There is currently some discussion about a talk which used pornographic imagery and jokes to illustrate points about Ruby programming [1]. A similar event happened in 2006 here is the description of the event from the author - which includes an unreserved apology [2]. It seems to me that the current discussion focusing on what is inappropriate for a public lecture is the wrong way to do it as there is a vast range of inappropriate material. I suggest that instead a white-list of appropriate references to porn in lectures will be more effective - if nothing else it makes for a much smaller list. Here is a first draft of such a list:

1. Pornographic web sites handle a lot of traffic. There are significant technical problems that need to be solved. A lecture from an employee of an Internet porn company which covers the solutions to those technical problems would be of interest to many system administrators. Of course such a lecture should not promote the Internet porn company or show any samples of their products.


2. Digital processing of images is an interesting topic. Having a digital editor from a magazine such as Vogue describe in detail how they do their job would be really interesting. There is a lot of overlap between the range of pictures displayed in Vogue and those displayed on porn sites. Having an employee of a porn company demonstrate how they touch up the picture of a fully clothed model would be an interesting technical topic, but of course it would be totally inappropriate to make any specific mentions of how the parts of the picture which are not PG-13 rated are edited. Even showing a picture of a porn star might be controversial, but I m sure that the same work could be reproduced with a photo of someone who has a more respectable career. Touching up a picture of RMS to make him look like a politician would make for a challenge for the presenter and an interesting lecture.


3. The image known as Lenna is a photograph of a Playboy model named Lena that is widely used to test image compression [3]. While the image remains controversial, it seems to me that it would be impossible to give a complete and factual account of the history of image compression without mentioning it.


4. The police have great discretionary powers to determine which crimes should be actively investigated. Senior police decide how many resources to assign to each case. I believe that in many jurisdictions the police will assign a much lower priority to a hacking case if the victim is running a porn service. Rumor has it that porn sites put a lot more effort into system security than most Internet services, partly due to not having as much protection from the police as other industries and partly because their customers don t want to be identified. I would be very interested in attending a presentation about practical computer security by a system administrator from a porn site. As an aside I m always interested in talking to people who do security work, so I would like to have a chat with someone who does such work for a porn site.


5. A few years ago I attended a lecture about the security implications of porn surfing. It had some scary statistics on the number of porn sites that try to deploy malware on the computers of the people who view porn, and it made a good business case for banning porn at work without reference to HR issues (which is very relevant for the jurisdictions where viewing porn at work is not considered to be a social problem). I would like to see a new version of that talk with statistics based on more recent research, my theory is that modern porn sites are more toxic than the old ones due to the general increase in criminal activity on the net - but I have no evidence to support it.

Of course in all cases jokes about porn are not acceptable, mentions of porn need to be strictly on the basis of historical analysis or the description of technical and legal issues which are relevant to the audience. Delivering a talk about porn without inappropriate jokes would take a great deal of effort, but it can be done (and I ve seen it done once). For these five cases (and the few others that will probably be suggested in comments) it would probably be best if the conference organisers viewed the talk first to ensure that there was no misunderstanding about what is appropriate. I think that comparing a short list of specific cases where porn can reasonably be mentioned in a public lecture with the vast number of potential inappropriate references illustrates the probability of a random porn reference being acceptable. The probability of making a random porn reference that is appropriate is probably slightly less than that of winning the lottery.

• [1] http://use.perl.org/~jarich/journal/38978


• [2] http://use.perl.org/~Alias/journal/31986


• [3] http://en.wikipedia.org/wiki/Lenna

It is time for stupid, empty politicians slogans once again in my dear country. And, as always, while we had lively, controversial presidential elections three years ago (and I won't rant this time on why so many Mexicans still believe the current president can only be called a de facto president), the mid-term elections... Fail to get any attention and cause only bored reactions. I am writing today mostly because I stumbled upon Francisco's post on why the Mexican Ecologist Green Party (PVEM) campaign does not impress him. As many, many other people with strong political opinions I know, I will go to the voting booth next July 5th, as I have done every time since I was of age - But I will most probably void my ballot, as I have found nobody worth my vote. And even if I am (and have always been) a leftist person, none of the four so-called leftist parties inspire the smallest bit of confidence. But hell, even the rightist or centrist parties fail to inspire confidence to their voters - After the 2006 electoral fiasco, we got a political system nobody believes in. And all analysts seem to concur that we moved from the most complete presidential regime to an utter partidocracy, where all of the (strong enough) parties cover each other's back not to lose the respective privileges (largely, money, but also law-making faculties and influence, which of course translates to impunity). Worth a very special mention is the crown jewel of political clowns in Mexico - PVEM, the Mexican Ecologist Green Party. A party that gets the gold medal for the most corrupt in our country (which is no small feat). A party where the National Party Presidents to date have only been father and son. And it is alarming because it is the only party apparently gathering more voters than they had before. But also, because of its utter pragmatism and lack of respect for anything they might once have stood for. I still remember on the 1994 elections, the first time they participated in general elections, their slogan was don't vote for a politician Vote for an ecologist... Little did the society know by then they were worse off than our oft-hated politicians. Can you imagine a so-called ecologist party that is expelled of the Global Greens as its behaviour is completely antithetical to anything a green party stands for? A party that promotes reinstating the death penalty (which was abolished from our Constitution, after decades of not being applied, less than a decade ago)? Or they say that, if a given medicine is not available at the Social Security hospitals, the government should pay the citizen so he can go and buy it at a drug store? (of course, if a needed medicine is not available at the Social Security it is most probably because the government is underfunded, not because the lazy administrators don't want to buy the medicines. And yes, with those two retrograde, stupid and -thankfully- completely unfeasible promises they have doubled their probable voters outcome in the past couple of months. The campaigns are only officially starting now. They are all really pathetic. A voter turnout of ~30% is expected. But yes, I am a politized person and just cannot help inviting everybody who has the right to go and vote. If there is somebody worth voting for in your district, please vote for him/her. However... Together with many people I admire, together with many of my friends, together with the people who still believe it is possible to make something out of this forsaken country's politic system... I invite you to void your ballots. Hopefully they will be enough so they must be heard this time.

