As reply to my previous post about per-process namespaces, Russell wrote about pam-namespace and shared subtrees. As he reports, pam-namespace (that I discovered by the occasion) can do what I was suggesting would be nice for pam-tmpdir. Anyways, I was actually already planning to write about shared subtrees and how they can be useful with namespaces. In this first post, I will introduce shared subtrees, while in a follow-up post I will introduce how they can usefully be used with namespaces. As a preliminary note, you should know that while etch’s kernel supports shared subtrees, etch’s mount doesn’t support the necessary options. Lenny’s mount is unfortunately uninstallable on etch due to its dependency on a newer libc. But you can find a smount utility’s source code in Documentation/filesystems/sharedsubtree.txt in the kernel source, where other explanations about the feature are available. So, you can either backport lenny’s util-linux to etch, or build smount to replicate what I will be doing below. If you are using smount, just replace

mount --make-type path

with

smount path type

As seen in my previous post, bind-mounting allows to attach a file hierarchy at some other place in the virtual file system.

mount --bind / /mnt

will make all the contents of / (/bin, /etc, …) available through /mnt (/mnt/bin, /mnt/etc, …). On the other hand, sub-mounts will be ignored in such a case. For instance, /usr is usually a different mount point from /. It means /mnt/usr will be empty (provided it is empty in the underlying physical filesystem), instead of containing the same as /usr:

$ mount --bind / /mnt
$ ls /mnt/usr
$ ls /usr
bin games include lib lib32 lib64 local sbin share src X11R6
$ umount /mnt


If you also want /usr to be bind-mounted, you must use --rbind instead of --bind:

$ mount --rbind / /mnt
$ ls /mnt/usr
bin games include lib lib32 lib64 local sbin share src X11R6
$ ls /usr
bin games include lib lib32 lib64 local sbin share src X11R6


Obviously, sub-sub-mounts will also be propagated. Since recursively bind-mounting will create a bunch of mount points, unmounting can become a hassle. You can use the following command to unmount everything:

$ awk '$2 ~ /^\/mnt/ print $2 ' /proc/mounts sort -r xargs umount

Now, this is where shared subtrees come in. After the bind mount has been done, if you mount something on either side of the bind mount, the new mount is not propagated. This is called private subtrees, and is the default. But before doing anything else, let’s setup our testing environment:

$ mkdir -p /a/a /b
$ touch /a/b /a/c
$ ls /a
a b c
$ ls /b


After, bind-mounting /a onto /b, let’s see what happens when mounting something under /a, then under /b:

$ mount --bind /a /b
$ ls /b
a b c
$ mount --bind /usr /a/a
$ ls /a/a
bin games include lib lib32 lib64 local sbin share src X11R6
$ ls /b/a
$ umount /a/a
$ mount --bind /usr /b/a
$ ls /a/a
$ ls /b/a
bin games include lib lib32 lib64 local sbin share src X11R6
$ umount /b/a


As I said earlier, these new mounts are not propagated. Note that I used bind-mounts as sub mounts, but it would work all the same with other kind of mounts (device, fuse, etc.). There are 2 other modes that allow to have some propagation: shared and slave. shared allows mounts on both ends to be shared. Note you need to set the mode before bind-mounting:

$ umount /b
$ mount --bind /a /a # This is needed because /a is not initially a mount point and you can only apply subtree modes to mount points.
$ mount --make-shared /a
$ mount --bind /a /b
$ mount /dev/sda1 /a/a
$ ls /a/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /a/a
$ mount /dev/sda1 /b/a
$ ls /a/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /b/a


You can even mount on one end and unmount from the other:

$ mount /dev/sda1 /a/a
$ umount /b/a
$ ls /a/a


slave allows mounts on the “master” end (/a in our case) to propagate to the “slave” end (/b), but not the other way around. The “master” end need to be shared :

$ umount /b
$ mount --make-shared /a # Only for completeness, we already set /a as shared earlier.
$ mount --bind /a /b
$ mount --make-slave /b
$ mount /dev/sda1 /a/a
$ ls /a/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /a/a
$ mount /dev/sda1 /b/a
$ ls /a/a
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /b/a


There is a third mode, unbindable, that does something different:

$ umount /b
$ mount --make-unbindable /a
$ mount --bind /a /b
mount: wrong fs type, bad option, bad superblock on /a,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg tail or so
$ mount --bind /a/a /b
mount: wrong fs type, bad option, bad superblock on /a,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg tail or so


As you can see, it disallows bind mounting of /a and its subdirectories to some other place. Finally, to put back the default mode, you can use:

$ mount --make-private /a

Similarly to --bind, there is also a recursive version of each: rshared, rslave, runbindable and rprivate, to apply these to sub-mounts.

