My too-long absence from writing much here can be ascribed to two, differently pleasant, activities. First, a fantastic vacation in Cuba, and second, the redesign and launch of the XTech web site. Of the first, come to my place for dinner and I'll bore you at length about how amazing it was. Of the second, I'd like to bore you right now! Thanks to Ruby on Rails and a few late nights, the XTech site now has these new features:

• Full conference schedule (apart from 6 Mozilla talks I'm still nailing down)
• A blog. With go-faster Atom 1.0 stripes and everything!
• Details on the newly-added Ajax Developers' Day.

A few more details on the Ajax Developers' Day. As I mentioned before, when putting together the schedule we felt there was a lot of excellent content still missed out (I'm still feeling guilty at having rejected proposals from many good friends and excellent speakers). So, we put together an extra day at the beginning of the conference where we could go further into detail on Ajax technologies. This day, featuring speakers such as Simon Willison from Yahoo!, XML expert Kurt Cagle and OpenLaszlo's Max Carlson, will allow those working on Ajax projects--either deployment or toolkits--to meet, discuss best practice and move forward on new ideas. Although it's a day-long event, we didn't want to make the price tag as high as a full-day tutorial, so you can register for the cost of a half-day tutorial. A few implementation details If that all sounded a little like advertising, here are some technical details worth sharing. The site's CMS is built on Ruby on Rails. Development was done on Linux, with the help of WINE to check out the view from Internet Explorer. The newsletter is managed by the absurdly wonderful CampaignMonitor. This conference not for sale Before I went on vacation, there was some debate in various quarters about paid-for plenary and keynote slots in conferences. Though I hope it is obvious, I wanted to state where I, and thus the XTech conference, stand on this issue. It has always been my policy to maintain a strict separation between the commercial and editorial aspects of XTech. Although each year there's always a company who thinks they can buy a speaking slot, I never let this happen. The content of the conference is formed by editorial selection by the programme committee, who take the scores from the peer review panel as their primary guide. Aside from what I hope shows in the excellent quality of the talks and generally interesting keynotes (yes, we get it wrong occasionally!), there are two effects on the conference.

• Sponsors are that much more respected. When a sponsor respects the delegates' time and intelligence, but still attends, you know they're serious about engagement with attendees.
  
• A higher portion of the conference cost is in the registration fees than for some other conferences. We're still trying to keep the costs as low as we can, but we're not prepared to compromise the quality of the schedule by letting vendors buy talk time.

I hope this explains a little of my position. As a stance, it often creates more issues for me than it solves, but I believe it preserves XTech's reputation as a conference where you can hear some of the best no-fluff presentations on web technology.

