It's been really strange coming back from DebConf then Extremadura and having to fit my code time around paid work and housework and general stuff again. I keep wondering why I'm not getting things done and then realising that I've only got so many hours a week nowadays compared to the entire week during the worksessions. What makes it worse is the short gap between the conferences. I misjudged the length of time without income and didn't make any days available for paid work between DebConf and Extremadura. OK, it was only about a week but it was a further week without income followed by the week getting to and from Spain.
I'm now doing extra days to recover from the extra time without income and it makes the contrast even more noticeable. The tiredness from the extra work then makes it hard to get started on what I thought I'd get done. I've done a little bit on emdebian-tools and apt-cross, I've done a little bit on a few RC bugs and I've not done a load of stuff I thought I would have done by now.
If you're wondering why something I said I'd do has not been done, file a bug and I'll get to it. (The bug lists for buildd.emdebian.org or emdebian-tools are my main ToDo lists, if it appears in that list of bugs, I'll not forget. If it appears in an email, I probably will forget.)

Summary: If programs would have useful man pages or error messages, man would not have to look into source code. I just set up Debian sid chroot on my computer and have to sign something inside this chroot (dpgk-buildpackage). Okay, I want it to use gpg-agent in my host system, that should not be hard. Looking at gpg man page, GPGAGENTINFO variable is used to forward information about agent socket, PID and protocol version, so I set this variable according to host system, but it still does not work, giving nothing saying error that agent is not working. So let's debug this beast - strace reveals, that communication with agent works, but it replies "113 Server Resource Problem". Hmm, still not much useful information, but let's google for this problem. Fortunately Google reveals related Seahorse code, where man can find, that not set DISPLAY variable is causing this issue. Could not the error be more friendly, so that it tells me directly what is wrong?

A case of a former friend impersonating someone on facebook was decided during the summer: Applause Store Productions Ltd. & Anor v Raphael [2008] EWHC 1781 (QB) (24 July 2008) . The victim was awarded thousands of pounds in damages. As I write this, there’s still no response on facebook’s news page, but I wonder whether Firsht will be to UK social networking what Godfrey was to UK Usenet. A bit of a wake-up - a reminder that the internet isn’t a consequence-free playpen. I know that more than most - my youthful indiscretions are plastered across the web, if you know where to look. Fortunately, cooperative associates seem to understand that people learn over time and don’t hold decade-old mistakes against me. Talking of not holding old mistakes against people, LinkedIn is profitting from an influx of bankers since the banks started going bust. That’s going to change the society behind their network - for better or worse? All of the big name networks seem to be having some growing pains, like the breakdown of the Facebook metaphor and I think the “walled gardens” are ripe for replacement. I’m still listed there at present, but I’m using my account on the cooperativemagazine NoseRub server to monitor it and most of the stuff posted to facebook is taken from my websites. I’d like to make NoseRub import and export more things in more formats, but will anyone pay for that work? Otherwise, it keeps falling down my priorities because it’s in PHP and I don’t find that much fun. Maybe I’ll replace it with something more amusing in Scheme or Perl. Aside: is there a good bot that produces an RSS feed of jabber/XMPP presence messages?

Last Sunday was the 35th Berlin Marathon. I had flown over to Berlin on Thursday after work, and had Friday and Saturday to 'chill'. The weather was already pretty nice before the race, and truly gorgeous on Sunday: sunny yet not too warm, blue skies, no wind. As has been widely reported, Haile Gebrselassie set a new world record breaking his own mark set the year before and becoming the first man to finish under two hours and four minutes. Truly impressive. My race was pretty good too. I shaved over four and a half minutes off my own personal record (which was set in early 2006 at Sunburst) and finished in 3:13:09. That's a pace of 7:22 min/mile (or 4:35 min/km) which I am rather happy with. I held a fairly steady pace of under 7:30 almost all the way but but had to fight off the onset of cramps with some short walks about less than two miles to go. Coming back in Berlin after all those years is always a charm. The city has obviously changed a lot in some very visible areas. Yet it still recalls the Berlin of those years. The course was really nice, covering numerous neighbourhoods and starting and ending in Tiergarten. Lastly, it was also good to see old friends who have now been there since the mid- to late 1980s. And I managed to pack a quick visit to my parents in as they are just a good 80 minute ICE train ride away. All in all a very nice trip even though the travel from Chicago (without a direct flight!) is a bit of a hike.

