Jonathan Wiltshire: Getting things into Jessie (#4)
Getting things into Jessie (#4) is a post from: jwiltshire.org.uk Flattr
# /etc/pyroman/02_icmpv6.py:82 -A rfc4890f -p icmpv6 --icmpv6-type 255 -j DROPindicates that this particular line was produced due to line 82 in file /etc/pyroman/02_icmpv6.py. This makes debugging easier. In particular it allows pyroman to produce a meaningful error message if the rules are rejected by the kernel: it will tell you which line caused the rule that was rejected.
A common way to build a firewall ruleset is to run a shell script
calling iptables and ip6tables. This is convenient since you get
access to variables and loops. There are three major drawbacks with this method:
ip ,6 tables
command will download the ruleset from the kernel, add the rule
and upload the whole modified ruleset to the kernel.
iptables-restore
A classic way to solve these problems is to build a rule file that will be
read by iptables-restore and
ip6tables-restore1. Those tools send the ruleset to
the kernel in one pass. The kernel applies it atomically. Usually,
such a file is built with ip ,6 tables-save but a script can fit the task.
The ruleset syntax understood by ip ,6 tables-restore is similar to
the syntax of ip ,6 tables but each table has its own block and
chain declaration is different. See the following example:
$ iptables -P FORWARD DROP $ iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE $ iptables -N SSH $ iptables -A SSH -p tcp --dport ssh -j ACCEPT $ iptables -A INPUT -i lo -j ACCEPT $ iptables -A OUTPUT -o lo -j ACCEPT $ iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $ iptables -A FORWARD -j SSH $ iptables-save *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE COMMIT *filter :INPUT ACCEPT [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :SSH - [0:0] -A INPUT -i lo -j ACCEPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j SSH -A OUTPUT -o lo -j ACCEPT -A SSH -p tcp -m tcp --dport 22 -j ACCEPT COMMIT
nat table and one
block for the filter table. The user-defined chain SSH is
declared at the top of the filter block with other builtin chains.
Here is a script diverting ip ,6 tables commands to build such a
file (heavily relying on some Zsh-fu2):
#!/bin/zsh set -e work=$(mktemp -d) trap "rm -rf $work" EXIT # Redefine ip ,6 tables iptables() # Intercept -t local table="filter" [[ -n $ @[(r)-t] ]] && # Which table? local index=$ (k)@[(r)-t] table=$ @[(( index + 1 ))] argv=( $argv[1,(( $index - 1 ))] $argv[(( $index + 2 )),$#] ) [[ -n $ @[(r)-N] ]] && # New user chain local index=$ (k)@[(r)-N] local chain=$ @[(( index + 1 ))] print ":$ chain -" >> $ work /$ 0 -$ table -userchains return [[ -n $ @[(r)-P] ]] && # Policy for a builtin chain local index=$ (k)@[(r)-P] local chain=$ @[(( index + 1 ))] local policy=$ @[(( index + 2 ))] print ":$ chain $ policy " >> $ work /$ 0 -$ table -policy return # iptables-restore only handle double quotes echo $ $ (q-)@ //\'/\" >> $ work /$ 0 -$ table -rules #' functions[ip6tables]=$ functions[iptables] # Build the final ruleset that can be parsed by ip ,6 tables-restore save() for table ($ work /$ 1 -*-rules(:t:s/-rules//)) print "*$ $ table #$ 1 - " [ ! -f $ work /$ table -policy ] cat $ work /$ table -policy [ ! -f $ work /$ table -userchains cat $ work /$ table -userchains cat $ work /$ table -rules print "COMMIT" # Execute rule files for rule in $(run-parts --list --regex '^[.a-zA-Z0-9_-]+$' $ 0%/* /rules); do . $rule done # Execute rule files ret=0 save iptables iptables-restore ret=$? save ip6tables ip6tables-restore ret=$? exit $ret
iptables() function is defined and will shadow the
iptables command. It will try to locate the -t parameter to know
which table should be used. If such a parameter exists, the table is
remembered in the $table variable and removed from the list of
arguments. Defining a new chain (with -N) is also handled as well as
setting the policy (with -P).
In , the save() function will output a ruleset that should be
parseable by ip ,6 tables-restore. In , user rules are
executed. Each ip ,6 tables command will call the previously defined
function. When no error has occurred, in , ip ,6 tables-restore is
invoked. The command will either succeed or fail.
This method works just fine3. However, the second method is
more elegant.
ip ,6 tables
in a newly created network namespace, save it with ip ,6 tables-save
and apply it in the main namespace with ip ,6 tables-restore. Here
is the gist (still using Zsh syntax):
#!/bin/zsh set -e alias main='/bin/true ' [ -n $iptables ] # Execute ourself in a dedicated network namespace iptables=1 unshare --net -- \ $0 4> >(iptables-restore) 6> >(ip6tables-restore) # In main namespace, disable iptables/ip6tables commands alias iptables=/bin/true alias ip6tables=/bin/true alias main='/bin/false ' # In both namespaces, execute rule files for rule in $(run-parts --list --regex '^[.a-zA-Z0-9_-]+$' $ 0%/* /rules); do . $rule done # In test namespace, save the rules [ -z $iptables ] iptables-save >&4 ip6tables-save >&6
$iptables
environment variable tell in which namespace we are. In the new
namespace, we execute all the rule files ( ). They contain classic
ip ,6 tables commands. If an error occurs, we stop here and nothing
happens, thanks to the use of set -e. Otherwise, in , the ruleset
of the new namespace are saved using ip ,6 tables-save and sent to
dedicated file descriptors.
Now, the execution in the main namespace resumes in . The results of
ip ,6 tables-save are feeded to ip ,6 tables-restore. At this
point, the firewall is mostly operational. However, we will play again
the rule files ( ) but the ip ,6 tables commands will be disabled
( ). Additional commands in the rule files, like enabling IP
forwarding, will be executed.
The new namespace does not provide the same environment as the main
namespace. For example, there is no network interface in it, so we
cannot get or set IP addresses. A command that must not be executed in
the new namespace should be prefixed by main:
main ip addr add 192.168.15.1/24 dev lan-guest
iptables-apply which will
apply a rule file and rollback after a given
timeout unless the change is confirmed by the user.
My home router acts as an access point with an
Intel Dual-Band Wireless-AC 7260 wireless card. This card
supports 802.11ac (on the 5 GHz band) and 802.11n (on both the
5 GHz and 2.4 GHz band). While this seems a very decent card to use in
managed mode, this is not really a great choice for an access point.