The State Services Commission (SSC) (the NZ government body that oversees NZ government departments) released a guide to legal issues in using Open Source Software recently. The publication of this guide has caused a certain amount of consternation in the open source community and even manged to make it to Slashdot and Groklaw as well as spawning a fairly active thread on the NZ Open Source Society’s openchat mailing list. Through all of this I’ve found myself very much on the opposite side of opinion to most other people commenting on it. My initial thoughts on the document are quite nicely summarised by the Groklaw comment that Stuart points out. While the document uses some unfortunate language, there is nothing in it that is actually untrue. In fact my initial feelings towards the document (without having read it thoroughly) were that it was good to see the SSC taking enough notice of open source to feel the need to advise departments on the particular issues that it can bring up. Particularly dissapointing to me are the conspiracy theories that have been flying around. Groklaw surmises that the paper is a Microsoft hatchet job simply because it was authored by Chapman Tripp (a large NZ law firm) who happen to also represent Microsoft NZ on a range of intellectual property issues. I’ve yet to hear a single shred of evidence to back up this assertion and I find it quite ridiculous. Large firms working in a small market such as NZ will often run into conflict of interest issues and have well established procedures for dealing with them. Without seeing evidence to the contrary I cannot accept that a reputable firm like Chapman Tripp would risk their reputation by trying to intentionally mislead the goverment in a report like this. A far more like scenario, to my mind, is simply that the author(s) of the report are not very familiar with open source issues and didn’t do quite as much research as they should have to bring themselves up to speed with the unique IP features of open source licenses. Having read the document more thoroughly now, I can agree that it is far from perfect. I think the single most glaring problem is that it focusses only on open source software and doesn’t mention that many of the risks also exist when using proprietary software. This could leave an uneducated reader completely scared off open source due to a mistaken belief that it is far too risky. On the other hand we shouldn’t completely dismiss the document either as it does raise a number of clear risks that a department will face in adding open source software to their IT environment. We’re not going to do ourselves any favours by pretending that open source is a panacea to all the worlds software ills and can just be dropped in to any IT environment to make things better! It’s worth pointing out at this point that previous evidence from the SSC indicates that they are open source friendly. They have a very clear policy stating that Departments are encouraged to consider open source software alongside proprietary software and use it in cases where it wins on the basis of cost, functionality, interoperability, and security. Given this history, I am alarmed at the hostile reactions many participants on the NZOSS open-chat mailing list had to the document. Quite frankly I think some people are responding far too emotively to the language in the document (which is problematic - but not that bad) and missing the chance to evaluate the rest of it in an objective manner. We have a SSC that has indicated a friendliness towards open source in the past, and I don’t think that they would turn around and reverse their position in this manner. This report is intended to support their overall policy after all. Rather than jumping down their throats and shouting about how poor the document is we need to engage in a civil dialog, point out the issues with the document and offer constructive suggestions for how the document can be improved. To that end, Peter Harrisson has started some pages on the NZOSS wiki where we are going to co-ordinate our impressions and responses to the document so we can present a consistent NZOSS position to the SSC in response. I’d encourage everyone with an interest in the document to read and contribute to those pages. As for exactly what I form our response should take and what it should consist of? I’ll follow up with another post on that later in the weekend when I’ve had a bit more time to reflect.
What I do know (if you haven’t guessed already) is that I think we should be very careful not to respond in a hostile and emotive manner that will result in our relationship with the SSC becoming worse. That means we should take time to consider the document objectively, evaluate its propositions and provide a well researched and substantiated list of suggested improvements to the SSC.

I was at a client today when I remembered that David was due to arrive to Caracas circa 1430, so I called him to his brand-new-venezuelan-GSM-cellphone and I found out that he was in problems. In big, dark, awful problems. As I told in previous posts, he went to San Crist bal (near the border with Colombia) to visit his girl and know the city. He departed from Caracas in a bus on Friday night and arrived on Saturday morning. He spent the whole weekend there, and in Monday he was due to leave San Crist bal through the Mayor Buenaventura Vivas Military Airbase, in a civilian airplane. He arrived just on time for his flight, rushing to take the plane on time, and he was stopped by two so-called Inmigration Officials who demanded to see his passport. He recently got a new one from the Passport Office in Mexico City, so he had a brand new passport with the Venezuelan Entry Stamp (Mexicans don’t need a visa to enter Venezuela)
ONIDEX, the National Office for Inmigration. Praised for lots of people for fighting against Passport Corruption, kidnaps people in San Cristobal. The Officials told him that his passport was a fake, and they told him that, from this time on, he was under arrest. They made him leave the Airport quickly and took him in a civilian vehicle with no identifications. They started the trip to San Crist bal City (1 hour away from the Airport in a very scary road) and they kept telling him that his passport was fake (they claimed that the Passport didn’t have the watermarks, and stuff) Soon their position changed and a common practice in Venezuelan officials started: extorsion. They told him that there were “several ways to fix the problem”, and asked him what was in his backpack (which had a laptop, but he denied it): they were demanding money, and David wasn’t prone to do that.
National Guard. Doesn’t have a /proc/clue about anything. They drove David to the Inmigration Office in San Crist bal and told him that they “made” some tests to the passport and they determined that the passport was fake. They told David that their “Commander” told they that he should be deported into Colombia, since he was a “very important member of a Cartel that they were willing to capture”
DISIP: the Venezuelan Political Police. They were helpful in this episode, but they’re not angels. Finally, hours after that charade of Officials telling him funny laws, stupid suppositions and wanting him to give them money, they left David in the Bus Terminal in San Crist bal, where he was able to talk to Ana, from Debian Venezuela, which picked him up and went back to the Airport. The two “Officials” weren’t there anymore, and he had a last problem with the National Guard which had stupid suppositions about his trip, and stuff (this is common, but at least it’s not illegal) before he was able to get into the plane. Being in Caracas, I was really worried. Between Ana, my mother and me we were able to move several people to check David status in the Airport (my mother called four members of the Venezuelan FAA, I called the Venezuelan CIA and Ana called the Vicechancellor) and this probably saved David’s life and money, since the “Officials” might have been scared by the movement of people caring about David. He’s safe now, back in Caracas, in home. He has all his stuff and his health is OK (yet he was scared when he arrived, which I fully understand) Why am I writing this post? I’m really concerned about what happened to David, and I want to make a public statement on this. Somehow, we venezuelans got used to this kind of practices in our Country. Probably 40 years of pseudo-democracy with messy governors helped, maybe it’s a matter of education and culture. I don’t really care about this, but I do care about what they’re doing with the people in my Country. Today, President Chavez declared that a dance against corruption was going to start. I think it’s the fourth time he’s making something about corruption, and he’s failing. There’s a gang of people in San Cristobal, Mr. President, who tries to rob and scare the visitors. They should be in jail. They arrested somebody illegally. It’s forbidden in our Constitution to arrest somebody without having proofs to do it (we have one of the best Constitutions in the World, experts say, but we don’t have people who obey it). If you’re going to arrest an alien, you need to have a Public Prosecutor in place, writing down a legal document and guaranteeing the safety of the detained. This people should be in jail.
Stop Corruption! Though, as my mother later said to David, two awful Venezuelan people kidnapped David, but probably twenty Venezuelan people quickly acted to find out what was happening. We might be a Third World Country, but we use to be able to get out of our problems by our own. And, hell it’s rewarding. I want to apologize in the name of all venezuelans to David and to make a clear statement against corruption: we venezuelan won’t tolerate more corruption. We’ve grown between that, buying places in a line to get our National ID Card, paying one million bolivares to get a Passport appointment. We’re sick of this. This is not the great Venezuela we live in. Please, losers, shoot yourselves. Or eat rat poison, whichever makes less stains.

