Search Results: "jan"

16 January 2012

Michal Čihař: Fixup of historical data

This blog consists not only of posts created in it, but also older posts written elsewhere. The vast majority of them comes from older blog engine I used here (Nanoblogger), but almost same amount are posts written in Czech originally posted on abclinuxu.cz. It turned out that when I was doing import of those, I somehow forgot (or rather did not care) to fix links between them and links to rest of abclinuxu.cz website. With few lines script and huge help of BeautifulSoup these should be now fixed. So you can properly navigate over almost seven years of my blogging history. While looking at other failing URLs here, I've also added number of redirects, so that most people end up on pages where they expect :-).

Filed under: Django English Website 0 comments Flattr this!

Michal Čihař: Fixup of historical data

This blog consists not only of posts created in it, but also older posts written elsewhere. The vast majority of them comes from older blog engine I used here (Nanoblogger), but almost same amount are posts written in Czech originally posted on abclinuxu.cz. It turned out that when I was doing import of those, I somehow forgot (or rather did not care) to fix links between them and links to rest of abclinuxu.cz website. With few lines script and huge help of BeautifulSoup these should be now fixed. So you can properly navigate over almost seven years of my blogging history. While looking at other failing URLs here, I've also added number of redirects, so that most people end up on pages where they expect :-).

Filed under: Django English Website 0 comments Flattr this!

Benjamin Mako Hill: Mystery Hunt

I've mentioned before that I compete every year in the MIT Mystery Hunt -- an enormous, multi-day, round-the-clock puzzle competition held in January at MIT each year. Last year, my team Codex won the hunt. The reward (punishment?) for winning is the responsibility to write the 100+ puzzles, (and meta-puzzles, and meta-meta-puzzles, and theme, and events) and to put on the whole event the following year. So over the last year, I've worked with a huge group of folks to put together this year's hunt which had a theme loosely based on The Producers. My own role was small compared to many of my teammates: I contributed to some puzzle writing and to a bunch of "test-solving" of candidate puzzles to make sure they were solvable, not too easy, fun, and well constructed. During the hunt, I visited competing teams, verified answer submissions, and took advantage of my jet-lag from my return from Japan on the day of the hunt to work the night shift distributing items to teams. To get an idea of what the hunt is like, you can check out a puzzle I wrote for this years hunt. The solution is linked from the corner of that page.

14 January 2012

Ben Hutchings: Installing Debian GNU/Linux and Windows dual-boot under UEFI

I thought it was about time to get a faster machine for... well, mostly for compiling kernels faster, but I'm sure I will find other applications for it. I was originally intending to upgrade my laptop (Thinkpad T61, 1.8 GHz Core 2 Duo) but it seems that in the 3 years since I bought it second-hand laptop prices have not dropped in line with Moore's law. So instead I decided to upgrade (well, replace most of) a desktop PC. The last time I got a new desktop at home was in 2002. It has an Athlon XP, PATA drives and a huge CRT monitor. It has had some upgrades since then (DVD writer, more RAM, slightly faster CPU, replacement fan and PSU). Obviously it was time to replace motherboard, CPU and RAM. Not so obviously, the PSU needed changing again as modern CPUs apparently need more 12V electrons (?!). The DVD writer was salvageable via a USB adapter and its local HD is currently a laptop drive (the only spare SATA HD I had). The monitor is of course reusable, though the firmware setup program doesn't entirely agree with it. Windows Yes, I do sometimes run Windows. It's for games, and also seems to be needed for streaming video with stupid DRM. On the assumption that Windows is less likely to play nice with an existing installation, I tried installing it first. The firmware appear to allow me to boot the DVD in either BIOS or UEFI mode, so I selected the UEFI option. This worked so far as loading the initramfs (or whatever the Windows equivalent is) but then Windows was lacking a driver to access the DVD. This stumped me for a day or so until I realised I had plugged the drive into a USB 3 (XHCI) port. Apparently Windows 7 SP1 still doesn't include an XHCI driver in the installer (but neither does Debian 6.0.3 - we should fix that). The installation was mostly uneventful after this. The Windows installer includes a reasonably capable partition editor. Debian Installation of files was entirely uneventful. The installer correctly detected the GPT (GUID partition table) created by Windows. However, it was not able to install a boot loader. Currently it only includes support for the LILO and GRUB-PC boot loaders that run under BIOS. After much experimentation and cursing, I found instructions for installing Debian Squeeze on XServe 3.1 by Jan Peter Alexander Rajagukguk, which put me on the right track. It seems that the grub-install script for GRUB-EFI in squeeze (and maybe other parts of the package) doesn't actually work. However. JP's direction to build GRUB from source is no longer necessary. Here's what I did (minus the mis-steps):
  1. Boot the installer in rescue mode and open a shell on the installed system: 
    # # We start in dash, so switch to bash.
# exec bash
# mkdir -p /boot/efi
# # Mount the EFI boot partition by UUID.
# # It's probably called sda1 now, but is subject to change.
# ls -l /dev/disk/by-uuid
...
# echo >>/etc/fstab 'UUID=efi-boot-uuid /boot/efi vfat defaults 0 0'
# mount /boot/efi
# # Enable unstable sources, but use stable by default
# echo >>/etc/apt/apt.conf 'APT::Default-Release "squeeze";'
# echo >>/etc/apt/sources.list 'deb http://cdn.debian.net/debian/ sid main'
# apt-get update
...
# # Install unstable grub-efi-amd64
# apt-get install -t unstable grub-efi-amd64
...
# # Install GRUB to the EFI partition.  The '--removable' options
# # inhibits setting EFI variables, which won't work because we booted
# # through BIOS emulation.  Instead, it installs as the default boot
# # loader.
# grub-install --bootloader-id=GRUB --removable
# # On the AMI/ASUS firmware, you cannot select a new bootloader
# # directly but can invoke a 'shell'.  So I made GRUB the shell:
# cp /boot/efi/boot/grub/grub.efi /boot/efi/shellx64.efi
# exit
  2. Reboot and select GRUB as the boot loader if necessary. In my case I had to enter the setup program and select 'EFI shell'. Debian should now boot from the hard drive.
  3. Add a non-volatile boot option for GRUB (and make it the default): 
    # apt-get install efibootmgr
...
# modprobe efivars
# efibootmgr -c -l '\efi\grub\grubx64.efi' -L GRUB

Francois Marier: Debugging OpenWRT routers by shipping logs to a remote syslog server

Trying to debug problems with consumer-grade routers is notoriously difficult due to a lack of decent debugging information. It's quite hard to know what's going on without at least a few good error messages.