Mike writes about his work in using namespaces on Linux [1]. In 2006 I presented a paper titled Polyinstantiation of directories in an SE Linux system about this at the SAGE-AU conference [2]. Newer versions of the code in question has been included in Debian/Lenny. So if you want to use namespaces for a login session on a Lenny system you can do the following:
mkdir /tmp-inst
chmod 0 /tmp-inst
echo /tmp /tmp-inst/ user root >> /etc/security/namespace.conf
echo session required pam_namespace.so >> /etc/pam.d/common-session Then every user will have their own unique /tmp and be unable to mess with other users. If you want to use the shared-subtrees facility to have mount commands which don t affect /tmp be propagated to other sessions then you need to have the following commands run at boot (maybe from /etc/rc.local):
mount make-shared /
mount bind /tmp /tmp
mount make-private /tmp The functionality in pam_namespace.so to use the SE Linux security context to instantiate the directory seems broken in Lenny. I ll write a patch for this shortly. While my paper is not particularly useful as documentation of pam_namespace.so (things changed after I wrote it), it does cover the threats that you face in terms of hostile use of /tmp and how namespaces may be used to solve them.

• [1] http://glandium.org/blog/?p=217


• [2] http://doc.coker.com.au/papers/polyinstantiation-directories-in-se-linux/

It’s almost Christmas and time to buy scientific toys for children. Here are some random ideas, of course it’s probably too late for the online stores to deliver - but there’s always next year. The MikroKopter is a kit helicopter based on four propellors (two rotating in each direction) and is capable of semi-autonomous flight while carrying a decent payload (such as a digital camera) [1]. The parts cost over E700 and the skill involved in assembling it is significant, but it would be an excellent present for anyone who is 14+. Of course the type of helicopter described in my previous post [2] is a much more affordable present and can be used by a young child. The scitoys.com site has a good range of scientific toys for sale [3], they are assembled into kits. The United Nuclear site has a huge range of chemical supplies and related things [4] that can be used for making some great science experiments and toys. They also have really detailed information about the potential hazards of the things that they sell (not that I was planning to buy Cesium or Uranium anyway). If buying exotic alloys elsewhere it’s probably a good idea to check the United Nuclear site for the hazard information (not all sites provide as much information as they should). Professor Bunsen is an Australian site selling similar produces to SciToys [5]. The range is slightly different, and if you are in Australia then it’s safer to buy locally - there is a significant amount of stuff on the United Nuclear site that would be unlikely to pass Australian customs. The Spirograph is a good way to introduce mathematical concepts to children [6], it would probably be a good present for children who’s parents are not interested in maths and science. Lego [7] is always good, but there are also other similar products to consider. Meccano is good for older children, but the ranges for younger children have some deficiencies (the 2+ stuff requires the finger strength of an adult to assemble all parts). The Italian company Quercetti has some great products [9]. Unfortunately their web site is only in Italian and they have no links to sites in other countries/languages (they do have the names of some distributors who may have web sites). Their products includes a gears set (suitable for teaching children as young as 1yo) and a model car with an engine that has pistons moving inside a clear plastic case, a two-speed gearbox, and a fully functional differential (designed for 2yo+). For more hands-on tasks that require supervision (not something that can go under a tree) one good option for ages 3+ is to disassemble a variety of computers and computer parts. CD-ROM drives are good because you can connect a 9V battery to the head assembly motor or the tray eject motor to make it work. Hard disks have insanely strong magnets inside them - don’t give two such magnets to a child. A multi-meter is a great educational toy that can be used for many great experiements (as well as for practical tasks such as determining which battery of a set is flat) [10]. The parts from a hard disk can be used to demonstrate how a generator works (the mechanism to move the heads provides you with strong magnets and a coil that fits them). Note that an analogue meter is needed for such experiments as the amount of electricity generated is small and AC - a digital meter will average it out to zero (at least for the more affordable meters that I have used). It’s probably best to own both a digital meter and an analogue one, the minimum age for owning such a meter is probably about 10, the minimum age for using one with supervision is about 3. An oscilloscope is a great educational toy [11], unfortunately they are quite expensive (Ebay seems to have nothing below about $450). They can be used for all sort of fun tasks such as measuring the speed of sound. The wikipedia page notes that you can get PC based Oscilloscopes (PCO) which are cheaper. I wonder if they have Linux support for such things… The OLPC is a great computer for kids in developing countries [12]. They are now available in Australia [13]. For most children in first-world countries a second-hand laptop of a more traditional design is probably a better option. There are a significant number of old laptops gathering dust which can easily have Linux installed with a variety of educational software. Buying an OLPC on the “give one get one” deal costs $400US plus tax and shipping, while a second-hand laptop can be purchased for significantly less than that. While giving an OLPC to some random needy child is a good thing, as the person who gives a laptop locally is probably going to provide support for it there are some benefits to giving a regular laptop. Conferences often have bags of random junk to give out to delegates, and trade shows always have lots of little toys with company logos on them. Such things are usually of little use - but children like them. Also the trinkets that computer companies give away are often educational. If you have a cupboard filled with such things then unloading them on some children is a good idea - of course you have to make sure that anything you give to young children can’t be swallowed and has no sharp points.