$ lspci -k -nn -d 8086:08b1 03:00.0 Network controller [0280]: Intel Corporation Wireless 7260 [8086:08b1] (rev 73) Subsystem: Intel Corporation Dual Band Wireless-AC 7260 [8086:4070] Kernel driver in use: iwlwifi
iw:
$ iw reg get country CH: DFS-ETSI (2402 - 2482 @ 40), (N/A, 20), (N/A) (5170 - 5250 @ 80), (N/A, 20), (N/A) (5250 - 5330 @ 80), (N/A, 20), (0 ms), DFS (5490 - 5710 @ 80), (N/A, 27), (0 ms), DFS (57240 - 65880 @ 2160), (N/A, 40), (N/A), NO-OUTDOOR $ iw list Wiphy phy0 [...] Band 2: Capabilities: 0x11e2 HT20/HT40 Static SM Power Save RX HT20 SGI RX HT40 SGI TX STBC RX STBC 1-stream Max AMSDU length: 3839 bytes DSSS/CCK HT40 Frequencies: * 5180 MHz [36] (20.0 dBm) (no IR) * 5200 MHz [40] (20.0 dBm) (no IR) * 5220 MHz [44] (20.0 dBm) (no IR) * 5240 MHz [48] (20.0 dBm) (no IR) * 5260 MHz [52] (20.0 dBm) (no IR, radar detection) DFS state: usable (for 192 sec) DFS CAC time: 60000 ms * 5280 MHz [56] (20.0 dBm) (no IR, radar detection) DFS state: usable (for 192 sec) DFS CAC time: 60000 ms [...]
no IR. Here is the explanation for this flag:
The no-ir flag exists to allow regulatory domain definitions to
disallow a device from initiating radiation of any kind and that
includes using beacons, so for example AP/IBSS/Mesh/GO interfaces
would not be able to initiate communication on these channels unless
the channel does not have this flag.
iw can
confirm this:
$ iw list valid interface combinations: * # managed <= 1, # AP, P2P-client, P2P-GO <= 1, # P2P-device <= 1, total <= 3, #channels <= 1
$ iw list valid interface combinations: * # managed, WDS, P2P-client <= 2048, # IBSS, AP, mesg point, P2P-GO <= 8, total <= 2048, #channels <= 1
hostapd:
interface=wlan-guest driver=nl80211 # Radio ssid=XXXXXXXXX hw_mode=g channel=11 # 802.11n wmm_enabled=1 ieee80211n=1 ht_capab=[HT40-][SHORT-GI-20][SHORT-GI-40][DSSS_CCK-40][DSSS_CCK-40][DSSS_CCK-40] # WPA auth_algs=1 wpa=2 wpa_passphrase=XXXXXXXXXXXXXXX wpa_key_mgmt=WPA-PSK wpa_pairwise=TKIP rsn_pairwise=CCMP
I have recently moved to Lausanne, Switzerland. Broadband Internet
access is not as cheap as in France. Free, a French ISP, is
providing an FTTH access with a bandwith of 1 Gbps1 for
about 38 (including TV and phone service), Swisscom is providing
roughly the same service for about 200 2. Swisscom
fiber access was available for my appartment and I chose the 40 Mbps
contract without phone service for about 80 .
Like many ISP, Swisscom provides an Internet box with an
additional box for TV. I didn t unpack the TV box as I have no use for
it. The Internet box comes with some nice features like the ability to
setup firewall rules, a guest wireless access and some file sharing
possibilities. No shell access!
I have bought a small PC to act as router and replace the Internet
box. I have loaded the upcoming Debian Jessie on it. You can find
the whole software configuration in a GitHub repository.
This blog post only covers the Swisscom-specific setup (and QoS). Have
a look at those two blog posts for related topics:
/etc/dhcp/dhclient.conf when using the ISC DHCP client:
send vendor-class-identifier "100008,0001,,Debian";
6rd.swisscom.com and the
prefix is 2a02:1200::/28. After appending the IPv4 address to the
prefix, you still get 4 bits for internal subnets.
Swisscom doesn t provide a fixed IPv4 address. Therefore, it is not
possible to precompute the IPv6 prefix. When installed as a DHCP hook
(in /etc/dhcp/dhclient-exit-hooks.d/6rd), the following script
configures the tunnel:
sixrd_iface=internet6 sixrd_mtu=1472 # This is 1500 - 20 - 8 (PPPoE header) sixrd_ttl=64 sixrd_prefix=2a02:1200::/28 # No way to guess, just have to know it. sixrd_br=193.5.29.1 # That's "6rd.swisscom.com" sixrd_down() ip tunnel del $ sixrd_iface true sixrd_up() ipv4=$ new_ip_address:-$old_ip_address sixrd_subnet=$(ruby <<EOF require 'ipaddr' prefix = IPAddr.new "$ sixrd_prefix ", Socket::AF_INET6 prefixlen = $ sixrd_prefix#*/ ipv4 = IPAddr.new "$ ipv4 ", Socket::AF_INET ipv6 = IPAddr.new (prefix.to_i + (ipv4.to_i << (64 + 32 - prefixlen))), Socket::AF_INET6 puts ipv6 EOF ) # Let's configure the tunnel ip tunnel add $ sixrd_iface mode sit local $ipv4 ttl $sixrd_ttl ip tunnel 6rd dev $ sixrd_iface 6rd-prefix $ sixrd_prefix ip addr add $ sixrd_subnet 1/64 dev $ sixrd_iface ip link set mtu $ sixrd_mtu dev $ sixrd_iface ip link set $ sixrd_iface up ip route add default via ::$ sixrd_br dev $ sixrd_iface case $reason in BOUND REBOOT) sixrd_down sixrd_up ;; RENEW REBIND) if [ "$new_ip_address" != "$old_ip_address" ]; then sixrd_down sixrd_up fi ;; STOP EXPIRE FAIL RELEASE) sixrd_down ;; esac
ipaddr module is
pretty basic , it suits the job.
Swisscom is using the same MTU for all clients. Because some of them
are using PPPoE, the MTU is 1472 instead of 1480. You can easily check
your MTU with this handy online MTU test tool.
