I am often asked for advice about purchasing TVs and consumer electronics. Not that I am any great expert in those areas, but my general experience in specifying and purchasing electronics goods in related to my computer work does translate to other areas (and I know where to find advice on the net). As part of this I get to closely observe what happens when people install new home entertainment systems. I have not observed anyone who uses anywhere near the full function of their system, even using the bare minimum functionality in all areas is very rare. I believe that the first problem with this is the input devices. A remote control is designed around the idea of one button for each high-level command, this can be compared to languages such as Chinese and Japanese which have one character per word. In terms of language evolution it seems that the benefits of having multiple characters became apparent and widely accepted thousands of years ago. Now for a simple input device having one button for each high-level operation makes sense. For the basic functions of a VCR you have PLAY, STOP, Fast-Forward, Rewind, Record, and Eject - 6 buttons is quite reasonable. But then you want slightly advanced features such as “record from 8PM to 9PM on channel A and then record from 10PM to 11PM on channel B” and things become unreasonably difficult. More than 10 years ago I was recommending that people just buy 5 hour tapes and press record before leaving home, getting the full functionality out of a VCR was just too hard. Jokes are often made about people who leave their VCR flashing 12:00 (because it’s too difficult to set the time), I only set the time on a VCR to stop the flashing (flashing lights annoy me). Since programmable VCRs became popular things have only continued to develop. Now it’s not uncommon to have separate remote controls for the TV, VCR, DVD player, and the Cable TV box - a total of four remote controls! This is obviously a problem, and the solution that some people are adopting is to have a single more complex remote control - this is an example of problems not being solved by the same type of thinking that caused them. One of the attempts to solve this is to have everything controlled by a PVR [1]. This means that you have one device recording content (maybe from multiple sources or multiple channels), playing recorded content or live content, and maybe playing DVDs and CDs. Of course then you have a complex remote control for that device which just shifts the problem. To solve these problems we need to consider the entire problem space from a high-level. We start with the signal that is displayed by the TV, it can come from cable TV, digital TV, analogue TV, VCR, or DVD - these input sources have names such as “Composite”, “RCA1″, “RCA2″, “RCA3″, “DTV”, and “ATV”. Often people have written instructions near their TV to map these names to what they do. Obviously the TV needs to be able to be programmed with human friendly names, and as these names are not of much use on their own it should be possible to use compound names and abbreviations. If I want to watch ABC (the Australian Government sponsored TV channel) then I would rather type “ABC” on a keyboard and then have the entertainment system determine whether that maps to “cable:abc”, “dtv:abc”, or “atv:abc” depending on what options are available. The current process of choosing an input source (such as RCA1 mapping to cable TV) and then choosing a channel (102 mapping to ABC) means among other things that it is essentially impossible for a guest to control the TV. A further problem is the lack of available output. While it might seem that a large-screen HDTV has adequate output available, it’s often the case that you don’t want to stop watching one show while trying to find another. When something of wide interest is happening (another war or an election) it’s common for several people in one room to want to watch the news. Having everyone stop watching while someone goes through menus to find a different news channel is not well accepted. It seems to me that we need a separate output mechanism for controlling the entire system from that which is used for the main display. This of course requires integration between all parts of the entertainment system, which shouldn’t be that difficult given the complexity of all the components (every one of which has more compute power than a typical server of 20 years ago). It is currently quite common for PVRs and DVD players to support playing videos from USB and SD devices, so the next logical step is to get an Ethernet port in each device (and maybe have Ethernet switches built in to some of the high-end entertainment hardware). Then XML transferred over HTTP could be used for controlling the different components from a single web server which provides a web-based GUI. While a random guest would not get much functionality out of my TV configuration (or that of most homes where I have assisted in the configuration of new hardware), they shuold be able to use a web-based GUI with ease. For controlling the entire system a NetBook [2] computer such as the EeePC should do well. As high-end TVs cost over $5,000 an EeePC which costs $500 (list price - surely less in bulk) could easily be bundled without much impact on the overall price in the same way that companies selling computers in the $1,000,000 price range used to bundle $10,000 workstations to manage them. An EeePC has abut the same size and mass as four remote controls (so it wouldn’t be inconvenient to use). Also the built-in wifi could be used for the remote control (wires are inconvenient and Infra-Red has limited bandwidth so probably wouldn’t provide a good web based GUI). Also someone who wanted to save some money could instead choose to use an old laptop on a coffee table (any web browser would do). I have deployed Linux desktop machines for some people who had no trouble using it, but who then had trouble using TVs that I configured for them - so I conclude that a modern Linux distribution is significantly more user friendly than the equipment that you find in a modern lounge room. Cable TV companies all seem to be ISPs and often provide compelling value as an ISP service if you want to use the TV service. So it seems that the “Cable Modem” could be built in to the Cable TV box for added savings in hardware purchase and less boxes to manage in the home. This of course would increase the value of a NetBook [2] as a remote control as it could also be used for general Internet access at the same time. TV shows often promote their web sites to their customers and TV advertising also often includes a URL. If the URLs were distributed by VideoText then that would provide more information for the viewers, a better reach for advertisers and people who create the TV shows, and it when it became popular it would save us fom those stupid scrolling news tickers that appear on the bottom of most cable new shows! Some of these benefits are currently achieved by people running MythTV. The first problem with Myth is that it is still largely stuck to the bad old UI paradigm (which of course can be fixed as it’s free software). The next problem is that getting a result of comparable quality to the dedicated hardware is expensive, difficult, or both. A regular PC makes more noise than you desire in your lounge room and configuring a Myth machine for your choice of DTV hardware and the frequencies used in your location is a pain. You can buy a preconfigured machine which solves these problems, but it will be more expensive. For most lounge rooms the cheap Chinese hardware is what will be used. Ultimately I believe that TV will be killed by the Internet. The range of content on the net is increasing and the rate of acceleration is also increasing. TV seems to have not made any significant changes since the introduction of cable and satellite TV (both of which happened a long time ago and were not significant changes). But I don’t expect it to happen soon. I predict another 10 years of the current TV business model. I believe that better integration of home entertainment hardware so that it can obey simpler commands from the user in a more friendly manner while not getting in the way of the main purpose (displaying the TV picture) has the potential to extend the life of the current TV business model. Not that I care whether the TV industry dies sooner or later. I just want to escape from having to provide phone-support to people who can’t get their TV to work correctly!