Based on this:

Next stop, Openmap. Openmap was in English and I got a little further with it. But the program still got stumped when I put in that geology map. I'm starting to think that maybe there's something wrong with the geology map, even though I was able to open it on its own under ArcExplorer. Oh, and Openmap made all of my xterms all funky --- they changed from filling up 2/3 of the screen and being white type on a black background to filling up 1/5 of my screen and being black type on a gray background. Ugly.

I'm pleased to award you your official linux geek diploma. It's been a while coming, I know. :-) (PS, you might want to look and see if openmap did anything to the .Xresources file in your home directory when you installed it.)

(From that firehose of software releases, Freshmeat) Turn to fgr. "Fgr is a small and simple application that finds files and pipes the result to grep in order to refine the search based on content." "This release adds Japanese translations. It removes unnecessary build dependencies." When did Emacs start counting as a build dep? I don't think I need to actually look at the program's info page -- it's fairly likely that this is written by the same person as wrote For each File (or, at the very least, they carry the same overengineering gene). Finally, since no blog entry would be complete without a bit of Desktop Wars, I leave you with this gem: "This command is used by the Xfce desktop environment".

I finally replaced my aging SCSI scanner over the weekend. It was making really odd noises while scanning, and had somehow upset my SCSI chain such that the BIOS could load GRUB ok, but GRUB then couldn't load the kernel. I have better things to do with my time than sacrifice goats, so I went looking for a cheap 'n cheerful replacement. Oddly enough PC World provided an acceptable option. They have a system whereby you can reserve an item on the web for pickup from your local store, and get a reduction off the in store price. I have no idea why they don't just reduce in store prices anyway. I ended up with a Canon LiDE 60 for £44.82, slightly less than ebuyer charge before P&P and with the added advantage that I could go and pick it up on Saturday. I had, of course, done some research beforehand to ensure this was a supported scanner, however it turned out I'd misread. I thought the version of SANE in Debian was a little old; turned out the versions for sane-frontends and sane-backends differ and I'd looked at the former instead of the latter. Plus I thought I was going to need to pull a CVS or snapshot copy to get the support I needed. So I unwrapped the scanner, plugged it into a spare USB port and checked lsusb showed it up. Then, just to see what would happen, I tried scanimage -L and was rewarded with device genesys:libusb:004:009' is a Canon LiDE 60 flatbed scanner. Rock. scanimage just worked and produced a nice PNM of my Electric Six CD inlay. I don't think installation could have got any easier than that. Admittedly I already had SANE installed as I'd had a previous scanner, but if I hadn't the only addition would have been aptitude install sane-utils.