Here is how I made my OpenWRT-based Gargoyle router send its log messages to a network server running rsyslog.

Server ConfigurationGiven that the router (192.168.1.1) will be sending its log messages on UDP port 514, I started by opening that port in my firewall:
iptables -A INPUT -s 192.168.1.1 -p udp --dport 514 -j ACCEPT
Then I enabled the UDP module for rsyslog and redirected messages to a separate log file (so that it doesn't fill up /var/log/syslog) by putting the following (a modified version of these instructions) in /etc/rsyslog.d/10-gargoyle-router.conf:
$ModLoad imudp
$UDPServerRun 514
:fromhost-ip, isequal, "192.168.1.1" /var/log/gargoyle-router.log
& ~
The name of the file is important because this configuration snipet needs to be loaded before the directive which writes to /var/log/syslog for the discard statement (the "& ~" line) to work correctly.

Router ConfigurationFinally, I followed the instructions on the Gargoyle wiki to get the router to forward its log messages to my server (192.168.1.2).

After logging into the router via ssh, I ran the following commands:
uci set system.@system[0].log_ip=192.168.1.2
uci set system.@system[0].conloglevel=7
uci commit
before rebooting the router.


Now whenever I have to troubleshoot network problems, I can keep a terminal open on my server and get some visibility on what the router is doing:
tail -f /var/log/gargoyle-router.log

13 January 2012

Steve Kemp: Some misc. updates

Security
Today I made available a 3.2.0 kernel for my KVM guest which has a bastardised version of the PID hiding patch configured: So now on my guest, as myself, I can only see this: 
steve@steve:~$ ls -l /proc/   egrep ' [0-9]+$'
dr-xr-xr-x  7 steve users          0 Jan 13 17:22 15150
dr-xr-xr-x  7 steve users          0 Jan 13 17:29 15739
dr-xr-xr-x  7 steve users          0 Jan 13 17:29 15740
lrwxrwxrwx  1 root  root          64 Jan 13 17:20 self -> 15739
Running as root I see the full tree: 
steve:~#  ls -l /proc/   egrep ' [0-9]+$'
total 0
dr-xr-xr-x  7 root        root                 0 Jan 13 17:20 1
dr-xr-xr-x  7 root        root                 0 Jan 13 17:20 1052
dr-xr-xr-x  7 root        root                 0 Jan 13 17:20 1086
dr-xr-xr-x  7 root        root                 0 Jan 13 17:20 1101
dr-xr-xr-x  7 root        root                 0 Jan 13 17:20 1104
dr-xr-xr-x  7 root        root                 0 Jan 13 17:21 1331
dr-xr-xr-x  7 pdnsd       proxy                0 Jan 13 17:21 14409
dr-xr-xr-x  7 root        root                 0 Jan 13 17:21 14519
..
This (obviously) affects output from top etc too. It is a neat feature which I think is worth having, but time will tell..
mod_ifier
A long time ago I put together an Apache module which allowed the evaluation of security rules against incoming HTTP requests. mod_ifier was largely ignored by the world. But this week it did receive a little attention. The recent rash of Hash Collision attacks inspired inspired a fork with parameter filtering. Neat.
Otherwise nothing too much to report - though I guess I didn't actually share the link to the RESTful file store I mentioned previously. Should you care you can find it here: ObQuote: "I saw a man, he danced with his wife" - Chicago, Frank Sinatra

12 January 2012

Michal Čihař: Tiny blog improvements

Finally, I've found some time to do some improvements on this blog engine. First thing which was more and more missing is reasonable content for description in HTML headers. This lead to sites like Google+ always fetch the constant text and that did not look that. So now, there is something really relevant to the content, either first paragraph (what is the case for all old entries) or something I can manually edit (in case I won't be too lazy). For automatic extraction I tried several approaches. First attempt was simply extracting first paragraph from Markdown, however I quickly remembered that quite a lot of older posts were written directly in HTML, which made this big failure. Later trying BeautifulSoup on rendered HTML, what lead to missing spaces around text which was originally in links. Finally I discovered html2text, which worked pretty easily and does what I need. In the end the code looks like following: 
def get_auto_summary(self):
    h2t = html2text.HTML2Text()
    h2t.body_width = 0
    h2t.ignore_images = True
    h2t.ignore_links = True
    h2t.ignore_emphasis = True
    text = h2t.handle(self.body.rendered)
    return text.splitlines()[0]
Other change affects Flattr, as providing Flattr links for each posts is now possible even without javascript (it's called Auto-submit URL), I've decided to implement them this way. Let's see how many things will get on Flattr this way (at least it will give me better indication what somebody considered being useful). Thanks for commenters on my older blog post for hints.

Filed under: Django English Website 2 comments Flattr this!