It is not uncommon that PMTUD is broken on some parts of the
Internet. While not ideal, setting up TCP MSS will alievate any
problem you may run into with a MTU less than 1500:
ip6tables -t mangle -A POSTROUTING -o internet6 \ -p tcp --tcp-flags SYN,RST SYN \ -j TCPMSS --clamp-mss-to-pmtu
ip link set txqueuelen 32 dev lan ip link set txqueuelen 32 dev internet ip link set txqueuelen 32 dev wlan
fq_codel. A qdisc receives packets
to be sent from the kernel and decide how packets are handled to
the network card. Packets can be dropped, reordered or
rate-limited. fq_codel is a queuing discipline
combining fair queuing and controlled delay. Fair queuing
means that all flows get an equal chance to be served. Another way
to tell it is that a high-bandwidth flow won t starve the
queue. Controlled delay means that the queue size will be
limited to ensure the latency stays low. This is achieved by
dropping packets more aggressively when the queue grows.tc qdisc replace dev lan root fq_codel tc qdisc replace dev internet root fq_codel tc qdisc replace dev wlan root fq_codel
Originally published on politi.kov
I have been asked by a bunch of friends from outside of Brazil for my opinion regarding the recent elections we had in Brazil, and it is a bit complicated to explain it without some background, so I decided to write this piece providing a bit of history so that people can understand my opinion.
The elections this year were a rematch of our traditional polarization between the workers party (PT) and the social democracy party (PSDB), which has been going on since 1994. PT and PSDB used to be allies. In the 80s, when the dictatorship dropped the law that forbade more than 2 parties, the opposition party, MDB, began breaking up in several smaller ones.
PSDB was founded by politicians and intelectuals who were inspired by Europe s social democracy and political systems. Parliamentarism, for instance, is one of the historical causes of the party. The workers party had a more grassroots origin, with union leaders, marxist intelectuals and marxist-inspired catholic priests being the main founders. They drew their inspiration from the USSR and Cuba, and were very close to social movements.
Some people have celebrated the reelection of Dilma Roussef as a victory of the left against the right. In my opinion that view is wrong for several reasons. First, because I disagree that PSDB and A cio Neves in particular are right-wing, both in terms of economics and social/moral issues. Second, because I believe Dilma s first government has taken a quite severe turn to the right in several topics that matter a lot to me. Since comparisons with PSDB s government during the 90s has been one of the main strategies of the campaign this year, I ll argue why I think it was actually a pretty good government with a lot of left in it.
Unlike what happens in most other places, Brazil does not really have an actual right-wing party, economics-wise. Although we might see the birth of a couple in the near future, no current party is really against public health, education and social security being provided by the state as rights, or wants to decrease state size and lower taxes significantly. It should come as no surprise that even though it has undergone a lot of liberal reforms over the last 20 years, Brazil is still a very closed country, with very high import tariffs and a huge presence of the state in the economy. There is a certain consensus about all of that, with disagreements being essentially on implementation details, not goals.
On the other hand, and contrary to popular belief, when it comes to social and moral issues we are a very conservative people. Ironically, the two parties which have been in power over the last 20 years are quite progressive, being historically proponents of diversity, minorities rights, reproductive rights. They have had to compromise on those causes to become viable alternatives, given the conservative nature of the majority of the voters.
Despite their different origins and beliefs, both parties share socialist inclinations and were allies from the onset. That changed in 1992, when president Collor, who had been elected on a runoff against Lula (who PSDB supported), was impeached by Congress for corruption. With no formal political support and a chaotic situation in his hands, Itamar Franco, the vice president, called for a national union government to go through the last two years of his term. PSDB answered the call, but the workers party decided against being part of the government.
Fernando Henrique Cardoso, a sociologist who was one of the leaders of PSDB was chosen to lead the Foreign Relations Ministry, but a few months later got nominated to the Economy. At the time, Brazil lived under hyperinflation of close to 1000% a year, and several stabilization plans had been attempted. Economy Ministers did not last very much in office at the time. FHC gathered a team of economists and sponsored their stabilization plan, which turned out to be highly successful: the Plano Real ( Real Plan ). In addition to introducing a new currency, something that was becoming pretty common to Brazilians by then, it also attacked the structural causes of inflation.
Lula was counting on the failure of the Plano Real when he ran against FHC in 1994, but the plan succeeded, giving FHC two terms as president. During those two terms, FHC introduced several institutional changes that made Brazil a saner country. In addition to the hyperinflation, Brazil had lived a debt crises for decades and was still in default. FHC s team renegotiated the debts, reopened lines of credit, but most importantly, introduced reforms that made the Brazilian finances and financial system credible.
The problem was not even that Brazil had a fiscal d ficit, it just did not have any control whatsoever of money supply and budget. Banks, regardless of whether they were private or public, had very little regulation and took advantage of the hyperinflation to hide monstrous holes in their balances. When inflation was gone and regulation became more strict, those became apparent, and it was pretty clear that the system would collapse if nothing was done.
Some people like to say that FHC was a president who ruled for the rich and didn t care about the poor. I think the way the potential collapse of the banking system was handled is a great counter-example of that. The government passed laws that made the owners of the banks responsible for the financial problems, regardless of whether caused by mismanagement or fraud. If a bank went under, the central bank intervened and added enough money to protect the deposits, but that money was a loan that had to be repaid by the owners of the bank, and the owners properties were added as collateral to the loan. As a brazilian journalist once said, the people did not risk losing their deposits, the bankers did risk losing the banks, though. Today, we have a separate fund, filled with money from the banks, that does what the central bank did back then when required.
Compare that to countries where the banking system was saved with tax payer money and executives kept getting huge bonuses regardless, while owners kept their profits. It is hard to find an initiative that is more focused on the public interest against the interest of the rich people who caused the problem. This legislation, called PROER, is still in place today, and it came along with solid regulation of the banking system. It should come as no surprise that Brazil went through the financial crisis of 2008 with not a single hiccup of the banking system and no fear of bank runs. Despite having been against PROER back in the day, Lula celebrated its existence in 2008, when it was clear it was one of the reasons we would not suffer much. He even advertised it as something that should be adopted by the US and Europe.
It is also pretty common to hear that under FHC social questions were not a priority. I believe it is pretty simple to see that that was not the case both by inspecting the growth of social spending and the improvement of social indicators for the period, such as UN s human development index. One area in which people are particularly critical of the FHC government is the investment on higher education, and they are actually quite right. Brazil has free Federal universities and those did not get a lot of priority in the 90s. However, I would argue that while it is a matter of priorities, it is not one of education versus something else, but rather of what to invest on inside education. The reality is basic education was the priority.
