I recently had to setup netconsole in order to diagnose some grsecurity-related suspend/resume problems. The idea is to have the broken machine send its kernel messages to a remote machine via the network.
As a prerequisite, the local machine (the one sending the console messages) must have the following kernel options turned on:

• CONFIGFS_FS
• NETCONSOLE
• NETCONSOLE_DYNAMIC

(The first and last ones are required in order to be able to configure netconsole after boot, through the configfs interface.)The remote machine should be told (using netcat) to listen on a specific UDP port (64001 in this example):

netcat -l -p 64001 -u -s 192.168.1.1 2>&1 tee /root/netconsole.log

Then, running this script on the local machine will turn netconsole on (don't forget to customize the appropriate parameters for your environment):

#!/bin/sh
modprobe configfs
umount /sys/kernel/config 2> /dev/null
mount -t configfs none /sys/kernel/config
modprobe netconsole
mkdir  /sys/kernel/config/netconsole/hostname
echo "xx:xx:xx:xx:xx:xx" >  /sys/kernel/config/netconsole/hostname/remote_mac
echo 192.168.1.1 >  /sys/kernel/config/netconsole/hostname/remote_ip
echo 64001 >  /sys/kernel/config/netconsole/hostname/remote_port
echo 192.168.1.2 >  /sys/kernel/config/netconsole/hostname/local_ip
echo 64001 >  /sys/kernel/config/netconsole/hostname/local_port
echo eth1 >  /sys/kernel/config/netconsole/hostname/dev_name
echo 1 >  /sys/kernel/config/netconsole/hostname/enabled
dmesg -n 8

That's all you need to start seeing messages on the remote machine's screen.
Interested readers may want to look at other ways to configure and use netconsole.

( I love acronyms :-D )

At this point, all of you should know and see how the H D Moore s toys work. Those toys attack SSH public-key authentication using clone keys and online brute force.

Furthermore, many of you know that there are other effects produced by a biased PRNG besides this one.

Strangely, I could not find more of those toys exploiting these aspects. So, I would like to show you a Wireshark patch which attacks Perfect Forward Secrecy (PFS) provided by Ephemeral Diffie Hellman (EDH).
Introduction to EDHLet s put it in plain words (if you know what we are talking about, ignore this and jump to the next heading):
In an insecure communications channel the parties agree a common key to cipher their dialog. This is what happens in SSL (in most of the cases, depending on the cipher suite):

• The server selects a random prime p and a generator g of the field Z*_p (Let s ignore the mathematical properties of these values). So, the components p and g are public.
  
• The server picks a secret random number X_s and calculates Y_s=g^X_s mod p. Y_s is public and is sent to the client (just like p and g).
  
• The client does something similar, selecting a secret random number X_c and calculating Y_c=g^X_c mod p too. The client makes Y_c public by sending it to the server.
  
• The shared secret s is the public key of the other part to the exponential of the own private number, all in p modulus. That is, for the client s=Y_s^X_cmod p and for the server s=Y_c^X_smod p.
  
• With this shared secret the parties can encrypt all the following messages in a secure way.
  
• In the Ephemeral Diffie Hellman (EDH), the private numbers are ruled out, so s is mathematically secure and nobody can obtain it even having access to one of the parties after the aforementioned handshake.
  

The exploit If an eavesdropper can explore the complete private key space (the all possible numbers for X_c or X_s), he/she will be able to get access to the shared secret. With it all the communication can be deciphered. That s what this patch can do.

A Wireshark with this patch and a list of possible private keys will try to brute force the share secret. If one of the parties is using the vulnerable OpenSSL package the communication is totally insecure and will be decrypted.

• The patch for Wireshark 1.0.2 can be downloaded from here.
  
• Debian packages with the patch applied can be found here.
  
• This is a list of all 2¹⁵ possible 64 and 128 bit DH private keys in systems vulnerable to the predictable OpenSSL PRNG described by DSA-1571.
  
• An example of a pcap file can be found here (it was built with a vulnerable client and one of the Moore toys, a hacked getpid by running $ MAGICPID=101 LD_PRELOAD= getpid.so ./vulnerable-openssl/apps/openssl s_client -connect db.debian.org:443 )

The patch was submitted in order to be committed on the Wireshark trunk. There you can find the patch against the on-develop source revision 25765.
Issues that can be improvedWe (the other developers and myself) detected few things to be improved. But we will do nothing for them. So, if you want to contribute with some code, start from these items and submit the patches to the Wireshark s bugzilla:

• When the packets are out-of-order the decipher with stop itself.
  