I'm in the market for a new laptop. I've got almost 4 years out of my Dell D610 (which I've been despising from not long after purchasing) and decided that I'll never buy from Dell again. I used to be very down on ThinkPads because of the placement of the Escape key, but since I've been using one at work for the last 3.5 years, I've gotten used to the Escape key location, and found the laptops themselves to otherwise be very solid and well supported by Linux. So Lenovo it is. Next question: T400 or X301? I've seen both, and the X301 is very sexy in terms of thickness, weight, and having all the latest bells and whistles, but boy, is it expensive. I did a side-by-side comparison between a T400 decked out the way I wanted, and an X301 decked out the best I could choose, and I've opted for the T400. The main problems I had with the X301 were that there was no choice of processor, and the processor available seemed significantly slower than what I could get in the T400, and of course the cost. I seemed to be paying nearly $1000 more for a slower processor, just to get something extra thin and light, with LED backlighting and an SSD disk. What finally swayed me to spending less money and getting an arguably "better" laptop was if I paid less now, I'd be more comfortable possibly getting something in less than 4 years time down the track. So if it came down to the X301 for 4 years or the T400 for 2 years, the T400 seemed like a better deal. What will hopefully end up happening is I'll end up using the T400 for four years and not end up hating it by the end of that time. Here's what I ended up going with:

• Intel Core 2 Duo Processor P8600 (2.40GHz 1066MHz 3MBL2) 25W
• 14.1 WXGA+ TFT, w/ CCFL Backlight, Camera
• Intel Graphics Media Accelerator 4500MHD with vPro
• 2 GB PC3-8500 DDR3 SDRAM 1067MHz SODIMM Memory (2 DIMM)
• UltraNav (TrackPoint and TouchPad) with Fingerprint Reader
• 160 GB Hard Disk Drive, 7200rpm
• DVD Recordable 8x Max Dual Layer, Ultrabay Slim (Serial ATA)
• Intel WiFi Link 5100 (AGN) with My WiFi Technology
• 9 cell Li-Ion Battery

All of that plus a 2 year warranty and an additional 90W AC adapter came out at $1,240 (they have a 15% off discount code thing running until tomorrow, which brought the price down a bit) I'm particularly excited about not having a proprietary graphics chipset. I'm particularly unexcited about it including Windows Vista Home Basic. Drat, enumerating all of the options made me just realise that I seem to have omitted the 5-in-1 media reader from the final order. Oh well. That was largely just a nice-to-have anyway. Sarah tends to do all of the photo management on her laptop. I doubt this will get to me before Thursday, so I should have it waiting for me by the time I get back from Barcelona.

I've said it multiple times, but all mailing list managers suck. Especially mailman. (On that topic SELinux is nasty, Emacs is the one true editor, and people who wear furry boots are silly.) Having setup some new domains I needed a mailing list manager, and had to re-evaluate the available options. Mostly I want something nice and simple, that doesn't mess around with character sets, that requires no fancy deamons, and has no built in archiving solution. Really all we need is three basic operations:

• Confirmed opt-in subscription.
• Confirmed opt-out unsubscription.
• Post to list.

