GNOME-Mud 0.11 was released yesterday. This was probably something unexpected to those who follow the mailing list, as it's the first release in over three years. Back in 2006, Les Harris started contributing to the project and started a major rewrite of the program. Things looked very promising, with the program being ported to newer GNOME technologies and standards and being basically rewritten from ground up. However, Les got hit by Real Life and being the project's only real hacker, development basically stopped for nearly two years. On June, I was tempted to remove my irssi subscription to #gnome-mud; all I did was idling or telling people who popped by that nothing was being done and that wouldn't change unless someone rolled up their sleeves and finished up the nearly ready 0.11 release. A few days after considering declaring GNOME-Mud dead, Les joined IRC after more than a year of no contact, recovered his GNOME account password and started to commit the missing bits at an awesome pace. A few weeks later, 0.11 was done, with even more features than originally planned (support for more advanced MUD protocols like MSP or ZMP, for example) and I finally found the time to make a tarball and publish it. Les has lots of plans for the next release, and I hope my old wish of seeing GNOME-Mud becoming a MUD client that is comparable to the classic zMud will soon be a lot closer. The foundation set by this release certainly will make it easier to accomplish. As always, if you want to contribute, we'll be happy to help you out on #gnome-mud at GIMPnet, or in gnome-mud-list@gnome.org.

For some reason, I was under the impression that uploading a new upstream release would place the package in the NEW queue. I was proved wrong because I was able to upload ELinks 0.12~20080527-1 to experimental yesterday and I am a DM who can't upload NEW packages.

To me, this did not make a whole lot of sense. NEW exists to keep the Debian archive legal and to prevent serious QA issues. Uploading a new upstream release of a package pushes a _new_ orig.tar.gz file to the archive and could contain potentially DFSG non-free material which is an issue if the package is being uploaded to main.

What is a bit ironic here is that a DM can't upload an updated package that is essentially the same except that it creates new debugging-symbols packages from the same source package. To a very large extent, these -dbg packages should neither be of questionable legality nor have serious QA issues. What I don't know is if it is necessary that these go to NEW because the FTP masters add overrides manually.

On Wednesday, OSCon really goes into high gear (and the wifi croaks) at OSCon. The people that aren't going to the tutorials all arrive, and aren't yet sluggish from the late-night vendor parties and BOFs.

The keynotes were OK, and after that, I listened to Keith Packard talk about the future of X. Then it was off to finish the preparation for my own talk on Linux on the corporate desktop. It was the first time I spoke at OSCon, and it seems to have gone well. I keep running into people that were at the talk and thought of some more questions -- and of course I chatted with a number of people right after as well. There are a number of other companies that are planning on doing what we've done, or even started down the implementation path already. It's some effort making something of OSCon quality (Damian Conway suggests something like 10 hours preparing for every 1 hour presenting -- I didn't do that), but I'm glad I did.

The Expo Hall opened Wednesday as well. Met some interesting folks there -- Open Lina, a company that sells Linux hardware, an Open Source groupware product I hadn't heard of before (they are apparently working on Debian Packages too), and some others I can't remember right now...

Tuesday I had dinner at Andina, a Peruvian restaurant, with fellow Haskellers Bryan O'Sullivan and Don Stewart -- the first time the three of us Real World Haskell folks met in one place.

Today brought Nat Torkington's excellent keynote, and also r0ml's great talk this afternoon ("I started this talk in 2003, and it's run a bit long.") Another great time for some networking in the hallways and expo hall. One of the LinuxFest Northwest folks had attended my talk, happened to see me as I was stuffing one of the may free t-shirts that vendors were giving out into my laptop bag (by afternoon, they were getting quite in your face about it), and struck up a conversation.

Went for sushi over lunch with a couple of folks from #oscon on IRC, then dinner with Debian folks.

Been a busy week, but met lots of people. I didn't go to as many talks as I planned because I was so busy talking to people -- guess that means the conference was a hit.

Tomorrow, I'll leave /home for more than 3 weeks:

• 10 days with my family in a rented house in Cahors (FR). We might have Internet access there (the owner is indeed installing it and I'll probably help him doing this The Right Way...being interested in the result).
• back at /home on Wednesday Aug. 6th by train
• buy cheese on Aug. 7th (VERY important). Pack it in the bag (round goat cheese inside socks, etc). Also pack some other less important stuff (t-shirts, sweaters, running stuff).
• fly off to DebConf from Paris Orly (Aug 7th, 21:10), via Madrid with Air Europa
• meet Jacobo Tarrio at EZE airport and get our bus to Mar Del Plata
• kiss and hug dozens of friends
• stop sleeping
• enjoy DebConf
• back home on Aug. 18th
• back to work on Aug. 19th (yeah, that's crazy)

For people who are not tired of this, I've had the great honor of being sollicited to hold a keynote lecture at Debconf. As you'd guess, that will be about i18n in Debian. I plan it to be a kinda general thing, giving the current rough picture of how things are going (or not going). No deep technical stuff (aha, how could *I* do that anyway?), just talking with hands. From informations I have, it should be on Aug. 14th, at the beginning of the talks schedule (9:30 or so, local time...check this when the official schedule is out). Apart from that, my personal schedule for DebConf is mostly working with the i18n folks who will be there (Felipe A. van de Wiel aka "faw", Nicolas Fran ois aka "nekral") on the i18n server. Work/talk with Neil Williams about tdebs stuff and all things related to i18n and embedded stuff is also planned as well as preparing the Extremadura meeting we need to have at the end of the year.

So for those of you who arn't aware, as of yesterday, it's easy for any spotty teenager/script kiddie to make you see content you didn't expect to when you go to google or your bank, etc. Maybe you're lucky and someone has fixed the problem on your network. Most likely you're not so lucky. (Confidential to Anna, Maggie, Adrianne, Errol, Barbara, Mark: You're lucky! But only when you're at home.) At the moment, the idea that DNS can be trivially poisoned seems like a really serious problem. Will there come to be a point when we just regard this as "DNS spam", basically accepting that it's happening all the time, indeed that a given DNS query is as likely spoofed than good, and nothing can be trusted, or indeed, fixed? If you don't think this can happen to a internet techology, just look at the average inbox now, and compare it to the average inbox circa 1993. I can't claim to be an expert in this area, but based on what I'm reading, the current "fix" increases the time-to-exploit from 11 seconds to maybe 1 week. (BTW, is there a reason why DNS servers are caching in-baliwick responses.. would it work to entirely disable that caching? Any chance for a second round of more targeted fixes now that the cat is out of the bag?) Also, I get the impression DNSSEC will never be successfully deployed, barring a miracle. And we seem to have just run out of miracles.