9 January 2012

Steve McIntyre: Armhf buildds and status in Debian

Current status Back in September, I wrote about the machines that I set up to help bootstrap the new armhf port in Debian. Basing on Konstantinos' huge efforts in bringing up the new "architecture" in debian-ports, we started importing armhf into the main Debian archive on the 24th of November. Since then, those builders have been churning away night and day to build the huge collection of software that makes up the Debian archive. The current state can be seen on the armhf buildd status page, and there's a nice graph showing how quickly we've managed to run from 0 to over 90% of the archive here. (Click on the image for a larger version, or visit https://buildd.debian.org/stats/ for other versions. We overtook hurd-i386 quickly and are now ahead of the kfreebsd-* architectures. armhf bootstrap graph We've recently brought 3 more similar build machines online (hildegard, howells and hummel), again sponsored by the nice folks at Linaro but now hosted at the York NeuroImaging Centre at the University of York. This gives us both more build horsepower to keep up with building more different bits of Debian (experimental, updates etc.) and more redundancy in case of problems. We now have the vast majority of the archive built, and now a number of us are concentrating on fixing the remaining issues: language bootstraps and bugs. Also, on the 7th of January we were just added into testing, the next step on our path for inclusion as a Debian release architecture. Setting up the machines A lot of people have been asking me about the physical setup I showed in my last blog about these machines, so here's more details for those who are interested. Mount the 6 boards into the mini-rack, connect up the Molex power connectors to each board, attach ethernet cables and turn it all on! Each board comes with a micro-SD card containing uboot and an Ubuntu installation. I've configured uboot to boot off the hard drive directly, but leaving configuration available to use the Ubuntu on the micro-SD as a simple rescue system should the need arise. The Quickstart boards are not ideal physically for two reasons: the lack of SATA power, plus you need to push a power button on each board to boot it - they don't boot automatically the moment power is applied. However, they're quite inexpensive little machines and have done a great job of building the Debian archive so far! The ideal machines for us would also include more RAM at this point. CPU on these is adequate, but the larger C++ packages (yay webkit!) use a huge amount of memory at link time. Linking in swap is not the best thing, performance-wise... :-( UPDATE 2012-01-12: Ian tells me that the newer Quickstart-R boards apparently have a different power controller; these now boot up straight away without needing you to push a button. That sounds useful.

8 January 2012

Bartosz Feński: sshfs 2.3

I ve just uploaded new version of sshfs package. Here goes changelog: sshfs-fuse (2.3-1) unstable; urgency=low * New upstream version. (Closes: #636357)
- documents special handling of IPv6 addresses (Closes: #572222)
- corrects arguments handling (Closes: #535333, #535343, #571152)
* ACK NMU from 2.2-1.1 version, thanks Robert.
* Fixes typo in short description of -dbg package (Closes: #514261)
* Depends on fuse instead of fuse-utils (Closes: #629327)
* Clarify that owner/group options have to be numbers (Closes: #497368)
* Repackaged from scratch, uses DEP-5 copyrights, new debhelper,
quilt format, new policy standards. Bartosz Fenski <fenio@debian.org> Sun, 08 Jan 2012 10:01:04 +0000 Enjoy, it fixes 8 bugs ;)