So, as it was previously anounced (and recently re-invited by Micah), this weekend is the debiannyc BSP. This makes me think on my lack of involvement on the technical part of Debian (I’m still socially involved with friends and groups) for the last couple of months. So, for the sake of encouraging others to join us on Saturday if you in the city (or the tri-state area, or beyond!), here it is, my personal list of tasks I’m willing to work on:

• Retake/rewrite the tools and scripts I used to mess WNPP with.
• Check what other things are missing to improve WNPP.
• Deal with some of the lists.debian.org bugs wearing my listmaster hat.
• Install Debian on a Vortex86 machine I’ve been having around for the last couple of months.
• Dig into Ruby and Perl RC bugs and try to squash some of them (after all, this is a BSP, and RC bugs is the primary target!).
• Encouraging Raquel to take a look at some of the previous www.debian.org re-design proposals and try to come up with something useful out of it.
• Have lots of beer while doing all of above.

See you at Vireo! UPDATE: The BSP was a lot of fun. Striking now the things I actually did from my list.

It started harmless when Thomas asked on Linux User Group Switzerland mailing list if someone knows a tux-shaped alarm clock. But the topic of that thread quickly moved to two other things in tux shape: the Tux Droid, a device similar to the Nabaztag, but needs a Linux host with USB, and ACME Systems’ Tux-Server, a ETRAX CRIS based Foxboard inside a tux-shaped case. We found out that Telion, the Swiss importer for Foxboards, also imports ACME Systems’ Tux Case — although the Tux Case is not mentioned on their website. Even better: They had a few old Tux Cases in stock which don’t fit anymore on current Foxboards since the position of the power socket changed. (So only one hole in the case was missing.) And they wanted to get rid of them quite fast: They offered us the Tux Cases for 10 CHF (6€) each instead of 28 CHF each (17€) if we buy all of them. Of course we couldn’t reject this offer and bought all five remaining cases. Another part of the thread was about performance. Although ETRAX CRIS is used by its inventor AXIS in many of its products (they’re famous for the Linux based web-cams) many were not sure if the board’s performance would be sufficient for their ideas. Another disadvantage of the ETRAX CRIS architecture is that no mainstream Linux distribution supports it. Another point was the Foxboard’s price (169€, ca. 268 CHF). Bones just mentioned that an NSLU2 costs only about 100 CHF (60€). Probably on IRC someone (probably Bones, too) wondered if it’s possible to fit a NSLU2 into such a quite inexpensive Tux Case. We took Wikipedia’s picture of the NSLU2 board, compared the size of the USB ports on that picture, compared them with real-life USB ports and found out the size of the board that way. And when I got my Tux-Case I noticed that the NSLU2 board really could fit into the Tux-Case. Since I’m already building a bigger NAS-like home server, I have no use for another, much slower NAS. But since I more or less gave up the also ARM-based Thecus N4100, another ARM-based machine in my hardware collection wouldn’t be bad. So it didn’t took long and the idea was born to build the NSLU2 board into a Tux-Case and let the website tux.ethz.ch run on it. (I inherited its administration from Beat and it’s currently just a virtual host on one of our webservers.) Then it would be a server named Tux, serving Tuxes, looking like a Tux and running Tux’ operating system Linux. :-) I ordered an NSLU2 at Brack for 117.60 CHF (ca. 70€). Played around with the original firmware for a moment, but it’s horrible from a security point of view: You can’t even change the admin password (default: “admin”) if no USB harddisk is attached. And no, a USB stick doesn’t suffice. So I didn’t wait long and tried to install Debian’s “armel” (ARM, Little Endian) port on it. But the NSLU2 refused the “new firmware” with the error message “Upgrade: no enough free space.”. While this is not in the Debian specific NSLU2 FAQ, it is mentioned in the general troubleshooting FAQ. As described in there, first upgrading to the most recent firmware version and then uploading the Debian installer worked fine. After I had successfully installed Debian Lenny on a pqi 4 GB USB sticked into the NSLU2 and verified that everything is working fine, I opened the NSLU2 case and checked if it really would fit into a Tux Case. It does, but very, very close. You’ll have to drill some holes and the ethernet socket will stick out Tux’s shoulder, but everything else should fit perfectly after a few mounting parts inside the Tux Case have been removed. As a proof of concept I laid the NSLU2 board on the Tux Case’s back: So later the LEDs will be in Tux’ one shoulder while the network socket will be in his other shoulder. And the USB stick will be inside his paunch via a USB hub.