So for those of you who arn't aware, as of yesterday, it's easy for any spotty teenager/script kiddie to make you see content you didn't expect to when you go to google or your bank, etc. Maybe you're lucky and someone has fixed the problem on your network. Most likely you're not so lucky. (Confidential to Anna, Maggie, Adrianne, Errol, Barbara, Mark: You're lucky! But only when you're at home.) At the moment, the idea that DNS can be trivially poisoned seems like a really serious problem. Will there come to be a point when we just regard this as "DNS spam", basically accepting that it's happening all the time, indeed that a given DNS query is as likely spoofed than good, and nothing can be trusted, or indeed, fixed? If you don't think this can happen to a internet techology, just look at the average inbox now, and compare it to the average inbox circa 1993. I can't claim to be an expert in this area, but based on what I'm reading, the current "fix" increases the time-to-exploit from 11 seconds to maybe 1 week. (BTW, is there a reason why DNS servers are caching in-baliwick responses.. would it work to entirely disable that caching? Any chance for a second round of more targeted fixes now that the cat is out of the bag?) Also, I get the impression DNSSEC will never be successfully deployed, barring a miracle. And we seem to have just run out of miracles.

30 C, 19 km, 2 hours, 200m positive slope Exactly one year after (re)starting to run regularly, that was my pace for today. Running on afternoon on a sunny and hot summer day lowers the pace quite severey, indeed, but I wanted to try it and see how I can resist. Considering that I still remember July 24th 2007 where my first run lead to the great performance of 3.5km in 30 minutes (and two stops because being too tired), this is not so bad. Ah, and the last number is 75....kilograms. On July 24th 2007, it was 82..:-)

Today, fifty years ago, my mother was born.

On July 24th, 1958, Vicenta Leyva gave birth to Olga Cristina Garza Leyva in the small town of Zumpango del R o (later renamed to Eduardo Neri), in the southern Mexican state of Guerrero. Her father Guillermo Garza, who is still alive, was a private pilot. Olga Cristina was named Cristina after the saint that is celebrated on the same day.

She was their third kid, a couple of years before V ctor and Guillermo were born and a couple of years after, Carlos was born, all of them being born on total different places on southern and central Mexico. The father, being a pilot, was absent from home for long periods, he even had "another family" somewhere in northern Mexico, supposedly in Sinaloa.

In the early 60s, the family moved to Mexico City where they were going to spend most of their life. They lived on a small apartment on Col. Moctezuma, which was (and still is) a working class neighborhood, just besides the Mexico City International Airport, on the eastern part of the city. Back in the days, it used to take quite some time to travel from there to any point of the city, like the downtown area or beyond.

All the kids spent most of their childhood there attending public schools. They weren't a wealthy family who couldn't even afford to buy and have meat on some days but only in special ocassions.

As the years passed and the kids became adults, Olga met David Moreno Rojas in the same neighborhood. He was enrolled at the National Autonomous University of Mexico, under Enterprises Administration in Ciudad Universitaria. He was also an avid f tbol player. He was named David after his father, David Moreno Gonz lez. They became boyfriend and girlfriend and got married when she was 20 and he was 24 years old on December 19th, 1978. They lived together for a few years in Col. Del Valle in central Mexico City.

Ten months later they were married, Lorena Moreno Garza, their first kid, was born on October 7th, 1979. S The family then moved to the suburb in Aragon, Estado de M xico. They had their second child on August 8th, 1984, named David Moreno Garza, becoming David III.

After the 1985 Mexico City massive earthquake, the family wanted to move outside the city and found relocation in Ciudad del Carmen, on the Mexican state of Campeche, located on the shore of the Gulf of Mexico, on 1988. They spent three or four years there and then moved to Celaya, Guanajuato where most of the father's family was located. They spent about five years there and then, for family reasons, they returned to Mexico City in 1995 to attend the family business.

Olga and her family had a good, loving family by then and had decided to not have any more kids. They had both of their children on private schools and taught them catholicism. On 1998, Vicenta passed away after a quick period of time because of liver cancer. This shocked most of the family.

As the years passed, the family business was sold and Olga stopped working, as she used to in the business. But as she had always been very active, she started working as a seller for a fine jewelry firm where she keeps working currently. Her husband, after pursuing his dream of going back to school and studying Law, works as a private work-related issues lawyer.

Olga is the most loving, nursing, affective, meticulous, scrupulous person I've ever met and even though I have only met her for almost twenty-four of her fifty years now, I admire her and love her as much as I have no words to describe. She is the one that built my sensitive, loving side where my heart resides, and I thank God for giving me such a great life gift and having her at any time.


Today, her husband is 54, her daughter is 28, her son is 23 and she is 50 now. This is also an special year because she and her husband will celebrate 30 years of their marriage.

Felicidades, jefecita.