There's nothing more disturbing than a wrong monitor resolution setting. In my lack of understanding I chose 1280x1024 for use with my 19" CRT, as I was tired of the huge 1600x1200 workspace. (My vision got slightly worse over time and I hate wearing glasses when I am staring at a computer monitor.) So 1280x1024 is not really 4:3 and I only noticed it when I looked at something which should have been a circle but was an ellipse instead. Well, armed with a set square (oh, I would have written measuring triangle, but ok, this seems to be the technical term for it) I refit the image displayed by my CRT to have the same DPI setting on both the vertical and the horizontal direction. So circles are circles again and squares are squares. The world is looking nice again! It is still a bit unnatural, given the black borders on the left and the right side of the picture. But well, it's certinaly more room than 1280x960 would provide me.

I was baking waffles today, using my not-so-secret recepy. I needed about fifteen of them, and murphy helped me let it take far longer than initially expected. I had already made some errors in creating the dough (though nothing that I couldn't fix), and when I had eventually finished it and was halfway through baking those waffles, my waffle iron broke down. Which wasn't totally unexpected, given how this is a waffle iron that was part of the inheritance of an aunt of my dad's who had died even before I was born, which must have been approximately fourty years ago. Still, it had me sitting there with a broken waffle iron, a promise that I'd be baking waffles for a fundraising activity, and only half the number of waffles that I needed. I had found myself a slight little problem. So, I went to a local shop, had a look at the waffle irons that they had for sale, and chose one that looked OK to me. I hadn't taken a close look at the box, but the saleswoman had shown me the device and it looked well suited for my needs. Once home, I showed it to my brother. Who promptly exclaimed that 'it is the same as the old one'. At first, I wanted to protest; but on close examination of the picture on the box, I had to agree that he was right! They had restyled the one inside the box—given it a different colour, and used a temperature dial with a more modern look—but it was, indeed, the same model. And this redesign must have happened fairly recently; the illustratory pictures in the user manual still show the 'old' style design, which is identical to the old waffle iron, modulo approximately fourty years of technical evolution. In fact, the single most drastic change between the old device and the pictures in the manual of the new one would seem to be the fact that the company producing these devices changed names in the mean time. They also appear to be having a website, which contains pictures of yet another design of the same appliance. I was baffled. I mean, sure, home appliances are not computers, and I could imagine how a waffle iron, designed five years ago, would still be in sale today. But after that long? What I haven't checked yet, for lack of time, is whether the irons of the old device would fit in the new device. I'll do that tomorrow, because the old device had a 4x6 "Brussels waffles" iron, whereas the new only came with a double 4x7 "Home-made waffles" iron, and an iron for six heart-shaped biscuit waffles. If that would fit, then that would save me an expense of 32 euros—I love baking Brussels waffles, so any waffle iron I use needs to be able to do those. Even if it can only do so one waffle at a time. The ability to use the iron of that 40-year-old thing in the new device would be... great.

Today is ircbot-day. Let’s worship all those ircbots who serve us with information, announce new stories or submissions, keep an eye on our servers, annoy dkg, mirabile and others ;-), or just turn someone’s head. So today I think of

• jabba — for announcing every Symlink story, announcing any Symlink submission to the Symlink editors and for bothering anyone who says “re” on #symlink or #lugs. ;-)
• gaby — for never letting an eye from any of the ETHZ Departement of Physics’ computers and for probably being the most sexy chatteress on #lugs. ;-)
• MelOne — for always knowing what we said on #symlink.
• blogbot — for remembering all our blogs and a little backlog on #blosxom
• captu (aka Copyra Pasta) — for helping us to not paste a lot of waste into #lugs.
• blutbot — for I just can’t remember what he did and what he could do. Maybe I also don’t want to know.
• And of course also a thanks to all these NickServs, ChanServs, MemoServs and StatServs out there in the net for their ubiquitous services.

