---

If someone by any chance has noticed in
DEHS' stats page
that there was a bump in the number of failing watch files and is
wondering why it hasn't gone down like it used to, here's the answer:
I'm testing how DEHS' can heal itself, and how long it takes.

In the past when such kind of bumps occurred I used to start a special
DEHS run which retries all the failed watch files, but since doing
that is probably the reason why some of the normal runs process many
more watch files and take longer to finish I decided to let DEHS
automatically recover.

According to my plan it should take from 6 to 7 days to completely
recover from the last mass-failure which was caused by sourceforge's
garr mirror going down abruptly. And I hope this information will be
of some use to design a proper self-healing/recovery mechanism for
DEHS2 (or should it be DEHS-ng? I don't know yet, feel free to propose
names)

Last week I ordered and received a Nikon D90 DSLR which replaces my very rusty Kodak DX3600. I got it on Friday and there was not much time to deal with all the functions when we visted some puppies on Saturday. But the results are nice, though:



Although the camera is the successor of the D80 and inherited some parts from the D300, it is still not supported by Linux apps. Gphoto2 just recognizes D80 and D300 in PTP mode and digikam is the same. One drawback with the D90 is, that it can't be operated in mass storage mode but only in PTP mode. So, I'll need to either use my USB cardreader or Windows. Needless to say I prefer the cardreader. :)
But I hope that either Linux apps will support the D90 soon or Nikon will add mass storage mode for the D90 in newer firmwares.

Today everyone in the Netherlands received a letter about the new national electronic health record (EPD) and the possibility to object against registration. EPD aims to provide access to one's patient data to every care provider through a central information broker. I have submitted the form to disallow my data to be accessed through this system. First of all, there's no clear benefit for me, and I think that goes for the large majority of people. The possible situation where someone has a critical condition and isn't treated by his regular doctor and is unable to inform the stand-in of this and the stand-in has the time to delve through the entire EPD and actually finds and correctly interprets the necessary information seems extremely small for anyone, let alone the big majority that doesn't suffer such critical conditions in the first place. Hence, making it the default for everyone seems very inappropriate. See also this interesting article, written in Dutch by my uncle. Interestingly the same minister was recently opposed to a default-allow for organ donorship, which may address a problem that is much more real. The other concern is security. I am not worried by the technical security of the system, it seems to be of acceptable standard (see this report by my friend Niels). I am more concerned about access restrictions: these are implemented post hoc, that is, anyone can access my file and I can check who accessed my it and whether they had the right to. However, this procedure involves sending in paper forms which I think in practice will not bring about much review. Combined this project reminds me of voting computers - introducing new concerns while solving no actual problems.

Here's a nice opportunity for everyone to learn more about coreboot, a Free Software / Open Source firmware/BIOS for x86 PCs. Ron Minnich, founder of the LinuxBIOS (now called coreboot) project, Peter Stuge of Stuge Konsult, and Stefan Reinauer of coresystems GmbH have given a presentation for the Google Tech Talks series recently. The topic was (of course) coreboot, its history, goals, features and technical details, surrounding tools and libraries such as flashrom and libpayload, as well as an automated test system for running a hardware test-suite upon every checkin in the coreboot repository. A video of the talk, aptly named coreboot (aka LinuxBIOS): The Free/Open-Source x86 Firmware (134 MB), is available from Youtube, get it for instance via:

  $ apt-get install youtube-dl
  $ youtube-dl http://www.youtube.com/watch?v=X72LgcMpM9k

The talk includes various demos of coreboot and various payloads you can use with coreboot. One nice example is the TINT payload, a Tetris-like game for Linux (apt-get install tint for the curious), which has been reworked to be usable as a coreboot payload. So, yes, you can now put Tetris in your BIOS ROM chip and play it from there (no hard drive required). Other demos included some cluster nodes with coreboot, and a "normal" x86 desktop board booting coreboot + Linux in a very few seconds (much room left for optimizing there though, if you really want to get into fast booting). Check out the full talk for more infos, and if you're willing to give it a try (see the list of currently supported boards), contact us on the mailing list or join the #coreboot IRC channel on Freenode.

Some weeks ago, I accidentally deleted half of my /usr/lib. I didn't lose anything important and was able to restore everything (thanks to my Ctrl+C'ing the process in time) but that user error did strike me as too easy to make (apparently, I'm not alone). So I started thinking about how I could prevent something like that from happening again.

I realized one thing: there is no way I would ever want to delete /usr or /etc for example. I figured that "rm" should, by default, refuse to delete certain critical directories (or files). Of course, that would be a very controversial patch to "rm" itself and the chances of this approach succeeding were pretty close to zero.