I'm lazy this morning, so I'll write a quick changelog about what's coming next in awesome 3.1, as of now.

• awesome-client is now a true REPL: so it now returns things like errors;
• mouse events now support button release;
• awful has been splited in several modules;
• the window stacking has been reworked and handled special windows (dock, desktop) much better;
• window type is now exported and correctly handled;
• any window can go fullscreen;
• widget can get an event when the mouse enters in it;
• placement (smart, under_mouse, etc) has been move into awful;
• statusbars and titlebars has been merged in a common type: wibox;
• wibox can be floating (i.e. you can now write your own conky-like with wiboxes);
• _NET_WM_STRUT_PARTIAL is now supported so panel and dock automagically puts padding around the screen;
• sticky windows are handled like sticky windows and are not tagged anymore;
• windows that get reparented are now unmanaged (that fixes view of PDF etc in your browser);
• a new image type has been introduced so you can manipulate image directly in awesome and use them;
• a new imagebox widget has been (re)introduced to use image objects;
• a real minimize/iconify state is now available;
• awesome gets a --check to check Lua syntax file; restart is now also checked for syntax file by default.

And of course some bug fixes.

So, while everyone was watching the Bush Bank Bail-out plan get rejected by Congress, they also found time to approve more bad copyright law, an RIAA-backed initiative to attack cooperative download tools like BitTorrent. Thankfully, the attempt to empower the Department of Justice to prosecute on behalf of Big Music was lost (DoJ didn’t want the task anyway) and the Bush administration is minded to veto it. But that’s been the least of my politician annoyances in September. Earlier this year, we were encouraged by Cooperatives-UK to get involved with our Local Strategic Partnership. I went to North Somerset Partnership’s event but I was less than impressed by it. There’s no obvious way that NSP is capable of promoting cooperation. Publishing a thick glossy book about sustainability makes me wonder if it’s capable of doing anything sensible - most people I’ve shown it to have either laughed at it, or got angry about the wasted resources. They’re not the only LSP we have here. Last week, I went to the West of England Partnership’s Transport Forum which

“horrendously perverted the idea of a “forum” - the event would have been better titled “Joint Transport Lectures” because nearly all our time was spent watching council officers and consultants tell us how wonderful transport is here (they’re meeting 18 out of 21 targets, you know!) and what roads and bus roads they will build next. … The whole event seems like a colossal waste of resources for all involved.”

So, I seem to be having a bad time with politicians recently. If the above wasn’t enough, we got a reply to our petition requesting ODF at the National Archives which amazingly doesn’t mention Open Document Format at all. I’ve written to our MP (John Penrose) asking about that. And finally, I asked Climate Change Minister Joan Ruddock MP

“If there’s no windfall tax to fund it, how will the government remove the climate-harming services from the market and encourage new suppliers (particularly Third Sector ones who should show concern for their communities and sustainable energy) into the market?”

and got the non-answer of

“The Government is tackling a very wide range of issues that impact on Climate Change through a variety of mechanisms. The energy efficiency programme recently announced is directed at those most in need and where a small expenditure can produce a significant and lasting saving in energy use. Thus saving households money and reducing CO2 emissions.”

What the heck has that to do with removing harmful services and encouraging new suppliers? If any politicians want to be held in better esteem, try giving some straight answers instead of imitating the above, please. “Yes, Minister” was meant to be a satire!