• The brute force attack should run in a background process (and with a progress bar)
  
• Check the length of the keys before trying to brute force them.
  
• The patch also implements the display of public DH parameters in the packet tree. It s incomplete.

CreditsPaolo Abeni <paolo.abeni at email.it>
Luciano Bello <luciano at debian.org>
Maximiliano Bertacchini <mbertacchini at citefa.gov.ar>

This work was partially supported by Si6 Labs at CITEFA, Argentina.

UPDATE Jul. 21st: See more and updated info here, especially this.

( I love acronyms :-D )

At this point, all of you should know and see how the H D Moore s toys work. Those toys attack SSH public-key authentication using clone keys and online brute force.

Furthermore, many of you know that there are other effects produced by a biased PRNG besides this one.

Strangely, I could not find more of those toys exploiting these aspects. So, I would like to show you a Wireshark patch which attacks Perfect Forward Secrecy (PFS) provided by Ephemeral Diffie Hellman (EDH).
Introduction to EDHLet s put it in plain words (if you know what we are talking about, ignore this and jump to the next tittle):
In an insecure communications channel the parties agree a common key to cipher their dialog. This is what happens in SSL (in most of the cases, depending on the cipher suite):

• The server selects a random prime p and a generator g of the field Z*_p (Let s ignore the mathematical properties of these values). So, the components p and g are public.
  
• The server picks a secret random number X_s and calculates Y_s=g^X_s mod p. Y_s is public and is sent to the client (just like p and g).
  
• The client does something similar, selecting a secret random number X_c and calculating Y_c=g^X_c mod p too. The clients makes Y_c public by sending it to the server.
  
• The share secret s is the public key of the other part to the exponential of the own private number, all in p modulus. That is, for the client s=Y_s^X_cmod p and for the server s=Y_c^X_smod p.
  
• With this share secret the parties can encrypt all the following messages in a secure way.
  
• In the Ephemeral Diffie Hellman (EDH), the private numbers are ruled out, so s is mathematicaly secure and nobody can obtain it even having access to one of the parties after the aforementioned handshake.
  

The exploit If an eavesdropper can explore the complete private key space (the all possible numbers for X_c or X_s), he/she will be able to get access to the share secret. With it all the communication can be deciphered. That s what this patch can do.

A Wireshark with this patch and a list of possible private keys will try to brute force the share secret. If one of the parties is using the vulnerable OpenSSL package the communication is totally insecure and will be decrypted.

• The patch can be downloaded from here.
  
• Debian packages with the patch applied can be found here.
  
• This is a list of all 2¹⁵ possible 64 and 128 bit DH private keys in systems vulnerable to the predictable OpenSSL PRNG described by DSA-1571.
  
• An example of a pcap file can be found here (it was built with a vulnerable client and one of the Moore toys, a hacked getpid by running $ MAGICPID=101 LD_PRELOAD= getpid.so ./vulnerable-openssl/apps/openssl s_client -connect db.debian.org:443 )

The patch was submitted in order to be committed on the Wireshark trunk. There you can find the patch against the on-develop source revision 25765.
Issues that can be improvedWe (the other developers and myself) detected few things to be improved. But we will do nothing for them. So, If you want to contribute with some code, start from these items and submit the patches to the Wireshark s bugzilla:

• When the packets are out-of-order the decypher with stop itselft.
  
• The brute force attack should run in a background process (and with a progression bar)
  
• Check the length of the keys before trying to brute force them.
  
• The patch also implements the display of public DH parameters in the packet tree. It s incomplete.

CreditsPaolo Abeni <paolo.abeni at email.it>
Luciano Bello <luciano at debian.org>
Maximiliano Bertacchini <mbertacchini at citefa.gov.ar>

This work was partially supported by Si6 Labs at CITEFA, Argentina.

I’ve finished the porting of rng from qt3 to qt4 and uploaded it to unstable. It has some minor regressions compared to the qt3 version, like the localization of the qt4 widgets which isn’t working yet and that the column which sorts the table isn’t saved and restored properly on startup, but it closes many other bugs and it doesn’t crash anymore. The new version doesn’t bring so much new features so far, but since it’s using much of the stuff which came with QT4, like the QTableModel and the QWebView, it runs much faster in many cases, e.g. when sorting or filtering the table. Ah, and last but but not least: thanks to WebKit rng even passes acid1 and acid2. Doesn’t yet pass acid3 but I guess someone is already working on it

dsyslog 0.3 has been released, with support for postgresql logging targets, and much more. The development of postgresql support, and extensive documentation, has been made possible by Google’s summer of code program sponsorship of Jeff Katz, who intends to contribute even more code to 0.4. It’s presently sitting in NEW, but if you want it now, you can grab it from the dsyslog website.