One of the most significant tasks performed by a SE Linux system is loading the “policy“. The policy is the set of rules which determine what actions are permitted by each domain. When I first started using SE Linux (in 2001) the kernel knew where to find the policy file and would just read the data from disk as soon as it had mounted the root filesystem. Doing such things is generally considered to be a bad idea, but it was an acceptable mechanism for an early release. One issue is that the policy needs to be loaded very early in the system boot process, before anything significant happens. In the early days the design of SE Linux had no support for a process to change it’s security context other than by executing another process (similar to the way a non-root process in the Unix access control system can not change it’s UID, GID, or groups). Although later on support for this was added, it was only available as the request of the application (an external process could not change the context of an application without using ptrace - a concept that is too horrible to contemplate) and I am not aware of anyone actually using it. So it’s almost a requirement that there be no more than one active process in the system at the time that policy is loaded, therefore it must be init or something before init that loads the policy. When it was decided that a user-space program had to instruct the kernel to load the policy we had to determine which program should do it and when it should be done, with the constraint that it had to be done early. The most obvious solution to this problem was to load the policy in the initramfs (or initrd as it was known at the time). One problem with this is that the initramfs is limited in size by kernel compilation options and may need to be recompiled to fit a bigger policy. As an experiment to work around this limitation I had a small policy (which covered the domains for init and the scripts needed for the early stages for system boot) loaded in the initramfs and then later in the boot process (some time after the root filesystem was mounted read/write) the full policy was loaded. A more serious problem with including policy in the initramfs was that it required rebuilding the initramfs every time the policy changed in a significant way, of course scripts could not determine when a change was significant (neither could most users) so that required needless rebuilds (which wastes time). Even with a small policy for early booting loaded it was still sometimes necessary to change it and update the initramfs. I believe that as a general rule an initramfs should only be rebuilt when a new kernel is installed or when a radical change is made to the boot process (EG moving from single disk to software RAID, changing between AMD and Intel CPU architecture, changing SCSI controller, or anything else that would make the old initramfs not boot the machine). The initramfs that was used to boot my machine is known to actually work, the same can not be said for any new initramfs that I might generate. But the deciding factor for me was support of machines that did not use an initramfs or initrd (such as the Cobalt machines [1] I own). To solve these problems I first experimented with a wrapper for init. The idea was to divert the real init to another file name (or use the init= kernel command-line option) and then have the wrapper load the policy before running the real init. I never intended that to be a real solution, just to demonstrate a point. Once I had proven that it was possible to load the policy from user-space before running the real init program it was a small step to patch init to do this. One slightly tricky aspect of this was in getting the correct security context for init. The policy has always been written to allow a domain transition from kernel_t to init_t when a file of type init_exec_t is executed. The domain kernel_t is applied to all active processes (including kernel threads) at the time the policy is loaded. So init only has to re-exec itself to get the correct context. Fortunately init is designed to do this in the case of an upgrade so this was easy to manage. Since that time every implementation of SE Linux apart from some embedded systems has used init to load the policy. The latest trend in Linux distributions seems to be using upstart [2] as a replacement for the old SysV Init. The Fedora developers decided to make nash (a program that comes from the mkinitrd source tree in Fedora and is a utility program for a Red Hat based initramfs) load the SE Linux policy as it would apparently be painful to patch every init to load the policy. As far as I am aware there are only three different init programs in common use in Linux, the old SysV Init (which used to be used by everyone), Busybox (for rescuing broken systems and for embedded systems), and now Upstart (used by Ubuntu and Red Hat since Fedora 9). Embedded systems need to work differently to other systems in many ways (having the one Busybox program supply the equivalent to most coreutils in one binary is actually a small difference compared to the other things), and modifying the policy load process for embedded systems is trivial compared to all the other SE Linux work needed to get an embedded system working well. There are at least two commonly used initramfs systems (the Debian and Red Hat ones) and probably others. As one init system (SysV Init) already has SE Linux support it seems that only one needs to be patched to have complete coverage. I’ve just written a patch for Upstart (based on the version in Debian/Experimental) and sent it to an Ubuntu developer who’s interested in such things. I also volunteer to patch any other init system that is included in Debian (I am aware of minit and will patch it as soon as it’s description does not include “this package is experimental and not easy to install and use“). It seems to me that repeating the work which was done for SysV Init and upstart for any other init system will be little effort, at worst no greater than patching an initramfs systems (and I’ll do it). As the number of initramfs systems that would need to be patched would exceed the number of init systems it seems that less work is involved in patching the init systems. The amount of RAM required by the initramfs is in some situations a limitation on the use of a system, when I recently did some tests on swap performance by reducing the amount of RAM available to a Xen DomU [3] it was the initramfs that limited how small I could go. So adding extra code to the initramfs is not desired. While this will be a small amount of code in some situations (when I patched /sbin/init from Upstart it took an extra 64 bytes of disk space on AMD64), dragging in the libraries can take a moderate amount of space (the fact that an LVM or encrypted root filesystem causes SE Linux libraries to be included in the initramfs is something that I consider to be a bug and plan to fix). Finally not all boot loaders support an initrd or initramfs. I believe that any decision which prevents using such sweet hardware as Cobalt Qube and Raq machines from being used with SE Linux is a mistake. I have both Qube and Raq machines running fine with Debian SE Linux and plan to continue making sure that Debian will support SE Linux on such hardware (and anything with similar features and limitations).

• [1] http://en.wikipedia.org/wiki/Cobalt_Networks


• [2] http://upstart.ubuntu.com/


• [3] http://etbe.coker.com.au/2008/05/22/xen-and-swap/

Share This

The notorious nutsack (cc-by-2.0) The conference pack for LugRadioLive was called a “nutsack” for some reason (anyone know why?). It seems like a pretty good pack, as far as these things go. First of all, it’s a durable paper bag, so much greener than plastic. It contained:

• the event programme/schedule
• a LUGRADIO LIVE badge which I only discovered when I tipped the bag out,
• a key-shaped yahoo keyring - I don’t know what it’s meant to symbolise and I already have one far-too-big novelty keyring - seems like a total waste of metal
• UKUUG t-shirt with amusing slogan on the back and a membership application form - tempting, especially since AFFS seems to be idling since I quit and ORG is a self-perpetuator AFAICT
• flier for PyCon UK 12-14 Sep 2008 Birmingham
• subscription form for the 50/year Linux Magazine
• flier for LinuxPro Magazine’s conference streaming which says “no special software is required”. Well, users actually have a choice of Java, MPlayer, Real, WindowsMediaPlayer or anything else which can view an Ogg Theora stream, which is pretty good, but not quite “no special software”. ffplay seemed unhappy in my first tests, with errors like “[vorbis @ 0xb7dbc430]Not a Vorbis I audio packet.
  [theora @ 0xb7dbc430]Warning, unsupported keyframe coding type?!
  [theora @ 0xb7dbc430]Header packet passed to frame decoder, skipping” which I’ll follow up RSN, unless any kind soul knows how to fix that.
• a bytemark pen - always handy to advertise a decent hosting company at people in business meetings, but I don’t think it’s refillable, so that’s not going to last long,
• a fun goodbye postcard from Birmingham Perl Mongers to LugRadio - it’s actually a digital photo print, which seems a really good idea that I’ve not seen done before
• CDs of ubuntu 8.04 LTS Desktop Edition (oh well) and openSUSE 11.0 (oh dear)

All in all, smarter than your average conference pack… or am I just thinking that because it looks a bit like a picnic?

