I have been interviewed on Debian and OSS in general for the Vertical Viewpoints series of the CALIBRE project. The interview lasted for almost three hours and the interviewer did a really good job at condensing everything I said down to five pages. Regardless, it seems somewhat patchy and gives the impression that I am jumping between topics. The audience is the industry though, they must be used to that. NP: Man on Fire / The Undefined Design

I am working on a script to help me switch mail profiles from within vim, because mutt's profile abilities are seriously limited (even with muttprofile). The script will have three modes: manual, menu, and auto. In manual mode, you tell it something like switch-profile debian and it converts an existing mail to use my Debian profile. In menu mode, it displays a menu of available profiles, and in auto mode uses heuristics defined by the profiles to determine which one to use. My problem at the moment is menu mode. What I want is a good selection interface that (a) works over most any terminal, and (b) allows quick and dependable keyboard-driven selection. So far, I've had multiple ideas:

1. A simple shell script that would assign [0-9a-z] to the profiles and then expect me to press one of the letters to select the profile I want (also see ssft). I don't particularly like this because if I added a profile to the presumably alphabetically sorted list, I'd have to relearn which keys to press when doing quick (subconscious) selection.
2. debconf, which comes with multiple interfaces, but doesn't really seem made for the task. In the end, it would probably end up giving the same experience as (1) above.
3. A method which I've implemented in the script (run it with the --menu option), which is reminiscent of "autocomplete". I need to add arrow selection and I have to figure out how to actually access $result from outside the while loop (this method doesn't work, because I need stdout for the interface and I have not managed to figure out using file descriptors 3 and above), but I already like it very much, although it seems rather brittle so far.

Do you have any other ideas? Or do you know of a tool/library I could use for this? I'd much rather have this work without having to install a separate package, but there's also no point in reinventing the wheel. PS: I am using POSIX shell for this even though Perl or Python would be much better suited, simply because it's faster and available everywhere. NP: Man on Fire / Habitat Update: Jan Hudec points me to Vim's console-menus and now makes me ponder whether I want a vim-only solution, or one that could be used by friends of other editors too. And Simon Huggins is trying to get me to use htag, which I'll have to check out.

I restarted my laptop last night only to discover that I could not piece together the password I used to encrypt my harddisk, and it did not help that I knew it was pwgen-generated (a sequence of random digits or letters which try to be "pronouncable"). I had left my palm pilot with the password database at home, and the emergency key I created for such cases was on a USB medium with a read error. I beat my head on the table and tried and tried and tried, but to no avail. So I started pondering how to convince my friend Hanspeter to walk to my flat again and help me out, having resigned myself to the idea that I'd have to do more reading tomorrow (today) at the office. As it turned out, Hanspeter would stay at my flat that night anyway and switched on my machine at home to allow me to fetch the emergency key. But I didn't end up needing it. I slept and dreamt and suddenly had some sort of a nightmare in which a string of letters came haunting me, tormenting my consciousness in much the same way that the Guitar Hero notes come flying at you. I woke up and had ten characters in my head, and I was confused. It took me at least two minutes to remember that I had been scrambling for the harddrive password, and when I figured it out, I wasn't surprised that the string I dreamt would decrypt my drive. I really should gain some distance to these frickin' computers! NP: Man on Fire / Habitat

Nori points me to this article by Bruce Schneier, which seems like good news for me. Does it mean I'll be able to visit the US again sometime in the future? I don't think so; travel to the US is among the most unattractive things I can currently think of. I might reconsider when the US stops treating visitors like terrorists, taking their fingerprints and requiring so-called "Passenger Name Records" to be made available by the airline companies transporting passengers into the US, with the sole purpose to build a criminal file for everyone entering the country, just in case they become a threat to national security or an obstacle in the path of the neo-conservatives to forge ahead. In addition, I'd fear for my laptop, which US immigration officers can now seize without reasons and scrutinise; I do not own a laptop because I can do without one for weeks on end. Furthermore, all my data are encrypted for good reasons. As the old saying goes: "only the guilty have something to hide", I'd surely make it into their prisons as a suspected terrorist (which has happened to people before). What the US doesn't understand is that even though I may be guilty and therefore hiding something, it doesn't mean I am hiding it from them. So no, I don't think I'll enter the US anytime soon. NP: I Love You but I've Chosen Darkness / Fear Is on Our Side

After an amazingly stressless journey [0], I've arrived yesterday evening in Limerick and met Daren and Mel, two alumni of UL who let me move into a spare room in the house they're renting. To be exact, Mel actually lives next door, but who cares about details. After a bit of unpacking, we headed for the pub and returned for an extensive session of Guitar Hero on the Playstation II, which is a truly fun and excellent game.