Ever since my former desktop machine gsa died and I started using only laptops at home, I noticed a need for a home server for storing all my MP3s, holiday pictures, games, and backups of my other machines. And I also want a filtering web proxy at home again. Current situation Currently my Norhtec MicroClient Jr. “c2” with it’s 120 GB 2.5" harddisk does some of these jobs (mostly storage and backup), but it neither has the disk space nor the performance to do all the things I want. For storage I once bought a TheCus N4100, the big brother of the popular and officially Debian supported N2100. Unfortunately there are a few things different than in the N2100 (NIC without MAC) which makes it much more difficult to get Debian on it and the original firmware doesn’t support NFS at all. *grmpf* I had hints from others who managed to get Debian on this NAS, but I didn’t find the time and leisure to really dig into cross-compiling kernels. (Although with the new 1.3.06 firmware, so called modules became possible also for the N4100 and a SSH module has been posted with which a Debian chroot could be installed and the required kernel build on the machine itself.) I though wasn’t very angry when the N4100+ came out shortly after I bought the N4100, because the N4100+ was no more an ARM based device but had a Celeron processor inside instead. And a NAS which is built on average PC hardware wasn’t as appealing as some device based on some more exotic architecture mainly used in embedded devices. :-) The Mini-ITX Appeal This view changed rapidly, when Raffzahn showed me a few Mini-ITX boards and cases. I surfed around on Mini-ITX.com store and stumbled upon the NAS-like ES34069 case from Chenbro featuring four S-ATA hotswap 3.5" slots, a slim-line CD-ROM drive slot, a SD card reader, and enough space for an additional 2.5" hard disk and a low profile Mini-ITX board. Additionally, the VIA EPIA SN series of Mini-ITX boards sports 4 S-ATA ports and either a passively cooled 1 GHz C7 processor or an actively cooled 1.8 GHz C7 processor. That should be enough power for a small multi-purpose home server while still keep the power consumption low. And I’m not the only one having this idea, Mini-ITX.com suggests this combination and Chenbro officially supports the VIA EPIA SN boards. Additionally, Debian 5.0 Lenny seems to run fine on the SN series, only lm-sensors seems to have problems with SN18000G and SN10000EG (but not SN18000 and SN10000E). So when the Chenbro ES34069 case showed up in digitec’s online shop, I ordered one there and a VIA EPIA SN18000G board at Brack. I didn’t order any disks since for data storage I plan to use the four Samsung 400 GB 3.5" S-ATA disks I bought for the N4100, and for the system I plant to use the 2.5" disk I initially bought for my MicroClient JrSX “c1”, but then continued to use it only with the CF card. Not yet sure, if I’ll also equip the slim-line optical drive slot, too. The case took several weeks to deliver and the mainboard hasn’t arrived yet. Instead I got an e-mail from Brack that VIA products are currently very difficult to get in Switzerland. Reason is said to be that VIA tries to channel the distribution of their products to a single distributor. (Sounds somehow similar to what Apple tried with the iPhone and failed.) Mini-ITX boards and power consumption So I now have a nice case without a board. There aren’t that many Mini-ITX boards out there sporting 4 S-ATA ports. One which cleary stood out was the new Intel DG45FC Mini-ITX board with LGA775 socket. (In Switzerland neither available at Brack nor at digitec, but e.g. at PCP.) But reading the specs of this board it was also clear that it wasn’t thought for NAS systems but high-performance HTPCs — the focus seems to be on multimedia performance which a NAS doesn’t need. Its newer sister, the Intel DQ45EK Mini-ITX board is focussed more on office and business PCs than on multimedia. But Intels remote adminstration is not really a plus for me (don’t need it, I’ve got SSH ;-) and it’ neither cheaper than the DG45FC nor has it significantly lower power-consuption. Despite the 120W power-supply there are people who already combined the Chenbro ES34069 with the Intel DG45FC or DQ45EK board, e.g. one of the administrators of the German NAS-Portal forums built such a machine and this German guy who wants to build a Windows Home Server based on such a combination. At least the NAS-Portal administrator found out that the board consumes so much power that together with the 4 S-ATA disks the included 120W power supply doesn’t suffice and the system is not stable in this configuration. Trusted Reviews review of the DG45FC explains why: It’s one of the first Mini-ITX board not following the MoDT idea, has a desktop chipset instead a mobile chipset and therefore hasn’t all of the power-saving features of those mobile chipsets. But it’s easy to see anyway: Most of the CPUs supported by the DG45FC and DQ45EK boards have a TDP of 65W. Offically the processor cooler delivered with the case supports processors with up to 65W, but 65W is already more than the half of what the power supply delivers and according to the Trusted Reviews review, the board itself consumes another 35W itself. So for the four 3.5" S-ATA disks — which are usually not as economical as notebook disks — about 20W are left. This can’t work! The guy from NAS-Portal.org plans to solve the problem by using a universal 180W notebook power supply instead of the original one. In comparison to the 100W of the both Intel boards, VIA’s SN18000G consumes only 26W (the fanless SN10000EG even only 22W) and that’s board and processor! That’s about ¼ of what the Intel board consumes. Imagine the difference between having a 100W light bulb (suffices for a whole small room) shining 365 days a year compared to a 25W light bulb (often used in bedside lamps) in a year. Other Mini-ITX mainboards with 4x S-ATA include the following ones:

• Jetway JNC62K: According to Mini-ITX.com it fits into the Chenbro ES34069 case, but requires at least a 120W power supply which again questions its power consumption and its usage together with four 3.5" harddisks, although it is recommended for the ES34069 by Mini-ITX.com. But I haven’t made that good experiences with NVidia chipsets yet, so this board seems currently no option for me anyway. OTOH there’s German speaking guy who build a ES34069 based server using this board and only three SATA harddisks and runs the OpenSolaris based and commercial NexentaStor on it, so the hardware can’t be too exotic. (Review at Bit-Tech; Review at MiniITX.biz)
• Albatron KI690-AM2: Already over one year old and Silent PC Review says it has an extremely restrictive BIOS and poor fan control. (Another Review at TweakTown)
• iEi KINO-9454-R20: Seems to support only Pentium 4 and Pentium D.
• Several Commell mainboards: LV-66A (VIA C7 1.5 GHz), LV-672 (Pentium 4), LV-674 (Pentium D).
• Gigabyte GA-6KIEH-RH (not yet available)
• Kontron 986LCD-M/mITX: Socket mPGA478 and mPGA479, supports Intel Core 2 Duo Mobile beyond others; 3x GBit network interfaces, but also quite multimedia focussed — the review at EPIACenter.de (German written) says using it for NAS or a network-focussed machine is casting pearls before swine. :-) But the same counts for the DG45FC surely, too. ;-) Importer for Switzerland seems to be fabrimexSystems and end customers can buy it e.g. at ichbinleise.ch (which seem to sell only Kontron mainboards), but it’s way more expensive than the Intel DG45FC and even more expensive than the VIA SN18000G.
• J&W MINIX™ 780G-SP128MB: Another new multimedia focussed mainboard, but unless ATI drivers are way less usable than the NVidia drivers, I prefer not to use ATI graphics cards. (Review at MiniITX.biz)
• Advantech AIMB-221, AMD/ATI based and said to have a power-consumption less than 100W and a low TCO. But 100W are still too much for the 120W PSU. (German review at MiniTechNet)

Conclusion For now, I decided to wait a little bit more for my VIA EPIA SN18000G board which still seems to be the best board for the Chenbro ES34069 case although not really cheap. But if I once in a not that distant future decide to have a desktop at home again, I’m quite sure it’ll sport a cute Mini-ITX case (perhaps a nice black-orange HFX micro M1 case by mCubed — unfortunately the M2 is no more available in a color combination including orange ;-) with an Intel DG45FC or Kontron 986LCD-M/mITX and a decent Core 2 Duo processor. Software Plans Of course my home server will run Debian GNU/Linux 5.0 Lenny on it, with software RAID-5 and LVM2 over the 1.6 TB of S-ATA disks resulting in 1.2 TB available disk space which will be offered using at least NFS, SMB and SSH (think sshfs). Planned software includes BackupPC (a very fine pulling backup system for machines which are not online 24/7) and Privoxy. I’ll perhaps also install Tor and a caching proxy like Squid or Polipo. Another idea is to run Mediatomb on that machine. :-)