• [1] http://en.wikipedia.org/wiki/Digital_video_recorder


• [2] http://en.wikipedia.org/wiki/Netbook

Share This

If you search for bacula mysql backup on Google you won’t find any recipes to make a backup of your MySQL databases. Sure, you can just copy the files, but then you’ll have a big nasty surprise when you need to restore it. So I decided to make my own script to create a copy of the MySQL database I can back up and restore with Bacula. I run it every day on the server, and it dumps every table to a separate file, overwriting the previous file only if the contents have changed. In this way, when I do an incremental or differential backup, Bacula will copy only those tables whose contents have changed. Of course, consistency among tables is lost, as every table dump is done within a separate transaction, but… well, I’m copying a MySQL database with MyISAM tables, so it’s not like there was much consistency to start with :) And so I leave here the script in case someone else would like to replicate my setup. And if someone else can tell me if there’s a wonderfully simple way to make backups of MySQL databases with Bacula that I’ve somehow overlooked, I’m all ears :)

#!/bin/bash -e
CWD=$(pwd)
[ -n "$1" ] && CWD="$1"
sql()  
        mysql -B "$@"
 
clean()  
        sed 1d   sort -u
 
was_table_modified()  
        UNCHANGED=1
        for dbfile in /var/lib/mysql/$2/$3.*
        do
                if [ "$1" -ot "$dbfile" ]
                then
                        UNCHANGED=0
                fi
        done
        return $UNCHANGED
 
DATABASES=$(echo "SHOW DATABASES"   sql   clean)
for db in $ DATABASES 
do
        [ -d "$CWD/$db" ]   mkdir -p "$CWD/$db"
        TABLES=$(echo "SHOW TABLES"   sql $db   clean)
        for table in $ TABLES 
        do
                FILE="$CWD/$db/$table".gz
                if was_table_modified $FILE $db $table
                then
                        mysqldump --opt $db $table   gzip > "$FILE".new
                        if [ ! -f "$FILE" ]   ! cmp -s "$FILE" "$FILE".new
                        then
                                mv "$FILE".new "$FILE"
                        else
                                rm -f "$FILE".new
                        fi
                fi
        done
done