[0]

I brought my bike along, for transport and exploring. This involved packing a bit of extra stuff, borrowing a friend's Tranzbag, arriving early at the airport to get it boxed to ensure a safer journey, picking it up in Dublin, and somehow getting it to Limerick, where I'd have to reassemble it. I wasn't really looking forward to the trip. It turned out to be stressless, as I said. The boxing cost me 10 Franks at the airport and was completed in less than 5 minutes, nobody at the check-in counter said anything, as if it was the most normal thing for them to check in bikes, some dude retrieved the box in Dublin and placed it on my cart, and while I was waiting, I found out that I wouldn't have to hop on a coach (bus) to go to the Dublin train station, catch a train to Limerick, and then finish the last mile in a taxi: a bus operates fairly regularly directly from Dublin airport to Limerick, taking four hours for the journey. That's about how long it would have taken me via the train station, but I only had to pay 19 the train itself would have been 25 , plus the taxi charges. The coach driver was curious when he saw the box, but I didn't have to pay extra, and after watching Airport on my laptop and listening to the new Katatonia album, I found myself with my bag and the bike next to the university's main entrance, with Mel and Daren on the way to pick me up. Five minutes later, I was in my home-to-be-for-five-weeks.

I dropped into bed at around 4am and promptly overslept the next morning, then decided to use the day for errands, hitched a ride from Laura (the stressed-out Skynet president and Skycon organiser) to an excellent nearby bike store where I reassembled the bike, got myself a lock (see below) and a mud guard for the front wheel, then headed off for the campus bank to open an account, rode back and forth between the Lero building and the bank to satisfy their bureaucratic thirsts and finally obtained the details for my very own Irish bank account. And I squeezed a bit of grocery shopping in between. Meeting Brian (my supervisor) in the hallway, we agreed on a meeting on Monday, so the remainder of this week is for finishing the various proposals and papers on my to-do list, preparing for the meeting by getting back to speed with my research, as well as getting to know the local party crowd exams are about to end in Limerick and I've been told to have picked quite an excellent time of year for my visit because the university will become a mad house this weekend. We'll see how compatible those tasks are, but boy am I glad that I am not living anywhere near the student villages, or as I put it last night: I don't mind going to parties, but if the party comes to where I am, I'd rather not have it be every night. So this would bring me to the title of this post: stuff that I forgot to pack:

• A second sweater, it's pretty cold here and I don't want to be wearing the same sweater every day (even though it's merino wool and thus woudn't start to smell).
• A pair of windcheater gloves, the thin wool ones I have aren't exactly made for cycling.
• Rain trousers to wear over my regular pants. It's raining and wet and the light colours of the pants I am wearing are a high-contrast basis for the mud.
• My bike's lock key. Fortunately I left it unlocked, but still had to go out and buy a new lock (which was more painless than having the key sent here).
• Comfy sneakers for home use, as it's too cold to just be wearing socks.

Due to popular request, I shall be back here with pictures of my surroundings one of these days. NP: I Love You but I've Chosen Darkness / Fear Is on Our Side