When FHC came to power, Brazil had a significant number of children who were not going to school at all. The goal was to make access to schools universal for young children, and that goal was reached. Every child has been going to school since the early 2000s, and that is a significant achievement which reaches the poorest. While the federal universities are attended essentially by the Brazilian elite, given the difficulty of passing the exams and the relative lack of quality of free public schools compared to private ones, which is still a reality to this day, investment on getting children to even go to school for the early years has a significant impact on the lives of the poorest.
It is important to remember that getting every child to go to school is also what gave birth to one of the most celebrated programs from the Lula era: Bolsa Fam lia ( Family Allowance ) is a direct money transfer to poor families, particularly those who have children and has been an important contribution to lowering inequality and getting people out of extreme poverty. To get the money, the families need to ensure their children are 1) attending school and 2) getting vaccinated.
That program comes from the FHC government, in which it was created with the name Bolsa Escola ( School Allowance ), in its turn inspired by a program of the same name by governor Cristovam Buarque, from PT. What Lula did, and he deserves a lot of credit for this, was to merge a series of smaller programs with Bolsa Escola, and then expand the program to ensure it got to more and more people. Interestingly, during the announcement of the program he credited the idea of doing that to a state governor from PSDB. You can see why I think these two should be allies again.
When faced with all these arguments, people will eventually say that FHC was bad because he privatized companies and used orthodox economic policies. Well, if that is what it takes, then we ll have to take Lula down with him, because his first term was essentially a continuation of FHC s second term: orthodox economic policies to keep inflation down, along with privatization of several state-owned companies and banks. But Lula, whom I voted for and whose government I believe was a good one, is not my subject: Dilma is.
On Lula s second term, Dilma gained a lot of power when other major leaders of PT went down for corruption. She became second in command and started leading several programs. A big believer in developmentalism, she started pushing for a bigger role of the state in the coordination of the productive sector, with a clear focus on growing the industrial base.
One of the initiatives she sponsored was a sizable increase on the number and size of subsidized loans given out by the national development bank (BNDES). Brazil started an unnofficial national champions program, where the government elected a few big companies to get a huge amount of subsidized credit.
The goal was for these selected firms to get big enough to be competitive on the global market. The criteria for the choices is completely opaque, if it even exists, and includes handing out milions in subsidized credit for Eike Batista, who became Brazil s richest enterpreneur for a while, and lost pretty much everything when it became clear the oil would not be pumping out of his camps after all, sinking with them a huge amount of public funds invested by BNDES.
The way this policy was enacted, it is unclear how much it really costs in terms of public funds: the Brazilian treasury emits debt to capitalize, lends that money to BNDES with higher than market interest, and BNDES then lends it out to the big companies with a lower than market interest rate. Although it is obviously unsustainable, the problem does not yet show in the balance because the grace period for BNDES debt with the treasury is 2040. The fact that this has a cost and, perhaps more importantly, a huge opportunity cost is not clear because it is not part of the government budget. Why are we putting money in this rather than quadrupling Bolsa Fam lia, which studies show generates 1,78 reais in GDP for every 1 real invested? Worse, why are we not even updating Bolsa Fam lia enough to cover inflation?
When Dilma got elected in 2010, the first signs were pretty bad. She was already seen as someone who did not care much for the environment, and on her first month in power she made good on that promise by pushing to get the Belo Monte Dam building started as soon as possible regardless of conditionalities being satisfied. To this day there are several issues with how the building of the dam is going: the handling of the indigenous people and the small city nearby are lacking, conditionalities are not met.
Beyond Belo Monte, indigenous leaders are being assassinated, deforestation in the Amazon forest has increased by 122% in 2014 alone. Dilma s answer to people who question her on these kinds of issues is essentially: would you rather not have electric power?
Her populist authoritarian nature and obsession with industry are also pretty evident when it comes to her policies in the energy area as a whole. She showed up in national tv on the eve of our independence day celebration to announce a reduction in electric tariffs, mainly for industry, but also for homes. Nobody really knew how. The following week she sent a fast-track project to Congress to automatically renew concessions of power grid operators, requiring those who accepted it to lower tariffs, instead of doing an auction, which was already necessary anyway because the concessions were up on 2015. There was no discussion with stakeholders, there was just a populist announcement and a great deal of rhethoric to paint anyone who opposed as being against the people.
And now, everything went into the crapper because that represented a breach of contract that required indemnification, and we had a pretty bad drought that made power more expensive given the need to turn on the thermal generators. Combining the costs of the thermal generation, indemnity, and financial fallout that the grid operators suffered, we are already at 105 billion reais and counting, nobody knows how high the cost will reach. Any reduction in tariffs has long been invalidated. And the fact that industry has lowered production significantly ends up being good news, we would probably be under rationing already if that was not the case.
You would expect someone who fought a dictatorship to be pretty good in terms of human and civil rights. What we see in reality is a lack of respect for those things. During the world cup, Dilma has put the army on the streets and has supported arbitrary behaviour from state polices throughout the country. They jailed a bunch of demonstrators preemptively. No shit. The would be demonstrators were kept in jail throghout the tournament under false accusations. Dilma s Minister of Justice said several times that the case against them was solid and that the arrests were legal, but it turned out the case simply did not exist. Just this week we had a number of executions orchestrated by policemen in the state of Par and there is zero reaction from the federal government.
In the oil industry, Dilma has enacted a policy of subsidizing gas prices by using a fixed price that used to be lower than the international prices (it is no longer the case with the fall in international prices). That would not be a problem if Brazil was selfsufficient in oild and gas, which we are not: we had to import a significant amount of both. The implicit subsidy cost Petrobr s a huge amount of cash the more gas it sold, the bigger the losses. This lead not only to decreasing the company s market value (it is a state-controlled, but open company), but to reducing its capacity of investment as well.
That is more problematic than it sounds because, with our current concession model, every single oil camp needs to have Petrobr s as a member of the consortium. Limiting the company s investment capacity limits the rate at which our pre-salt oil camps can be explored and thus the speed at which we can become selfsufficient. Chicken and egg anyone?
To make things worse, Dilma has made policies that lowered taxes on car production, used to foster economic activity during the crisis in 2008-2010, essentially permanent. This lead to a significant increase in traffic and polution on Brazilian cities, while at the same time increasing the pressure on Petrobr s, which had to import more and more gas. Meanwhile, Brazilian cities suffer from a severe lack of mobility infrastructure. A recent study has shown that Brazil has spend almost twice as much subsidized money on pro-car policies than on pro-mass transit projects. Talk about good usage of public funds.