As it usual when someone gets in, this is my hello Planet Debian post. I’m Nicolas Valc rcel, i’m the maintainer of terminator and augeas and really interested on server and security topics. I’ve just started my New Maintainer process some weeks ago and hoping to put all my energies on making debian even better and easier! I Live in Lima, Per .

One of the most exciting things about the computer industry these days is the ease with which can get started. Decent computers can be had for well south of $1000, hosting is cheap, services like Amazon EC2 make it ever easier to scale rapidly should the need arise, and the only other things you need are an internet connection and a place to sit. This is leading to more people, like 37 Signals to question the need for investment entirely and others, like YCombinator to successfully make very small investments (thousands of dollars, rather than millions). Sometimes, however, I wonder - is it just a passing moment in time, a window of opportunity, or is it a long term trend? Historically, to set up something like a factory required a great deal of money, putting it beyond the reach of anyone unable to obtain financing. Even in this day and age, there are plenty of endeavors that require large amounts of capital, and a lot of time, prior to seeing returns: that's how things work in my wife's field, biotech. Some fields have even become more expensive with time. High end computer games are very expensive propositions in this day and age, compared to the low budget stuff typical of, say, the Commodore 64 era, although it's also true that the market has also grown a lot, and that there is still space for smaller-budget operations. How does all this look historically? Have there been industries in the past where it was so easy to get started? Anything that was able to scale? By which I mean: it might have been relatively easy to start some kind of small business, but it would most likely always stay small, whereas things like Craigslist or 37Signals have the means to grow a great deal without adding lots of people. Will things change in the future so that one or a few programmers can't compete with a big team? Or perhaps things will go in the other direction and more industries will become like computing is today and it will be possible to a biotech startup in your home office?