A common trait of virtually all of the media in Mexico -and, as far as I have been able to see, in Latin America- is the push for society to be afraid. The government and the media (which go hand-in-hand, mainly due to a series of favors owed to each other - currently stemming from the government's illegitimacy and lack of trust from the general population) wants us all to think the country is as violent and as dangerous as it has never been before.
And yes, I cannot and won't try to deny that there are many critical points that need attention - But the answer cannot be militarization, cannot be further restraining the civil liberties, cannot be criminalization.
The only way to prevent crime is to reduce poverty. And poverty is not reduced by giving foreign "investors" (bah, ask people living on cities that border the USA if the maquilas have brought any kind of investment or somehow bettered the living conditions of the population!) access to segments of the economy so far limited to the government - Poverty will only be reduced when the government starts reviewing the tax systems to remove the legal loopholes that make it possible for a large enterprise to get tax exemptions on most of their income, and make the lower income people pay zero taxes, even get social aid.
But back to the topic: Since the 1994 crisis (the "decembrine errors"), we are being constantly bombed about the raging insecurity in Mexico. Maybe we have been bombed with that same ideas for more time, but I was not very politically conscious before that. When things go a bit smoother on the political side, the media relaxes the "we are so fucked" mantram.
When our de facto president current ruler took power, on December 2006, he had so much opposition he could not for months attend a single public event. So far, he is still avoiding them; everywhere he goes, the place must be cleared and sanitized of anybody who might show he just does not agree with the imposition we had. What was his first government action? To decree that every branch of the government would get a 10% budget cut on the salaries - but the security forces (the army, the different police corporations) would have a 46% raise.
After almost two years of ineptitude, they keep chanting the old "oh, we are living such dangerous times" mantra. The security forces recently got yet another raise, and everybody in the media says this country cannot be lived in anymore.
And people buy that crap.
Up to a month or two ago, the general outcry is that the drug lords had taken over the country - And, yes, in several areas of Mexico, their presence is bigger than the official security, or the security agencies are completely coopted by them. But not even His Majesty Felipe Calder n I "El Ileg timo" can say with a straight face that "we are winning the war against the drug lords" (a war brought by himself, of course - Think of it as Mexico's Irak. Think of Calder n as Mexico's Bush.) - A new attention sink was needed.
Of course, this country is not safer than Finland. But crimes do happen there as they happen here. Here, we have got a tremendous movement because of one brutal kidnapping in August, and everybody now thinks that everybody is at risk of dying kidnapped.
So today, after over a month of bombarding us with fear about kidnaps, I am sick of reading stupid reactions. What made me post this was a request for ideas at a local Free Software-related portal about monitoring known potential criminals. Of course, such a proposal would violate the right to anonimity and to lead a personal life even a convicted criminal has. And, of course, the cries of people that think the society should castrate rapists and kill kidnappers, basically going back 4000 years in history. People, let me hand you a stone and a stick so you can club the whole society to death.
The first step towards getting out of this security nightmare perception we have is to be critical towards what the media tells us - and to understand (and _really_ understand. I won't buy your argument that "it's easier to rob somebody for MX$4000 than to work a full day for MX$100", as it's only easier on one level, but it is a tremendous cost on many others) what makes good people act against the society.

It’s not easy to choose a laptop, and part of the problem is that most people don’t seem to start from the use of the laptop. I believe that the following four categories cover the vast majority of the modern use of mobile computers.

1. PDA [1] - can be held in one hand and generally uses a touch-screen. They generally do not resemble a laptop in shape or design.


2. Subnotebook [2] AKA Netbook [3] - a very small laptop that is designed to be very portable. Typically weighing 1KG or less and having multiple design trade-offs to give light weight (such as a small screen and a slow CPU) while still being more powerful than a PDA. The EeePC [4] is a well known example.


3. Laptop [5] - now apparently defined to mean a medium size portable computer, light enough to be carried around but with a big enough screen and keyboard that many people will be happy to use them for 8 hours a day. The word is also used to mean all portable computers that could possibly fit on someone’s lap.