The wait for Debian sarge was long and painful for me, because I was trying hard to synchronise the publication of my Debian book with it, and much to my own surprise, the book was done before sarge was ready, and I had to wait. In the end, the tome left the presses only a little more than 24 hours after our release managers announced Debian 3.1 in July 2005, bundled with the second release of the official DVD, 3.1r0a. Since then, the volume has been reviewed numerous times and praised by many readers. I was especially honoured to find the title in the top ten list of most favourably reviewed books by one of my most respected reviewers, Richard Bejtlich. We are now approaching the release of Debian etch, version number 4.0, and a lot of stuff has been added or changed in Debian. I have received more than 150 emails since the etch freeze announcement, asking about an updated edition for etch, and while I am most gratious for all the feedback (and can't deny a certain amount of pride), I have to disappoint my readers, at least for now. I have not had the time to update my text, and thus cannot synchronise a new edition with the release of etch. There are a number of reasons: first, shortly after the publication of the original edition, I suffered from several physical problems, which in the end all pointed to severe muscle deformations in my back from years of wrong posture sitting at the desk. Now, one and a half years after the first symptoms appeared, I've been through numerous therapies and even though the net result is positive, I am not over the problems yet. Thus, I still try to minimise the time spent on a computer, and getting a second edition of the book out would achieve quite the opposite. Second, I am busy with my Ph.D. research, so I cannot work on the book much. It has been suggested to me to allocate minimal resources to an update, getting the text ready for etch and postponing new content to another edition. However, I would feel uncomfortable doing that. On the one hand, I'd much rather see my work be relicenced under a Creative Commons licence. So long as that is not possible, I'd rather not make people spend money without getting much in return. My book's to-do list is growing and there are many new topics which I would like to cover in the next edition (for instance: fonts, xen, more packaging topics, including modules, kernel patches, pbuilder, and packaging with version control systems). Thus, with the release of a new edition, I want to provide not only an updated version, but also one with enough content to give a fair return for people's money. I have always thought that updated-but-no-new-content editions are ripping the customers off, so I don't want to go into that direction. I am thus currently looking at the relase of the second edition together with Debian lenny, the Debian release following etch. I am looking forward to much more feedback between now and then. NP: Solar Project / Force Majeure

If you like the mutt email client and have to use Mozilla Firefox, you might like to be able to click mailto: links and have mutt handle them. There are various extensions that promise to take care of this, but none of them worked for me. So I wrote a little script to handle the interfacing. Instructions how to tie it in with Firefox are included in the header comments. Enjoy! Comments, patches, and suggestions welcome. NP: Dream Theater / Awake Update: thanks to the suggestion by Nelson A. de Oliveira, the script now supports the setting of arbitrary headers, including In-Reply-To. This means you can now use it to answer list mail from the Debian list archive pages (but see #406866 and #406867).

Dear lazyweb: for an internal resource, we are currently using IP-based access control, based on the fact that the data themself are not sensitive, but still must not be accessible to everyone. We are experiencing more and more of a problem with people working from home, from dynamic IPs, and yet, I cannot come up with a good authentication scheme. The resource contains large files and it's accessed concurrently by many users. Thus, SSL-tunneling to protect the basic HTTP user:pass combination is not really an option. Also, I would prefer if people couldn't share passwords. I've looked into client certificates, which are supported by most browsers; the trouble here is that we need to access the resource also with applications not supporting client certificates. So in the end, I am back to IP-based authentication and now looking for a web login tool that can verify user credentials against a flat file, database, or even PAM, and update the .htaccess file accordingly. This way, users could share passwords, but a password would only ever authenticate an IP, not the content. Do you know of such web login tools, which are not written in PHP? NP: No-Man / Flowermouth Update: Ronny Adsetts suggests the use of VPN. That is an option, but again, it sort of requires encryption (or at least tunneling) of large quantities of data, for which we don't have the hardware.

Especially on IRC, I am often faced with the task to share a file with someone. There are pastebins, but they don't help with binary files, quick updates, or sharing directories. Over the past year, I thus developed the pub shell script, which you can obtain from my SVN repository (you can check out the parent directory with several other helpers, or all my non-admin shell scripts). I documented it in the header, so if I excited your interest, have a look there for details. pub requires an SSH-accessible machine with a directory to which you can write, and which is exported via HTTP or FTP (it would be nice to support WebDAV in the future). In my case, that's madduck@scratch.madduck.net:/srv/apache2/stuff.madduck.net/htdocs/scratch, which is available as http://scratch.madduck.net/. Thus, I created ~/.pubrc with the following contents:

TARGETHOST="madduck@scratch"
TARGETDIR="/srv/apache2/stuff.madduck.net/htdocs/scratch"
PUBBASE="http://scratch.madduck.net/"