Several weeks ago, the people in charge of maintaining the Windows machines in my institute were desperate because of a series of virus outbreaks - Specially, as expected, in the public lab - but the whole network smell virulent. After seeing their desperation, I asked Rolman to help me come up with a solution. He suggested me to try replacing the Windows workstations by substituting local installations by a server having several virtual machines, all regenerated from a clean image every day, and exporting rdesktop sessions. He suggested using Xen for this, as it is the virtualization/paravirtualization solution until now best offered and supported by most Linux distributions (including, of course, RedHat, towards which he is biased, and Debian, towards I am... more than biased, even bent). So far, no hassle, right?
Of course, I could just stay clear of this mess, as everything related to Windows is off my hands... But in October, we will be renewing ~150 antivirus licences. I want to save that money by giving a better solution, even if part of that money gets translated to a big server.
Get the hardware
But problems soon arose. The first issue was hardware. Xen can act in its paravirtualization mode on basically any x86 machine - but it requires a patched guest kernel. That means, I can paravitualize many several different free OSs on just any computer I lay my hands on here, but Windows requires full- or hardware-assisted- virtualization. And, of course, only one of the over 300 computers we have (around 100 of which are recent enough for me to expect to be usable as a proof-of-concept for this) has a CPU with VT extensions - And I'm not going to de-comission my firewall to become a test server! ;-)
When software gets confused for hardware
So, I requested a Intel Core 2 Quad Q9300 CPU, which I could just drop in any box with a fitting motherboard. But, of course, I'm not the only person requiring computer-related stuff. So, after pestering the people in charge for buying stuff on a daily basis for three weeks, the head of acquisitions came smiling to my office with a little box in his hands.
But no, it was not my Core 2 Quad CPU.
It was a box containing... Microsoft Visio. Yes, they spent their effort looking for the wrong computer-related thingy :-/ And meanwhile, Debconf 8 is getting nearer and nearer. Why does that matter? Because I have a deadline: By October, I want the institute to decide not to buy 150 antivirus licenses! Debconf will take some time off that target from me.
Anyway... The university vacations started on July 5. The first week of vacations I went to sweat my ass off at Monterrey, by Monday 14 I came back to my office, and that same day I finally got the box, together with two 2GB DIMMs.
Experiences with a nice looking potential disaster
Anyway, by Tuesday I got the CPU running, and a regular Debian install in place. A very nice workhorse: 5GB RAM, quad core CPU at 2.5GHz, 6MB cache (which seems to be split in two 3MB banks, each for two cores - but that's pure speculation from me). I installed Lenny (Debian testing), which is very soon going to freeze and by the time this becomes a production server will be very close to being a stable release, and I wanted to take advantage of the newest Xen administration tools. Of course, the installation was for AMD64 - Because 64 bitness is a terrible thing to waste.
But I started playing with Xen - And all kind of disasters stroke. First, although there is a Xen-enabled 2.6.25 Linux kernel, it is -686 only (i.e. no 64 bit support). Ok, install a second system on a second partition. Oh, but this kernel is only domU-able (this is, it will correctly run in a Xen paravirtualized host), but not dom0-able (it cannot act as a root domain). Grmbl.
So, get Etch's 2.6.18 AMD64 Xen-enabled kernel, and hope for the best. After all, up to this point, I was basically aware of many of the facts I mentioned (i.e. up to this point I did reinstall once, but not three times)... And I hoped the kernel team would have good news regarding a forward-port of the Xen dom0 patches to 2.6.25 - because losing dom0 support was IMO a big regression.
But quite on time, this revealing thread came up on the debian-devel mailing list. In short: Xen is a disaster. The Xen developers have done their work quite far away from the kernel developers, and the last decent synchronization that was made was in 2.6.18, over two years ago. Not surprisingly, enterprise-editions of other Linux distributions also ship that kernel version. There are some forward-patches, but current support in Xen is... Lacking, to say the least. From my POV, Xen's future in the Linux kernel looks bleakish.
Now, on the lightweight side...
Xen is also a bit too complicated - Of course, its role is also complicated as well, and it has a great deal of tunability. But I decided to keep a clean Lenny AMD64 install, and give KVM, the Kernel Virtual Machine a go. My first gripe? What a bad choice of name. Not only Google searches for KVM gives completely unrelated answers (to a name that's already well known, even in the same context, even in the same community).
KVM takes a much, much simpler approach to virtualization (both para- and full-): We don't need no stinkin' hypervisors. The kernel can just do that task. And then, kvm becomes just another almost-regular process. How nice!
In fact, KVM borrows so very much from qemu that it even refers to qemu's manpage for everything but two command-line switches.
Qemu is a completely different project, which gets to a very similar place but from the other extreme - Qemu started off as Bochs, a very slow but very useful multi-architecture emulator. Qemu started adding all kinds of optimizations, and it is nearly useful (i.e. I use it in my desktop whenever I need a W2K machine).
Instead of a heavyweight framework... KVM is just a modprobe away - Just ask Linux to modprobe kvm, and kvm -hda /path/to/your/hd/image gets you a working machine.
Anyway - I was immediatly happy with KVM. It took me a week to get a whole "lab" of 15 virtual computers (256MB RAM works surprisingly well for a regular XP install!) configured to start at boot time off a single master image over qcow images.
KVM's shortcomings
Xen has already been a long time in the enterprise, and has a nice suite of administrative tools. While Xen depends on having a configuration file for each host, KVM expects them to be passed at the command line. To get a bird-eye view of the system, xen has a load of utilities - KVM does not. And although RedHat's virt-manager is said to support KVM and qemu virtualization (besides its native Xen, of course), it falls short of what I need (i.e. it relies on a configuration file... which lacks expresivity to specify a snapshot-based HD image).
To my surprise, KVM has attained much of Xen's most amazing capabilities, such as the live migration. And although it's easier to just use fully virtualized devices (i.e. to use an emulation of the RTL8139 network card), as they require no drivers extraneous to the operating system, performance can be greatly enhanced by using the VirtIO devices. KVM is quickly evolving, and I predict it will largely overtake Xen's (and of course, vmware and others) places.
Where I am now
So... Well, those of us that adopt KVM and want to get it into production now will have some work of building the tools to gracefully manage and report it, it seems. I won't be touching much my setup until after Debconf, but so far I've done some work over Freddie Cash's kvmctl script. I'm submitting him some patches to make his script (IMHO) more reliable and automatizable (if you are interested, you can get my current version of the script as well). And... Starting September, I expect to start working on a control interface able to cover my other needs (such as distributing configuration to the terminals-to-be, or centrally managing the configurations).