• [1] http://www.mikrokopter.de/ucwiki/en/MikroKopter


• [2] http://etbe.coker.com.au/2008/12/11/toy-helicopter/


• [3] http://scitoys.com/


• [4] http://unitednuclear.com/


• [5] http://www.profbunsen.com.au/


• [6] http://en.wikipedia.org/wiki/Spirograph


• [7] http://www.lego.com/


• [8] http://www.meccano.com/


• [9] http://www.quercetti.com/


• [10] http://en.wikipedia.org/wiki/Multimeter


• [11] http://en.wikipedia.org/wiki/Oscilloscope


• [12] http://laptop.org/


• [13] http://www.olpc.org.au/

Linux has had this neat feature for quite some time now: since 2.4.19 according to the docs. Yet, it is neither very known nor very used. I couldn’t even find a program that would create a new namespace for its subprocesses, similar to what chroot does with the root of the file hierarchy. This neat feature allows each process to have a different set of mount points. While you most of the time want processes to share their mount points, there are some cases where you may want to have some processes have a different set of mount points. Combined with bind mounts, it can allow some useful setups. In case you are not familiar with bind mounts, they allow to “attach” a part of the file hierarchy to some place else. For example:

$ ls /mnt
$ ls /usr
bin games include lib lib32 lib64 local sbin share src X11R6
$ mount --bind /usr /mnt
$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6

Now, take pam-tmpdir, for example. It sets $TMPDIR and $TMP to point to a user-specific temporary directory. Sadly, it is pretty useless for applications that don’t follow the standards of using these environment variables. Without namespaces, if you’d create a temporary directory and bind-mount it to /tmp, this new /tmp would be visible to everyone, to every process. But with namespaces, you can make this new /tmp only available to subprocesses. If pam-tmpdir were to do this, it would also allow applications trying to write to /tmp without resorting to $TMP or $TMPDIR to be using the temporary space, without impacting external processes, that would still be using the original /tmp. On x86-64, you can run both 64-bits and 32-bits applications. 64-bits applications would take libraries from /usr/lib, and 32-bits applications would search libraries in /usr/lib32. But badly crafted 32-bits applications could be trying to load libraries from /usr/lib, where only 64-bits versions are available. With namespaces, the broken 32-bits application could have /usr/lib32 bind-mounted to /usr/lib without the 64-bits applications knowing. You could certainly get a similar result with the following set of commands:

$ mount --rbind / /chroot
$ mount --rbind /usr/lib32 /chroot/usr/lib
$ chroot /chroot $application

(–rbind also attaches submounts, contrary to –bind) The downside, here, is that external processes will see all this setup under /chroot. The whole setup would be invisible to external processes if namespaces were used. Another nice use of namespaces would be to mount encrypted volumes under a different namespace, so that only a limited set of processes would be allowed to read the decrypted data. The sad thing is that you need the admin capability to create a new namespace, so that would need to be done by a setuid root program. There are, as far as a few hours fiddling showed me, 2 system calls that will setup a new namespace: clone(2), and unshare(2). The second is easier to use, though only available since 2.6.16. But while etch ships 2.6.18, the glibc coming with it doesn’t implement unshare(2), so we need to use syscall(2) instead. The following code will run /bin/sh, or any command given as argument after creating a new namespace. The new process and its subprocesses will inherit the new namespace.