4. Desktop Replacement [6] - a big heavy laptop that is not carried much.

There is some disagreement about the exact number of categories and which category is most appropriate for each machine. There is a range of machines between the Subnotebook and Laptop categories. There is some amount of personal preference involved in determining which category a machine might fall in. For example I find a Thinkpad T series to fit into the “Laptop” category (and I expect that most people would agree with me). But when comparing the weight and height of an average 10yo child to an adult it seems that a 10yo would find an EeePC to be as much effort to carry as a T series Thinkpad is for an adult. It seems to me that the first thing that you need to do when choosing a laptop is to decide which of the above categories is most appropriate. While the boundaries between the categories are blurry and to some extent are limited by personal preference it’s an easy second step to determine which machines fit the category you have selected (in your opinion) once you have made a firm decision on the category. It’s also possible to choose a half-way point, for example if you wanted something on the border of the “Laptop” and NetBook categories then a Thinkpad X series might do the job. The next step of course is to determine which OSs and applications you want to run. There are some situations where the choice of OS and/or applications may force you to choose a category that has more powerful hardware (a CPU with more speed or features, more RAM, or more storage). For example a PDA generally won’t run a regular OS well (if at all) due to the limited options available for input devices and the very limited screen resolution. Even a NetBook has limitations as to what software runs well (for example many applications require a minimum resolution of 800×600 and don’t work well on an EeePC 701). Also Xen can not be used on the low-end CPUs used in some NetBooks which lack PAE. Once you have chosen a category you have to look for features which make sense for that category. A major criteria for a PDA is how fast you can turn it on, it should be possible to go from standby to full use in less than one second. Another major criteria is how long the battery lasts, it should compare to a mobile phone (several days on standby and 8 hours of active use). A criteria that is important to some people is the ability to use both portrait and landscape views for different actions (I use portrait for editing and landscape for reading). A NetBook is likely to be used in many places and needs to have a screen that will work well in adverse lighting conditions (a shiny reflective screen is a really bad thing), it also needs to be reasonably resilient as it is going to get bumped if it is transported a lot (a solid state disk is a good feature). It should also be as light as possible while having enough hardware to run a regular OS (an EeePC 701 with 512M of RAM and 4G of storage is about the minimum hardware for running a regular distribution of Linux). A desktop replacement needs to have all the features, lots of RAM, a fast CPU and video hardware, and a big screen - it also needs a good keyboard (test by typing your name several times). The “Laptop” category is much the same as the desktop replacement, but a bit smaller, a lot lighter, and better battery life. It seems very difficult to give any specific advice as to which laptop to buy when the person who wants the advice has not chosen a category (which is often the case).

• [1] http://en.wikipedia.org/wiki/Pda


• [2] http://en.wikipedia.org/wiki/Subnotebook


• [3] http://en.wikipedia.org/wiki/Netbook


• [4] http://en.wikipedia.org/wiki/Eeepc


• [5] http://en.wikipedia.org/wiki/Laptop


• [6] http://en.wikipedia.org/wiki/Desktop_replacement_computer

Share This

I started testing GCC 4.4 ten days ago and the results are in. In total, I filed 28 new bugs and ran into 7 known issues. More than half of the bugs I filed have already been fixed and many of those that are still open have already received some attention (debugging, suggested patches). I sent a complete report to the GCC list, although I forgot to mention that I set optimization to -O3 to catch more problems. I know that it's quite popular to complain about GCC, but I'd say that most impressions people have about the GCC community no longer hold true. The GCC community is very active these days, bugs tend to get a lot of attention and there are major infrastructure changes underway to improve the compiler.

After reading on Jimmy Schementi's weblog that IronPython, the .NET implementation of Python, is just an apt-get install ironpython away, I thought I'd give it a whirl. Here's what I got. Huh? Maybe Microsoft took that "significant whitespace" thing a little too literally... It turns out that IronPython really wants you to use a dark background (bug report). Ah, so that's why the background of Jimmy's blog is black! As you can see from the screenshot, it's also a bit difficult to quit from the Ubuntu version of IronPython. That weird symbol is a result of pressing Ctrl+D. Even Ctrl+\, which usually helps in such cases, only produces a nasty .NET CLR traceback with no ill effects to the interpreter. On the bright side, this is a good start. IronPython seems to be more or less functional, with speed comparable to CPython, even though the example code included in Debian looks a little "heavy" (see /usr/share/doc/ironpython/Tutorial).

I see Martin is proud to have started this... altfrangg, calvados, faegnaescht, gazpacho, gin, gluggsi, lumpesammler, papillon, syydelaervli, tonic, zbasel If you can guess this, you're invited to gatecrash anytime. If you can guess this and don't live close to me (or did at some time in the past, and didn't use Google), I'd be curious to know how...

Sure, Martin, you started a meme (by the way, I roughly guessed you naming scheme which is a nice one). I wish I would have named my machines this way: patrick, bob, sandy, eugene, plankton, carlo, gary, puff, pearl, etc. (easy to guess for people who went to Debconf's day trips). Indeed, I haven't because I named the first ones too long time ago. So they're named kheops, khephren, mykerinos, snefrou, saqqarah, merenptah, amenophis, sethi, djedefre. Easy to guess. PS: 'carlo' is only for French-speaking users. For en_*, thata would be squidward.