There is a lot of interest in making organisations “green” nowadays. One issue is how to make the IT industry green. People are talking about buying “offsets” for CO2 production, but the concern is that some of the offset schemes are fraudulent. Of course the best thing to do is to minimise the use of dirty power as much as possible. Of course the first thing to do is to pay for “green power” (if available) and if possible install solar PV systems on building roofs. While the roof space of a modern server room would only supply a small amount of the electricity needed (maybe less than needed to power the cooling) every little bit helps. The roof space of an office building can supply a significant portion of the electricity needs, two years ago Google started work on instralling Solar PV panels on the roof of the “Googleplex” [1] with the aim of supplying 30% of the building’s power needs. For desktop machines a significant amount of power can be saved if they are turned off overnight. For typical office work the desktop machines should be idle most of the time, so if the machine is turned off outside business hours then it will use something close to 45/168 of the power that it might otherwise use. Of course this requires that the OS support hibernation (which isn’t supported well enough in Linux for me to want to use it) or that applications can be easily stopped and restarted so that the system can be booted every morning. One particular corner case is that instant-messaging systems need to be server based with an architecture that supports storing messages on the server (as Jabber does [2]) rather than requiring that users stay connected (as IRC does). Of course there are a variety of programs to proxy the IRC protocol and using screen on a server to maintain a persistent IRC presence is popular among technical users (for a while I used that at a client site so that I could hibernate the PowerMac I had on my desktop when I left the office). It seems that most recent machines have BIOS support for booting at a pre-set time. This would allow the sys-admin to configure the desktop machines to boot at 8:00AM on every day that the office is open. That way most employees will arrive at work to find that their computer is already booted up and waiting for them. We have to keep in mind the fact that when comparing the minimum pay (about $13 per hour in Australia) with the typical electricity costs ($0.14 per KWh - which means that a desktop computer might use $0.14 of electricity per day) there is no chance of saving money if employee time is wasted. While companies are prepared to lose some money in the process of going green, they want to minimise that loss as much as possible. The LessWatts.org project dedicated to saving energy on Linux systems reports that Gigabit Ethernet uses about 2W more power than 100baseT on the same adapter [3]. It seems most likely that similar savings can be achieved from other operating systems and also from other network hardware. So I expect that using 100baseT speed would not only save about 2W at the desktop end, but it would also save about 2W at the switch in the server-room and maybe 1W in cooling as well. If you have a 1RU switch with 24 Gig-E ports then that could save 48W if the entire switch ran at 100baseT speed, compared to a modern 1RU server which might take a minimum of 200W that isn’t very significant. The choice of server is going to be quite critical to power use, it seems that all vendors are producing machines that consume less power (if only so that they can get more servers installed without adding more air-conditioning), so some effort in assessing power use before purchase could produce some good savings. When it comes time to decommission old servers it is a good idea to measure the power use and decommission the most power hungry ones first whenever convenient. I am not running any P4 systems 24*7 but have a bunch of P3 systems running as servers, this saves me about 40W per machine. It’s usually the case that the idle power is a significant portion of the maximum power use. In the small amount of testing I’ve done I’ve never been able to find a case where idle power was less than 50% of the maximum power - of course if I spun-down a large number of disks when idling this might not be the case. So if you can use one virtual server that’s mostly busy instead of a number of mostly idle servers then you can save significant amounts of power. Before I started using Xen I had quite a number of test and development machines and often left some running idle for weeks (if I was interrupted in the middle of a debugging session it might take some time to get back to it). Now if one of my Xen DomU’s doesn’t get used for a few weeks it uses little electricity that wouldn’t otherwise be used. It is also possible to suspend Xen DomU’s to disk when they are not being used, but I haven’t tried going that far. Xen has a reputation for preventing the use of power saving features in hardware. For a workstation this may be a problem, but for a server that is actually getting used most of the time it should not be an issue. KVM development is apparently making good progress, and KVM does not suffer from any such problems. Of course the down-side to KVM is that it requires an AMD64 (or Intel clone) system with hardware virtualisation, and such systems often aren’t the most energy efficient. A P3 system running Xen will use significantly less power than a Pentium-D running KVM - server consolidation on a P3 server really saves power! I am unsure of the energy benefits of thin-client computing. I suspect that thin clients can save some energy as the clients take ~30W instead of ~100W so even if a server for a dozen users takes 400W there will still be a net benefit. One of my clients does a lot of thin-client work so I’ll have to measure the electricity use of their systems. Disks take a significant amount of power. For a desktop system they can be hibernated at times (an office machine can be configured such that the disks can spin-down during a lunch break). This can save 7W per disk (the exact amount depends on the type of disk and the efficiency of the PSU - (see the Compaq SFF P3 results and the HP/Compaq Celeron 2.4GHz on my computer power use page [4]). Network booting of diskless workstations could save 7W for the disk (and also reduce the noise which makes the users happy) but would drive the need for Gigabit Ethernet which then wastes 4W per machine (2W at each end of the Ethernet cable). Recently I’ve been reading about the NetApp devices [5]. By all accounts the advanced features of the NetApp devices (which includes their algorithms for the use of NVRAM as write-back cache and the filesystem journaling which allows most writes to be full stripes of the RAID) allow them to deliver performance that is significantly greater than a basic RAID array with a typical filesystem. It seems to me that there is the possibility of using a small number of disks in a NetApp device to replace a larger number of disks that are directly connected to hosts. Therefore use of NetApp devices could save electricity. Tele-commuting has the potential to save significant amounts of energy in employee travel. A good instant-messaging system such as Jabber could assist tele-commuters (it seems that a Jabber server is required for saving energy in a modern corporate environment). Have I missed any ways that sys-admins can be involved in saving energy use in a corporation? Update: Albert pointed out that SSD (Solid State Disks) can save some power. They also reduce the noise of the machine both by removing one moving part and by reducing heat (and therefore operation of the cooling fan). They are smaller than hard disks, but are large enough for an OS to boot from (some companies deliberately only use a small portion of the hard drives in desktop machines to save space on backup tapes). It’s strange that I forgot to mention this as I’m about to buy a laptop with SSD.

• [1] http://www.boston.com/news/science/articles/2006/10/16/google_to_convert_hq_to_solar_power/