#include <sched.h>
#include <syscall.h>
#include <unistd.h> int main(int argc, char *argv[])
  syscall(SYS_unshare, CLONE_NEWNS);
  if (argc > 1)
    return execvp(argv[1], &argv[1]);
  return execv("/bin/sh", NULL);



This tool, once built, is called newns in the following example.

$ mkdir /tmp/abc
$ ./newns
$ mount -n --bind /tmp/abc /tmp
$ touch /tmp/a
$ ls /tmp
a
<in another terminal>
$ ls /tmp
abc
$ ls /tmp/abc
a


When using namespaces, it is better not to have mount fill /etc/mtab, using the -n argument. /proc/mounts will contain the proper mount information about the namespace of the process reading it. /proc/PID/mounts will contain the mount information for the given process. As bind mounts also work on files, you can override some files. The following will run dash instead of bash (in subprocesses, too, obviously):

$ ./newns sh -c "mount -n --bind /bin/dash /bin/bash; /bin/bash"

Back to the idea of having encrypted volumes only available to some processes, the following should work (unverified):

$ ./newns sh -c "encfs /tmp/crypt-raw /tmp/crypt; /bin/bash"

Only the opened bash, and its subprocesses, would have access to /tmp/crypt. The newns tool used above could, to allow normal users to be able to fiddle with namespaces, be improved to be a setuid root program that would drop its privileges right after unshare(2) to take the same privileges as the calling process. As you can see, per-process namespaces have a wide range of possible uses ; it’s astonishing that it’s not more used yet, considering its age. Additionally to per-process namespaces, there are also a bunch of other (more recent) features that allow to implement vserver-like features with a vanilla kernel, such as networking netspaces (work under progress, though), PID namespaces and utsname (see uname(2)) namespaces. Actually, these features are designed to be used by vserver and openvz. I am looking forward to having unprivileged mounts implemented, so that users could fool around with bind mounts. Unprivileged namespaces would be a nice addition.

Say you just deleted a branch or did a git reset --hard <earlier commit> and in the process lost a commit which you intended to keep.

Well, the good news is that unless you have run git gc to run a pass of garbage collection over your repo and get rid of objects which aren't linked to anymore, the objects for your lost commits should still be in the repo.

If you remember the SHA-1 IDs then you can simply use git cherry-pick to apply them to the current branch. However, if you don't have these commit IDs anymore, there is still a way to get to them.

This command will display all commits from the most recent to the oldest one:

git log -g

King Politics thinks the GOP anti-bailout faction has the politics of the day wrong:

The time for pragmatism is now, but Senate Republicans don t recognize that. Senate Republicans have yet to realize that the GOP lost so many seats in 2006 and 2008 because the American public has a greater desire for pragmatism than ideology.

I think that s true to a point but I suspect it has more to do with post-Katrina George W. Bush than any coherent definition of ideology. As much as the Democrats would like to pretend otherwise, ideological is not a term I d readily apply to the bumbling nature of Bush s second term. Nor am I really convinced that the average voter is doing much more than engaging in post-hoc rationalized-as-something-else economic voting, which doubtless makes me no fun at parties when I play a public opinion scholar. ( Yes, all this crap matters at the margins, and occasionally elections are won at the margins, but most of the time it doesn t matter. ) But I digress. There is a broader lesson, though, in that to the extent the Democrats believe that their recent success is due to their ideology it is at their long-term peril, particularly if they bypass pragmatism in favor of catering to the cobbled-together collection of rent-seekers that passes for the Democratic coalition. To the extent bailing out Detroit is seen as a Democatic handout to its paymasters particularly with the emerging frame of the greedy unions are standing in the way trumping any sort of concept that any deal that tells the UAW to can their contract is essentially an impairment of the obligation of contract (which, believe it or not, is unconstitutional) the auto bailout won t go over well in the 48 or so states that don t host significant Big Three production. On a related note, Steven Taylor notes the defining-down of the filibuster by the media to mean failure to win a cloture vote. While I accept the point graciously, I think this may be more a failure of us as a profession than the media per se; modern congressional procedures (not just filibusters and holds, but also esoterica such as the Rules Committee and UCAs), even superficially treated, aren t a strong point of most American government textbooks, and more often than not that s the only real government orientation budding journalists will get. I make a point of assigning Barbara Sinclair s Unorthodox Lawmaking in my Congress classes, but I doubt the average journalist gets that in-depth in their undergrad days. So here at least I think the blame falls somewhat closer to home than we might want to admit.