Thanks to all of you not war-making ircbots for existing. Without you, IRC would be less funny. ;-)

Jurij, I would not get panicky just because somebody claims MD5 can be "broken" really, really, really quickly. They do not reveal many details but reading their attack scenario you can get a slight idea of what they did to "weaken" MD5. In this case the attacker have control on both documents, the original and the forged one. I assume their method relies on getting a signature on exactly the same document that they created - without any modification and also on having a way to insert hidden, redundant data. And the signing party must be sufficiently stupid to sign things that it has no control about. Applying this in a real-world scenario should become a bit more complicated. In most formats you can discover manipulations based on adding additional data. And in stronger watermarking technologies it would become much more complicated to add random data without violating the watermarking quality criteria (or even breaking the cover format). All that just speculation, of course. I am looking forward to reading their paper.

Short summary: I can’t stay away from coding Blosxom plugins. Perl rules. PHP sucks. ;-)

• New version 0.04 of the tagging plugin, supporting Technorati style tag links to many resources.
• New add-on plugin pathbasedtagging to the plugin tagging, implementing Technorati style tag links in pure Blosxom without any help from Apache’s mod_rewrite.
• New plugin dept offering Slashdot like “dept.” lines for Blosxom postings.

Supporting Technorati style tag URLs After releasing the last version of my Blosxom plugin tagging, I noticed that Technorati only seems to like URLs ending in “/tagname” but not ending in “=tagname” (as they do if you use classic query strings instead of the path info), even if the a tag has a rel="tag" attribute. And not only I noticed this but also some other users of the plugin. (Although I do wonder how Furl made it to a Technorati partner with URLs like http://www.furl.net/furled.jsp?topic=tags…) So I somehow had to change the syntax style for my tags. This wasn’t very hard for the links, but I wanted them to still link to my blog and not to Technorati, Flickr, Wikipedia or any other external resource. Implementing Technorati style tag URLs The obviously easiest solution for someone who’s using and administrating Apache web servers for nearly ten years now was to use some mod_voodoo—eh—mod_rewrite:

RewriteEngine On
RewriteRule ^/cgi-bin/blosxom.cgi/tags/(.*)$ /cgi-bin/blosxom.cgi?-tags=$1 [PT]

That way I could use Technorati style tags and had a well performing solution. But somehow this solution wasn’t that satisfying since it wasn’t pure Blosxom and therefore had some dependency including access to some Apache config file. (Even if the config file was called .htaccess. ;-) A pure Blosxom solution A few days ago I somehow noticed that in general a special behaviour on some URLs could also be implemented using Blosxom’s API. Using the entries function to modify the Blosxom internal path itself before Blosxom or e.g. the entries_index runs but not returning any hashes, allows to have some path like URLs not being treated as a path by Blosxom. Unfortunately this couldn’t be incorporated into the tagging plugin itself, since plugins doing such path interpreting voodoo needs to be ran before any plugin supplying an entries function runs. But the tagging plugin must run after such a plugin. So I created the small add-on plugin pathbasedtagging which is solely thought for use together with the tagging plugin (but may have other, yet unknown purposes). And since I got asked if they could use the tagging plugin to link to external tag URLs instead of the own blog, I included a ready to use list of more or less popular external tag URLs including Technorati, Flickr, del.icio.us, de.lirio.us and Wikipedia. from the slashdot dept. Since I’ve always liked the often sarcastic or even evil comments inside Slashdot’s subtitle alike dept. lines and since I’m also used to use them at Symlink, I wanted them in my blog, too. Time for a new plugin. The basic work of parsing out the data from the text files the posts reside in was already written for the tagging plugin. So I just had to use that code, simplify it and add some little more code to get the dept plugin whose results you can see in my blog directly beneath the title of a posting since a few days now. Update 02:52h Hey, see my Technorati profile: It worked! Technorati recognised the tags! Yeah!

Just killed all the remaining comment spams (I hope) and implemented a simple regexp based blacklist which should get most medicaments, potence pills, casinos, lotteries and other frequently posted junk. I hope, it does not hit too many valid posts. If you have problems posting comments, feel free to contact me by e-mail or on IRC. In other news, I installed the blosxom plugin comments_recent and adapted the mail feature of writeback notify to my (in the meanwhile heavily modified) instance of the comments plugin v0.6. I also made it symlink-safe for use with multcat.