One of the only remaining good news the government was still able to mention was the constant reduction in extreme poverty. Dilma was actually ellected promising to erradicate extreme poverty and changed the government s slogan to A rich country is a country with no poverty (Pa s rico pa s sem pobreza). Well, it turns out all of these policies caused inequality and extreme poverty both to stop falling as of 2013. And given the policies were actually deepened in 2014, I believe it is very likely we ll see an increase in both when we get the data for 2014, next year.
Other than that, her policies ended up being a complete failure. Despite giving tax benefits to several sectors, investment has fallen, growth has fallen and inflation is quite high at 6,6% for the last 12 months. In terms of minorities, her government has been a severe set back, with the government going back on educational material against homophoby saying it would not do advertisement of sexual choice , and going back on a decree that allowed the public health system to perform abortions on the cases allowed by the law (essentially if the woman has been raped).
Looking at Dilma s policies, I really can t see that much of the left, honestly. So why, you might ask, has this victory been deemed a victory of the left over the right? My explanation is the aura the workers party still manages to keep over itself. There s a notion that whatever PT does, it will still be more to the left than PSDB, which I think is just crazy.
There is also a fair amount of idealizing Dilma just because she is Lula s proteg . People will forgive anything, provided it is the workers party doing it. Thankfully, the number of people aligned on the left that supported the candidate from PSDB this election tells me this is changing quite rapidly. Hopefully that leads to PT having to reinvent itself, and get in touch with the left again.
There s a lot of discussion / moaning /arguing at this time, so I thought I d post something about how LAVA got into Debian Jessie, the work involved and the lessons I ve learnt. Hopefully, it will help someone avoid the disappointment of having their package missing the migration into a future stable release. This was going to be a talk at the Minidebconf-uk in Cambridge but I decided to put this out as a permanent blog entry in the hope that it will be a useful reference for the future, not just Jessie.
Context
LAVA relies on a number of dependencies which were at the time all this started NEW to Debian as well as many others already in Debian. I d been running LAVA using packages on my own system for a few months before the packages were ready for use on the main servers (I never actually installed LAVA using the old virtualenv method on my own systems, except in a VM). I did do quite a lot of this on my own but I also had a team supporting the effort and valuing the benefits of moving to a packaged system.
At the time, LAVA was based on Ubuntu (12.04 LTS Precise Pangolin) and a new Ubuntu LTS was close (Trusty Tahr 14.04) but I started work on this in 2013. By the time my packages were ready for general usage, it was winter 2013 and much too close to get anything into Ubuntu in time for Trusty. So I started a local repo using space provided by Linaro. At the same time, I started uploading the dependencies to Debian. json-schema-validator, django-testscenarios and others arrived in April and May 2014. (Trusty was released in April). LAVA arrived in NEW in May, being accepted into unstable at the end of June. LAVA arrived in testing for the first time in July 2014.
Upstream development continued apace and a regular monthly upload, with some hotfixes in between, continued until close to the freeze.
At this point, note that although upstream is a medium sized team, the Debian packaging also has a team but all the uploads were made by me. I planned ahead. I knew that I would be going to Macau for Linaro Connect in February a critical stage in the finalisation of the packages and the migration of existing instances from the old methods. I knew that I would be on vacation from August through to the end of September 2014 including at least two weeks with absolutely no connectivity of any kind.
Right at this time, Django1.7 arrived in experimental with the intent to go into unstable and hence into Jessie. This was a headache for me, I initially sought to delay the migration until after Jessie. However, we discussed it upstream, allocated time within the busy schedule and also sought help from within Debian with the RFH tag. Rapha l Hertzog contributed patches for django1.7 support and we worked on those patches upstream, once I was back from vacation. (The final week of my vacation was a work conference, so we had everyone together at one hacking table.)
Still there was more to do, the django1.7 patches allowed the unit tests to complete but broke other parts of the lava-server package and needed subsequent tweaks and fixes.
Even with all this, the auto-removal from testing for packages affected by RC bugs in their dependencies became very important to monitor (it still is). It would be useful if some packages had less complex dependency chains (I m looking at you, uwsgi) as the auto-removal also covers build-depends. This led to some more headaches with libmatheval. I m not good with functional programming languages, I did have some exposure to Scheme when working on Gnucash upstream but it wasn t pleasant. The thought of fixing a scheme problem in the test suite of libmatheval was daunting. Again though, asking for help, I found people in the upstream team who wanted to refresh their use of scheme and were able to help out. The fix migrated into testing in October.
Just for added complications, lava-server gained a few RC bugs of it s own during that time too fixed upstream but awkward nonetheless.
Achievement unlocked
So that s how a complex package like lava-server gets into stable. With a lot of help. The main problem with top-level packages like this is the sheer weight of the dependency chain. Something seemingly unrelated (like libmatheval) can seriously derail the migrations. The package doesn t use the matheval support provided by uwsgi. The bug in matheval wasn t in the parts of matheval used by uwsgi. It wasn t in a language I am at all comfortable in fixing but it s my name on the changelog of the NMU. That happened because I asked for help. OK, when django1.7 was scheduled to arrive in Debian unstable and I knew that lava was not ready, I reacted out of fear and anxiety. However, I sought help, help was provided and that help was enough to get upstream to a point where the side-effects of the required changes could be fixed.
Maintaining a top-level package in Debian is becoming more like maintaining a core package in Debian and that is a good thing. When your package has a lot of dependencies, those dependencies become part of the maintenance workload of your package. It doesn t matter if those are install time dependencies, build dependencies or reverse dependencies. It doesn t actually matter if the issues in those packages are in languages you would personally wish to be expunged from the archive. It becomes your problem but not yours alone.
Debian has a lot of flames right now and Enrico encouraged us to look at what else is actually happening in Debian besides those arguments. Well, on top of all this with lava, I also did what I could to help the arm64 port along and I m very happy that this has been accepted into Jessie as an official release architecture. That s a much bigger story than LAVA yet LAVA was and remains instrumental in how arm64 gained the support in the kernel and various upstreams which allowed patches to be accepted and fixes to be incorporated into Debian packages.
So a roll call of helpers who may otherwise not have been recognised via changelogs, in no particular order:
rc-alert can help you spot problems with runtime dependencies (you do have your own package installed on a system running unstable if not, get that running NOW). Watching build-dependencies is more difficult, especially build-dependencies of a runtime dependency, so watch the RC bug lists for packages in your dependency chain.
Last friday saw a somewhat distressing
email to
the debian-devel mailinglist, wherein Joey Hess, one of Debian's most
valuable contributors, announced his decision to quit the project.