Using pipes we can easily arrange for a script to be invoked for different options:

# Aliases for 'list-blah' mailing list.
#
^list-blah-subscribe$:   " /sbin/skxlist --list=list-blah --domain=example.com --subscribe"
^list-blah-unsubscribe$: " /sbin/skxlist --list=list-blah --domain=example.com --unsubscribe"
^list-blah$:             " /sbin/skxlist --list=list-blah --domain=example.com --post"

The only remaining concerns are security related. The most obvious concern is that the script named will be launched by the mailserver user (Debian-exim in my case). That suggests that any files it creates (such as a list of email addresses - i.e. list members) will be owned by that user. That can be avoided with setuid-fu and having the mailing list manager be compiled. But compiled code? When there are so many lovely Perl modules out there? No chance! In conclusion, if you're happy for the exim user to own and be able to read the list data then you can use skxlist. It is in live use, allows open lists, member-only lists, and admin-only lists. It will archive messages in a maildir, but they are ignored for you to use if you see fit. List options are pretty minimal, but I do a fair amount of sanity checking and I see no weaknesses except for the use of the Debian-exim UID. ObFilm: Blade

Is there any way to provide an alternate CSS stylesheet for GoLive CS2 only, not for regular browsers? Because there are some things in that layout that are too difficult for the GoLive renderer, it doesn't display them right. The pages are still editable (just plain XHTML), it's just not looking right in GoLive (advanced CSS).The site already has alternate stylesheets for browsers such as the broken Internet Explorers, so if I could convince GoLive to use their stylesheet it might be looking a lot better in the editor, too ...I am aware that GoLive CS2 has been abandoned in favor of DreamWeaver. Still it's going to be used in a project I help with the web templates.(Other options would be Kompozer and Amaya, but none of them seem really fit for production use: Amaya was just removed from Debian because it had some security issues and the maintainers had the impression the code was such a mess that there will be much more such issues. And Kompozer seemed to be a mostly dead branch of a Gecko hack (although there has been a new alpha release this year) ... is there some reliable opensource non-source HTML editor that I'm missing?)P.S. Sorry, no comments in this blog. Use Email: erich AT debian ORG

The original plan was to see the new Star Trek film on Mothers Day being the incurable romantic that I am but it didn't work out so we ended up going today instead. Overall we liked the film. It's best not to think about the plot too deeply or it will implode like red matter. (Red matter??? Are my children the scientists of the future? "I hereby name this new element Ballerinium") Anyway lots of jokes and explosions to keep your mind away from those kind of thoughts. As the title of this post suggests, I am not too fond of what they did with the Spock character. (Uhura Spock? Highly illogical.) The new Kirk is spot on as the green-alien-banging douchebag (amirite Uhura?) we know and love. And Chekhov, Scottie, and McCoy were great. The bad guy wasn't really that bad I thought. I hope they make the aliens badder and more alien in the inevitable sequels.

I have made a couple of references in my blog to the new software suite I am writing, which I am calling Alue. It is time to explain what it is all about. Alue will be a discussion forum system providing a web-based forum interface, a NNTP (Netnews) interface and an email interface, all with equal status. What will be unusual compared to most of the competition is that all these interfaces will be coequal views to the same abstract discussion, instead of being primarily one of these things and providing the others as bolted-on gateways. (I am aware of at least one other such system, but it is proprietary and thus not useful to my needs. Besides, I get to learn all kinds of fun things while doing this.) I have, over several years, come across many times the need for such systems and never found a good, free implementation. I am now building this software for the use of one new discussion site that is being formed (which is graciously willing to serve as my guinea pig), but I hope it will eventually be of use to many other places as well. I now have the first increment ready for beta testing. Note that this is not even close to being what I described above; it is merely a start. It currently provides a fully functional NNTP interface to a rudimentary (unreliable and unscalable) discussion database. The NNTP server implements most of RFC 3977 (the base NNTP spec IHAVE, MODE-READER, NEWNEWS and HDR are missing), all of RFC 4642 (STARTTLS) and a part of RFC 4643 (AUTHINFO USER the SASL part is missing). The article database is intended to support with certain deliberate omissions the upcoming Netnews standards (USEFOR and USEPRO), but currently omits most of the mandatory checks. There is a test installation at verbosify.org (port 119), which allows anonymous reading but requires identification and authentication for posting. I am currently handing out accounts only by invitation. Code can be browsed in a Gitweb; git clone requests should be directed to git://git.verbosify.org/git/alue.git/. There are some tweaks to be done to the NNTP frontend, but after that I expect to be rewriting the message filing system to be at least reliable if not scalable. After that, it is time for a web interface.

This document explains how to use deboostrap --foreign to build from scratch and install a minimal Debian system on the Sheevaplug (but it is equally applicable to many other embedded systems). The only piece missing to be able to install from bare metal is a working kernel and initramfs pair, so this document assumes that you already have a kernel which can mount the root file system from a USB key. For the Sheevaplug, the factory kernel in the internal NAND flash will work fine. The Debian kernel package puts us in a chicken and egg situation: it cannot mount the root without an initramfs (because all drivers are modular), but we cannot build one until we can boot the system. I suppose that, as an exercise of style, somebody could create a minimal initramfs with busybox and the kernel modules needed to mount the root and then mount it manually, but if you really lack a working kernel then it's probably faster to boot the file system image for the first time using qemu and the "versatile" debian-installer target. The first step is to run the first stage of debootstrap on another system (which does not need to be ARM), to build a temporary root file system. I use the --variant and --include options to build the smallest possible system with network support, but they can be omitted.