King Politics thinks the GOP anti-bailout faction has the politics of the day wrong:

The time for pragmatism is now, but Senate Republicans don t recognize that. Senate Republicans have yet to realize that the GOP lost so many seats in 2006 and 2008 because the American public has a greater desire for pragmatism than ideology.

I think that s true to a point but I suspect it has more to do with post-Katrina George W. Bush than any coherent definition of ideology. As much as the Democrats would like to pretend otherwise, ideological is not a term I d readily apply to the bumbling nature of Bush s second term. Nor am I really convinced that the average voter is doing much more than engaging in post-hoc rationalized-as-something-else economic voting, which doubtless makes me no fun at parties when I play a public opinion scholar. ( Yes, all this crap matters at the margins, and occasionally elections are won at the margins, but most of the time it doesn t matter. ) But I digress. There is a broader lesson, though, in that to the extent the Democrats believe that their recent success is due to their ideology it is at their long-term peril, particularly if they bypass pragmatism in favor of catering to the cobbled-together collection of rent-seekers that passes for the Democratic coalition. To the extent bailing out Detroit is seen as a Democatic handout to its paymasters particularly with the emerging frame of the greedy unions are standing in the way trumping any sort of concept that any deal that tells the UAW to can their contract is essentially an impairment of the obligation of contract (which, believe it or not, is unconstitutional) the auto bailout won t go over well in the 48 or so states that don t host significant Big Three production. On a related note, Steven Taylor notes the defining-down of the filibuster by the media to mean failure to win a cloture vote. While I accept the point graciously, I think this may be more a failure of us as a profession than the media per se; modern congressional procedures (not just filibusters and holds, but also esoterica such as the Rules Committee and UCAs), even superficially treated, aren t a strong point of most American government textbooks, and more often than not that s the only real government orientation budding journalists will get. I make a point of assigning Barbara Sinclair s Unorthodox Lawmaking in my Congress classes, but I doubt the average journalist gets that in-depth in their undergrad days. So here at least I think the blame falls somewhat closer to home than we might want to admit.

There seems to be indeed a meme on the various use of SSH. So far I ve not seem mine, so here it is ! If you use the -w option when connecting using SSH, and if you have the correct configuration, then two virtual network interfaces will be created on both the client and the server. Using these interfaces with a bit of routing and resolving magic, you can establish a full connection tunneled through an SSH connection !

The new Global 300 list has been released this week:-

the 300 top co-operatives are responsible for an aggregate turnover of 1.1 trillion USD which makes it the size of the 10th economy of the world nearly the size of the Spanish economy. The list also shows that co-operatives are growing in terms of turnover 14%

Also, the Good Fuel Co-operative (a consortium established early in 2008 by five UK biodiesel cooperatives: Goldenfuels, Sundance Renewables, Magpie Recycling, Bolton Alternative Fuels Co-operative and Biofuels.org.uk) has launched a share issue to raise 420,000 to fuel the growth of the biodiesel market. Finally, Cooperatives-SW board will meet in Exeter in January and the AGM will be in Plymouth in April - so if you d like me to let you know the dates when they re announced (for meeting up or otherwise), please leave a comment on this post and tick the Notify me of followup comments box. Thanks!

Yours faithfully,

Very un-unhappy Amaya.

Sorry about my last post. I never was upset at the people who pinged me. Just a bit overwhelmed. It just felt very scary to me.

I am damn fucking crazy after all, paranoid et all! Chemistry might help. Your hugs sure will!