I’m practically 4 courses away from finishing my degree (the course I failed in June, I passed a couple weeks ago). 4 courses which I loathe, but that I’ll get done this year. After them, I still have to prepare something akin to a “final project”, but that doesn’t worry me much, since it’ll be something I enjoy. Apart from these 4 courses, I also have to take a couple non-computer science ones, whichever I want. I’ve decided to go for French lessons, since I’ve always wanted to learn French. I’m very excited for this. Today was my first day. I had some previous, incredibly rudimentary notions of French already, but that didn’t help not to find it a bit daunting at first: there’s so much to learn. (I can’t remember at all how I felt when I started studying English, but alas, I was a kid, when you’re taught stuff you know zero about.) I decided, though, to look it from a positive note, and make a pleasant experience out of it: not everyday one has the opportunity to dive into something completely new. I remained excited for the rest of the class, and I’m sure my classmates thought, “Why is this guy stupidly smiling from time to time?” (These are courses designed for freshmen, and I felt out of place. It seems 8 years it’s a lot of time.) Incidentally, my sister speaks French, and she’s lent me some books and dictionarys from her time as a student. Some of these were books from Le Petit Nicolas series; I had read all of them during my childhood, in Spanish. I glanced through the French versions, and recognizing every single picture in them as something I had already seen, albeit fifteen years ago, was a very weird feeling.

RAM is the new Disk [1] - interesting post about using a distributed network of servers with RAM for main storage. The concept is that RAM on another machine can be accessed faster than local disk and that disk performance for contiguous IO has been increasing steadily at a greater rate than random seek performance. So disks can be used in a similar manner to tape drives (backing up data) and RAM can be used as main storage (2RU machines with 1TB of RAM are predicted soon). It is interesting to contrast this with the Rubik’s Cube solver which uses disk as RAM [2]. Interesting Sun Blog post about how ZFS uses flash based SSD (Solid State Disk) for read caching [3]. Yahoo has released a Firefox plugin named Yslow to tell you why your web site is slow [4]. This complements the Yahoo Best Practices for Speeding Up Your Web Site document [5]. Amsterdam now has cargo trams [6]. This reduces pollution and traffic congestion while allowing efficient transport of cargo. The cargo trams tend to follow passenger trams so they don’t provide any additional obstacle to traffic. Interesting article by Cory Doctorow about how the standard formats limit creative content [7]. He makes the unfortunate mistake of claiming that “no one tries to make sitcoms about stories that take five minutes to tell” and “no one tries to make feature films about subjects that take 30 seconds to elucidate” - I think that the majority of sitcom episodes can be described in considerably less than 5 minutes and a significant number of movies (EG every one that stars Jean-Claude Van Damme [8]) can have their plot described in less than 30 seconds.

• [1] http://www.infoq.com/news/2008/06/ram-is-disk


• [2] http://etbe.coker.com.au/2008/06/24/rubiks-cube-io-bandwidth/


• [3] http://blogs.sun.com/brendan/entry/test


• [4] http://developer.yahoo.com/yslow/


• [5] http://developer.yahoo.com/performance/rules.html


• [6] http://www.citycargo.nl/faq_eng.htm


• [7] http://www.internetevolution.com/author.asp?section_id=479&doc_id=164252&


• [8] http://en.wikipedia.org/wiki/Van_damme

Share This

... is to have upstream do it..:-) Apparently, yesterday, Jelmer Vernooij, member of the Samba Team and maintainer of samba4 and related packages (openchange, etc.) started some triaging of bugs of the samba package. After several years of efforts by Steve Langasek, No l K the and /me, the bug log of samba is not in a so bad shape, but, still, tseeing one of our upstream digging in our dirt is very good news... Thanks again, Jelmer. You really deserve to reach the end of your NM process, now.