debootstrap \
         --foreign --arch=armel \
         --variant=minbase \
         --include=linux-image-2.6-kirkwood,module-init-tools,udev,netbase,
                   net-tools,ifupdown,iproute,whiptail,vim-tiny \
         sid ./target/ http://ftp.it.debian.org/debian/

As usual when using debootstrap, some manual configuration is needed:

cd target/
echo bokassa.mi.bofh.it > etc/hostname
vi etc/network/interfaces
vi etc/resolv.conf
echo LANG=C > etc/default/locale
echo '127.0.0.1 localhost' > etc/hosts
cat <<END > etc/fstab
/dev/root / ext3 noatime 0 1
tmpfs /tmp tmpfs defaults 0 0
#/tmp /var/tmp none bind 0 0
END

I took some hints from http://wiki.debian.org/ReadonlyRoot to reduce writes to the flash file system:

# the blkid cache is evil anyway
ln -s /dev/null etc/blkid.tab
# this link will be created anyway by the package
ln -s /var/lib/initscripts/nologin etc/nologin
# it's better to not use a static mtab with modern kernels
ln -s /proc/mounts etc/mtab
# unless you plan to use multiple removable network interfaces, persistent
# interface names are not needed
: > etc/udev/rules.d/75-persistent-net-generator.rules

Two small workarounds are needed:

# if this is not set then the preinst of linux-image-* will die trying
# to ask a debconf question in the debootstrap second stage
echo 'do_initrd = yes' > etc/kernel-img.conf
# a workaround for bug #520742
: > etc/udev/disabled

Now you can format a USB pen drive and copy the root file system on it:

mke2fs /dev/sdb1
tune2fs -i 0 -c 0 /dev/sdb1
mount /dev/sdb1 /mnt/
rsync -aH target/ /mnt/
umount /mnt/

After powering the plug press a key to get to the U-Boot prompt and use the factory kernel to boot from USB:

setenv bootargs console=ttyS0,115200 root=/dev/sda1 rootdelay=10 panic=10 init=/bin/bash
run bootcmd

Then you can run the second stage of debootstrap, finish the bare minimal configuration and start init:

./debootstrap/debootstrap --second-stage
# disable the gettys for /dev/tty[1-6], which do not exist
vi /etc/inittab
# and add one for the serial console
echo 'T0:2345:respawn:/sbin/getty -L ttyS0 115200 linux' >> /etc/inittab
# do not forget to set the root password or you will not be able to login...
vi /etc/shadow
rm /etc/udev/disabled
exec /bin/bash
mount / -o ro,remount
exec /sbin/init

Congratulations, now you can login on the system and start to install the packages you like:

echo 'deb http://ftp.it.debian.org/debian/ unstable main' > /etc/apt/sources.list
echo 'APT   Install-Recommends "false";  ;' > /etc/apt/apt.conf.d/no-recommends
apt-get update
# dash is much faster
apt-get install dash
dpkg-divert --add /bin/sh
ln -sf dash /bin/sh
# I do not like these, YMMV
rm /vmlinuz /initrd.img
rmdir /selinux /srv
# the kernel is able to read the time from the RTC by itself, and this
# will allow using a read only root
echo HWCLOCKACCESS=no >> /etc/default/rcS
# faster boot
echo CONCURRENCY=shell >> /etc/default/rcS
# useless on this platform
mv /etc/rcS.d/S01glibc.sh /etc/rcS.d/K01glibc.sh
dpkg-reconfigure tzdata
apt-get install openssh-server screen iptables wget less

U-Boot requires that the kernel and initramfs have a special header:

apt-get uboot-mkimage
cd /boot/
mkimage -A arm -O linux -T kernel  -C none -a 0x00008000 -e 0x00008000 \
  -n Linux-2.6.29-2 -d vmlinuz-2.6.29-2-kirkwood uImage
mkimage -A arm -O linux -T ramdisk -C gzip -a 0x00000000 -e 0x00000000 \
  -n initramfs -d initrd.img-2.6.29-2-kirkwood uInitrd

Now you can reboot and configure u-boot to boot from the USB device. This is the variables scheme I like and it is not mandatory in any way, so I recommend that you read and understand the existing configuration before modifying it (some lines have been broken for readability):

setenv bootargs_nand $(bootargs)
setenv bootcmd_nand $(bootcmd)
setenv bootargs_root root=/dev/sda1
setenv bootargs_misc 'ro panic=10
  mtdparts=nand_mtd:0x400000@0x100000(uImage),0x1fb00000@0x500000(rootfs)'
setenv bootcmd_usb 'usb start; ext2load usb 0:1 0x00200000 /boot/uImage;
  ext2load usb 0:1 0x01100000 /boot/uInitrd'
setenv bootcmd 'setenv bootargs $(console) $(bootargs_root) $(bootargs_misc)
  $(bootargs_more); run bootcmd_usb; bootm 0x00200000 0x01100000'

Since now you are not using anymore the Marvell kernel tree it is mandatory to set these two variables and reboot:

setenv mainlineLinux yes
setenv arcNumber 2097
saveenv
reset

Installation to SD is identical, but requires an updated version of U-Boot with SD support. Due to a kernel bug which prevents autoloading the driver you will need to add mvsdio and mmc_block to /etc/initramfs-tools/modules and rebuild the initramfs. (Yes, the naming theme I use at home is "african dictators"...)