6 January 2012

Mirco Bauer: Smuxi 0.8.9 "One Giant Leap" Release

Smuxi - IRC Client Smuxi 0.8.9 "One Giant Leap" Release
Just in time for 2012 I am very pleased to announce Smuxi 0.8.9 codenamed "One Giant Leap". During the development 56 bug reports and 33 feature requests in 593 commits were worked on making this release a major milestone of the Smuxi project. At the Chaos Communication Congress (28C3) in Berlin I was doing the final development sprint to get 0.8.9 done, which was a very intensive and refreshing experience. Here are the highlights of this release: Development Builds / Rolling Releases After the 0.8 release it became clear that a continious and short development -> test cycle is important to keep the project going quickly. At some point I have received requests if the project is dead while it was more active than ever. The lack of new releases (for about 15 months) lead to this wrong impression. Thus Smuxi can be obtained from development builds now. This includes daily builds for Debian (Squeeze, Wheezy, Sid), Ubuntu (Lucid, Maverick, Natty, Oneiric, Precise) and Windows. Thanks goes to Hannes Tismer for providing the Windows autobuilder and to Canonical for the PPA autobuilder. We invite everyone to use these daily builds to keep track of the latest development of Smuxi. Issues and regressions are fixed in a very short period (usually the same day). Thanks to our users who ran development builds and reported issues which led to many bug fixes prior to this release. On the other hand one of my New Year's resolutions are to "release early, release often" So there should be no nerd left behind... Screenshot of Smuxi 0.8.9 on Mac OS X Mac OS X support With the help of Steven McGrath (Steve[cug]) who created the initial Mac OS X installer for Smuxi we now have official support for Mac OS X. The download page contains the instructions how to obtain and install Smuxi on Mac OS X. This makes the 4th platform where Smuxi can be used on besides Windows, Linux and *BSD. For now Smuxi 0.8.9 doesn't feel as native as it could as it relies on the GTK+ port. We are looking into enhancing the experience though, just stay tuned. Chat History on Disk (Beta) The most exciting feature in this release I think are the "persistent message buffers". With this feature I could solve one of the biggest drawbacks IRC ever had: IRC does not retain any messages you have sent or received. All messages are only relayed to all users. The issue is that if you close your IRC client or even just leave a channel, all your received messages are gone. One workaround in most clients was to create text log files which then contains the chat history, but it is annoying and not user-friendly to open some text file somewhere from your disk to read the history outside of your IRC client. Now with Smuxi 0.8.9 you no longer have this issue, all chat history gets automatically written and read to a message database when you start Smuxi, join channels or open queries! As this feature is not fully stable yet it is not enabled by default. If you want to try it go to: File -> Preferences -> Interface and change "Persistency Type" from "Volatile" to "Persistent", hit OK and restart Smuxi. Now all messages are saved into the database and will automatically be shown. Click here for a screencast of this feature Jabber / XMPP Support (Beta) You probably have friends not on IRC and Twitter, say on Jabber, gTalk or Facebook? This is where the new XMPP engine of Smuxi comes into play. You can send and receive messages to/from them now! The implementation is far from complete, though. It has no buddy list for example and needs only to be treated as a technical preview of what will be coming in future Smuxi releases. Click here for a screencast of this feature Screenshot of Smuxi's Text Interface Text Interface (Alpha) This is the first release that contains a text frontend based on the STFL library. STFL is a library that uses ncurses to draw text based user interface using a markup language (like Glade for GTK+). This frontend is in early alpha state and lacks a lot of interface features and likes to crash. It is still included to attract potential developers who want to enhance this frontend. The frontend can be enabled by passing --enable-frontend-stfl to the configure script and then by executing smuxi-frontend-stfl. NetworkManager Support Everyone with a laptop knows how annoying it can be to suspend and resume when network based applications suddenly go crazy because they have lost the connection and either spew errors or take forever to get back in shape. Smuxi will now detect the network state right away with the help of the new Network Manager support. It automatically reconnects when needed right away for you. Next Generation Internet Support You can now connect to IRC servers using the IPv6 protocol Enhanced Find Group Chat Support Users had real issues to find out how to search for channels, thus Bianca Mix added a neat feature. The /list command will now simply open the Find Group Chat dialog for you. This way everyone used to IRC will find it in no time. Searching for channels on freenode wasn't working correctly, this is now fixed. Smuxi also supports the SAFELIST feature of the IRC protocol now which allows to retrieve a full channel list and do client side search which makes consecutive searches much faster. Enhanced Windows Experience For a long time you could not use Smuxi with the latest GTK# version of 2.12.10 on Windows. The issue was that Smuxi relied on SVG support which 2.12.10 no longer had. Smuxi is no longer using SVG instead it uses pre-scaled PNG images thus it works just fine with GTK# 2.12.10 on Windows now. At the same time the issue that the maximized state of the main window was left when restoring from task bar is fixed with GTK# 2.12.10. Screenshot of Fixed-Sys vs Consolas font Smuxi used by default the FixedSys font on Windows to give it the typical IRC look most people are used to. Since Windows Vista there is a better console-like font available called Consolas. Smuxi will now use the Consolas font instead on Windows Vista or later. Another important enhancement is that Smuxi no longer has issues with multiple GTK+ installs on the same computer, which was getting more common with more popular ported GTK+ applications such as GIMP or Pidgin. SSL for IRC fixed IRC with SSL was only working with the default port of 6697. Thanks to Jo Shields now any port can be used with SSL. Crash Related Issues Desktop notifications could crash Smuxi in case of errors related to the notification system or an absent notification daemon. There was a chance that the crash dialog simply disappeared which made reporting bugs more difficult no longer happens. Rapid use of ctrl+w, /window close (Jimmie Elvenmark) and opening the Find Group Chat dialog on the Smuxi tab do no longer crash. Also number-only network names, /network switch freenode and GTK+ install without SVG support no longer lead into a crash. Enhanced Notice Handling Notices will no longer open query tabs for you instead it will show them on tabs you share with the person who sent it with the server tab as fallback. This also avoids ChanServ, NickServ and spammy IRCop tabs. Twitter fixes Twitter made some changes to their API which broke the Twitter support of Smuxi 0.8. This was taken care of and also a few other issues were solved allowing Smuxi 0.8.9 to work smoothly with Twitter again. Extended Keybindings Smuxi allows now to use the ctrl+tab / ctrl+shift+tab and ctrl+n / ctrl+p keys to switch tabs. The keybindings still work even with a hidden menu bar now. Smuxi Server specific highlights More interactive and much faster synchronization When connecting to a smuxi-server you had to wait till Smuxi finished the synchronization before you could use the interface. Also you could not tell how far the synchronization was and just had to wait till it was completed. With Smuxi 0.8.9 the connect just takes a few seconds and all chats are synchronized in the background with a progress bar so you can use the interface from the first moment on and know how far it is. The speed how much it takes to synchronize all chats also reduced drastictly by 400%! Click here for a screencast of this feature More background communication When using a smuxi-server the interface sometimes had load times like when opening the preferences or when using the nickname completion (Andrew Kannan). These operations are done in the background and no longer blocks the interface. Also when the communication is lost to the smuxi-server the frontend will now automatically reconnect to it in the background. Low Bandwidth Mode When it comes to mobile internet connectivity such as UMTS/HSDPA, Edge and GRPS it can be a real pain to connect to the smuxi-server as it has to transfer all the messages over that. If you just want to ask someone you know then you don't need any old messages to do that. With the "Low Bandwidth Mode" you can now connect to the smuxi-server without loading old messages which makes the connect very quick. You find this option in the engine connect dialog. Stable Protocol Initially I didn't plan to make the protocol of Smuxi stable before the 0.9 release, but as it turned out the 0.8 protocol was good enough to still use it and for that reason Smuxi 0.8.9 is still compatible with 0.8. The 0.8 protocol will see no breakages, instead the next protocol will be on-top or opt-in of the current one. This means future Smuxi versions stay compatible with it. Shutdown Command You can now shutdown the smuxi-server if you like using the /shutdown command. It it safe to use the command, it will do a clean shutdown sequence for you. For example it makes sure all messages are written to disk in the case of enabled persistent message buffers. If you have your smuxi-server daemon monitored (e.g. with runit) it can also automatically be restarted and upgraded this way. Built-in SSH Keyfile Support It is no longer needed to fiddle with the .ssh/config file or pagent to get SSH key authorization working. You can now simply tell Smuxi which SSH keyfile you want to use to connect to your smuxi-server. Updated Translations
  • Catalan (Siegfried-Angel Gevatter Pujals)
  • Danish (Joe Hansen)
  • Finnish (Kalle Kaitala)
  • French (Cl ment Bourgeois)
  • German (Bianca Mix)
  • Italian (Vincenzo Campanella)
  • Portuguese (Americo Monteiro)
  • Spanish (Castilian) (Ricardo A. Hermosilla Carrillo)
New Translations
  • Chinese Simp (Dean Lee)
  • Slovak (Tom Vadina)
  • Swedish (Jimmie Elvenmark)
  • partially Russian (Aleksandr P)
  • partially Turkish (Umut Albayrak)
  • partially Urdu (makki)
Contributors Contributors to this release are the following people:
  • Mirco Bauer (497 commits)
  • Tuukka Hastrup (10 commits)
  • Bianca Mix (10 commits, translations)
  • Cl ment Bourgeois (8 commits, translations)
  • Andrius Bentkus (5 commits)
  • Carlos Mart n Nieto (3 commits)
  • Jimmie Elvenmark (3 commits, translations)
  • Hannes Tismer (1 commit)
  • Jonathan Pryor (1 commit)
  • Jo Shields (1 commit)
  • Siegfried-Angel Gevatter Pujals (translations)
  • Dean Lee (translations)
  • Aleksandr P (translations)
  • Americo Monteiro (translations)
  • Andrew Kannan (translations)
  • Joe Hansen (translations)
  • Kalle Kaitala (translations)
  • makki (translations)
  • Ricardo A. Hermosilla Carrillo (translations)
  • Tom Vadina (translations)
  • Umut Albayrak (translations)
  • Vincenzo Campanella (translations)
Thank you very much for your contributions to Smuxi! After reading this whole pile of text, head over here and grab this smexy stuff!
Posted Sun Jan 1 22:58:29 2012
Copyright 2004-2009 Mirco 'meebey' Bauer