Here's what I can do now (lines are truncated after 80 characters):

## publish a simple file
$ pub /etc/fstab
http://scratch.madduck.net/__etc__fstab 1446 885c2219df938a059a5f0a13e65e8f9
## ... with optional verification by downloading and comparing md5sums
$ pub --verify /etc/fstab
http://scratch.madduck.net/__etc__fstab 1446 885c2219df938a059a5f0a13e65e8f9
I: successfully uploaded: /etc/fstab
$ HEAD http://scratch.madduck.net/__etc__fstab   head -1
200 OK
## remove the published file
$ pub --delete --verify /etc/fstab
I: successfully deleted: /etc/fstab
$ HEAD http://scratch.madduck.net/__etc__fstab   head -1
403 Forbidden
## bzip2 the file while publishing
$ pub --bzip2 /etc/fstab
http://scratch.madduck.net/__etc__fstab.bz2 501 16e3b533f6588b670c75160dce1f
$ pub --bzip2 --delete /etc/fstab
## same with gzip
$ pub --gzip /etc/fstab
http://scratch.madduck.net/__etc__fstab.gz 423 ea28b1fc537690a0344b74ad2f2d7
$ pub --gzip --delete /etc/fstab
## sometimes I don't want the filename to be guessable:
$ pub --obscure /etc/fstab
http://scratch.madduck.net/__etc__fstab__7eb7d8881a02e47e2906131dec256115 14
$ pub --obscure --delete /etc/fstab
## and this even works with extensions, properly:
$ pub --obscure /etc/a2ps.cfg
http://scratch.madduck.net/__etc__a2ps.9b411100f9d144d090d540c9879dd26b.cfg
$ pub --obscure --delete /etc/a2ps.cfg
## and finally: directories:
$ pub --bzip2 /etc/init.d
http://scratch.madduck.net/__etc__init.d.tar.bz2 59758 1f94314ff9fd472f28172
$ pub --bzip2 --delete /etc/init.d

You'll see how the name is chosen: __etc__fstab. If you're publishing a file from underneath $HOME, the base is truncated:

$ pub ~/debian/misc/security/debsec.zuml
http://scratch.madduck.net/debian__misc__security__debsec.zuml 14366 537b7f7

Of course, all of the above take an arbitrary number of arguments:

$ pub /etc/fstab /does/not/exist /etc/init.d
W: skipping nonexistent file: /does/not/exist
http://scratch.madduck.net/__etc__init.d.tar 337920 c350629b859e1369ed29a98c
http://scratch.madduck.net/__etc__fstab 1446 885c2219df938a059a5f0a13e65e8f9
$ pub -d /etc/fstab /does/not/exist /etc/init.d
W: skipping nonexistent file: /does/not/exist

Over time, the scratch space will fill up. Thus, I am using tmpreaper to delete files which have not been accessed in 30 days. The script in use, as well as the files that givern the way the HTTP server presents the scratch space, are available in this SVN repository. I hope this tool will be useful to some, and I am looking forward to patches and suggestions! NP: No-Man / Returning Jesus

Just now on the Swiss hotline, a lady announced in the typical Swiss way of speaking "high German" that the airline now offers bla bla bla to over 200 "Destinationen". I had to snicker. English readers may wonder what the deal is, and even Germans might just yawn: "Destinationen" is not a German word, it's "destinations" germanified, and it's no news that the German language is seriously deteriorating as English words are creeping in. At the risk of being repetitive: it's not the English words per se, it's the fact that they are being conjugated or declinated according to German rules, which irritates me (and many others). The reason for this blog post was simply the humour: a Swiss lady speaking "high German" with her subtle Swiss accent, using words that don't exist as if there was nothing to it. I actually had to laugh out loud. Note that I have great respect for Swiss people speaking German, it being somewhat of a foreign language to them. I am perfectly aware that many are uncomfortable doing so, and this post is not trying to make fun of them, but rather expose the irony of the use of a non-German word. NP: Dream Theater / When Dream and Day Reunite Update: Christof Roduner informs me that "Destinationen" is actually a German word, or at least recognised by the Duden:

De s ti na ti on, die; -, -en <lat.> (Reiseziel; veraltet f r
Bestimmung, Endzweck)
Aus: Duden - Die deutsche Rechtschreibung, 24. Aufl. Mannheim 2006.