Gobby 0.5 (or to be more precise 0.4.92) just hit the Karmic Koala. Below you can see a screenshot of the new version (just click on it to get a large version). It is sadly not protocol compatible to the old version but it features local undo and redo! Furthermore it's not yet stable on-the-wire wise. The software itself is fairly stable but it could be a bit bumpy if the server protocol version goes out of date. If you want to try it out on earlier versions, I offer backports in the Infinote PPA for Intrepid and up. I hope to get to Hardy soon, sadly it needs some more backports. There is a public server available on gobby.0x539.de if you want to try it out (connections are encrypted, but all contents are public and can be deleted by everybody, wiki-like; so please be considerate and non-destructive). On local networks Gobby will look for servers through Avahi. That said Gobby is not yet able to host servers by itself, like the old version did. You have to install the infinoted server. You can do this on any computer, even on the local network and take advantage of Avahi. If you want encrypted connections you need to create certificates but if an unencrypted session is acceptable you can get an ad-hoc server by invoking infinoted --security-policy=no-tls without further configuration. It will persist content across invocations, too. Thanks to Greg Heynes, there will also be a KDE client for Gobby, called... Kobby! The first time someone actually uses the fact that the software uses a library for interoperability. Interesting that it's done now when the library's C instead of C++ (which obby was written in), with Qt being C++ anyway. I'm not yet aware of packages but I really hope that we can release with both. If you encounter problems, please report them to our Trac (preferred) or Launchpad.

I'm adopting svn-buildpackage and I've made a few commits via collab-maint already. So #528733 is now mine.

I expect to be working with Jan and anyone else who wants to work on the svn-inject and svn-upgrade functionality that I don't use personally. For this reason, I've re-opened #377467 as an RFH.

I use svn-bp for a lot of my own packages and I'm not going to use git if I can possibly avoid it (quite possibly, ever). The current collab-maint changelog is already long enough so I won't be making many changes prior to the first upload to close the ITA. However, once that is done, I'll be looking at Jan's 0.7 branch code and gradually working through the rest of the bugs.

It's not as if I have a huge amount of time available for svn-bp, so things will take time, but it can't stay orphaned.

I have decided that is high time to declare svn-buildpackage orphaned since many people are replying on it to be useful, but nobody cared enough to answer to the RFH Eduard Bloch made some 3 years ago.

I know it would have been better if I would have asked a request for adoption, but, honestly, the package didn't had a maintainer in the last year and that would have been lying to everybody.

The package is quite important and I would hate to see it leave the official archive since many people do need it and use it regularly (I know for sure the GNOME, Perl and the Debian Games Team use it) and I have enjoyed working on the package while I was motivated.

The code is maintained in SVN and the trunk can be viewed at:

http://svn.debian.org/wsvn/collab-maint/deb-maint/svn-buildpackage/trunk/

and can be checked out with any of these commands:

# read-only copy
svn co svn://svn.debian.org/svn/collab-maint/deb-maint/svn-buildpackage/trunk svn-buildpackage

# read write, if you have an account on alioth.debian.org:

svn co svn+ssh://svn.debian.org/svn/collab-maint/deb-maint/svn-buildpackage/trunk


Also, note that the package has several features which the new maintainer(s) should be aware of and must make sure they all work when changing the code. Also, there are some things to remember:

• there is support for native and non-native packages
• non-native packages' repo can be a complete repo (with an upstream branch) or an incomplete repo (just the differences from the upstream - most times the debian directory, but not always)
• there is an interactive and a non-interactive mode, both have to work properly
• the packages can be stored in the repo under 2 different layouts and both have to work since they are both used; support for an arbitary layout would be great and I have a few ideas about how to implement that, so please contact me if you want to work on that
• team maintainance workflow MUST be supprted and should be one of the highest concerns for the maintainer; this means that being able to work on a new package without issuing more than one command to have all necessary stuff for the build, package upgrades to be done is the target to reach for (currently the situation is a lot better than it was in the past)
• there is on misfeature from the past that should be finally dealt with - something that was supposed to work as a cache ended up working like an override; meanwhile the effect for new packages/checkout has been minimised, but the code could do better at dealing with old checkouts affected but this (drop the old file name for the overrides, use a new one and scream when the old file name is encountered)
• 0.6.24 is waiting for an upload
• a test frame is missing and would be most welcome; I already started working on this based on the git test frame, but didn't managed to have a good-enough-to-publish code
  

These being said, I am really hoping svn-buildpackage will find a new maintainer since it deserves a lot more attention than I am providing. Don't forget, 0.6.24 is wating for an upload already.