Michal &#268;iha&#345;: Adding API to Django application

One of Django applications I maintain is our internal tool used at SUSE used for managing incoming L3 requests. Recently request to add some API arose (read only for now). Looking at available solutions, I came to conclusion that django-piston should be the best choice for me. Adding simple model based API with it is indeed quite simple, all basic information you need is written in getting started part of their documentation. On the other side, things can never go without problems, so I was hit by well known bug. Fortunately fix exists, though it is not yet merged upstream. While digging so deep into problem anyway, I've submitted a request to include this patch in devel:languages:python OBS repo.

Filed under: Django English Suse 4 comments Flattr this!

4 January 2012

Pau Garcia i Quiles: FOSDEM 2012 CrossDesktop DevRoom: deadline extension

FOSDEM is one of the largest gatherings of Free Software contributors in the world and happens each February in Brussels (Belgium). One of the developer rooms will be the CrossDesktop DevRoom, which will host Desktop-related talks. Are you interested in giving a talk about open source and Qt, KDE, Enlightenment, Gnome, XFCE, Windows, Mac OS X, general desktop matters, mobile development, applications that enhance desktops and/or web? We have extended the deadline for a few more days, until January 8th. If you want to submit a talk proposal, hurry up! I have to say I am very surprised to see very few Qt/KDE talk proposals. Is there nothing interesting the Qt and KDE world have to say to 5,000+ people?
There is more information in the Call for Talks we published a couple of months. If you are interested in Qt/KDE, come visit us at the KDE booth. If you add yourself to the KDE FOSDEM 2012 wiki page, we will be able to better organize the usual dinner on Sunday and/or smaller meetings for special interest groups .

3 January 2012

Rapha&#235;l Hertzog: My Debian Activities in December 2011

This is my monthly summary of my Debian related activities. If you re among the people who made a donation to support my work (364.18 , thanks everybody!), then you can learn how I spent your money. Otherwise it s just an interesting status update on my various projects. Dpkg and Multiarch I had some hope to have a multiarch-enabled dpkg in sid for Christmas as Guillem told me that it was realistic. Alas Guillem got sick. We re in January and we re still not there. While some of Guillem s commits in December were related to multi-arch, the size of his pu/multiarch/master branch did not really shrink. We still have 36 commits to merge most of the work he did was refactoring some parts of the code that were already merged. And he initiated some discussion on interface changes. I participated to those discussions hoping to bring them to a quick resolution. I m still maintaining my own pu/multiarch/full branch, it is based on Guillem s branch but with further fixes that I developed and that he has not yet merged and with a change reverted (Guillem s branch allows crossgrading packages between different architectures while dpkg does not manage this correctly yet). I can only hope that January will be the last month of this never-ending saga. It s been one year since I started working on this project. :- Misc dpkg work I reviewed (and later merged) a patch of Kees Cook to enhance dpkg-buildflags so that it can report which hardening features are enabled. This feature might then be used by tools like lintian to detect missing hardening features. I mentored Gianluca Ciccarelli who is trying to enhance dpkg-maintscript-helper to take care of replacing a directory by a symlink and vice-versa. I took care of #651993 so that dpkg-mergechangelogs doesn t fail when it encounters an invalid version in the changelog, and of #652414 so that dpkg-source --commit accepts a relative filename when a patch file is explicitly given. Guillem also merged a fix I developed for LP#369898. Packaging work WordPress 3.3 came out so I immediately packaged it. Despite my upstream bug report, they did not update their GPL compliance page which offers the corresponding sources for what s bundled in the tarball. So I hunted for the required sources myself, and bundled them in the debian.tar.xz of the Debian source package. It s a rather crude solution but this allowed me to close the release critical bug #646729 and to reintroduce the Flash files that were dropped in the past which is great since the Flash-based file uploader is nicer than the one using the browser s file field. Quilt 0.50 came out after 2 years of (slow) development. The Debian package has many patches and several of them had to be updated to cope with the new upstream release. Fortunately some of them were also merged upstream. It still took an entire morning to complete this update. I also converted the packaging from CDBS to dh with a short rules file. Zim 0.54 came out and I immediately updated the package since it fixed a bug that was annoying me. Review of the ledgersmb packaging As the sql-ledger maintainer (and a user of this software for my accounting), I have been hoping to get ledgersmb packaged as a possible replacement for it. I have been following the various efforts initiated over time but none of them resulted in a real package in Debian. This is a real pity so I tried to fix this by offering to sponsor package uploads. That s why I did a first review of the packaging. It took several hours because you have to explain everything that s not good enough. I also filed a wishlist bug against lintian (#652963) to suggest that lintian should detect improper usage of dpkg-statoverride (this is a mistake that was present in the package that I reviewed). nautilus-dropbox work I wanted to polish the package in time for the Ubuntu LTS release and since Debian Import Freeze is in January, I implemented some of the important fixes that I wanted. The Debian package diverges from upstream in that the non-free binaries are installed in /var/lib/dropbox/ instead of $HOME.
Due to a bug, the files were not properly root-owned so I first fixed this (unpacking the tarball as root lead to reuse of the embedded user & group information, and those information changed recently on the Dropbox side apparently). Then we recently identified other problems related to proxy handling (see #651065). I fixed this too because it s relatively frequent that the initial download triggered during the package configuration fails and in that case it s the user that will re-trigger a package download after having given the appropriate credentials through PackageKit. Without my fix, usage of pkexec would imply the loss of the http_proxy environment variable and thus it would not be possible for a user to download through a proxy. Last but not least I reorganized the Debian specific patches to better separate what can and should be merged upstream, from the changes that upstream doesn t want. Unfortunately Dropbox insists on being able to auto-update their non-free binaries, they are, thus, against the installation under /var/lib/dropbox and the corresponding changes. Book update We re making decent progress in the translation of the Debian Administrator s Handbook, about 6 chapters are already translated (not yet reviewed though). The liberation campaign is also (slowly) going forward. We re at 67% now (thanks to 90 new supporters!) while we were only at 60% at the start of December. Thanks See you next month for a new summary of my activities.