For all of Joey's contributions over the years, this is an unwelcome
message; I'd much rather have seen him remain active in Debian, both on
a personal and a technical level. As it is, I have a feeling of not just
losing a colleague in Debian, but also a friend.
For people not active in Debian, it's easy to miss Joey's contributions
to the project, but let me tell you that without Joey Hess, Debian
simply would not be where it is today. We would not have the
debian-installer and we would not have debhelper (so we would have
massively complicated debian/rules files). More than that, though, Joey
has been one of those people who, on a technical level, seemed to
instinctively sense the right thing to do; as in, whenever Joey Hess
disagrees with you on a technical matter, you know you must be doing
something wrong.
As sudden and as unwelcome as last friday's announcement was, however, I
can't say that it was totally unexpected. I've noticed Joey reducing
his efforts in core areas of the project over the past few years, where
on the one hand he has been mostly withdrawing from debian-installer
development, and on the other hand his two most recent 'large' projects
(ikiwiki and git-annex) haven't really been about Debian. Still, it's a
painful loss; and while Debian has lost other high-profile contributors
in the past over divisive issues, and recovered, that doesn't make it
any less fun.
Here's to you, Joey. May you find joy in whatever you decide to do next.
May you not disappear from our collective radars. May we meet again,
at some conference in the future, so I can buy you a beer. (hint: FOSDEM
)
Whitespace matters.
Git has support for checking whitespace in patches. git apply and git am have the option --whitespace, which can be used to warn or error about whitespace errors in the patches about to be applied. git diff has the option --check to check a change for whitespace errors.
But all this assumes that your existing code is cool, and only new changes are candidates for problems. Curiously, it is a bit hard to use those same tools for going back and checking whether an existing tree satisfies the whitespace rules applied to new patches.
The core of the whitespace checking is in git diff-tree. With the --check option, you can check the whitespace in the diff between two objects.
But how do you check the whitespace of a tree rather than a diff? Basically, you want
git diff-tree --check EMPTY HEAD
except there is no EMPTY. But you can compute the hash of an empty Git tree:
git hash-object -t tree /dev/null
So the full command is
git diff-tree --check $(git hash-object -t tree /dev/null) HEAD
If have this as an alias in my ~/.gitconfig:
[alias]
check-whitespace = !git diff-tree --check $(git hash-object -t tree /dev/null) HEAD
Then running
git check-whitespace
can be as easy as running make or git commit.
rm -f ng
make[2]: Leaving directory '/home/henrich/src/pkg-java/nailgun'
rm /home/henrich/src/pkg-java/nailgun/ng-nailgun
rm: cannot remove '/home/henrich/src/pkg-java/nailgun/ng-nailgun': No such file or directory
debian/rules:16: recipe for target 'override_dh_auto_clean' failed
make[1]: [override_dh_auto_clean] Error 1 (ignored)
make[1]: Leaving directory '/home/henrich/src/pkg-java/nailgun'
dh_clean
gbp:info: Orig tarball 'nailgun_0.9.1.orig.tar.gz' not found at '../tarballs/'
Use of uninitialized value $_[0] in substitution (s///) at /usr/share/perl/5.20/File/Basename.pm line 341.
fileparse(): need a valid pathname at /usr/bin/pristine-tar line 417.
pristine-tar: failed to generate tarball
gbp:error: Couldn't checkout "nailgun_0.9.1.orig.tar.gz": it exited with 255
Yes, and just "cp -arp libspiro /tmp/; cd /tmp/libspiro" and
gbp buildpackage works... (why?)
If someone would have told me that I would visit three feminist events this year I would have slowly nodded at them and responded with "yeah, sure..." not believing it. But sometimes things take their own turns.
It all started with the Debian Women Mini-Debconf in Barcelona. The organizers did ask me how they have to word the call for papers so that I would feel invited to give a speech, which felt very welcoming and nice. So we settled for "people who identify themselves as female". Due to private circumstances I didn't prepare well for my talk, but I hope it was still worth it. The next interesting part though happened later when there were lightning talks. Someone on IRC asked why there are male people in the lightning talks, which was explicitly allowed for them only. This also felt very very nice, to be honest, that my talk wasn't questioned. Those are amongst the reasons why I wrote My place is here, my home is Debconf.Second event I went to was the FemCamp Wien. It was my first event that was a barcamp, I didn't know what to expect organization wise. Topic-wise it was set about Queer Feminism. And it was the first event that I went to which had a policy. Granted, there was an extremely silly written part in it, which naturally ended up in a shit storm on twitter (which people from both sides did manage very badly, which disappointed me). Denying that there is sexism against cis-males is just a bad idea, but the background of it was that this wasn't the topic of this event. The background of the policy was that usually barcamps but events in general aren't considered that save of a place for certain people, and that this barcamp wanted to make it clear that people usually shying away from such events in the fear of harassment can feel at home there.
dominant talk patternsand how to work around or against them also made sure that the rest of the event was giving shy people a chance to speak up and feel comfortable, too. And the range of the sessions that were held was simply great. This was the event that I came up with the pattern that I have to define the quality of an event on the sessions that I'm unable to attend. The thing that hurt me most in the afterthought was that I couldn't attend the session about
minorities within minorities. :/ Last but not least I attended AdaCamp Berlin. This was a small unconference/barcamp dedicated to increase women's participation in open technology and culture named after Ada Lovelace who is considered the first programmer. It was a small event with only 50 slots for people who identify as women. So I was totally hyper when I received the mail that was accepted. It was another event with a policy, and at first reading it looked strange. But given that there are people who are allergic to ingredients of scents, it made sense to raise awareness of that topic. And given that women are facing a fair amount of harassment in the IT and at events, it also makes sense to remind people to behave. After all it was a general policy for all AdaCamps, not for this specific one with only women.