---

Update: Neil Williams answered and agreed to take over maintenance, but he doesn't usually use svn-inject and svn-upgrade, so somebody taking care of those would be needed. Ironically, those two scripts are the ones in the worst shape of the three main scripts.

So WebKitGTK+ 1.1.7 is here. JIT is finally enabled for x86-64 on Linux! Yay! Go get it!. I am hoping for 1.1.8 we will have serious improvements on what we have landed recently, and on the Media Player. So, stay tuned =D. It looks more and more like we will have a good release for GNOME 2.28.

Our place has a fancy magical lock on the front door that has been sticking lately. We phoned the locksmith who put it in to discover that he apparently can't talk to us because we're not the registered owners of the lock.

Right - when we bought the place, we apparently don't automatically get the title to the locks on our front door. The former owners could phone at anytime and get into our place. If we were locked out in the middle of the night, he couldn't let us in.

Fuck that. Will replace the lock myself with a crowbar if I have to.

To the extent possible under law, Antti-Juhani Kaijanaho has waived all copyright and related or neighboring rights to
Asynchronous transput and gnutls. This work is published from Finland. GnuTLS is a wonderful thing. It even has a thick manual but nevertheless its documentation is severely lacking from the programmer s point of view (and there doesn t even seem to be independent howtos floating on the net). My hope is to remedy with this post, in small part, that problem. I spent the weekend adding STARTTLS support to the NNTP (reading) server component of Alue. Since Alue is written in C++ and uses the Boost ASIO library as its primary concurrency framework, it seemed prudent to use ASIO s SSL sublibrary. However, the result wasn t stable and debugging it looked unappetizing. So, I wrote my own TLS layer on top of ASIO, based on gnutls. Now, the gnutls API looks like it works only with synchronous transput: all TLS network operations are of the form do this and return when done ; for example gnutls_handshake returns once the handshake is finished. So how does one adapt this to asynchronous transput? Fortunately, there are (badly documented) hooks for this purpose. An application can tell gnutls to call application-supplied functions instead of the read(2) and write(2) system calls. Thus, when setting up a TLS session but before the handshake, I do the following:

                gnutls_transport_set_ptr(gs, this);
                gnutls_transport_set_push_function(gs, push_static);
                gnutls_transport_set_pull_function(gs, pull_static);
                gnutls_transport_set_lowat(gs, 0);

Here, gs is my private copy of the gnutls session structure, and the push_static and pull_static are static member functions in my sesssion wrapper class. The first line tells gnutls to give the current this pointer (a pointer to the current session wrapper) as the first argument to them. The last line tells gnutls not to try treating the this pointer as a Berkeley socket. The pull_static static member function just passes control on to a non-static member, for convenience:

ssize_t session::pull_static(void * th, void *b, size_t n)
 
        return static_cast<session *>(th)->pull(b, n);
 

The basic idea of the pull function is to try to return immediately with data from a buffer, and if the buffer is empty, to fail with an error code signalling the absence of data with the possibility that data may become available later (the POSIX EAGAIN code):

class session
 
        [...]
        std::vector<unsigned char> ins;
        size_t ins_low, ins_high;
        [...]
 ;
ssize_t session::pull(void *b, size_t n_wanted)
 
        unsigned char *cs = static_cast<unsigned char *>(b);
        if (ins_high - ins_low > 0)
         
                errno = EAGAIN;
                return -1;
         
        size_t n = ins_high - ins_low < n_wanted
                ?  ins_high - ins_low
                :  n_wanted;
        for (size_t i = 0; i < n; i++)
         
                cs[i] = ins[ins_low+i];
         
        ins_low += n;
        return n;
 

Here, ins_low is an index to the ins vector specifying the first byte which has not already been passed on to gnutls, while ins_high is an index to the ins vector specifying the first byte that does not contain data read from the network. The assertions 0 <= ins_low, ins_low <= ins_high and ins_high <= ins.size() are obvious invariants in this buffering scheme. The push case is simpler: all one needs to do is buffer the data that gnutls wants to send, for later transmission:

class session
 
        [...]
        std::vector<unsigned char> outs;
        size_t outs_low;
        [...]
 ;
ssize_t session::push(const void *b, size_t n)
 
        const unsigned char *cs = static_cast<const unsigned char *>(b);
        for (size_t i = 0; i < n; i++)
         
                outs.push_back(cs[i]);
         
        return n;
 