Hi, I’d like to send an email from a small domain that you’ve never heard of or from a big ISP that’s known for being slack about spam (*), I can’t send the mail to you because of your anti-spam measures. I think that this is unfair, it’s discrimination, and you are cutting off your nose to spite your face in rejecting my mail. So please reconfigure your mail server now and accept more spam in your inbox, my message is important enough to justify the extra time you will spend manually deleting mail and the risk of accidentally deleting legitimate mail while deleting heaps of spam (I am in fact more important than you). By not accepting my mail you are being an asshole. I only receive a dozen spam messages a day and I don’t mind it, without even knowing you or having bothered to do a web search to see how well your email address is known I’m sure that you don’t receive any more spam than me and therefore you too can turn off most anti-spam measures and manually sort through the spam. You don’t really have a problem with spam, you are just paranoid, I’m sure that you installed your anti-spam measures before receiving any spam and then never bothered to check the hit rates. My sys-admin knows that one of the DNSBLs has an old entry from when his server was broken, but he won’t request that it be removed - so you can change your server because my sys-admin doesn’t want to click on a URL that you sent him. The RFC-ignorant.org service is used and run by ignorant people - I know this without even reading their web site to discover how it works. The above is a summary of a number of complaints that I have received about my anti-spam measures. I’ve para-phrased them so that they make sense, I have not actually had someone directly say “I’m more important than you so you should just accept more spam”, but the implication is quite clear. Now there are some legitimate reasons for requesting that anti-spam measures be reduced. In the distant past almost everyone had working reverse DNS entries which matched the forward entries and it was common to reject mail from systems that didn’t have valid DNS. Nowadays there are many big ISPs that delegate IP address space without permitting reverse DNS entries, and there are companies that have one department in charge of IP addresses (who don’t have a clue about reverse DNS) and another department running mail servers (who are cluefull). So the environment has changed to make reverse DNS checks a non-viable anti-spam measure. Requesting that people remove such checks is reasonable. Anti-spam measures that attack innocent third parties are bad. Sending “warnings” about viruses has made no sense for many years as all modern viruses fake the sender address, an employee of one company once admitted to me that they were sending out anti-virus “warning” messages as a way of sending unsolicited advertising to random people (I reported them as a spam source). Some time ago on a routine upgrade of ClamAV I accidentally copied in a default configuration file that made it send such warnings - I was grateful when someone informed me of my mistake so that I could fix it. Challenge-response is another technology that causes harm to others. I think it makes a lot of sense for mailing lists (every modern list server will confirm subscription requests), while it does result in sending unwanted mail to innocent third parties (every time a new virus becomes prevalent I receive a number of confirmation messages from list servers), but it’s not something that I will use on a regular email account (but I am prepared to do paid work implementing CR for other people). Requesting that manually implemented blocks be removed is quite reasonable. Occasionally I find that mail from one of my servers is blocked because a previous owner of the IP address space did bad things. In such a situation it is quite reasonable to provide an assurance that the new owner takes abuse issues seriously and to request that the block be removed. Requesting that I make any change to my system without making a minimal effort to get your broken mail server fixed is totally unreasonable. If the system administrator is not prepared to click on a URL to get their system removed from a black-list or if the user is unwilling to report the problem to the sysadmin then I will probably be unwilling to make any change to my system. The only exceptions to this rule are for clients, colleagues, and for people who use mail services that are large and unresponsive to users (IE the users don’t directly pay). I recently made a white-list entry for a large European ISP that is used by a Debian Developer for their work, as the ISP is known to be unresponsive to requests and mail related to Debian work is important to me I added a white-list entry. One thing I am planning to do is to document my anti-spam measures and then allow people the opportunity of suggesting new anti-spam measures that I haven’t tried yet if they want me to turn off any of my current protections. (*) I’m not aware of any big ISP that takes strong measures against spamming customers and customers whose computers are trojaned. I am aware of one having done it in the past, but I suspect that they may have ceased doing so after their brush with bankruptcy. I suspect that many ISPs simply rate-limit their customers connections to the outbound mail relays and hope that they don’t get enough infected customers at any time to get themselves listed as a spam source.

pommed v1.23 is out, with full support for the late 2008 laptops. The LCD backlight inner workings got figured out finally, but there s a catch: the backlight won t react to the settings when running X11 with the proprietary nVidia drivers on the MacBook5,1 and the MacBookAir2,1. It works fine on the MacBookPro5,1 and it works fine on all three machines with the opensource nouveau driver. Switching to the console before setting the backlight and then back to X does work as a workaround. So there s something up with the proprietary nVidia driver, and my uneducated guess is that the MacBook Pro may somehow be exempt from the issue due to its dual GPU config. I ve also switched the nVidia machines to using the generic sysfs backlight driver in pommed. This driver has been there for some time for the PowerPC machines, so now it s part of the generic pommed code. You need the mbp_nvidia_bl driver in your kernel for this to work. Don t panic! If you don t have it, pommed will fall back to the native driver (nv8600mgt) and everything will work just as before. Pommed will tell you if it has to fall back to the native driver, so check your logs if you want to know. This release of pommed needs testing on all nVidia machines: MacBookPro3,1, MacBookPro4,1, MacBookPro5,1, MacBook5,1 and MacBookAir2,1. If anything doesn t work, tell me about it and I ll fix it.