It seems to be a common idea by non-bloggers that the comment they enter on a blog is somehow special and should be taken seriously by the author of the blog (everyone is a legend in their own mind). In a recent discussion one anonymous commentator seemed offended that I didn’t take his comments seriously and didn’t understand why I would take little notice of an anonymous comment while taking note of a later comment on the same issue by the author of the project in question. In most forums (and I use the term in the broadest way) an anonymous comment is taken with a weight that is close to zero. That doesn’t mean that it will be ignored, it just means that the requirement for providing supporting evidence or of having a special insight and explaining it is much greater. One example of this is the comment weighting system used by Slashdot.org (AKA “/.”). The /. FAQ has a question “Why should I log in?” with the answer including “Posting in Discussions at Score:1 instead of Score:0 means twice as many people will see your comments” [1]. /. uses the term “Anonymous Coward” as the identification of users who are not logged in, this gives an idea of how they are regarded. Advogato uses a rating method for blog posts which shows you only posts from blogs that you directly rank well or which match the trust metric (based on rankings of people you rank) [2]. I believe that the automated systems developed by /. and other online forums emulate to a some extent the practices that occur off-line. For any discussion in a public place a comment from someone who does not introduce themself (or gives an introduction that gives no reason to expect quality) will be treated with much less weight than one from someone who is known. When someone makes a comment their background will be considered by people who hear it. If a comment is entirely a matter of opinion and can not be substantiated by facts and logical analysis then the acceptance of the comment is solely based on the background of the author (and little things like spelling errors can count against the author). Therefore if you want your blog comments to be considered by blog authors and readers you need to make sure that you are known. Using your full name is one way of not being as anonymous but most names are not unique on the Internet (I’ve previously described some ways of ensuring that you beat other people with the same name in Google rankings [3]). The person who owns the blog can use the email address that is associated with the comment to identify the author (if it’s a real email address and it’s known by Google). But for other readers the only option is the “Website” field. The most common practice is to use the “Website” field in the comment to store the URL of your blog (most blog comments are written by bloggers). But there is nothing stopping you from using any other URL, if you are not a blogger and want to write comments on blogs you could create a personal web page to use for the comments. If the web page you use for such purposes gives links to references as to your relevant experience then that would help. Someone who has skills in several areas could create a web page for each one and reference the appropriate page in their comment. One problem we face is that it is very easy to lie on the net. There is no technical obstacle to impersonation on the net, while I haven’t seen any evidence of people impersonating others in an attempt to add credibility to blog comments I expect it’s only a matter of time before that happens (I expect that people do it already but the evidence of them getting caught has not been published anywhere that I’ve read). People often claim university education to add weight to their comments (usually in email but sometimes in blog comments too). One problem with this is that anyone could falsely claim to have a university degree and no-one could disprove their claim without unreasonable effort, another is that a university degree actually doesn’t mean much (lots of people remain stupid after graduating). One way in which adding a URL to a comment adds weight is that for a small web site the author will check a reasonable portion of the sites that link to them, so if someone impersonates me and has a link to my web site in the comment then there’s a good chance that I will notice this. OpenID [4] has the potential to alleviate this by making it more difficult to forge an association with a web site. One thing that I am working on is enabling OpenID on all the web sites that are directly associated with me. I plan to use a hardware device to authenticate myself with the OpenID server (so I can securely enter blog comments from any location). I expect that it will become the standard practice that comments will not be accepted by most blogs if they are associated with a URL that is OpenID enabled unless the author of the comment authenticates themself via OpenID. Even when we get OpenID enabled everywhere there is still the issue of domain specific expertise. While I am well enough known for my work on SE Linux that most people will accept comments about it simply because I wrote them, the same can not be said for most topics that I write about. When writing about topics where I am not likely to be accepted as an expert I try and substantiate my main points with external web pages. Comments are likely to be regarded as spam if they have too many links so it seems best to only use one link per comment - which therefore has to be on an issue that is important to the conclusion and which might be doubted if evidence was not provided. The other thing that is needed is a reasonable chain of deduction. Simply stating your opinion means little, listing a series of logical steps that led you to the opinion and are based on provable facts will hold more weight. These issues are not only restricted to blog comments, I believe that they apply (to differing degrees) to all areas of online discussion.

• [1] http://slashdot.org/faq/accounts.shtml


• [2] http://www.advogato.org/person/raph/diary.html?start=224


• [3] http://doc.coker.com.au/internet/personal-seo/


• [4] http://en.wikipedia.org/wiki/Openid

Share This

It appears as if I have started a meme. Someone please shoot me. NP: Gazpacho: Night

Logging on the Freerunner By default, the FreeRunner comes without a system log daemon, and rightfully so, because you don't want a daemon filling up /var, and a nightly cron job to rotate logs, on a mobile phone. However, I do not want to give up logging. If there are bugs I want to investigate, I like to be able to look at the logs. The solution: remote logging. Configure the phone to send all log info via UDP to my laptop, and configure my laptop to listen for UDP syslog messages from the phone only. How to do it:

1. apt-get install rsyslog (see below how other logging daemons fail)
2. Add a /etc/hosts entry for the laptop on the phone: 192.168.0.200 base
3. Add a /etc/hosts entry for the phone on the laptop: 192.168.0.202 openmoko
4. Replace the phone's rsyslog rules to send everything to the laptop:

   ################
   ##### RULES ####
   ################
   # Everything goes to the main computer, via UDP, if available
   *.*     @base
   #
   # Emergencies are sent to everybody logged in.
   #
   *.emerg                         *
   
   

5. Tell the laptop's rsyslog to accept UDP messages from the phone only:

   # provides UDP syslog reception
   $ModLoad imudp
   $UDPServerRun 514
   $UDPServerAddress 192.168.0.200
   
   

That is all. When the phone is not connected, the UDP packets from the logger will go nowhere. When it gets connected to the laptop, a script is triggered that creates the 192.168.0.200 interface, rsyslogd will listen on that interface and the UDP packets will be logged. This has the extra potential to be able to get error messages in case of bugs in the SD card driver, which I seem to hit from time to time. Why rsyslog sysklogd could receive the messages from the phone, but can only listen on all interfaces, and therefore requires me to set up firewall on my laptop in order to get packets from the phone only. syslog-ng can and can be told to listen on a given interface, but it will refuse to start if that interface isn't available. Since the phone is on an hotplugged interface that comes and goes, this is totally unacceptable. And finally, rsyslog is going to replace sysklogd both in Debian and in Fedora, so it's just as well a good excuse to switch.

My class has started with the “reportage” of our class with this excellent post and overview, which covers our initial comparison of the early phone phreakers and the early MIT hackers. I am excited to see the blog develop.

Following with the meme on Planet Ubuntu and started somehow in Planet Debian here it comes my machine names:
Current ones:
Laptop: Buster
Netbook: GogoDodo
Old Machines
Old Laptop: Marvin
Desktop: LePew
Work: LaFume
Palm: Tweety Did you already guessed what’s the patron? If not, i always take those names from here. Thank you Wikipedia for having the complete list of the Looney Tunes Characters.

I had to rewire a DSL concentrator (thunderstorm blew one of the ports...) today. The concentrator has two fan-out cables (input, output) with 25 RJ-11 connectors, color coded, so I had to find the colors of the remaining non-defective ports (there are 12 ports on this concentrator, the other 13 pairs are not connected. Presumably there isn't a 12 pair cable.) Google shows tons of references to the apparently standard 25 pair color code (first pair is white/blue), but unfortunately “my” cable had a light blue/light yellow first pair with most other pairs made up of cables with a base color and a colored stripe. I couldn't find the color chart on the Internet. Finally, the strange thought of RTFM entered my mind (and I even found the manual of the concentrator), and found that the importer has added a color chart leaflet to it; the cable is referred to as a “Telco50” cable. So here we go:

Pair	First Wire	Second Wire
1	red	red — white
2	yellow	yellow — black
3	green	green — white
4	blue	blue — white
5	brown	brown — white
6	black	black — white
7	purple	purple — white
8	orange	orange — white
9	light green	green — black
10	blue — black	purple — black
11	light blue — black	light blue — red
12	light green — green	light green — blue
13	light green — black	light green — red
14	light blue — blue	light blue — green
15	light yellow — red	light yellow — black
16	light yellow — green	light yellow — blue
17	gray	gray — black
18	gray — green	gray — red
19	red — black	light red
20	light red — blue	light red — green
21	light red — black	light red — red
12	white	orange — black
13	white — blue	white — green
24	white — red	white — black
25	light blue	light yellow

(Actually, on the DSL concentrator here this order is listed as “pin” numbers while the 12 ports are assigned in reverse order, starting at 25. The concentrator is a Zyxel VES-1012 and is not in production anymore.)

I’ve just updated my repository of SE Linux related packages for Lenny [1] to include a set of ffmpeg packages modified to not need text relocations (execmod access under SE Linux). I haven’t checked to make sure that I fixed all issues in those packages, but I have fixed all the issues that prevented Mplayer from working in a default configuration of SE Linux. I had to patch the file libswscale/rgb2rgb.c to disable the MMX assembly code as the --disable-mmx option doesn’t work for that file. I changed the build script so that when it generates the code for the shared and cmov targets in i386 mode it adds -DPIC and -DBROKEN_RELOCATIONS to the CFLAGS and also added LIBOBJFLAGS=-fPIC to the ./configure run. There might have been a better way of doing this, but the current implementation basically works. Long term I think that the ideal solution to this would be to have separate versions of the library packages for people who prefer extra security to a possible 15% performance benefit. While using these libraries on an EeePC 701 (the least powerful of all the machines I own which could be used to play video) I was able to play full-screen video downloaded from ted.com without any glitches so it seems that a 15% performance loss is not a problem.