Yes, it’s me again with this DSA-1571 exploitation issue. The discovery, explanation and exploitation of the bug is now part of my final coursework for my postgraduate degree career. So, yes… sorry. Some weeks ago I started suspecting about the attack to PFS in SSL with EDH. The key point is: the key space is dependent of the PRNG state. The bug affects the initialization of the PRNG, but the random string has not a pattern by it self. If you ask for many random numbers to the PRNG, you gonna get numbers that differ among them, since they are the output of a hash function of them self. So each random number depends on, besides the PID, the state of the PRNG pool in the moment (in other words, amount of bytes that you already pull from the PRNG pool before) The explained attack was based in a fixed list of private exponents (which are selected randomly during the DHE handshake), presupposing that all the application call RAND_bytes() the same number of times before get it. To make the list of exponent I ran the openssl s_client with all the possible PIDs, hoping that all the applications behaves the same way. After more tests I notice that that was an overgeneralization. The proof is in the pudding: wget and cURL, two simple CLI file retrievers, gets different exponent between them, even running with the same PID. I was working on this when I accidentally found a really nice Eric Rescorla’s post which is deeply related with this. The post goes further and analyzes the interaction between how Apache forks off and how it generates SSL handshakes. So, I made lists of secret exponents for wget, curl, openssl s_client and openssl s_server with a modification version of libssl (appling this patch) and running scripts like this:

for i in $(seq $((2**15)));
do
  export MAGICPID=$i;
  LD_LIBRARY_PATH="openssl.broken/" LD_PRELOAD="./getpid.so" \
     wget --no-check-certificate https://localhost/ -q  -O /dev/null ;
  echo $i ;
done

As you can see, I used the HD Moore’s GetPID faker shared library and a normal local Apache with mod_ssl. The broken libssl (which is in .openssl.broken/) store up in /tmp/data.key a csv with command name, PID and all the DH components (g, x, y and p). But this way is farly unconfortable for others SSL deamon servers. Have you got any better idea?

Yeah, it happened already a while ago, but I still get angry about it, so I need to rant about it in my blog: Yahoo!, the owner of del.icio.us, recently renamed the cool old del.icio.us to the no more cool and two bytes longer delicious.com. WTF? Part of del.icio.us’ popularity was its cool host name, why drop that? And even if a few dumbasses don’t understand the wordplay on the perfect host name, they could have offered delicious.com as a second domain name which works in parallel. But no, they dropped the good old del.icio.us in a way so that all old bookmarklets, bookmarks, plugins, etc. don’t work right anymore and I need to login each time I want to save a bookmark on all browsers where I once was logged in on the old site even if I’m already logged in at the new site in the same browser session. delicious.com sucks. And no, I don’t let count Gabor’s argument that people have difficulties with domains like del.icio.us, since many sites are well known or can be easily remembered because of their creative host or domain name: del.icio.us, script.aculo.us, wua.la, identi.ca, certifi.ca, laconi.ca, cr.yp.to, buenz.li (Swiss German), go.to, bit.ly, chickensh.it, gibts.net (German), doma.in, etc. No wonder, Montenegro sells many second level domains under their top level domain .me as “premium domains”.

OpenSSH can be compiled against OpenSC. Since the latter has support for the Belgian electronic ID card, that means you can use your eID card to log on to a remote server using OpenSSH. To do this is fairly simple, once you know how it works. First, obviously, you need to have ssh compiled against opensc. Unfortunately, the Debian package comes with that option disabled, but it's easy to enable that:

sudo apt-get build-dep openssh
sudo apt-get source openssh
cd openssh-*
$EDITOR debian/rules

Find the "Common build options", and add another line:

confflags += --with-opensc=/usr

Now add another changelog entry, so that your next apt-get upgrade won't overwrite your locally-modified SSH package:

dch -i

Next, build and install the package:

dpkg-buildpackage -rfakeroot -b -uc -us
cd ..
sudo dpkg -i openssh-client*

You now have an OpenSSH that can access smartcards. So, how do you use it to log on to a remote system? Simple:

pkcs15-tool -c
ssh-keygen -D 0

The first command will tell you the order of the certificates on the card. In my case, the Authentication certificate is first, while the Signature certificate is second. You do not want the Signature certificate; you only want the Authentication certificate. The second command will output the RSA public keys that are on the smartcard in both SSH1 and SSH2 format, in the same order as in the pkcs15-tool output. You only want the SSH2 version, and you only want to get the Authentication key. That key needs to be added to your ~/.ssh/authorized_keys on the remote host. Note that the '0' assumes that your smartcard is in slot 0; if that doesn't work, 'pkcs11-tool -L' should tell you which slot you need. After we've done this, we're ready to start using the smartcard to log in. While ssh-add has an option to load keys from a smartcard, this only works with smartcards that allow one to download the private key from the smartcard into the computer's RAM. This is not possible with the eID (and for good reason), so you can't use ssh-agent with your eID card. However, you don't really need it.