77020 packets transmitted, 18029 received, 76% packet loss, time 77049435ms
rtt min/avg/max/mdev = 20.026/130.848/2245.752/287.550 ms, pipe 3 Above are the ping results from pinging my server (hosted on a business DSL connection). Telstra stuffed up and appear to have entirely disconnected DSL for a few suburbs (based on reports from a client who has several clients in that region that all went offline simultaneously). It’s affected at least two ISPs (every DSL service uses Telstra’s backbone). The above ping results show almost 17 hours of outage, but it was really more like 18 (I didn’t start pinging until I realised it was down). Telstra’s response to the problem reports (which my client raised via two ISPs) was that it would take until the end of the next business day. The problem was reported at 10AM, so Telstra was apparently happy with two entire business days of outage. I think that the root cause of such problems is the terrible performance of Sol Trujillo [1] (or “Telstra’s Sole True Hero” as suggested in Crikey [2]). Under Sol’s leadership Telstra stock has not performed well (it’s a monopoly - it’s supposed to reap money), it’s lost market share in every area where competition is permitted and it hasn’t made it’s customers happy. Sol is taking an approach to business that works well for some big companies in the US (and for the mining and automative industries in Australia). He has been trying to force the government to extend the Telstra monopoly with the Fibre To The Node (FTTN) plan [3]. His idea was to have small Telstra boxes (nodes) spread around the suburbs with short copper runs to each home, each node would have absolutely no spare space for other ISP equipment and therefore the other ISPs would not be able to provide a service. The claim was that FTTN was needed for decent performance but ADSL2+ has been shown to work well in the areas where FTTN was proposed. Telstra even sent out brochures to stock-holders encouraging them to lobby members of Parliament on behalf of Telstra’s rent seeking [4]. However Australia is not like the US and this didn’t work, they couldn’t even get Telstra stock holders to support such plans. Speaking for myself, my interests as a Telstra stock-holder (and I own more Telstra shares than the median stock holder) are vastly outweighed by my interests as a consumer of telecommunications services. I would like to see the government nationalise the local loop and the exchange buildings and then provide fair and equal access to all telephone companies and ISPs (including Telstra). Then we can have true competition in this market and the companies that provide the best services will win. Currently Telstra resembles one of those inefficient Soviet monopolies. We need some capitalism in the telco industry!

• [1] http://en.wikipedia.org/wiki/Sol_Trujillo


• [2] http://www.crikey.com.au/


• [3] http://www.zdnet.com.au/news/communications/soa/Optus-threatens-war-over-Telstra-s-fibre-plans/0,130061791,139225166,00.htm


• [4] http://en.wikipedia.org/wiki/Rent_seeking

Share This

Today I had the honour to prepare and announce the first Blosxom release after exactly two years and six days. The primary cause for the Blosxom 2.1.0 release date this week was to get our development efforts of the last two year into Debian Lenny with a nice version number (i.e. one without snapshot dates in the package version ;-). The second biggest cause was that it just was time. But Debian Freezes always give you a good kick in the ass. ;-) Rhonda plans to prepare an updated blosxom package for Debian during the day. (Update 25-Jul-2008: Packages are available.) So if Planet Debian is broken in a few days, you know whom to blame: Me and my last minute bug fixes. ;-) But since you seem to be able to read this, the release shouldn’t be too broken – because of course my blog already runs the very fresh Blosxom 2.1.0 release. ;-)

One of long standing things on my todo list was to make synchronisation work from my cell phone (Sony-Ericsson K750i) to some PIM application on Linux side (as a GNOME user Evolution is the natural choice). I tried it several times but it never actually worked. Today I gave it yet another try and I finally succeeded on first attempt :-). As a first step I just wanted to make a backup of all things. Gammu can do it quite well and it's the tool I trust for this purpose:

gammu backup /tmp/phonebook.vcf
gammu backup /tmp/calendar.vcs

Now it's time to play with OpenSync. We will use setup guide and SyncML guide as a starting point. As I had in past problems with both sides - both phone and Evolution failed with some random errors, I wanted to go step by step. So I started with setting up phone to files synchronisation:

msynctool --addgroup file2phone
msynctool --addmember file2phone file-sync
msynctool --addmember file2phone syncml-obex-client

Now we need to configure file storage, just tell it where it should store the data:

msynctool --configure file2phone 1

And change path in your editor to something like:

<?xml version="1.0"?>
<config>
  <!-- directory path for file-sync -->
  <path>/home/foo/phone-backup/</path>
  <!-- should care of subdirectories (TRUE or FALSE) -->
  <recursive>FALSE</recursive>
</config>

Now the more tricky part comes, we need to set up phone end:

msynctool --configure file2phone 2

Fortunately we can use example from the SyncML guide and just fill in Bluetooth address (you can get it using hcitool scan) and channel (sdptool browse 00:b0:0b:fa:ce:00):

<?xml version="1.0"?>
<config>
  <bluetooth_address>00:b0:0b:fa:ce:00</bluetooth_address>
  <bluetooth_channel>7</bluetooth_channel>
  <identifier>Sony Ericss</identifier>
  <version>1</version>
  <wbxml>1</wbxml>
  <username></username>
  <password></password>
  <type>2</type>
  <usestringtable>0</usestringtable>
  <onlyreplace>0</onlyreplace>
  <onlyLocaltime>0</onlyLocaltime>
  <recvLimit>0</recvLimit>
  <maxObjSize>0</maxObjSize>
  <contact_db>Contacts</contact_db>
  <calendar_db>Agenda</calendar_db>
  <note_db>Notes</note_db>
</config>