• [2] http://en.wikipedia.org/wiki/Jabber


• [3] http://www.lesswatts.org/tips/ethernet.php


• [4] http://doc.coker.com.au/environment/computer-power-use/


• [5] http://en.wikipedia.org/wiki/Netapp

Share This

One of the reasons that I didn’t post much last week was that I was contacting some of my MEPs as part of the Telecom Packet Action in order to help defend cooperative software distribution and use. This is a bit longer than my usual posts and no software is announced below, but I’m posting it here in the hope that more people will take part in this campaign that affects every EU internet user. In short, some MEPs that I remember from the Software Patent campaign proposed amendments that would enable the unpopular three-strikes regime, where internet users could be disconnected and fined if they had three allegations of copyright infringement made (not necessarily proved AIUI) against them, and ISPs could be required to block legal peer-to-peer cooperative distribution systems like BitTorrent. ISPs would also have to distribute official advice about proper internet use and I remember how good that often is. Note that three-strikes wasn’t explicit in the amendments, but there did appear to be loopholes which could be used to allow it, such as only prohibiting technical feature requirements. For longer descriptions, see articles by La Quadrature du Net (Squaring the Net) and The Open Rights Group. The UK Independence Party MEPs replied quickly that they would vote against, mainly because of the source of the legislation. I don’t completely agree with that, but at least UKIP does what it says on the tin. Neil Parish MEP of the Conservatives sent me back a reply which referred to unknown numbering (H1, K1 and so on) and generally seemed like a mish-mash of replies that other people had received. I replied with questions about several aspects, including asking where his numbering came from, and I’ve not seen an answer yet. I’ll email him again in a few days because it’s been over a week. I was really annoyed by the reported complaints by Malcolm Harbour (Conservatives lead MEP on this issue) about how voters have reacted to these amendments, where he called it “scaremongering” amongst other things. No mongering was required - those amendments are damn scary. See comments from a media solicitor at the end of a BBC report:-

“The amendment will cause several problems, firstly, many broadband users routinely transfer large files which are encrypted. “Many of these are acting quite legitimately and in order to determine whether or not such large files are or are not the produce of illicit file sharing the ISP will have to carry out an unprecedented degree of analysis of its customers’ traffic. “Furthermore, computers are frequently shared - within offices, within homes, within educational institutions and inadvertently, where wrong-doers “piggy back” on an inadequately secured Wi-Fi connection. “All this raises the spectre of people losing internet access - for reasons which are no fault of their own.”

The main thing that these actions over the last few years have taught me is the broken state of European Union decision-making. I know I’m sometimes dissatisfied with problems in local and civil democracy, but the EU is a good idea whose democracy and accountability seems broken on a massive scale. There are just too many disconnects, as far as the ordinary voter can see. We put things in to elections and consultations and get bizarre law-making like this. If we act to correct the bizarre law-making, some MEPs start criticising us quite severely. And what kind of stupid representative system allows the representatives to repeatedly blame the voters but still be safely elected because of their high position on their party’s list? I’d love a simple, reformist constitution that’s simple enough for people to actually understand, approve in referendums and participate in the EU effectively. I doubt it will happen in my lifetime, though.

---

Quick post: Please update your links pointing to maintainer.php

The new reports page is report.php and has a more DDPO-like params style.

Examples:
DEHS report for package lojban-common:
Old: htt p://dehs.alioth.debian.org/maintainer.php?name=lojban-common
New: http://dehs.alioth.debian.org/report.php?package=lojban-common

DEHS report for filippo:
Old: htt p://dehs.alioth.debian.org/maintainer.php?maint=filippo[at]debian.org
New: http://dehs.alioth.debian.org/report.php?login=filippo[at]debian.org
New2: http://dehs.alioth.debian.org/report.php?login=filippo

Note that the maintainer.php script will still work for some time but please update your links whenever you have a couple of minutes to do so.

Just over three weeks ago I started a new job, I left my position as a Network Manager to start a job as a Linux Consultant. On my last day I was given a rather generous collection from everyone there. The purpose of this post is to show everyone that the money was well spent, the picture shows the books and DVDs that I bought. Thanks guys.

I've been rather disconnected lately, trying to finish my PhD, find a job, etc. I got permission from my committee to start writing my thesis a few weeks ago, so I've been trying to get that in gear, as well as finishing up data for publication. This should all be done by November, if all goes well, so I can get back to spending more time on the things that I love.

I've tried to stay somewhat current with what's going on, and there's been a noticeable change over the past couple weeks in the tone of discussion around the community. I've personally been fascinated by the appearance of two things: the Linux Hater's Blog and the debate about Gtk 3.0. What's striking about both of these things is that they focus very much on the more consumer-oriented side of Linux. It's all about pleasing the independent vendors and grandma, and not about doing cool things. This is a huge shift from a few years ago. When I (and I assume many of us) got started with Free Software it wasn't really about these things, but more about getting your own work done and less about pleasing other people. Pleasing others was good of course, but it wasn't really expected. Just getting the system up and running was cool at the time, but using it exclusively for all your work? Only if you were in the right line of work!