So instead, I decided to build a wrapper around "rm" which prevents the deletion of important files by checking each one against a blacklist. Anything you add to the blacklist will not be deletable using "rm" unless you override this protection by calling "rm.real" directly.



This tool, safe-rm, ships with a default system-wide configuration file (/etc/safe-rm.conf), but each user can supplement that list of "protected" directories and files by adding lines to ~/.safe-rm.

Debian and Ubuntu packages are available from the usual places.

There are of course different approaches to preventing these kinds of problems...

Michael blogs about Critical Mass.
What is Critical Mass in case you are too lazy to go to Michael's or to the Wikipedia? A cyclist-awareness movement, showing how bikers are safer (i.e. more visible) when there are more of them. The (dis)organizational nature of this movement (at least according to Wikipedia's information) seems quite fun and interesting.
However, I have to oppose what Michael says is a strong point of CM in Austria - At least, given my country's culture.
People who don't bike often say we have the least bike-aware culture, and that this city must be like hell to cyclists. It is not - Mexicans tend to believe this is the worst place possible on many accounts, and I'm happy to prove the contrary. I do feel that bringing people out to the streets, as our local government's Mu vete en bici program pushes, is completely right: It shows people how fast they can move in real streets in the city, taking away the fear of being run over by a bus, and people will gradually understand we can all excercise the right to use the streets without polluting, and gives us a better idea on how to behave with traffic (even if the traffic is made of fellow bikers) around us. I know this program works - At least, because it worked on me. Whenever possible, I go everywhere in this (not small or friendly by any measure) city by bike.
Anyway - What criticism do I have for Michael's post? That he states they:

Bicycling ludicrously slowly for a good hour, we managed to claim some fairly busy streets while many people tried to get home by car.

IMHO, what we should be doing is to demand the drivers to respect us, not to make them want to run us over. They should not be driven into hating bikers because of the chaos they generate - It is terrible to sit in a car for two hours when you usually take 30 minutes. There is simply no justification for that.
When I took part of the World Naked Bike Ride, some people wanted to take all four lanes of Reforma. Fortunately, reason prevailed, and we took only the lane we were assigned. And we should keep that in mind! Whenever possible, we should protest and make ourselves heard, but without interfering, without damaging, other people's lives!
Oh, by the way: If anybody in Mexico wants to have some nice hours of healthy fun: I am still pondering whether to join, as it is a huge effort, but I am very inclined to do so. Next week, November 9, we will go by bike from Mexico City's Z calo to Pachuca. We face 95Km and close to four hours. The road to Pachuca is basically flat, and going in a large group is a great experience. Hope to see you there!

When Heather designed a logo for me for Morphoss she did it with a bitmap editor, naturally enough because that's the tool she's most familiar with using. I'd rather not use a bitmap as the source format for the logo though, because it will degrade when it gets resized, so I redrew it as a vector graphic. One of the best free, open-source tools around for vector graphics seems to be Inkscape and I've mucked around with it for many years, so I naturally used that. Once you have a logo though, you naturally want to use it in documents, and the importing of SVG graphics into OpenOffice.org documents is a long-outstanding bug (let alone embedding SVG graphics) so I needed to convert them to another format. It's actually the most requested feature in OOo, appearing twice in the top 10, and even spawning an external SVG importer project. Since both programs support encapsulated postscript I was able to save the logo from Inkscape as .eps and use it directly in OpenOffice.org. While this initially seemed satisfactory, after a few weeks of using documents with the .eps logo embedded in them I started to get annoyed with the strange pauses when my CPU was maxed out while paging up and down. I was sure that that had not happened in the past when I was using a logo in WMF format, which OOo inevitably has to support well for compatibility with other Office Suites. After some searching around for more complicated ways to convert SVG or EPS to WMF, I discovered that what I could do was simply to open the EPS in OpenOffice.org draw, and save it from there as a WMF. This seems to work well, for my purposes anyway, so now when I use my logo in my OpenOffice.org documents I don't see any annoying slowdown paging up and down within the document, and I didn't have to download the SVG importer for OpenOffice.org either. Well alright, I did download the SVG importer as well, but my logo didn't look nearly so good without it's text, and with everything displaced up and to the right at various offsets!

From the NaNoWriMo TOS:

The Office of Letters and Light reserves the right to change the terms and conditions hereof without prior notice at any time and any such change shall be effective immediately upon posting the changed Agreement on NaNoWriMo.org. The effective date indicated at the top of this page will be updated to indicate that changes have been made. You should, as a condition of continuing to access NaNoWriMo.org and use its features, periodically review the terms of this Agreement and such continued access and/or use shall be deemed to be conclusive evidence of your agreement to be bound by any such changed Agreement.