I really like the simplicity of Blosxom as blogging framework and I also like Perl very much. But somehow this Perl 4 alike global variables madness of Blosxom v2 sucks in several ways: It effectively prevents Blosxom from being used with mod_perl and it’s just not what I would call an API. I would like to have a more object-oriented plugin API and it should be save for use with FastCGI, mod_perl or similar possibilities to cache the parsed script code instead of reparsing with each request. Another thing should be a tagging facility. Had to write that by myself for Blosxom v2. (Wasn’t that hard though.) But since Blosxom v3 development seemed to have stopped in May 2004, I have been thinking about and looking for alternatives. First thought was to write a Blosxom clone by myself using Embperl as framework (as I did with web galleries after not finding any web gallery software fitting all my needs). But since I got infected with Ruby recently, I also thought about writting a Blosxom clone in Ruby, which would give me quite a lot of Ruby experience and would make a good fit since Ruby as well as Blosxom have some kind of Zen (or KISS) philosophy. The next thought was: I can’t be the first to come up with that idea and googled a little bit. First thing I digged up was Rage, some kind of Blosxom on Rails. But I didn’t find any source code although the author seems to prefer open source software. Seems as if it is seems to be ready for production but not ready for public release. The next thing I found was hint to some Blosxom clones in the Ruby Application Archive (RAA). Unfortunately two of them (sakura and lily) seem to have Japanese only web pages. :-( But for luck the third Ruby based Blosxom clone found in the RAA, Blosxonomy, seems to be quite well featured, under actual development, has a english written web page and one of if its main concepts is taggability. And also the other core concepts sound fine: simplicity, extensibility and compatibility. Sounds really perfect and I’ll probably give it a try, but not on my current blog host: There is no Ruby installed and it’s not my own box.

Now playing: Rolling Stones — Ruby Tuesday

After blathijs and I today talked a little bit about blosxom plugins on the #blosxom IRC channel, I installed the listplugins plugin. Since I’m a perfectionist in some things, I had to configure it to link every plugin I use to it’s web page or source. While going through my plugin list, I noticed that there were three additional plugins I wrote myself and of which I thought I should share:

• acronyms works similar to and is losely based on Fletcher Penney’s autolinks but instead of setting links it marks configurable keywords as abbreviation or acronym and show their expansion when hovering over the keyword (all using standard XHTML).
• xml_ping_generic is based on xml_ping_weblogs and can ping an arbitrary number of URLs to be pinged with the weblog.com’s XML RPC ping API. By default it pings weblogs.com and technorati.com.
• date_rfc822 is nothing else than the 822-date command (which returns a date in RFC 822 conform format and is written in Perl, too) wrapped into a blosxom plugin. Work similar to date_fullname. I use it for including <pubDate> tags in the RDF.

All plugins are published under the same open source license, they initially came with. In other news… I started using XFN, the XHTML Friends Network, at least the blogroll, and created accounts at Technorati and at yigg.de, a German Digg.com clone formerly respective yet still known as digg.de

Now playing: Battle Without Honor or Humanity — Hotei Tomayasu (from the Kill Bill Soundtrack)

I once decided not to have a blog, because I feared, the time I will spent blogging would vanishing from my Symlink time. But due to Symlink not being a real blog but rather a news and discussion website with a journalistic attitude and limited subjects, there are topics missing I would like to write about. And due to not wanting to spam my beloved IRC channels with all those uninteresting subjects, a blog seemed to be the right place: Nobody needs to read it, but anyone can read it. And since Blosxom (which I first noticed at zobel’s and at alphascorpii’s blog) is fully the way I would design a blog (technically), I installed it today, tweaked a little bit the httpd.conf of our Apache and there it is: My never wanted but inescapably closer coming weblog named Blogging is futile. And it will probably be mixed, German and English.

Joey mentioned a few unix utilities and started collecting them. I create utilities for my work but usually they are too specialized and mostly fall into the "process my unique file format" category. I have however a few more generally usable utilities which haven't seen the world outside my computer and thought I'd make them more accessible.

todist

Input is a list of numbers, one on a line. Output is their distribution, a value and how many time it occurs in the input. Useful for my statistics and performance work.

tostats

Input is a list of numbers, one on a line. Output is some statistics about the numbers: average, stddev, min, max, mid point.

I also have a few non-unix-style utils that are useful (to me), It's a fairly simple multiple machine synchronization by using multicast messages. It's also useful to synchronize on a single machine, running it at the end of one command sequence and running the receiver to wait for it to end and do some other commands. It enables the equivalent of: cmd && othercmd && thirdcmd for multiple branches, so I can run two or more command chains when one ends.