That must be the new orthography, which I won't comment on at this point.

To Kill a Mockingbird is in the ImDB Top 50 charts, and even though I've never been much of a charts person, I found them to be strangely accurate and have more than merely enjoyed each of the movies ranked 8 or above by the visitors of the site, with the exception of the fantasy and some of the science fiction movies those are just not my thing. I've owned the Mockinbird movie for quite a while but it's been until tonight that I haven't watched it. Whenever I took it out, I dismissed it as being too serious, as yet another movie that dealt with the topic of the inhuman treating of negroes in America, and similar to movies depicting Third Reich Germany, I've reached the point of saturation fairly soon, having seen The Shawshank Redemption, Mississippi Burning, and Malcolm X and many others. To Kill a Mockingbird was somewhat different in that its main focus is the relationship between the defendant's lawyer Atticus and his children, Jem and Scout. Especially Scout, the daughter, played by Mary Badham (who was to become to youngest nominee for the Best Supporting Actress award) displays a character that got right to my heart, but this is not to discredit Gregory Peck, who plays Atticus, and Robert Mulligan's directing, or most any of the other actors involved. I feel unable to write about the film, unable to find the right words. This is not to say that I am too moved by it, but simply because I wouldn't be able to describe the sheer beauty I found during the two hours it lasted. Definitely recommended. NP: Yue / ZKM Improv, 2006-04-29

I've been away from Zurich for a while, and one of the things I missed the most was my favourite cinema. So last night, I didn't need my arm twisted much (by Hanspeter) to go and see the Danish film Adam's Apples (warning: Flash content). Imagine a church community made up of four people: Ivan, the reverend, who lives Jesus' philosophy to offer the other cheek when slapped on one. Ivan is father to Christoffer, a spastic-retard, and widow to his late wife, who killed herself not being able to handle the retardation of their child. Ivan, of course, denies all this and treats Christoffer like a regular, jovial and energetic child, and lulls over the loss of his wife in an accident. If someone get too close to Ivan, he'll bleed from his ear. Ivan is played by Mads Mikkelsen, who also plays Le Chiffre in the latest Bond movie "Casino Royale" (which I'll cover in another post). Then there's Sarah, a dosser who got off with a man she didn't know or love and now expects a child. Because of her drinking problem, the child is said to have a 40% chance of being disabled. She cannot handle it and runs to Ivan for advice. Khalid is a Saudi who's on parole at the church after plenty of armed robberies of Statoil stations as part of his mission to destroy the Statoil empire. He speaks broken Danish (wonderfully translated in the subtitles), seems extreme at most of his actions, but all he really wants it is to return to Saudi Arabia. He's been at the church way longer than his parole, saving money but also just enjoying the innocence. Gunnar is a massively obese ex-tennis player who turned to overeating and alcohol after a ball of his was wrongfully judged to be out, causing him to lose an important game. He's at the church on parole for small-scale thievery and plays a role somewhat reminiscent of Lenny in "Of Mice and Men:" stupid but kind. He is also way beyond the end of his parole. There's also a doctor who seems to be the only one with a firm grasp of reality, but his sarcasm overshadows that completely. One day, Adam arrives. Adam's a misanthropic neo-nazi on parole, sent to the church to be cured. Adam calls himself evil and seems to be just that: he cannot deal with niceness, especially not the straioght-up, disarming kind displayed by Ivan in fact, he's the kind of guy who'd slap the other cheek even if not offered. Adam's task is to care for the apple tree (which is everyone's pride) and bake a cake from the harvest. As the story develops, Adam's fight against Ivan's benevolence reaches hilarious heights as the characters seem to exchange exactly those sentences that the other didn't want to hear. When later a group of neo-nazis join the battle, as well as what would have to be called God, everyone (characters and movie-goers) are left wondering who's after whom, and sundry other questions on morale. The film was once again a great display of Scandinavian cinematography, which I've grown to like a lot over the years of being a regular at this cinema. Despite the somewhat flat story and the surreal element of God in one scene (and only one), I can hartily recommend it. The actors are doing an amazing job, and in the end, the movie is primarily funny, not because of jokes or forced humour, but because of the dryness and darkness of what's happening between what seems to be average people like you and me on the screen. NP: The Flower Kings / Paradox Hotel