Can somebody tell me, why ICECC_VERSION variable is used as path to file with used toolchain? Why does help say "see create-env" when there is no such thing I could see? Why does not it properly tell, that I have to use icecc --build-native and then use absolute path to resulting tarball as ICECC_VERSION and then it will start to work? Quick notes for future:

icecc --build-native
export ICECC_VERSION= pwd /b98eeead34edf15d2edf2383c2c4e317.tar.gz

I have just bought myself a toy helicopter. I had been tempted to buy one for a while and when I saw them on sale for $30 I couldn’t resist. My helicopter is model FJ-702 from Flyor, it is controlled by infra-red and is designed for indoor use only. It seems that the trick to flying one is to control the rate of ascent and descent. If the helicopter rises too fast then it may bounce off the ceiling which results in it swaying uncontrollably and crash-landing. If it is allowed to descend too fast then it becomes impossible to slow the rate of descent, I suspect that this is the settling with power [2] problem that is documented in Wikipedia. The helicopter is very fragile, I broke one of the skids and part of the tail assembly before I learned how to control it properly. Probably the main thing to look for when buying a model helicopter is a solid design - some time after buying (and breaking) my helicopter I visited the shop which sold it and heard the owner advising other customers to buy the $45 model which is apparently more solid. It seems that an ideal design would be a frame made of spring-steel (not to make it springy but to avoid it breaking when it hits). I recommend flying in a room with a carpeted floor, bouncing off a solid surface such as a wood floor will break a helicopter. Controlling a helicopter is really difficult. The models that I have tried and seen demonstrated all have serious problems with unwanted rotation. My helicopter and the others I have seen have coaxial rotors to avoid rotation without a tail rotor. According to the Wikipedia page a lot of energy is used by a tail rotor [1], as there has been obvious difficulty in designing the helicopter with adequate power (in terms of the light and weak frame and the short battery life) it seems that they didn’t use the tail rotor design to save energy. It’s a pity that instead the designers couldn’t have skipped the flashing LEDs etc. One strange thing is that one pair of blades can have their angle changed (which appears to be similar to the “semirigid” design shown on the wikipedia page). I’m not sure how increasing the angle of one blade while simultaneously decreasing the angle of it’s pair will do any good. I expect that this has something to do with the fact that the helicopter will rotate at different rates when under different amounts of vertical thrust. This incidentally makes it almost impossible to maneuver the craft. It has a tail rotor on a vertical axis to control forward and reverse movements, but the extreme difficulty in keeping it facing in one direction makes this almost useless. I wonder what the minimum size at which a gyro-stabiliser becomes practical. But as Wikipedia doesn’t document the existence of an autopilot for full size helicopters the chance of getting one for a toy is small. In summary, while I have had $30 of fun, I think that a more solid helicopter would be a better investment.

• [1] http://en.wikipedia.org/wiki/Helicopter


• [2] http://en.wikipedia.org/wiki/Settling_with_power

Today I wrapped up both of my classes. Usually the end of class/semester represents and is experienced as nothing short of pure, unadulterated joy and at both ends of the stick (student and professors alike experience similar emotions :-). Like my students, I am pretty beat and more than ready for a break. But I have to admit, I experienced the end of my hacker class with a tinge of sadness. This is the third time I have taught this class and each time, it seems like it becomes harder and harder to contain the class conversation and I enjoy them through and through. The last few classes were brimming with talk, which is what should exactly happen because by the last month students are walking/talking on a foundation built over the course of many weeks. There is not much I would have changed about the syllabus (most of the readings were great-to-stellar) nor the class. But if there is one thing I am sorry about it is that we never watched War Games. The last time I taught the class, I was able to arrange various movie sessions and we watched War Games, Tron, and Sneakers (among a few others) and the students not only learned something about hacker media representations but did a little out-of-class bonding with the movies and lots of food. Since space is such an issue at NYU, I decided not to forage or hunt for a suitable room (I have since found a connection who I think can hook me up with a room). But by missing War Games, we missed an important event in the history of hackerdom. The movie undoubtedly led to many a kids asking for a modem for xmas and I am sure led to a spike in hacking and phreaking 9 months later (or however long it takes for a kid to plead for a modem, get it, learn some new tricks etc). It is also the case that while it helped usher in the image of the hacker as nefarious computer trickster, David Lightman was also a pretty cool, cute, and likable kid. Not a nerd but a geek. It perhaps represents the glimmerings of the transformation of the negative nerd into the positive geek (oh and the list keeps the list of girl geeks growing ), signaling the spread of the computer into mainstream society. So next time I teach the class, there will certainly be more movies, War Games on the top of the list so that we can learn that “the only winning move is not to play.”