The low water mark outs_low (indicating the first byte that has not yet been sent to the network) is not needed in the push function. It would be possible for the push callback to signal EAGAIN, but it is not necessary in this scheme (assuming that one does not need to establish hard buffer limits). Once gnutls receives an EAGAIN condition from the pull callback, it suspends the current operation and returns to its caller with the gnutls condition GNUTLS_E_AGAIN. The caller must arrange for more data to become available to the pull callback (in this case by scheduling an asynchronous write of the data in the outs buffer scheme and scheduling an asynchronous read to the ins buffer scheme) and then call the operation again, allowing the operation to resume. The code so far does not actually perform any network transput. For this, I have written two auxiliary methods:

class session
 
        [...]
        bool read_active, write_active;
        [...]
 ;
void session::post_write()
 
        if (write_active) return;
        if (outs_low > 0 && outs_low == outs.size())
         
                outs.clear();
                outs_low = 0;
         
        else if (outs_low > 4096)
         
                outs.erase(outs.begin(), outs.begin() + outs_low);
                outs_low = 0;
         
        if (outs_low < outs.size())
         
                stream.async_write_some
                        (boost::asio::buffer(outs.data()+outs_low,
                                             outs.size()-outs_low),
                         boost::bind(&session::sent_some,
                                     this, _1, _2));
                write_active = true;
         
 
void session::post_read()
 
        if (read_active) return;
        if (ins_low > 0 && ins_low == ins.size())
         
                ins.clear();
                ins_low = 0;
                ins_high = 0;
         
        else if (ins_low > 4096)
         
                ins.erase(ins.begin(), ins.begin() + ins_low);
                ins_high -= ins_low;
                ins_low = 0;
         
        if (ins_high + 4096 >= ins.size()) ins.resize(ins_high + 4096);
        stream.async_read_some(boost::asio::buffer(ins.data()+ins_high,
                                                   ins.size()-ins_high),
                               boost::bind(&session::received_some,
                                           this, _1, _2));
        read_active = true;
 

Both helpers prune the buffers when necessary. (I should really remove those magic 4096s and make them a symbolic constant.) The data members read_active and write_active ensure that at most one asynchronous read and at most one asynchronous write is pending at any given time. My first version did not have this safeguard (instead trying to rely on the ASIO stream reset method to cancel any outstanding asynchronous transput at need), and the code sent some TLS records twice which is not good: sending the ServerHello twice is guaranteed to confuse the client. Once ASIO completes an asynchronous transput request, it calls the corresponding handler:

void session::received_some(boost::system::error_code ec, size_t n)
 
        read_active = false;
        if (ec)   pending_error = ec; return;  
        ins_high += n;
        post_pending_actions();
 
void session::sent_some(boost::system::error_code ec, size_t n)
 
        write_active = false;
        if (ec)   pending_error = ec; return;  
        outs_low += n;
        post_pending_actions();
 

Their job is to update the bookkeeping and to trigger the resumption of suspended gnutls operations (which is done by post_pending_actions). Now we have all the main pieces of the puzzle. The remaining pieces are obvious but rather messy, and I d rather not repeat them here (not even in a cleaned-up form). But their essential idea goes as follows: When called by the application code or when resumed by post_pending_actions, an asynchronous wrapper of a gnutls operation first examines the session state for a saved error code. If one is found, it is propagated to the application using the usual ASIO techniques, and the operation is cancelled. Otherwise, the wrapper calls the actual gnutls operation. When it returns, the wrapper examines the return value. If successful completion is indicated, the handler given by the application is posted in the ASIO io_service for later execution. If GNUTLS_E_AGAIN is indicated, post_read and post_write are called to schedule actual network transput, and the wrapper is suspended (by pushing it into a queue of pending actions). If any other kind of failure is indicated, it is propagated to the application using the usual ASIO techniques. The post_pending_actions merely empties the queue of pending actions and schedules the actions that it found in the queue for resumption. The code snippets above are not my actual working code. I have mainly removed from them some irrelevant details (mostly certain template parameters, debug logging and mutex handling). I don t expect the snippets to compile. I expect I will be able to post my actual git repository to the web in a couple of days. Please note that my (actual) code has received only rudimentary testing. I believe it is correct, but I won t be surprised to find it contains bugs in the edge cases. I hope this is, still, of some use to somebody

Now available for early testing, Ubuntu Karmic Alpha 1 has a kernel feature I ve long wanted in Ubuntu: NX emulation. Basically, if your hardware lacks NX support, the kernel will emulate the feature using memory segment limits and ordering. This was AFAIBT originally developed by PaX, and a similar version (with histories including work by Solar Designer and maybe OpenBSD?) has been carried in RedHat/Fedora for a while now (under the larger project called ExecShield , covering multiple protection technologies). As more and more of the monolithic ExecShield kernel patch has been taken upstream (many thanks to Arjan van de Ven for pushing them), the patch in RedHat has been shrinking. Recently, Dave Jones split up the remaining pieces into logical chunks small enough that I could actually read it without going cross-eyed. From this, I ported the nx-emulation patches to Ubuntu s kernel, and now they re happily live in Karmic. So, instead of this:

$ ./vulnerable-setuid-program $OVERFLOW_AND_SHELLCODE
# id
uid=0(root) gid=0(root) groups=0(root)

We get this:

$ ./vulnerable-setuid-program $OVERFLOW_AND_SHELLCODE
Segmentation fault (core dumped)
$ dmesg tail -n1
[170131.763976] vulnerable-set[16278]: general protection ip:80489c5 sp:bfa3e330 error:0 in vulnerable-setuid-program[8048000+1000]

Though, as always, please just use 64bit instead. :) Update: gave credit to PaX, thanks for the corrections!