There once was a credit card number tied to a name and when it was abused, the credit card company decided to tie it to an expiration date. It didn't take long until gifted hackers found out that twelve months and an average life cycle length of two years required them to check each credit card number against the 24 possible expiration date month-year pairs, so the credit card companies also required the billing address to match (at least fuzzily). Unfortunately, many of the companies accepting and storing credit card data are run by clueless people and the data sets of names, numbers, expiration dates, and billing addresses leaked, causing even more organised abuse. The credit card companies did not like that and proceeded to invest tiny amounts of additional energy and manpower into improving the status quo. So then, one day, in the dungeons of the credit card company offices, a bright young graduate from one of the American elite colleges yelled "heureka" [*] and outlined how to secure credit cards with the "credit card verification code" (CVC), printed on the back of each card printed, not stamped like the number. Maybe his/her theory was that the stamped number could be read from both sides, so a printed CVC would only be readable from one side of the card, bringing instantaneous 200% security increase. Maybe it was some other theory. In any case, the companies readily adopted the CVC and by today, every web form will ask you to also enter the CVC. They'll probably store and leak it too. What's next? Credit card colour?

[*]	"Heureka" is Greek for "this bath is too hot" [Dr. Who].

NP: OSI / Free Update: Andrew Pollock points me to the Wikipedia article on CVC as good reading. Indeed, the article explains security benefits in face-to-face transactions and in the socalled "card not present" situations, like ordering over the Internet. Apparently the CVC must not be stored, so in some ways they have learnt from the past. I know of at least one merchant in the US who stores the CVC in my profile though. Update: Mark Brown adds: "The CVC is being used because it defeats attacks like taking a photo of a card with a mobile phone: it makes it usefully harder (not impossible) for people to transparently clone cards." This squares with the Wikipedia article.

I've been away from this blog for a long time, and I have a bad conscience, having promised Laura, the Skynet president, that I would spread the word about the conference Skynet is organising: Skycon. The conference will take place at the University of Limerick on the weekend of 16-18 February 2007. I am going to be there, and so will a few vastly more important people, including at least one other Debian(-related) person. I haven't yet decided how to contribute to the programme (I know, Laura; sorry!), but the choice is between an overview of what's new in Debian etch, our forthcoming (slightly-delayed) next stable release, or an introduction into my Ph.D. research. I am leaning towards the former, but I'd really prefer to have etch out when I give such a talk, and of that we cannot be sure until it's ready. Anyway, it looks like a good event, and having met many of the Skynet folks, I am convinced it'll be successful. I am not sure how accomodation is handled, but if you're wanting to come to this conference, give me a shout. First, I can probably offer floor space (subject to approval by my landlady), and I can definitely offer advice on how to best get to Limerick. Update: The #skycon channel has been set up on irc.freenode.org to support the conference. NP: Opeth / Blackwater Park

Well ahead of time, I overcame my undefined difficulty and pressed the button, which caused Lufthansa to confirm the following schedule:

Fr  8 Jun 13:40 Z rich    14:40 Frankfurt LH3727 4h50 Economy Basic (W)
Fr  8 Jun 16:35 Frankfurt 17:30 Edinburgh LH4942      Economy Basic (W)
Mo 25 Jun 13:45 Edinburgh 16:40 Frankfurt LH4941 4h45 Economy Basic (Q)
Mo 25 Jun 18:35 Frankfurt 19:30 Z rich    LH3734      Economy Basic (Q)

I am paying slightly more for this flight than with the cheap airlines, but it's also the least time-intensive version. Alternatives started at 6.5 lay-overs at Luton, a night at Birmingham, or a three hour train ride to Friedrichshafen to catch a flight to Glasgow, from where I'd have to hop on another railway. Looking forward to Debconf7! My paper submission is forthcoming. NP: Opeth / Ghost Reveries