And now we should be able to synchronise whole phonebook from phone to selected directory:

msynctool --sync file2phone

Okay, this works, let's try more complicated thing - include Evolution in the chain. The steps are the same, config file for phone is the same, Evolution plugin has sane defaults you usually don't have to touch:

msynctool --addgroup phone2evo
msynctool --addmember phone2evo evo2-sync
msynctool --addmember phone2evo syncml-obex-client
msynctool --configure phone2evo 1
msynctool --configure phone2evo 2

But now comes the tricky thing - Sony-Ericsson phones usually have something broken around notes (or it is broken in OpenSync, I don't care, simply synchronisation fails without this step) and we have to avoid synchronisation of them. This can be done by changing filter file in group we've created above (usually in file ~/.opensync-0.22/group2/filter.conf):

<?xml version="1.0"?>
<filter>
  <note/>
</filter>

And finally we can start the synchronisation and it should work:

msynctool --sync phone2evo

You can also GUI multisync0.90 to do the configuration and start synchronisation, but it is not much different, you also still have to edit XML files.

A workmate called my attention today upon the fact that when you search for ‘ebox’ or ‘ebox-platform’ in Google you get some sponsored links from our fierce competitor, Untangle. Here is a screenshot of the ad:

You can see a full screenshot of the search too. On one hand, I am kind of honored about the fact that a California-based company which has raised almost 20 million dollars in venture capital and has over 30 employees is targeting us (a self-funded company) in such an explicit way, it must mean we are definitely on the good track On the other hand, this reminds me of the time when Ximian started to play with KDE keywords … yeah, we both are developing an open-source product, but one of us doesn’t care about ethics that much. BTW, we have a new shiny website

LUGRadioLive 2008 by sheilaellen (cc-by-2.0) This weekend, I learnt lots of things while at LugRadio Live in Wolverhampton. One thing was the surprising delay between posting something on this site and it actually appearing in the feed on my mobile phone. Another is that I can’t post to my new blog hosting from my mobile phone, which I’ll debug Real Soon Now. So, this is a bit later than when I first wrote it and it’s now one post instead of seven or so… Thanks to some unexplained delay travelling through Birmingham, I walked into LugRadio Live during the Introduction. The venue was generally pretty good, but the stage obstructed the entrance the acoustics in the atrium only seemed to work for the four gents. No idea what they said: I got past the stage into the audience and it finished almost immediately. For the first talk session, I went to see Rufus Pollock of Open Knowledge Foundation introduce a plan for the Comprehensive Knowledge Archive Network. Seems like a good idea. I’ve tons of questions, but I can’t quite get them into words, I don’t know when I’ll have time for this and I’m not sure they really matter anyway. I think I’ll mention CKAN to some librarians anyway and see what they make of it. I expected Emma Jane Hogbin’s “Form an orderly queue, ladies” to start an argument with the usual chix silliness but I was pleasantly surprised by how reasonable the advice was. In fact, the speaker also criticised the “chix” movements, although it appeared she participates in some women-only clubs, so not a 100% win for equality there. Sadly, much of the talk has been overshadowed in my mind by the memory of a giant furry racoon walking in unexpectedly, so I’ll probably grab the video of the LRL-USA version sometime soon. James Hooker’s talk titled “Taming the dragons — entrepreneurship and VCs” launched venturex as described on his own site already (along with more talk descriptions). It was an interesting demo, but it requires hackers to sell some votes in their companies to Venture Capitalists, which I believe is a bad thing for free software developers to do. We need to look more at a form of social entrepreneurism.</soapbox> I tried to ask a question, but the terrible atrium acoustics did funny things with my not-so-good hearing and I lost my way somewhat. At the end of that talk, I got chatting to an interesting web developer from Leicester who also forsook The Gong-a-Thong Lightbulb Talk Extravaganza and headed up to the Lightning Stage for Robert Collins and the Bzr talk. As well as some glimpses of how it’s changed since forking from tla, it was interesting to see a real (imperfect) demo and a non-Emacs version control GUI. The web interface for casual users to submit patches sounded very interesting and I also learned that some people pronounce “svn” like “Sven”. Most things that Robert thought were benefits sounded like drawbacks to me, so I’ll stay with git for now. Steve Lamb’s Green IT talk was the last presentation I saw. This talk really disappointed me because it seemed to be skewed towards the corporate governance nonsense instead of seeing Green IT as a vital pragmatic step, mentioning points I’d seen put more clearly elsewhere, as well as advertising Vista virtualisation and some panoramic webcam from Microsoft (who employ him) that doesn’t work with any free software, according to a deserved verbal shoe-ing in the Q+A. Only thing I remember that seems useful: charging from USB is more efficient than using wallwarts. Is that right? Finally, the main event: LugRadio Live and Unleashed. It opened with the shock announcement that LRL will continue into 2009, as announced elsewhere already. The rest of the madness will presumably appear online shortly and I don’t remember it well enough to do it justice… A tech conference crossed with a rocking gig by the strangest boyband ever, with a cheerleading racoon and some very cool people. I’ll try to be at LRL 2009. Will you be there? Were you at LRL this last weekend?

Thanks to the Virtuzzo developers for forward porting the OpenVZ patch to 2.6.26. It uses a lot of the already merged namespace features (For interested peoples linux-next carries interesting sysfs patches). The openvz upstream merge statistic is impressive. The namespace solution allows low overhead, while still running multiple Linux distributions in individual containers on the same box. Control over the network vitalisation is gained as a resource management for CPU power, I/O bandwidth and disk space. Live migration including snapshotting is possible too. The Debian 2.6.26 Linux images will feature not only better Xen vitalisation support, kvm port to new archs, but also an opvenvz flavour. Please don't forget to install proper vzctl userspace support as the correct dependencies have not yet been added. Supported archs will start with both x86 and the ia64 archs. Tomorrows linux-2.6 Debian trunk snapshots will already build openvz. Thanks for your feedback. P.S.: 2.6.26 is the targeted kernel for Lenny, we hope to convince Debian installer people to pick it up soonest - 2.6.25 is a not so bad backup plan as release hasn't fully approved 2.6.26 before extensive unstable testing.