We've come to a point where we expect a hell of a lot more though. We've got very vocal community members who want to spread Linux far and wide, and they want to do it today. And arguably, Linux is ready for it. We have good software that works rather well, can be easily installed and set up, and will run most of what people need. Yay us. On the other hand, after spending the better part of the decade using Linux on the desktop I'm finding that I agree with almost everything that the Linux Hater's Blog says. It's hard to argue with the truth, and the truth is that things are still difficult for people. I've spent the last few years trying to make X in Debian easier for people to deal with, and I've barely made a dent in just this one problem. And there's plenty more to pick and choose from. Sure, you can talk about how Windows and OSX have problems too, but we can't just be as good as them. We have to be better if we want to spread Linux and Free Software far and wide.

But do we really want to do that? Well, to be honest, I don't think it matters. No matter whether or not you care about grandma using Linux, we all want to have systems that work well and are easy to manage. Currently we have a lot of things in modern distros that could be a hell of a lot better. And many of them are directly related to fundamental assumptions we've made that don't really hold up as well as they should. They lead to lots of extra work leading to a sub-par product. We can do better and we should do better. If we have the absolute best system, world domination would be a natural side effect.

That's why I think that things like this need to stop and that we need more things like this. Sure, one is a hell of a lot harder, but no one cares if you solve an easy problem. It's the hard ones that matter, and provide the real payoff in the end. We need a better system to stop the hemorrhage of developers to OSX. When Miguel talks about how the people pushing for gtk 3.0 are all using OSX, I get very worried. If we want to be in control of our own destiny then we need to face our problems head on, and solve them.

I’ve been considering the possibility of using Xen on an ASUS EeePC as a mobile test platform for an Internet service. While the real service uses some heavy hardware it seems that a small laptop could simulate it when running with a small data set (only a few dozen accounts) and everything tuned for small amounts of RAM (small buffers for database servers etc). According to the wikipedia page about the EeePC [1] the 70x and 900 versions of the EeePC use a Celeron-M CPU. According to Wikipedia that is based on the Pentium-M (which lacks PAE support and therefore can’t run Xen). The Fedora Tutorial about the EeePC has a copy of the /proc/cpuinfo data from an EeePC [2] which shows that the model in question (which is not specified) lacks PAE. Are there any 70x or 90x variants that have PAE? Intel sometimes dramatically varies the features within a range of CPUs… The 901 version and the 1000 series use an Intel “Atom” CPU. According to discussion on the Gentoo Forums some Atom CPUs have the “lm” flag (64bit) but no “vmx” flag for virtualisation [3] (which means that they can run Xen paravirtualised but no KVM or hardware virtualisation for Xen), it also has PAE. This is more than adequate. According to the Wikipedia page the Atom comes in both 32bit and 64bit variants [4]. Hopefully the 901 version and the 1000 series EeePC will have the 64bit version. The 90x versions have support for up to 4G of RAM but the 1000 series is only listed as supporting 2G, hopefully that will be 4G or more (although I wouldn’t be surprised if Intel had a chipset supporting only 4G of address space and PCI reservations limiting the machine to 3G). But even 3G will be enough for a mobile test/development platform which should make it easier to debug some problems remotely. The 901 is available in Australia for just under $700. It’s a little more expensive than previous EeePC variants ($500 is a magic number below which things can be purchased with significantly less consideration), but it still might be something that one of my clients will pay for. The prime aim is to be a mobile sys-admin platform that can be carried anywhere, running a Xen simulation of the target network is an added bonus. Any suggestions for other laptops that should be considered will be welcome. It needs to be light (1.14Kg for a 901 EeePC is more than I desire), small (a reduced display size is not a problem), and not overly expensive ($700 is more than desired). Update: JB HiFi is selling the 1000H model [5]. The 1000H has an 80G hard disk and weighs 1.45Kg. The extra 210g and slightly larger size are a down-side, as is the extra ~$50 in price. A comment was made that OpenVZ could be used. If that avoids the need for PAE then a 702 series would do the job (with some USB flash devices as extras). The 702 is a mere 920g. Update: This ZDNET review shows that the 901 can only handle 2G of RAM and has an Atom CPU that is only 32bit [6].

• [1] http://en.wikipedia.org/wiki/ASUS_Eee_PC


• [2] http://fedoratutorials.com/tag/eeepc/


• [3] http://forums.gentoo.org/viewtopic-t-696142.html


• [4] http://en.wikipedia.org/wiki/Intel_atom


• [5] http://www.jbhifi.com.au/computers/


• [6] http://www.zdnet.com.au/reviews/hardware/laptops/soa/Asus-EeePC-901/0,2000065761,339290002,00.htm

Share This

You can now try the “Nouveau” free software nVidia video drivers from Debian experimental. If you would like to try them:

• Ensure you are using Debian sid.
• Add experimental sources to your /etc/apt/sources.list.
• Run:
  • sudo apt-get update
  • sudo m-a update
  • sudo m-a a-i drm
  • sudo apt-get install xserver-xorg-video-nouveau
• Edit your /etc/X11/xorg.conf and specify the nouveau driver in the Device section.
• Restart X. You will need to remove the binary nvidia kernel module.