• [1] http://doc.coker.com.au/computers/installing-se-linux-on-lenny/

Share This

I've long had the sneaking suspicion that, from the "free software" point of view, the most "threatening" proprietary software systems were not the most tightly locked down ones, where it's difficult to do anything without paying a fortune and control is absolute, but rather those that coopt as much as they can from the open source world. You get source code, you get an open and hackable system, you get to talk with the people who wrote the code, who will tell you all about it if you want to know. You can recompile it for different platforms, or tweak it how you want. You get to talk with other users of it, and maybe even share hacks and additions you've created. Just that you still may have to pay for it, and you don't get the rights to redistribute as you see fit. Gianugo Rabellino, CEO of SourceSense, speaks very well of Atlassian and what they're doing with systems like JIRA, which is a very open commercial offering: http://boldlyopen.com/2008/09/11/sustainable-software-look-down-under/ With the challenge "Can your Open Source vendor do this?". I don't think he's far off the mark; the fundamental problem with open source businesses is finding a way to introduce scarcity, as I've talked about before: http://journal.dedasys.com/articles/2007/02/03/in-thrall-to-scarcity That's not to say it's not possible (it is, obviously), or that open source doesn't work (it has, beyond my wildest dreams), just that we still haven't figured out the part that connects developers with money. One of the most successful (in terms of making Linux user friendly) companies to date is basically running on the "find a guy who already made a bundle elsewhere and is a good patron" model.

People frequently ask me what I am doing typing on my Palm right before logging in one of my remote systems. The answer is quite simple: generating my next password . People always seem puzzled by that answer Maybe I am just too old to have had only telnet sessions available to remote connections (that was the time before SSH took over)... or maybe I am just too paranoid regarding the access to my systems Anyway, I like One Time Passwords, and here is an article I can refer to when I get asked again ;-) One Time Passwords are just that: passwords that are good for one time use. They never repeat and once used you can throw it away securely. They were quite common when the authentication was done in clear text (so that any man-in-the-middle could steal your passwords), back in the r-tools age (rcp, rsh, rlogin, rexec, etc). After the SSH-related tools took over, providing easy tunneling and remote access, MITM attacks were of much concern, so OTPs became less relevant. What a shame, for they even have a couple of standards for those! But there s still room for OTPs Question: Is it easier to deploy a MITM attack or a keylogger? That s right We are always connecting to our remote systems in public terminals (well at least I am right now typing from the hospital computer), and a keylogger is so easily installed in one of those terminals, even remotely, that no one would ever get close to deploy a refined MITM attack just to steal someone s password. One would just install a keylogger! All the security SSH provides would just be gone by then. That s why I use SSH to connect to my remote machines, but use OTPs to authenticate myself. It s so easy to deploy it. In Debian you ll find packages opie-server and libpam-opie and those are the only things you ll need on the server side (besides SSH, obviously). OPIE means One-time Passwords In Everything , and combined with PAM, one can really use it everywhere. After installing it, you ll have to generate the password file for your account:

spectra@home:~$ opiepasswd -c
Adding spectra:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:
ID spectra OTP key is 499 ho6484
HAVE COOK LOLA AIRY NEIL ROAM

The pass phrase will be used to generate the passwords in a step before your login. Please, try not to forget it (specially if you re following this article and playing with some remote system at the same time). Now you can edit /etc/pam.d/ssh file (or its equivalent in non-Debian systems) to require that kind of authentication. Mine just looks like this:

# /etc/pam.d/ssh
auth       required     pam_env.so
auth       required     pam_env.so envfile=/etc/default/locale
auth       required     pam_opie.so

First two lines are unrelated and just load the environment variables. Last line is where the fun is. Please, note two things: (1) I removed references to pam_unix.so, which is what would ask for my real password, that I want to disable (no login is allowed with that password). And (2), I declared it as required, meaning that failing it will keep one out of the system. We are not ready yet! SSH will work by now, but will not present you the OTP challenge. Probably you could still login, but you d have to remember which is the current password (Trust me, you would not!). To get the challenge you ll need to enable it in /etc/ssh/sshd_config change the following line:

ChallengeResponseAuthentication yes

That s it. Now to login to your remote machine, that s what will usually happen:

spectra@hospital:~$ ssh home
otp-md5 498 ho6484 ext, Response:
spectra@home:~$

Voil ! It asks for password #498. By default, it starts with 500 passwords and goes down from that. Password #498 were asked, so the next will be #497. After that, #498 is not useable anymore, and #496 is not useable yet. You can generate a list of those passwords (let s say 10), print it and keep it in your pocket. This is the command you d use for that:

spectra@home:~$ opiekey -n 10 498 ho6484
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Sorry, but you don't seem to be on the console or a secure terminal.
Warning: Continuing could disclose your secret pass phrase to an attacker!
Enter secret pass phrase:
489: CALM INTO WEEK APS LOON VIE
490: HASH GYM RAID GOSH HOYT DUAL
491: BELL GIN RIFT HELM GUY BUNK
492: HEBE OBOE SUP LEG LULU LANG
493: HOYT JOT ASK JOG GIBE BETH
494: NASH MOOT HIND YEAH  YAP CARL
495: MATE OF BARD LAVA LEAK AHOY
496: TAB BAG KEY GILT AVID VEAL
497: MOLE FORM NIB LEER ROSS HAVE
498: SING WERE OVEN SOD VEIN NIBS

That is not so secure, since you can loose the paper and be doomed Luckily there are lots of small softwares that does this generation for you. Some you can use from your Palm or from some J2ME-enabled phone (such as N95). Some your can use from another (trusted) computer. Some are even online, written in javascript! There are at least one other side-benefit of using OPIE as above: You can give away your user password (even root password OK, probably not a Good Thing^TM), that the system would still be secure, since it only allows SSH authentications via OPIE! If the session is started with a username whose opiepasswd was not activated (first step scroll back to the beginning of the article), SSH will greet you with a bogus challenge only opie-activated users will be allowed to login with the above configuration. Easy enough, isn t it? Now, next time you see me typing on my Palm before opening an SSH connection you ll know what I am doing ;-)

I recently wasted a bit of time reading some right-wing blogs. One thing I noted was the repeated references to news reports about young women from an Islamic background being beaten (and in some cases killed) by their fathers (and other male relatives) for not conforming to some weird cultural ideas that some people associate with Islam. These are spun as examples of Islam being bad and therefore opposing immigration policies that allow Muslims into countries identified as “Christendom” or “The West” (never mind the fact that the vast majority of the population in “Christendom” don’t even attend church twice a year and the fact that Australia is directly south of China, Russia, and North Korea). It seems to me that when young people follow the cultural standards of the country where they live rather than the standards of the country that their parents came from then it’s evidence of “multiculturalism” working. When young Muslim women are beaten by their fathers whether it’s considered an example of Muslims being bad (and who therefore should be excluded) or an example of Muslims as victims who should be protected is a matter of interpretation. It’s not as if there is any shortage of domestic violence cases from any religious or cultural group. It’s often claimed that fundamentalist Muslims hate our culture, strangely the same people seem to claim that our culture will be destroyed by radical Islam. These two ideas seem to conflict, if our culture (the pro-science, free-speech, few inhibitions on clothing standards, do what you want but don’t hurt others culture that most readers of my blog enjoy) can be destroyed by radical Islam then they wouldn’t hate it. I think that the reason why fundamentalist religious people (Christians and Muslims) dislike our culture is because it is so strong. Our culture offers a way of life that is simply better than that which fundamentalist religious groups offer. Any religious person can choose to take a liberal approach to their religion (emphasising the positive aspects of giving to charity, being nice to others, etc) and enjoy our culture. Our culture is based around wide-spread communication, mass media, mobile phones, the Internet, custom clothing design, etc. It can do to religions what the sea does to rocks. It seems that the strongest efforts at attacking our culture come from Christian groups. For example the Exclusive Bretheren [1] runs a high school in my area, according to a local paper it distinguishes itself by having no students enter a university course! The Exclusive Bretheren (and some other radical Christian groups) have a deliberate policy of keeping children stupid with the idea that people who think may decide to change their religion. Some time ago I had a taxi driver start an unsolicited discussion of religion by telling me how much he hated Muslims. I pointed out the fact that there are Muslims of all races and asked why he thought that I was not a Muslim. After that the rest of the journey was very quiet. The mainstream media would have us believe that Muslims have some sort of monopoly on terrorism. Noam Chomsky’s paper “Terror and Just Response” [2] is one of many that he has written on this issue. I realise that many people don’t want to acknowledge the involvement of the US government (and it’s allies such as Australia) in international terrorism. But please read Noam’s position (which is compelling) or read his wikipedia page which lists his extensive accomplishments [3] (if it’s the background of an author that impresses you).

• [1] http://en.wikipedia.org/wiki/Exclusive_Bretheren


• [2] http://www.chomsky.info/articles/20020702.htm


• [3] http://en.wikipedia.org/wiki/Noam_chomsky

Share This