beid-pkcs11-tool -l -t

This will log in to the Authentication key on the smartcard (note that while it is possible to log in to the Authentication key, it is not possible to do the same with the Signature key). You will get the familiar belpic login window now, and the smartcard will now allow use of the private key. In order to actually use this key, you need to specify one extra option to ssh:

ssh -I 0

The -I option instructs SSH to use a smartcard key as a private key. Since we're already logged in to the smartcard, we do not need to enter a PIN code (and regardless, SSH does not know how to do that). You will now be logged on to the server. Note that there is no way to 'log out' of a smartcard; the proper way to do that is to remove your card from the cardreader...

Here are some slides and examples I used for a kernel course I developed (some time ago now). The course was aimed at C developers who wanted an introduction to both general UNIX-style user-space and Linux kernel development with a focus on embedded systems issues. The course is aimed at two 8-hour days, and is pretty packed in even then. The first day is user-space development and kernel building, focusing on things like make, autotools, advanced gcc, getting cross-compilers working, configuring the kernel and building. The second day we get into kernel internals; building up a kernel module to produce some simple proc nodes, take data, crash and debug, etc, look at internals like concurrency and the driver model, and focus on USB quite a bit. Here is a tarball of the entire thing, including the examples. Hopefully these can help out anyone tackling the design of such a course.

• Day 1
  • Linux philosophy, people and processes
  • UNIX build environment
    • Makefiles, Autotools
  • Executable and Linker Format
  • Advanced GCC
  • Linker, Dynamic Linker, Shared Libraries
  • Cross compilation toolchain
    • Building toolchains on Debian
  • Kernel development process
  • Source control, patches, GIT, Quilt
  • Configuring and building a kernel
  • Cross compiling kernel
  • initrd, initramfs, init tools

• Day 2
  • Kernel source layout
  • Kbuild, Kconfig
  • Syscalls (x86-32)
  • Kernel view of userspace
  • Virtual Memory
  • Getting data in/out kernel
  • Crashing, Oops, backtraces
  • Various tools
    • systemtap, kprobes
    • perfmon, oprofile
    • valgrind
  • Basic constructs
    • Concurrency, locks
    • Interrupts, sleeping
    • Atomic access
    • Memory allocation
  • VFS layer
  • /proc
  • Char and block devices
  • Driver model
    • sysfs, kobjects
    • buses, devices
  • USB Overview
    • Protocol overview
    • Registering drivers
    • uevents
  • Useful development paradigms
  • Unit testing

I found a machine which is not so ancient and did some tests with Xen on it.

Emacs CVS has an interesting new feature: it now accepts a --daemon command line option which makes it start up as a Unix daemon; it detaches from the controlling terminal, starts up a new process session, goes to the background, starts an Emacs server and just waits for connections. The user can then use emacsclient to create new frames (console or graphical) for the background Emacs, using the new multi-tty abilities of Emacs 23. Since frame creation is virtually instantaneous, this makes the editor start up much faster than in the usual case (and a lot more so if you have an extensive configuration). Also, if your X session goes down, the editor is still running in the background with your buffers and applications, safe from harm. Very neat! (Get it from the usual place if you run Debian.)

(Note: this new --daemon mode is a cleaner replacement for the old screen-based preload-emacs script that was distributed with the multi-tty branch.)

dosfstools is a collection of three utilities for making and checking FAT/MS-DOS filesystems:

• dosfsck (aka fsck.msdos and fsck.vfat)
• dosfslabel
• mkdosfs (aka mkfs.dos and mkfs.vfat)

Unfortunately, dosfstools are without an active upstream maintainer for a couple of years. After I took over the package in Debian in June, I'm now also taking over upstream. Version 3.0.0 includes all accumulated patches from Debian, Fedora, Gentoo and Suse together with some reordering of the sources. Packages have been uploaded to Debian sid, source tarballs can be downloaded from its new home.