As the Australian government wants to show how well they understand technology, they have started a blog about the “Digital Economy” [1]. So far they have hundreds of comments, most of which just tell them that their censorship ideas are wrong. In what may be related news, Barack Obama has announced details of some of his plans [2]. He will spend money on improving net access (something that the Australian government could learn from) and on improving schools (which will probably be about as effective as putting lipstick on a pig). I really hope that we don’t have someone in his administration deciding that improving schools requires censoring the Internet for the entire population (people tend to turn their brains off when it’s time to think about the children). He is also allocating money to road building (a stupid idea when cars are becoming increasingly expensive and world fuel supplies are running out - he should be building train and tram lines). But his idea about improving the energy efficiency of federal buildings is a really good idea, that will lead the development of technology that everyone can use to increase efficiency. He also wants to “modernise” the health-care system by moving to electronic medical records - this seems unlikely but I guess that all spending on IT is somehow good for those of us who are involved in the computer industry. One of his advisors has realised that there are economic benefits to really fixing the health-care system, so there is some hope that it will get fixed [3]. The FLOSS Manuals project has released a document about circumventing censorship systems [4], I expect that many people will be using them before the government even gets their Chinese-style filter installed (if they ever do).

• [1] http://www.dbcde.gov.au/communications_for_business/industry_development/digital_economy/future_directions_blog


• [2] http://www.politico.com/news/stories/1208/16258.html


• [3] http://tpmelectioncentral.talkingpointsmemo.com/2008/12/daschle_fixing_health_care_top.php


• [4] http://en.flossmanuals.net/CircumventionTools

I received a new laptop, a Dell Latitude E4300. I was a bit anxious with its level of support on Linux, because it only recently started being shipping, and it s full of recent Intel hardware. Also, with lenny being frozen for 5 months, we are currently a bit behind regarding hardware support. I installed lenny on it, as I usually run testing+APT pinning. What I m describing here is what is unsupported in lenny out of the box. Wireless:
Needs a 2.6.27 kernel (iwlagn driver), Lenny only has 2.6.26. Downloaded from the kernel team s unofficial repo. Firmware isn t packaged in Debian (firmware-iwlwifi needs an update). Needed to download it from Intel. Graphics:
Intel device, unsupported with lenny s driver (but vesa works surprisingly well, oI only noticed that I was using vesa when I tried to play a video and found out I had no xv support).
Works with experimental s Xorg and the experimental intel driver, but that Xorg needs some polishing. The evdev driver now handles all inputs, so the keymap has to be configured differently (as usual, #debian-x people were very helpful). Suspend/Resume:
Works out of the box using pm-utils. No need for quirks. All in all, it was easier than I expected, and support will probably be perfect for lenny+1/2 ;)

Some years ago I wrote a little tool called telak in order to display remote images on my wallpaper and have them updated regularly. Yesterday, as a challenge, I rewrote this as an awesome module, in Lua using wget. I simply used a wibox and a widget from awesome API to display the images. It's called telak, as the original, and is in the awesome next git branch, which will be the 3.2 version of my favorite window manager.

New Gammu testing release has just born. The largest changes are in vCard handler. It now supports photos in vCard and should properly handle error states which previously would lead to crash. This also leads to changed API for encoding/decoding vCard/vCalendar/vNote entries. Rest of changes is usual amount of bug fixes. Full list of changes:

• Better skipping of currupted messages in AT (bug #768).
• Autoload 6510 module if phone is S40 (bug #767).
• Add ID for Nokia 6500s (bug #770).
• Add automatic detection of Nokia phones (bug #770).
• Catch error when calls can not be deleted (bug #738).
• Better documentation of addnew (bug #734).
• Fix detection of OBEX capability on older Siemens phones.
• Try to detect wrongly formatted CMGL reply (bug #771);
• Handle phones which fail to report supported charsets.
• Fixed encoding of WAP indicator messages.
• Support for photos in vCard (bug #227).
• vC* saving now protects against buffer overflows.

You can download from usual place: http://cihar.com/gammu/, Debian users will find packages in experimental soon.