Last week, Stanford University hosted Cartel, a gathering of several schools that share similarities of infrastructure and IT problems. I was one of the coordinators, handled most of the content for the web site, helped prepare the agenda, and presented for three of the segments. It's considerably more work hosting and coordinating one of these than just attending one, even with the travel. Jeff Altman and Derrick Brashear, the other two OpenAFS gatekeepers, were also in town for half of Cartel and stayed through Friday, so we went out to dinner several times, played a great deal of Fluxx, talked about the state of the world, and caught up. This was all great and very informative, but I'm also an introvert, which means that no matter how much I'm enjoying social interaction, it's also extremely tiring. I'm still fairly wiped; I'm getting more done (and got more done last weekend) than I really expected, but I expect I'll be paying the price all the way through this week. (And then I have more company from out of town that I've been looking forward to for months, but which will then take its own toll, which means it's likely I'm going to be exhausted until well into August.) So, I'm currently looking at all the things I want to do and trying to tell myself that not only is it okay that they're not all going to get done right away, but I need to make a concerted effort to take time to relax, try to work less than 40 hours this week (after working 56 last week), and spend more time reading. Of course, writing reviews is one of the other things that I'm currently a bit behind on.... Debian is freezing for lenny next weekend. If I have a few moments, I may do final uploads of OpenAFS (to clarify that hppa isn't a supported platform) and kstart (a long-awaited new upstream release that adds a flag saying not to get forwardable tickets, needed if one has a krb5.conf configuration saying to get them and a site policy that says you can't). gnubg could stand another upload, but I probably won't get to that. The Shibboleth packages are all in good shape except that they don't all have complete copyright files for all the Autotools helper stuff, which is very not important. Thankfully, the freeze is basically meaningless for Lintian, which will continue apace (and Adam D. Barratt continues to take much of the load off by doing a ton of commit work), and means that Debian Policy work should actually slow. My intention is to make the next normative release of Policy shortly after the lenny release, which gives us plenty of time to work on more changes for the next version. I plan on somewhat ignoring both for a bit while I catch up on other things, since I released Lintian 1.24.2 on the 13th (which I see I never announced here — whoops). In other news, I finally started the process of moving services from systems I own and have to fix to systems where someone else owns the hardware and has to fix it when it breaks by buying a VM from Panix. I still need to sort out my DNS situation and get more direct control over my zone file now that I have somewhere I can run my own DNS server so that I can start moving services there, but so far, so good. I'm extremely impressed by their service and capabilities and already have all of my Git repositories on the system and gitweb set up once I get DNS updated.

About one week ago, I received my OpenMoko Freerunner. This is an openly developed mobile phone that runs purely on Free Software. So this is what I have to tell about it.The hardwareIt was smaller than I thought, and is quite light. My girlfriend says it s ugly, but I m fine with the look of it. Besides being a GSM-phone, it comes with some nice gimmics: GPS, accelerometer, WLAN. The touchscreen works fine, although I don t have anything to compare it with.The softwareThe system it comes with, even after upgrading, is still very rough. It mostly works for doing phone calls and SMSs, but there are a number of unsolved quirks that prevent me from using the Freerunner as my sole phone for now. The suspend mode is left too often, resulting in a battery life of about eight hours, and there are issues with the audio for the conversation partners, who will hear static and echoes. But, as this is free software, there is hope that this will be fixed eventually.DevelopmentThe OpenMoko distribution is based on Openembedded, which uses bitbake for building software. So if I got it right, and this is not sure, because documentation is rare and spread, there is the git repository at git.openmoko.org, which is a copy of the openembedded git repository. This contains bitbake recipies for all the packages, which includes where they can be downloaded, the package metadata (such as dependencies and version numbers) and sometimes patches. These recipies reference upstream tarballs or subversion URLs. For the native OpenMoko applications, the source is in the OpenMoko subversion repository.One of the suggested ways of compiling software for the FreeRunner is by using a toolchain tarball, that can easily be extracted somewhere and used to build the software from the subversion repository, or other (hopefully autoconf ed) software. This builds the binaries, but does not produce proper .ipk files, so no version number or dependencies.The other way is the full openembedded setup, made easy using the MokoMakefile. This, automatically, fetches and builds everything needed for the cross compiliation and all available packages, producing the same output as can be found on the openmoko servers. Setting this up requires about 6 gigabytes of storage and takes over a day the first time, but then hacking the phone is relatively painless, as it resolves dependencies and is self-contained.The communityFor a free software project, the state of the community is very important. The OpenMoko seems to suffer from a rush of interested people on the mailing lists, so it s hard to follow real development in a mass of frequently asked questions and nice ideas from people who have neither an OpenMoko phone nor wil do any coding.On the other hand, it s not easy for new contributers. I have written some code that make sure the phone can handle numbers such as 0172/123 456 instead of the official +49172123456 in the phonebook and the SMS app, something that other users have complained about as well. But no one could tell me where and how I should submit my patches, and the mail to the mailing list with the patches and the bug report is unanswered. It is not clear, at least to me, who is responsible for what part of the project quite different to what I m used to from Debian, where there is a clear list of maintainers for each package, and a well known way of submitting patches (by going through bugs.debian.org).For interested users, I have published my branch of the git repository at git.nomeata.de, and I will hopefully add more features and bugfixes later at least when I find out how to properly contribute to OpenMoko.