The Debian Edu Team is pleased to announce the release of Debian Edu Jessie 8.0+edu0~alpha0 Debian Edu is a complete operating system for schools. Through its various installation profiles you can install servers, workstations and laptops which will work together on the school network. With Debian Edu, the teachers themselves or their technical support can roll out a complete multi-user multi-machine study environment within hours or a few days. Debian Edu comes with hundreds of applications pre-installed, but you can always add more packages from Debian. For those who want to give Debian Edu Jessie a try, download and installation instructions are available, including detailed instructions in the manual[1] explaining the first steps, such as setting up a network or adding users. Please note that the password for the user your prompted for during installation must have a length of at least 5 characters! [1] <URL: https://wiki.debian.org/DebianEdu/Documentation/Jessie > Would you like to give your school's computer a longer life? Are you tired of sneaker administration, running from computer to computer reinstalling the operating system? Would you like to administrate all the computers in your school using only a couple of hours every week? Check out Debian Edu Jessie! Skolelinux is used by at least two hundred schools all over the world, mostly in Germany and Norway. About Debian Edu and Skolelinux =============================== Debian Edu, also known as Skolelinux[2], is a Linux distribution based on Debian providing an out-of-the box environment of a completely configured school network. Immediately after installation a school server running all services needed for a school network is set up just waiting for users and machines being added via GOsa , a comfortable Web-UI. A netbooting environment is prepared using PXE, so after initial installation of the main server from CD or USB stick all other machines can be installed via the network. The provided school server provides LDAP database and Kerberos authentication service, centralized home directories, DHCP server, web proxy and many other services. The desktop contains more than 60 educational software packages[3] and more are available from the Debian archive, and schools can choose between KDE, Gnome, LXDE, Xfce and MATE desktop environment. [2] <URL: http://www.skolelinux.org/ > [3] <URL: http://people.skolelinux.org/pere/blog/Educational_applications_included_in_Debian_Edu___Skolelinux__the_screenshot_collection____.html > Full release notes and manual ============================= Below the download URLs there is a list of some of the new features and bugfixes of Debian Edu 8.0+edu0~alpha0 Codename Jessie. The full list is part of the manual. (See the feature list in the manual[4] for the English version.) For some languages manual translations are available, see the manual translation overview[5]. [4] <URL: https://wiki.debian.org/DebianEdu/Documentation/Jessie/Features > [5] <URL: http://maintainer.skolelinux.org/debian-edu-doc/ > Where to get it --------------- To download the multiarch netinstall CD release (624 MiB) you can use * ftp://ftp.skolelinux.org/skolelinux-cd/debian-edu-8.0+edu0~alpha0-CD.iso * http://ftp.skolelinux.org/skolelinux-cd/debian-edu-8.0+edu0~alpha0-CD.iso * rsync -avzP ftp.skolelinux.org::skolelinux-cd/debian-edu-8.0+edu0~alpha0-CD.iso . The SHA1SUM of this image is: 361188818e036ce67280a572f757de82ebfeb095 New features for Debian Edu 8.0+edu0~alpha0 Codename Jessie released 2014-10-27 =============================================================================== Installation changes -------------------- * PXE installation now installs firmware automatically for the hardware present. Software updates ---------------- Everything which is new in Debian Jessie 8.0, eg: * Linux kernel 3.16.x * Desktop environments KDE "Plasma" 4.11.12, GNOME 3.14, Xfce 4.10, LXDE 0.5.6 and MATE 1.8 (KDE "Plasma" is installed by default; to choose one of the others see manual.) * the browsers Iceweasel 31 ESR and Chromium 38 * !LibreOffice 4.3.3 * GOsa 2.7.4 * LTSP 5.5.4 * CUPS print system 1.7.5 * new boot framework: systemd * Educational toolbox GCompris 14.07 * Music creator Rosegarden 14.02 * Image editor Gimp 2.8.14 * Virtual stargazer Stellarium 0.13.0 * golearn 0.9 * tuxpaint 0.9.22 * New version of debian-installer from Debian Jessie. * Debian Jessie includes about 42000 packages available for installation. * More information about Debian Jessie 8.0 is provided in the release notes[6] and the installation manual[7]. [6] <URL: http://www.debian.org/releases/jessie/releasenotes > [7] <URL: http://www.debian.org/releases/jessie/installmanual > Fixed bugs ---------- * Inserting incorrect DNS information in Gosa will no longer break DNS completely, but instead stop DNS updates until the incorrect information is corrected (Debian bug #710362) * and many others. Documentation and translation updates ------------------------------------- * The Debian Edu Jessie Manual is fully translated to German, French, Italian, Danish and Dutch. Partly translated versions exist for Norwegian Bokmal and Spanish. Other changes ------------- * Due to new Squid settings, powering off or rebooting the main server takes more time. * To manage printers localhost:631 has to be used, currently www:631 doesn't work. Regressions / known problems ---------------------------- * Installing LTSP chroot fails with a bug related to eatmydata about exim4-config failing to run its postinst (see Debian bug #765694 and Debian bug #762103). * Munin collection is not properly configured on clients (Debian bug #764594). The fix is available in a newer version of munin-node. * PXE setup for Main Server and Thin Client Server setup does not work when installing on a machine without direct Internet access. Will be fixed when Debian bug #766960 is fixed in Jessie. See the status page[8] for the complete list. [8] <URL: https://wiki.debian.org/DebianEdu/Status/Jessie > How to report bugs ------------------ <URL: http://wiki.debian.org/DebianEdu/HowTo/ReportBugs > About Debian ============ The Debian Project was founded in 1993 by Ian Murdock to be a truly free community project. Since then the project has grown to be one of the largest and most influential open source projects. Thousands of volunteers from all over the world work together to create and maintain Debian software. Available in 70 languages, and supporting a huge range of computer types, Debian calls itself the universal operating system. Contact Information For further information, please visit the Debian web pages[9] or send mail to press@debian.org. [9] <URL: http://www.debian.org/ >
).