No comment Liked this article? Click here. My blog is Flattr-enabled.

Jaldhar Vyas: Watch Me on Jeopardy! This Wednesday

<video controls="controls" poster="http://www.braincells.com/debian/images/jaldhar_jeopardy_howdy.jpg">
<source src="http://www.braincells.com/debian/images/jaldhar_jeopardy_howdy.mpg" type="video/mpeg">
<source src="http://www.braincells.com/debian/images/jaldhar_jeopardy_howdy.ogv" type="video/ogg">
HTML 5 Video does not seem to be supported by your browser. Download the video of my Jeopardy! "Hometown Howdy" here (MPG format) or here (OGG format). </video> Some time ago, I mentioned auditioning for Jeopardy!, Americas top TV quiz show. I didn't hear back from the producers for quite a while so I assumed I hadn't been selected but then suddenly one day in October I got a call inviting me to come out to Sony Studios in Culver City California for a taping in November. I went and it is finally airing now. So if you are in the US or Canada (the show is possibly syndicated elsewhere but I'm not sure) please be sure to watch me on Wednesday, January the 4th. I won't say how well I did until afterwards but I was quite pleased with my performance.

2 January 2012

Gunnar Wolf: Happy Public Domain day, even for the inhabitants of the longest-copyright-term country

Happy Public Domain day, even for the inhabitants of the longest-copyright-term country
Every year, on January 1st, new material ceases to be protected by copyright and enters the public domain. This means, every year, more knowledge, literature, paintings, music, movies and a long etcetera becomes collective property, instead of being artificially held by the current holders of their rights. As this image shows (source: http://publicdomainday.org/node/39 ), I have the honor(?) to live in the country with the longest copyright protection term in the world. Copyright in Mexico does not only last for 100 years It lasts for the natural life of the author plus 100 years. This means that the popular corridos that tell the stories of the 1910 revolution are still not in the public domain. La sucesi n presidencial, the book which Francisco I. Madero wrote to justify that a peaceful political change was needed for the 1910 elections, will not enter the public domain until 2014 (president Madero was killed during 1913). Does it make any sense to kidnap cultural, political or artistic works for over a century? Not only that: Material that is legally sold as public domain in other countries is illegal in ours. Take as an example the recordings of Enrico Carusso, the great Italian tenor who died in 1921. Over 15 years ago, I bought a couple of CDs with his recordings (even if the sources were quite low-quality, as they had been copied over from wax cylinders to magnetic tapes to optical media). I bought them surprisingly cheap, as they were genuine public domain. But they are still protected in my country. That means, I ilegally have some stolen(!) works of art which I lawfully bought outside my country. Copyright law needs to be revised to match reality. Technological advances have strongly changed reality since 1717's promulgation of the first copyright laws. The solution is not to extend the terms, but to rethink the whole process. (yes, this rant was mainly made as an excuse for me to copy this image and put it in a location I can easily refer to later. But I hope it is interesting to you!)

1 January 2012

Junichi Uekawa: Hello 2012.

Hello 2012.