I have just bought a EeePC 701 [1], I chose the old model because it’s significantly smaller than the 90x series and a bit lighter too and it had Linux pre-loaded. Also it was going cheap, while I am not paying for it I give the same attention to saving my clients’ money as to saving my own. I ruled out everything that was heavier or larger than an EeePC 901 and everything that cost more than $700. That left only the Linux version of the EeePC 901 (which I couldn’t find on sale) and the EeePC 701 as my options. I also excluded the EeePC 900 because it is bigger and heavier than the 701 but has the same CPU (and therefore can’t run Xen). In terms of it’s prime purpose (a SSH client) 96*22 characters is the size of a konsole screen with the default (medium) font size when the window is maximised, that is 5% more characters than the standard terminal size of 80*25 but the smaller number of lines is a problem. When using the small font I can get 129*29 which I find quite comfortable to read (it would be impossible for me to read withut glasses - which means having almost average vision for someone in their 30’s). Then I can get 129*31 if I dismiss the tool bar at the bottom of the screen and could probably get another couple of rows if I removed the tabs that Konsole uses to switch between sessions. That would only be viable if using screen extensively as a single session without the ability to switch between programs is not particularly useful (I don’t think that ALT-TAB is adequate for switching between terminal sessions). When running Debian I can get 130*32 with the same font due to smaller window controls, but I’ll write more about converting to Debian in another post. Note that while the OS that ships with the Linux based EeePC machines is based on Debian, it is heavily customised and has some notable differences from a typical Debian install. It has some proprietary software, and uses unionfs for the root and /home filesystems. The first issue is that Console (the KDE terminal program) can only be accessed from the file manager (via the tools menu or ^t), the machine clearly doesn’t have defaults for someone like me. In principle it’s a multi-user system that can be fully customised, but in practice it’s configured as a single-user machine. Once you have a Console window open you can run “su -” and the root password is the password for the “user” account. I wonder whether I could get more than 42 rows or more than 140 columns of text that is readable. If so then I could have two console windows fully displayed on screen. The screen is bright and clear, this is essential as the number of pixels per character is going to be low for any reasonable amount of text to be displayed on screen. The password that you set when you first use the machine also works for “su -” (in fact that is the only real use as I expect that almost everyone will choose the automatic login option). The display comprises a significant portion of the weight, if the screen is fully open (about 150 degrees) then it will tip over. Even when the screen is not as far open it will tip due to bumps if resting on your lap on a tram. It’s a pity that the screen is connected at the very back of the base, if the attachment point was a bit closer then it would balance better and also be easy to hold with one hand. The depth of the machine combined with the angle at the back makes it impossible for me to get a good one-handed grip from the base, so typing while standing on a moving tram or bus will be extremely difficult (unlike my iPaQ which I can use at full speed on any form of public transport). Inidentally it would be good if there was an attachment point for a wrist-strap, every camera and most mobile phones have them so it would be good to have the same safety feature in a laptop to facilitate use on public transport. Another reason for not using it as a PDA is the fact that it takes about 7 seconds to resume after hibernating (when the lid is closed). The PSU is almost as small as that of a mobile phone! This is a major benefit as in the past I have often stored a Thinkpad PSU at a client site for 9-5 jobs as it is heavy enough that I didn’t want to carry it on public transport. The EeePC PSU is light enough that it won’t be unpleasant to carry, and small enough to fit easily into a jacket pocket. The OS installation is very well done for the basics. It’s easy to launch applications and there is a good selection of educational programs (including the periodic table, planetarium, typing, letters, and hangman, drawing, and a link to www.skoool.com). It’s a pity that they organised the folders according to the area rather than the age, but generally the OS is very well done. Most of the reviews focus on the speed of the CPU, the RAM expansion options, etc, but miss the fact that it is a really nice machine for using as-is. It is a much better machine for teaching children than any of the machines I’ve seen which are sold specifically for children (see my previous post about an awful computer for kids [2]). I believe that you could give an EeePC to any 3yo and have them doing something useful in a matter of minutes! The ability to freely install new software should not be overlooked when considering a computer for children to use. Someone who buys one now could use it for a few years as an ssh client and then reinstall the original OS and give it to a child as an educational toy. It has a program to create OGG video files from it’s built-in camera and mic, at this moment it’s the only device I own that can create OGG files (this is a good thing). OGG compression takes a really long time, the Atom CPU in the 901 and 1000x series would be good for this. It’s a pity that the microphone is directly below the mouse buttons, it clearly records the mouse click used to finish recording. The version of mplayer which is installed to play OGG files can also play FLV files downloaded from youtube with youtube-dl (althrough the file association is not set). When I tried to play a MP4 file from ted.com it only gave audio (the video works on a full Debian/Etch installation). There is a full set of office software, OpenOffice.org, Thunderbird email client, and all the other stuff you might expect. I find that the biggest problem for using it is the size of the keyboard, I don’t think I’ll ever be able to touch-type properly on it. Not only are the keys small but the positions of non-alphabetical keys are slightly different from most keyboards. Another problem is that the space-bar needs to be pressed near the centre, I usually like to press near the end but that doesn’t work. Those issues are all trade-offs of the small size. My T series Thinkpad is reasonably portable and has a great keyboard so I have the serious typing while travelling angle covered. One real mistake in the keyboard design is the lack of a LED to indicate whether caps-lock is enabled (there are four status LEDs, adding number five couldn’t be that expensive), this is a real problem when using the vi editor (which uses letters as editor commands and is case-sensitive). It will also occasionally cause problems when entering passwords. There is a caps-lock indicator on screen, but that is in the toolbar at the bottom of the scren (which I like to dismiss to gain an extra two lines of text). It would be good if I could display the status of the caps and num lock keys in the right side of the title-bar of the active window (the only bit of unused space on the screen). The cooling fan makes an annoying buzz. It’s significantly louder than Thinkpads which dissipate a lot more heat. The other problems are all software, which is OK as I plan to reinstall it. Firstly it is using Debian and shipped with the broken openssl library. There is a GUI for installing upgrades, but it recommends rebooting after installing each one! Naturally I didn’t choose to reboot, I installed the security update #1. Then I clicked on the button to install a BIOS update. It told me that it had to reboot to apply the update and gave only one button (OK), I tried closing the window but it rebooted anyway (fortunately the vi swap file allowed me to recover this post - which I am entirely writing on the EeePC). Aftere booting up again I discovered that the libssl bug still wasn’t fixed and that there was a second udate to apply! Why can’t they have a “apply all updates” button and also have it not automatically reboot? This must be the only Debian-based distribution that forces Windows-style reboots. But that said, while they made some mistakes in their software it generally provides a good user experience

• [1] http://en.wikipedia.org/wiki/Eeepc


• [2] http://etbe.coker.com.au/2008/07/07/awful-computers-for-kids/

Share This