Editing your xorg.conf may be as simple as the replacing nvidia or nv with nouveau; nouveau won’t be chosen automatically over nv yet. If your xorg.conf has collected a lot of cruft over the years, see this wiki page for some pointers on what you can remove. For the status of the drivers with your particular card, please see upstream’s compatibility matrix. My experience has been positive; I have been using them for about two months on my dual-head 8600GT (NV50) setup with only a few small issues and a generally superior Gnometris experience. Some notes:

• If you find bugs (unrelated to the packaging), please report the problem upstream and not in the Debian bug tracker.
• At request of upstream, we are not providing 3D support. Please do not ask for it, as a wontfix tag often offends.
• Bonus points are awarded for removing the non-free nVidia driver; although installation of xserver-xorg-video-nouveau will remove nvidia-glx, purging nvidia-kernel-common and nvidia-kernel-source should remove all the module-assistant generated kernel modules. rms would be proud.

Many thanks to:

• Matthew Johnson (mjj29) for uploading.
• Julien Cristau (jcristau) for advice.
• Christopher Halse Rogers (ROAF) for his Ubuntu packages.
• The rest of the XStrikeForce, who do rather a lot of work you don’t really notice.

So apparently the Belgian 'government' has failed to meet its deadline; and as a result, the prime minister has handed in the 'government's resignation to the King. I say 'government', because these people have been doing quite a lot of things—all except governing... I must say I can't be surprised. I never liked Leterme; not before the elections, and not after. Now that more than a year has passed since his winning the elections, they have managed to accomplish exactly nothing. Well, that's not exactly true. There's a pattern here:

• June 2007. Leterme wins the election, and starts talking. He accomplishes exactly nothing.
• August 2007. After months of talking, Leterme gives up. The King hands the initiative to some other people, who manage to get basic agreements about things in the course of a few weeks.
• September 2007. Leterme is put at the wheel again.
• December 2007. After months of talking, Leterme gives up a second time. The King asks Verhofstadt to form an interim government. He does so in 2 weeks.
• March 2008. Leterme gets parties to agree on some basic things, and promises "a second package of state reforms by July 15, 2008".
• July 15, 2008. Surprise: Leterme has accomplished exactly nothing, and has to hand in his resignation. A third time.

And even after that horrible track record, CD&V/N-VA is still not willing to put Leterme aside as a candidate for the prime ministry. Now I'm sure some people will tell me that Leterme did indeed, accomplish something, such as the budget agreement of a few days ago. Well, here's a news flash: if you want to get a government set up, then not accomplishing that is pretty critical; something routine and simple as a budget is hardly noteworthy, then. The one thing I do not understand, have never understood, and will not ever understand, is why the larger parties in Belgium feel so compelled to create "cartels" with small extremist fringe parties. They all fell into that trap; VLD (liberals) with Vivant (economic strangelings); CD&V (catholic democrats) with N-VA (flemish nationalists), and SP.A (socialists) with Spirit (left-wing something). I have no trouble understanding why the fringe parties want to do this (gives them power where occasionally they wouldn't have any), but the large parties? It only causes trouble (as the CD&V/N-VA cartel has now proven beyond any doubt); and I seriously doubt it causes them a net win in votes. I could say that some other things about the past deb cle also puzzle me, such as the insistence of some people to get an unconditional split of BHV, thereby destroying all chances of even remotely reaching a compromise; but given the idiocy explained in the previous paragraph, I should hardly be surprised. Sigh. I wish I had some decent politicians in this country; but the people I voted for lost seriously, and were not part of the negotiations. I guess that should mean I have to say: told you so; but then, that's not very productive either. Here's for hoping they can still find some way out of this mess...

Back in May, I wrote about starting to bicycle to work. My plan was to do that 3 days a week. My ride is 10 miles each way, with the first 2.3 miles on dirt, gravel, and sand roads.

It's been going well. Yesterday was the first day that the ride really felt easy. It's been getting more and more fun, too.