I finally found some time to work on planet phpMyAdmin. It now has same look as phpmyadmin.net website, links to feeds are more visible and the website links to it at some places. All templates and planet configuration are now stored in our SVN repository. Now let's hope that I will not be the only one who regularly posts there :-).

With all the discussion about SHA-1 weaknesses and generation of new OpenPGP keys going on there's some concern about how the web of trust will be affected. I'm particularly interested in the impact on Debian; while it's possible to add new keys and keep the old ones around that hasn't worked so well for us with the migration away from PGPv3 keys. We still have 125 v3 keys left, many of them for users who also have a v4 key but haven't asked for the v3 key to be removed or responded to my email prodding them about it. I don't want to repeat that.

So if we're looking at key replacement we need to have some idea about where our Web of Trust currently stands, and what effect various changes might have on it. I managed to find the keyrings Debian shipped all the way back to slink and ran the keyanalyze and cwot stats against them. I then took the current keyring, pull in all the updates for the keys in it (so that any signatures from newly generated keys would be included) and ran the stats again. Finally I took details of 12 key migrations (mostly from Debian Planet but also a couple of others I knew about) and calculated what the effect of removing each key would be. These stats are cumulative and I replaced the most well connected (by centrality) keys first.

The results are below.

• Total is the total number of keys in the keyring
• SCS is the largest Strongly Connected Subset
• Reachable is the largest reachable subset
• MSD is the Mean Shortest Distance
• Centrality is the average centrality for the reachable subset
• update-foo indicates that foo's key was replaced with a newer one

	Total	SCS		Reachable		MSD	Centrality
1999-02-06 (slink)	228	36	(15.78%)	50	(21.92%)	2.9022
2000-01-03 (potato)	375	104	(27.73%)	180	(48.00%)	4.3382
2001-09-22 (woody)	948	538	(56.75%)	704	(74.26%)	4.7320	2008.6249
2005-05-28 (sarge/etch)	1106	883	(79.83%)	969	(87.61%)	3.3485	2074.6604
2007-12-04	1191	1001	(84.04%)	1062	(89.16%)	3.1103	2113.3747
2009-01-18 (lenny)	1126	947	(84.10%)	1010	(89.69%)	3.0489	1941.2594
2009-04-04 (squeeze/sid)	1121	946	(84.38%)	1008	(89.91%)	3.0466	1936.9761
2009-05-06 (current)	1067	894	(83.78%)	958	(89.78%)	2.9670	1759.4363
	Total	SCS		Reachable		MSD	Centrality
base	1067	904	(84.72%)	959	(89.87%)	2.9640	1776.4389
update-93sam	1067	902	(84.53%)	958	(89.78%)	2.9734	1780.9874
update-joerg	1067	900	(84.34%)	958	(89.78%)	2.9776	1780.7578
update-aurel32	1067	898	(84.16%)	957	(89.69%)	2.9803	1779.2497
update-noodles	1067	896	(83.97%)	956	(89.59%)	2.9831	1777.8326
update-jaldhar	1067	896	(83.97%)	955	(89.50%)	2.9855	1779.9193
update-srivasta	1067	896	(83.97%)	955	(89.50%)	2.9904	1784.3382
update-ana	1067	895	(83.88%)	954	(89.40%)	2.9926	1784.3102
update-nobse	1067	893	(83.69%)	953	(89.31%)	2.9947	1782.2392
update-neilm	1067	892	(83.59%)	951	(89.12%)	2.9974	1782.6098
update-reg	1067	891	(83.50%)	950	(89.03%)	2.9977	1780.8515
update-rmayorga	1067	890	(83.41%)	949	(88.94%)	2.9984	1779.4910
update-evgeni	1067	889	(83.31%)	948	(88.84%)	2.9974	1776.6445

This is actually more hopeful than I thought. There's an obvious weakening as a result of the migrations, but the MSD stays under 3 and the centrality stays fairly constant too. The reachable/SCS counts do decrease, but at this point it looks fairly linear rather than an instant partition. Of course the more keys that are removed the more likely this is to drop off suddenly. Counteracting that DebConf9 is coming up which will provide a good opportunity for normally geographically disperse groups to cross sign, reinforcing the WoT for these new keys.

Either way I at least have a better handle on the current state of play, which gives me something to work with when thinking about how to proceed. For now, bed.

My copy of Charles Stross's The Revolution Business, (book 5/6 in the "Merchant Princes" saga) arrived today. I'm currently half way through Iron Sunrise. I will have to put one of them aside for a while, but which one...