31 December 2011

Russell Coker: My Blog Server was Cracked

On the 1st of August I noticed that the server which runs my blog among other things was having an occasional SEGV from a sshd process. Unfortunately I was busy and didn t pay much attention to this, which turned out to be a big mistake. On the 12th of September I started investigating this properly and noticed that when someone tried to connect to ssh with password authentication sshd would SEGV after it was denied access to a shared memory region or a semaphore which had a SE Linux type of unconfined_t. I added some SE Linux auditallow rules and discovered that the memory region in question was created by the ssh client. Shortly after that I came to the conclusion that this wasn t some strange feature of ssh (or one of the many shared objects it uses) but hostile activity. The ssh client appeared to be storing passwords that it used in a shared memory region and sshd was also collecting passwords in the same region and presumably offering them to a ssh client which uses some extension to the ssh protocol. The sshd process was crashing because it couldn t handle EPERM on access to shared memory or semaphores. Presumably if the system in question wasn t running SE Linux then the exploit would have remained undetected for a lot longer. At this stage we don t know how the attacker got in. Presumably one of the people with root access ran a ssh client on a compromised system and had their password sniffed. One such client system was mysteriously reinstalled at about that time, the sysadmin of the system in question claimed to have no backups which made it impossible to determine if that system had been compromised. I believe that the sysadmin of the client system knew that their system was compromised, kept that information secret, and allowed other systems to become and remain compromised. The attacker made no good effort to conceal their presence, they replaced ssh, sshd, and ssh-add and didn t bother changing the Debian checksums so the debsums program flagged the files as modified. Note that I have kept copies of the files in question and am willing to share them with anyone who wants to analyse them. Steinar H. Gunderson has named this trojan Ebury [1]. Recovery By the evening of the 13th of September I had the system mostly working again. Jabber still isn t working because ejabberd is difficult to get working at the best of times, I am now investigating whether there is a better Jabber server to use, but as I don t use Jabber often this hasn t been a priority for me. Some of the WordPress plugins I use and all of the WordPress themes that are installed were outside the Debian packaging system, as I couldn t be sure that they hadn t been altered (because the people who wrote WordPress plugins don t keep old versions online) I had to upgrade to the newer versions. Of course the newer versions weren t entirely compatible so I had to use a different theme and I couldn t get all plugins working. Link Within no longer works, not that it ever worked properly [2], I wanted to try Outbrain again but their web site won t let me login (and they haven t responded to my support request). Does anyone know of a good WordPress plugin to provide links to related content? Either related content on my blog or on the Internet in general will be OK. Some people have asked me about the change in appearance of my blog. It was simply impossible (for someone with my PHP skills) to get my blog looking the same way as it did before the server was cracked. I think that the new look is OK and don t mind if people think it looks likw a VW advert VW make great cars, I was very satisfied with the VW Passat I used to drive. Future Plans I had bought some Yubikeys (USB devices that generate one-time passwords) [3] to control access to that server, if I had configured the software to use them then this might not have happened. The use of one-time password devices can prevent passive password-sniffing attacks. It would still allow active attacks (such as using ControlPath/ControlMaster options on the ssh client to allow a hostile party to connect later (EG the -M, -S, and -o ControlPersist options for the ssh client). It s a pity that there doesn t seem to be a way to configure the ssh server to disable ControlMaster. Conclusion It would be good to have some changes to sshd to allow more restrictions on what a client can request, as ControlMaster functionality isn t needed by most users it should be possible to disable it. SE Linux doesn t protect against a compromised client system or any other way of stealing passwords. It did do a good job of stopping Ebury from doing all the things it wanted to do and thus making me aware of the problem. So I count this as a win for SE Linux. Yubikeys are the cheapest and easiest way of managine one-time passwords. I had already bought some for use on the system in question but hadn t got around to configuring them. I have to make that a priority.

28 December 2011

Russell Coker: Secure Boot and Protecting Against Root

There has been a lot of discussion recently about the recent Microsoft ideas regarding secure boot, in case you have missed it Michael Casadevall has written a good summary of the issue [1]. Recently I ve seen a couple of people advocate the concept of secure boot with the stated idea that root should be unable to damage the system, as Microsoft Software is something that doesn t matter to me I ll restrict my comments to how this might work on Linux. Restricting the root account is something that is technically possible, for much of the past 9 years I have been running SE Linux Play Machines which have UID 0 (root) restricted by SE Linux such that they can t damage the system [2] there are other ways of achieving similar goals. But having an account with UID 0 that can t change anything on the system doesn t really match what most people think of as root , I just do it as a way of demonstrating that SE Linux controls all access such that cracking a daemon which runs as root won t result in immediately controlling the entire system. As an aside my Play Machine is not online at the moment, I hope to have it running again soon. Root Can t Damage the System One specific claim was that root should be unable to damage the system. While a secure boot system can theoretically result in a boot to single user mode without any compromise that doesn t apply to fully operational systems. For a file owned by root to be replaced the system security has to be compromised in some way. The same compromise will usually work every time until the bug is fixed and the software is upgraded. So the process of cracking root that might be used to install hostile files can also be used at runtime to exploit running processes via ptrace and do other bad stuff. Even if the attacker is forced to compromise the system at every boot this isn t a great win for the case of servers with months of uptime or for the case of workstations that have confidential data that can be rapidly copied over the Internet. There are also many workstations that are live on the Internet for months nowadays. Also the general claim doesn t really make sense on it s own. root usually means the account that is used for configuring the system. If a system can be configured then the account which is used to configure it will be able to do unwanted things. It is theoretically possible to run workstations without external root access (EG have them automatically update to the latest security fixes). Such a workstation configuration MIGHT be able to survive a compromise by having a reboot trigger an automatic update. But a workstation that is used in such a manner could be just re-imaged as it would probably be used in an environment where data-less operation makes sense. An Android phone could be considered as an example of a Linux system for which the root user can t damage the system if you consider root to mean person accessing the GUI configuration system . But then it wouldn t be difficult to create a configuration program for a regular Linux system that allows the user to change some parts of the system configuration while making others unavailable. Besides there are many ways in which the Android configuration GUI permits the user to make the system mostly unusable (EG by disabling data access) or extremely expensive to operate (EG by forcing data roaming). So I don t think that Android is a good example of root being prevented from doing damage. Signing All Files Another idea that I saw advocated was to have the secure boot concept extended to all files. So you have a boot loader that loads a signed kernel which then loads only signed executables and then every interpreter (Perl, Python, etc) will also check for signatures on files that they run. This would be tricky with interpreters that are designed to run from standard input (most notably /bin/sh but also many other interpreters). Doing this would require changing many programs, I guess you would even have to change mount to check the signature on /etc/fstab etc. This would be an unreasonably large amount of work. Another possibility would be to change the kernel such that it checks file signatures and has restrictions on system calls such as open() and the exec() family of calls. In concept it would be possible to extend SE Linux or any other access control system to include access checks on which files need to be signed (some types such as etc_t and bin_t would need to be signed but others such as var_t wouldn t). Of course this would mean that no sysadmin work could be performed locally as all file changes would have to come from the signing system. I can imagine all sorts of theoretically interesting but practically useless ways of implementing this such as having the signing system disconnected from the Internet with USB flash devices used for one-way file transfer because you can t have the signing system available to the same attacks as the host system. The requirement to sign all files would reduce the use of such a system to a tiny fraction of the user-base. Which would then raise the question of why anyone would spend the effort on that task when there are so many other ways of improving security that involve less work and can be used by more people. Encrypted Root Filesystem One real benefit of a secure boot system is for systems using encrypted filesystems. It would be good to know that a hostile party hasn t replaced the kernel and initrd when you are asked for the password to unlock the root filesystem. This would be good for the case where a laptop is left in a hotel room or other place where a hostile party could access it. Another way of addressing the same problem is to boot from a USB device so that you can keep a small USB boot device with you when it s inconvenient to carry a large laptop (which works for me). Of course it s theoretically possible for the system BIOS to be replaced with something that trojans the boot process (EG runs the kernel in a virtual machine). But I expect that if someone who is capable of doing that gets access to my laptop then I m going to lose anyway. Conclusion The secure boot concept does seem to have some useful potential when the aim is to reboot the system and have it automatically apply security fixes in the early stages of the boot process. This could be used for Netbooks and phones. Of course such a process would have to reset some configuration settings to safe defaults, this means replacing files in /etc and some configuration files in the user s home directory. So such a reboot and upgrade procedure would either leave the possibility that files in /etc were still compromised or it would remove some configuration work and thus give the user an incentive to avoid applying the patch. Any system that tries to extend signature checks all the way would either be vulnerable to valid but hostile changes to system configuration (such as authenticating to a server run by a hostile party) or have extreme ease of use issues due to signing everything. Also a secure boot will only protect a vulnerable system between the time it is rebooted and the time it returns to full operation after the reboot. If the security flaw hasn t been fixed (which could be due to a 0-day exploit or an exploit for which the patch hasn t been applied) then the system could be cracked again. I don t think that a secure boot process offers real benefits to many users.