And I've been getting faster. My worst time lately was 49 minutes, also yesterday morning. I really was riding slower than I felt normal, just taking it easy. But I had a headwind, and when I started my normal time in calm conditions was 60 minutes or more. That's almost a 20% improvement already.

Due to vacations, holidays, and weather, I haven't been able to average 3 days a week. When it's raining, or has rained recently, our roads get muddy and pretty much impassible on bicycle. Though some days, my ride is 2 miles longer because the short route is too muddy but the long route isn't.

So, overall, I've been enjoying bicycling, and plan to keep doing it.

Software in the Public Interest is a US tax-exempt not-for-profit organisation that supports a number of free software projects that I like - including debian, GNUstep and drupal - and it’s one of the most open and democratic free software organisations in the world. SPI’s next board meeting is today (Wednesday) at 1900 UTC on irc.oftc.net #spi and logs should appear here and on spi-general less than a day after. I’ve not seen a formal announcement yet, but I expect the agenda will appear here. (Update: the meeting has been postponed until after the election, but that wasn’t announced.) I’ve posted the log of the last board meeting and the log of the annual meeting to spi-general. I’m standing for election to the board for the second time. My platform contains four main proposals:-

1. Anonymise SPI votes - all votes are traceable at present
2. More SPI news - including getting the official announcements out on time
3. Consult members more - run a web panel, if members are interested
4. Report on SPI performance - at least some annual report

and free software developers who have joined SPI (at no cost) can vote for me online. If you’ve got any questions about my platform, please ask them here - or anywhere else that’s appropriate - and I’ll try to answer. I think it’s a much better platform because I learnt a lot from the last campaign, so I hope you’ll vote for me.

Lenny general freeze is approaching, so I'm walking thru my packages bugs and I found this one reported against fdupes.

I got 4Gb of memory, so how to reproduce an OoM? Let's start with a rather large file base, but I need a script to generate it. With 4 cores and a fast Raptor hd, I want something to stess them while learning something: Python + ParallelPython was the answer!

I wrote a small script that takes 3 parameters: the destination directory, the number of dirs to create and the number of files (with random contents) to created inside each of the created dirs. I ran it with 1000 dirs and 1000 files, so it generated 1M files set to work on.

But even with so many files, fdupes ran fine... At that point I realized that ulimit could be my friend, and the "-v" option would have saved me some time, but without the fun to write the script :)

If you don't know pp, here is a little explanation of the main part of the script (I forgot to comment the script well enough):

• job_server = pp.Server() is the pp job server: with no parameter, it allocates execution slots for the number of cores/CPUs on your system (you can force more/less)
  
• jobs.append(job_server.submit(gen_dir_set, (dirname+'/'+str(i),fileno), (), ('random',))) appends to jobs list the function returned by job_server.submit: this command takes the function to execute, the parameters tuple, the functions called by the first one (here empty) and the tuple of needed modules for the called function (here random).
• for job in jobs: job() execute each item in jobs: they are functions that return the results for every jobs (here they are discarded, but you could aggregate them to obtain the final result)
• job_server.print_stats() prints some stats about jobs executions (I love stats :D )

ParallelPython is more powerful than this: for examples, it allows to send your jobs to job nodes, machine dedicated to execute tasks (while you keep your own machine as the administration one), and more! Give it a try ;)

Most people will know that it's hard for the m68k port to keep up with unstable. Mostly because the hardware is not the fastest anymore, but usually we could work around this problem by throwing more hardware onto it. But there are sometimes non-m68k problems that prevent the port from keeping up like, let's say, no wanna-build access anymore, because all ssh pubkeys have been revoked due to DSA-1571 (OpenSSL).
The problem was mentioned on debian-68k mailing list, starting a discussion about the implications for m68k.
Some weeks after the incidence, the problem still existed and there was some discussion again how to proceed and it was tried to get the keys in again. And luckily there was some progress.

But that didn't last long and finally there was yet another attempt to get wanna-build working again for m68k.
As of this writing, there wasn't any success in getting wanna-build access back and after 2 months since the DSA-1571 incident, m68k is not allowed to build packages from wanna-build, because somebody didn't feel like adding some ssh pubkeys.

Maybe that person is overloaded with other work or such, but this means that this person puts extra workload on other people that are scheduling packages on multiple buildds for about 2 months now, although there is other work to do for the involved porters than acting as a human wanna-build.

I'm very disappointed by those who have failed to update the wanna-build ACLs in a timely manner for this long. And I'm very thankful of everyone who tried to help and especially of Stephen Marenka who acted as a human wanna-build in the meanwhile!