To my surprise, the call for participation to be part of the
committee explicitly listed representatives of Free Software
communities as privileged software stakeholders that they wanted to
have on the committee kudos to the agency for that. (The
Italian wording on the call was: Costituir titolo di preferenza rivestire un ruolo di [ ] referenti di community del software a codice sorgente aperto.) Therefore, after various prods by fellow European Free Software activists that were aware of the ongoing change in legislation, I applied to be a volunteer CAD68 committee member, got selected, and ended up working over a period of about 6 months (March-September 2013) to help the agency writing the new software acquisition guidelines. Logistically, it hasn't been entirely trivial, as the default meeting place was in Rome, I live in Paris, and the agency didn't really have a travel budget for committee members. That's why I've sought sponsorship from Debian, offering to represent Debian views within the committee; Lucas kindly agreed to my request. So what did I do on behalf of Debian as a committee member during those months? Most of my job has been some sort of consulting on how community-driven Free Software projects like Debian work, on how the software they produce can be relied upon and contributed to, and more generally on how the PA can productively interact with such projects. In particular, I've been happy to work on the related work section of the guidelines, ensuring they point to relevant documents such as the French government guidelines on how to adopt Free Software (AKA circulaire Ayrault). I've also drafted the guidelines section on Free Software directories, ensuring that important resources such as FSF's Free Software Directory are listed as starting points for PAs that looking for software solutions for specific needs. Another part of my job has been ensuring that the guidelines do not end up betraying the principle of Free Software preference that is embodied in article 68. A majority of committee members came from a Free Software background, so that might not seem a difficult goal to accomplish. But it is important to notice that: (a) the final editor of the guidelines is the agency itself, not the committee, so having a "pro-Free Software" majority within the committee doesn't mean much per se; and (b) lobbying from the "pro-proprietary software" camp did happen, as it is entirely natural in these cases. In this respect I'm happy with the result: I do believe that the software selection process recommended by the guidelines, finally published in January 2014, upholds the Free Software preference principle of article 68. I credit both the agency and the non-ambiguity of the law (on this specific point) for that result. All in all, this has been a positive experience for me. It has reaffirmed my belief that Debian is a respected, non-partisan political actor of the wider software/ICT ecosystem. This experience has also given me a chance to be part of country-level policy-making, which has been very instructive on how and why good ideas might take a while to come into effect and influence citizen lives. Speaking of which, I'm now looking forward to the first alleged violations of article 68 in Italy, and how they will be dealt with. Abundant popcorn will certainly be needed. Links & press If you want to know more about this topic, I've collected below links to resources that have documented, in various languages, the publication of the CAD68 guidelines.
In 1.7 seconds I had checked two mailing lists and confirmed that there are no message in the moderation queue. Every morning I currently moderate 68 mailman lists, and it normally take around two minutes. When I took over the two pkg-xiph lists above a few days ago, there were 400 emails waiting in the moderator queue. It took me less than 15 minutes to process them all using the listadmin program. If you install the listadmin package from Debian and create a file ~/.listadmin.ini with content like this, the moderation task is a breeze:% time listadmin xiph fetching data for pkg-xiph-commits@lists.alioth.debian.org ... nothing in queue fetching data for pkg-xiph-maint@lists.alioth.debian.org ... nothing in queue real 0m1.709s user 0m0.232s sys 0m0.012s %
There are other options to set as well. Check the manual page to learn the details. If you are forced to moderate lists on a mailman installation where the SSL certificate is self signed or not properly signed by a generally accepted signing authority, you can set a environment variable when calling listadmin to disable SSL verification:username username@example.org spamlevel 23 default discard discard_if_reason "Posting restricted to members only. Remove us from your mail list." password secret adminurl https:// domain /mailman/admindb/ list mailman-list@lists.example.com password hidden other-list@otherserver.example.org
If you want to moderate a subset of the lists you take care of, you can provide an argument to the listadmin script like I do in the initial screen dump (the xiph argument). Using an argument, only lists matching the argument string will be processed. This make it quick to accept messages if you notice the moderation request in your email. Without the listadmin program, I would never be the moderator of 68 mailing lists, as I simply do not have time to spend on that if the process was any slower. The listadmin program have saved me hours of time I could spend elsewhere over the years. It truly is nice free software. As usual, if you use Bitcoin and want to show your support of my activities, please send Bitcoin donations to my address 15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b. Update 2014-10-27: Added missing 'username' statement in configuration example. Also, I've been told that the PERL_LWP_SSL_VERIFY_HOSTNAME=0 setting do not work for everyone. Not sure why.PERL_LWP_SSL_VERIFY_HOSTNAME=0 listadmin
This is an update of my previous attempt at summarizing this discussion. As I proposed one of the amendments, you should not blindly trust me, of course. :-)
First, let s address two FAQ:
What is the impact on jessie?
Here's how to setup LXC-based "chroots" on Debian jessie. While this is
documented on the Debian wiki, I had to tweak
a few things to get the networking to work on my machine.
Start by installing (as root) the necessary packages:
apt-get install lxc libvirt-bin debootstrap
/etc/lxc/default.conf configuration (no
change needed here):
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = virbr0
lxc.network.hwaddr = 00:FF:AA:xx:xx:xx
lxc.network.ipv4 = 0.0.0.0/24
but I had to make sure that the "guests" could connect to the outside world
through the "host":
/etc/sysctl.conf:
net.ipv4.ip_forward=1
sysctl -p
virsh -c lxc:/// net-start default
virsh -c lxc:/// net-autostart default
/etc/network/iptables.up.rules:
-A INPUT -d 224.0.0.251 -s 192.168.122.1 -j ACCEPT
-A INPUT -d 192.168.122.255 -s 192.168.122.1 -j ACCEPT
-A INPUT -d 192.168.122.1 -s 192.168.122.0/24 -j ACCEPT
iptables-apply
/var/lib/lxc/) is simple:
sudo MIRROR=http://http.debian.net/debian lxc-create -n sid64 -t debian -- -r sid -a amd64
You can start or stop it like this:
sudo lxc-start -n sid64 -d
sudo lxc-stop -n sid64
sudo lxc-stop -n sid64
sudo lxc-start -n sid64
then install a text editor inside the container because the root image
doesn't have one by default:
apt-get install vim
then paste your public key in /root/.ssh/authorized_keys.
Then you can exit the console (using Ctrl+a q) and ssh into the
container. You can find out what IP address the container received from DHCP
by typing this command:
sudo lxc-ls --fancy
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LANG = "fr_CA.utf8"
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
then log into the container as root and use:
dpkg-reconfigure locales
to enable the same locales as the ones you have configured in the host.
I've wanted to ride to Paris for a few months now but was put off by the hassle of taking a bicycle on the Eurostar, as well having a somewhat philosophical and aesthetic objection to taking a bike on a train in the first place. After all, if one already is possession of a mode of transport...
My itinerary was straightforward:
Tower Bridge.
Fanny's Farm Shop, Merstham, Surrey.
Plumpton, East Sussex.
West Pier, Newhaven.
Leaving Newhaven on the 23h00 ferry.
Beauvoir-en-Lyons, Haute-Normandie.
S rifontaine, Picardie.
La tour Eiffel, Paris.
Champ de Mars, Paris.
Pont de Grenelle, Paris.
Cormeilles-en-Vexin, le-de-France.
Gisors, Haute-Normandie.
Paris-Brest, Gisors, Haute-Normandie.
Gournay-en-Bray, Haute-Normandie.
D but de l'Avenue Verte, Forges-les-Eaux, Haute-Normandie.
Mesni res-en-Bray, Haute-Normandie.
Dieppe, Haute-Normandie.
La Mancha .
Peacehaven, East Sussex.
Highbrook, West Sussex.
London weather.
Next.