There is a, well, very arrogant page in the autopackage wiki, which basically boils down to "everything around Linux is crap, so if you write an app for Linux, do it our way". They totally have lost the grip of reality, apart from just writing a lot of things on Debian and other Linux distributions which is outright wrong. But it looks like Debian no longer is on it's own with outright refusing to support autopackage crap. Looks like Python, C++, GTK, GlibC and the GNU toolchain. Oh, and pretty much everybody else. So, dear autopackage, if everybody except you is stupid, why don't you just leave us alone, and write your own OS according to your rules? I bet you'll find out after some time why they were setup this way... and what breaks with $your_way. And developers: Ignore autopackage, at least until they've adopted a sane attitude towards cooperating and dropped their arrogance. And they offer a solution which actually solves problems, instead of introducing tons of new ones (especially bringing back fragmentation, and all the dependency hell and incompatibilities a good package mangement tries so hard to avoid) If you really think you need "average" users to be able to try your latest version without wating for an "experienced" user to build packages for them, maybe have a look at Klik. While I have a low opinion of this approach in total, Klik seems to have a much better design, and especially a much better attitude.

Mike Hearn's 'Linux Problems' page has some interesting assertions on how to 'fix' Linux and make it 'enterprise-supportable' (which seem to boil down to: distributions suck, so avoid them; Python sucks, so avoid it; C++ sucks, so avoid that too; glibc, gcc and headers suck, so they need fixing; shared libraries, too, are hard for us, so we'd like other people to avoid dealing with them because autopackage is king).

The Debian bit is just flat-out wrong:

Debians dependency scanner is broken anyway, as there's no way to tell what version of a library is actually needed. Only the developers know that. It works around that problem by assuming that the binary requires whatever version it was built against (which as we see elsewhere may be true or may not be).

Cute, but no. Packagers can specify in shlibs files, the last ABI break. So if your library adds a new interface in 2.1.3-1, then you can put:
libfoo 1 libfoo1 (>= 2.1.3-1)
in your shlibs file, and wham, anything built against libfoo now gets that dependency. Of course, if the downstream packages are really ninjastupid, they can hardcode in their library deps.

Why should the convenience of Debian packagers, who number in the low 2s, outweigh the convenience of people who download autopackaged binaries from the website, who number in the high 200s/day?

Actually, last I checked, there were close on 1000 registered Debian developers, who had gone through the long process. I don't know how long the New Maintainer queue is (except: really long). There are millions and millions of users of Debian and its derivatives (Ubuntu, Knoppix, Maemo, et al). If you're going to be a condescending twat, could you at least please try to be accurate, instead of picking on Debian for being insignificant compared to your hundreds of downloads per day?

One year ago, I uploaded shadow 4.0.3-31 with "New maintainer" in the changelog. During this year, the shadow maitenance team has been built with Alexander Gattin, Christine Spang, Martin Quinson and last but definitely not least Tomasz Kloczko, the upstream author and Nicolas Fran ois, the best non DD ever. In one year, this wonderful team built 35 releases, closed 214 bugs (according to the changelog), cleaned out the BTS which had about 300 opened issues at that time. There are now 35 opened bugs, 24 being fixed in upstream's CVS, 3 tagged "wontfix" and 1 fixed in experimental. In short, there is no reported issue that hasn't received attention. It took us six months before being able to resynchronize the Debian version of login and passwd with upstream. After achieving it and after dozens of exchanges with upstream, the size of the diff.gz file went down from over 1.5MB to about 120kb in the next release. Upstream changelog is now full of patches and rewards to Debian. We used 26 cheese names for naming releases in a tradition established after a famous Cheese Party held at Debconf 5. Be prepared for the Debconf 6 Cheese Party! I see this work as a good example of revival work for an essential package and good collaboration with upstream. I probably have my part in this, trying to keep the communication, sometimes making decisions and always revive work on forgotten issues. But, definitely, I have to deserve a special mention to Nicolas. He's definitely the one who understand the whole code and when he didn't knew, he just learned. Without him, we would never have been able to achieve this. Please, just give him direct DAM approval if he ever applies as a NM...:-) Again, happy birthday to the new shadow....