means for a virtual machine in the first place). I'm also using cowbuilder within these VMs to do package builds. But cowbuilder has its own /dev tree, with its own device nodes, so this needs to be fixed too. So after you have successfully done cowbuilder --create, you need to modify the random device within the cowbuilder chroot:
mknod /var/cache/pbuilder/base.cow/dev/newrandom c 1 9
chmod --reference=/var/cache/pbuilder/base.cow/dev/random /var/cache/pbuilder/base.cow/dev/newrandom
mv -f /var/cache/pbuilder/base.cow/dev/newrandom /var/cache/pbuilder/base.cow/dev/random
Hopefully this will be useful for other people using cowbuilder (or other build strategies) on isolated virtual machines. If you've worked around this problem in other ways (or if there's a security concern about this approach), i'd be happy to hear about the details.

David Paleino: wicd_1.6.2.2-5~exp1_i386.changes is NEW

Why is wicd NEW? Simple, I managed to split the files into separate packages. As soon as it clears NEW, those who are using experimental will be able to install a cli-only wicd, i.e. no more unnecessary throwing in of GTK+ and X Smile I will make a call for testing as soon as this package clears the queue. Hope I didn't make too much mistakes Wink

Russell Coker: US Border Security

Making Light has a post about the Canadian sci-fi author Peter Watts who was beaten and jailed overnight without access to a lawyer by US border guards because he asked what they were doing [1]. Apparently one is supposed to cringe in fear whenever questioned by authority in the US, so much for land of the free . In 12 hours time I will hopefully have got past the security police and be boarding a flight out of the US and it will be a great relief. On a practical note, if al Quaeda was a serious threat, if anyone really cared to stop the importation of drugs, of if any of the other reasons for having security on borders were taken seriously then this sort of thing really wouldn t help to achieve such goals. One of the purposes of a justice system is to encourage cooperation from the population. If a suspect will be treated fairly and considered to be innocent until proven guilty then there is no reason not to report suspicious people to the police. If however a suspect will be summarily beaten and denied access to a lawyer then no decent person can make a police report unless they are certain of the suspect s guilt beyond all reasonable doubt. When Barack Obama was elected the majority of the world s population was greatly relieved, we expected some significant changes in the way things are run. It doesn t seem that he is living up to our expectations.

Russ Allbery: Peter Watts attacked by US border guards

Signal boost. While returning from a trip to the US (in other words, going to Canada) on December 8th, Canadian SF author Peter Watts was attacked, beaten, pepper-sprayed, and imprisoned without access to legal counsel by the US Border Patrol. See also his post on the subject. The government's case has obviously not yet been presented. However, given the past behavior of the US Department of Homeland Security, I find Watts's description of the event entirely credible. This is an outrage. This is the kind of thing that happens in third-world dictatorships. See also Making Light and Boing Boing. John Scalzi's post has information on how to donate money to Watts to get through this legal fight. I will be giving him money. I also plan on calling my US Representative and Senators when I'm no longer at work, as this sort of treatment of a Canadian citizen warrants a Congressional investigation and heads rolling, not only at the agent level but at the Homeland Security management level. Even apart from basic questions of human rights, Homeland Security is going to systematically destroy the tourist industry in the United States if this sort of behavior is not stomped on immediately and severely. There are border patrol guards who are probably still on duty today who are common criminals and belong in prison for assault. ETA: The government's side of the story. This is pretty much what I expected, and with the data available so far, I feel confirmed in my initial reaction. This level of force is completely disproportional and flatly unacceptable short of Watts pulling a weapon on the agents, which they are not claiming that he did and which therefore he clearly didn't do. I'm highly skeptical of this supposed "choking" of a police officer after they pepper-sprayed him. This reads like the standard cover-your-ass charges filed by the police after they beat someone up. Once they've provoked the struggle by grabbing you and have done something as painful and disorienting as pepper-spraying you, chances are you're going to physically react in ways that they can conveniently misinterpret and use as the basis for charges. People elsewhere have pointed out that contacting Congressional representatives is probably better done Monday morning since nothing will happen during the weekend.

Next.

Previous.