26 December 2011

Steve Kemp: So I'm a peddler of smut nowadays.

Over the Christmas period I've not been doing too much. December was a month that started out pretty well, in the first 10 days I had five models/friends/random-folk come to pose for me. (I have a few folk lined up for mid-January, but things tailed off quickly this month due to people having little free time). I spent a while mulling over what I was doing with images, as I've recently been doing a fair number of more NSFW images - In December this and this were my two favourite shots. I've posted NSFW images in various places over the past year (with permission; some volunteers/victims/friends don't want me to share anything, so I don't. They just hang on my walls.) but I was never consistent. Anyway I realised that .xxx domains are now available, so I figured I'd snarf one up and use that. That lead to tasteful.xxx - which is mostly full of images I didn't actually take, but that will change. (Sadly "artistic" was gone!) In more on-topic news I reported #651896 - a trivial security issue in another setgid(games) binary. I've got a couple more of those to tidy up and report in the near future. ObQuote: "Bright light. Bright light." - Gremlins

19 December 2011

Felipe Augusto van de Wiel: 19 Dec 2011

29 and counting
Time flies... and very fast.

There are so many things I'd like to share and tell you about but that would make a long and boring post, so I'll divide it in future entries, so I can keep this diary alive, keep people informed and tell a little bit about my story. Eventually, I may split this diary into a technical and a non-technical blog, but for now, I will stick around mixing topics. :-) Last time I wrote was back in 2009 at DebConf9 in Spain and a lot of things happened that year. Not only for Debian, but also for me.


My last year studying Computer Science was 2009 and that same year I was working full time, I helped organizing a large event for Computer Students (ENECOMP 2009), we had some troubles and side effects with Influenza A (H1N1) in my city (Curitiba, PR) and towards the end of the year I got really sick (not from Influenza) and it took a while to know what was going, during this process I did hurt some people I really love and I'm truly sorry. The past, 2010 went on as busy and unstable as 2009, my laptop's hard disk broke twice (January and October) and I survived thanks to backup and recovery procedures. I took some wrong decisions but fixed it later and learned a lot from my mistakes, decisions and choices.


Then 2011 came, my laptop's hard disk broke again and I lost almost 6 months of emails, I find out that after the second crash in 2010 part of my backup got b0rk3d. Fine, I didn't die, everything seems to be fine, but I'm still catching up with a lot of work and backlog. At different times one of my parents also got really sick and I learned quite a bit on how to deal with it.


Due to the laptop and the different things going on in my life I didn't work for Debian as much as I want and I still feel guilty. :-( But that's fine, this is a kind of public apologize for my peers in Debian (i18n, mirrors, release), I still want to help all of you, but I still have quite a bit of backlog to clean and quite a few things to learn in the process. And in general, I'm really sorry if I didn't (or I couldn't) work for Debian as much as I want.


Although I'm taking the chance to apologize in this post, I still want to make clear that I'm quite happy. This last year was pretty good, I had the opportunity to attend DebConf again and also got to know Sarajevo and Zagreb. New lessons were learned, better work cycles, nicer solutions. Today I'm completing 29 years old. 29. This is quite some time, not a long ride, but for one reason or another, I have high hopes for 2012 and what awaits me. And I do plan to learn more, to help more and whenever possible, to contribute back.

Last time I wrote here I mentioned about my graduation and another post to talk about that, I'll write about it as soon as I get my diploma (because of different printing problems it was delayed for almost 2 years). And I do plan to write more frequently. :-)

Next.

Previous.