No, I will not write the Office of Letter and Light a blank check.

Last weekend I created a set of backports of jabberd and its unfulfilled dependencies for etch, for use in my jabber server which has been suffering s2s problems for way too long. The packages are a bit quick and dirty, but good enough for my personal use (a known issue is the lack of shlibs bump in gsasl) and are available from this non-apt-get enabled repository. If I can help the XMPP team in any way to help these packages get into unstable or experimental, I'm totally willing to help.

Today’s the last day for the Gov.UK Consultation on Forced ISP Snooping: Please Say NO. I didn’t get to LinuxExpo, partly because of Monday Machine-Mangling Madness but I saw LinuxExpo 2008 Robert Castelo from the Drupal point-of-view. I also didn’t get to Public Sector Online (report by Andrew Lewin with links to more) and I definitely didn’t travel to Toronto, so the report on the Free Software and Open Source Symposium from Randy Metcalfe is pretty welcome. I wrote about the Social Enterprise Photography Competition and Cooperatives South-West Trade Fair last Friday - the photography competition deadline has been extended to 7 November. So you’ve still time to capture a vision of a more progressive approach to business that values people and the planet as well as profit. Last Friday was Get Online Day but TTLLP didn’t do anything for it this year - I took one look and reached similar conclusions to Graham Jones: Get online…! Oh - you are…! Related to that: on Tuesday, I got really annoyed about how many branches of government (national, regional, sub-regional and local) are obsessed about the private sector and are paying even less attention to other types of businesses, includingbuying off-the-shelf software which doesn’t conform to their stated policies about accessibility and interoperability. (Sorry if you saw evidence of that outburst… yes, local councillors are pretty powerless and get as annoyed about incompetent government services as everyone else.) It seems I’m not the only one feeling that good cooperative businesses are being overlooked. The ICA have recently sent an open letter to the Governments of the G-8 reminding them that co-operative financial institutions are an alternative secure, stable and sustainable model of business owned and controlled by people. Finally, a bit of advance notice here: “The inaugural Creativity & Business International Network (c&binet) will take place at The Grove in Hertfordshire from 26 28 October 2009” - is this something that free software and free culture supporters should get involved with? (And why did they pick a name that includes an XML special character?)

I just managed to chat with the nurse at the doctors office. The chest x-rays confirm Pneumonia, and I'm now on antibiotics. They've also done two throat swabs. The first came back negative for Strep Throat, but I apparently clearly have a throat infection of some sort. They also did blood work to check for mono. The rest of the lab work will come back in 48-72 hours. The antibiotics will almost certainly cover everything already, though. I should apparently be non-contagious by Wednesday and back to work then.

I'd planned to mention this a little closer to New Years, but may as well post it now: We're not the only ones who've had a crappy year. Two of the couple I know who've been together longer than Angie and I have been broke up this year. Other people have had problems with their kids, or been fighting, or been fucked by the stock market.

So I'm proposing a "Global Fuck You". At 00h15 GMT (So that folks in Brittan can celebrate New Years and then participate), I'm proposing that anyone who feels like they could've done without some piece of 2008 go out and burn something. If you feel so inclined, write the list on a sheet of paper of the items, and torch it over a candle (In the parking lot! Don't start 2009 homeless!) If you choose to burn something more creative, I probably don't want to hear about it (I'm looking at you, students in France!). =) I don't know if it'll do any good, but it will certainly feel good.

I'll post again in mid-December about this. In the meantime, tell your friends! Start a Facebook group. Or something. Next year's gotta be better.

Hugs and love, friends. Thanks for the b-day wishes. Congrats to those doing the Ubuntu release! =)

Update: On the other hand, I'm *really* glad we're not moving tomorrow anymore! =)

Tks,
Jeff Bailey

Via Kees Cook (and sorry for the reiteration for people following along Planet Debian, thanks to Caspar Clemens: Recent (>= 5.1) versions of OpenSSH (found at least in Debian Lenny and Ubuntu Intrepid), have the VisualHostKey option. What does it do?

$ ssh -o VisualHostKey=yes 172.16.10.1
Host key fingerprint is db:7a:d8:a8:2e:41:a2:e5:51:e1:7f:d0:73:bd:85:bf
+--[ RSA 2048]----+
     ..            
    ..  .   . .    
    .. . o . o .   
   + .. . o   +    
  + +  . S   . .   
 . . .  . o     .  
      .  .+.   E   
     .   o.o       
      oo...        
+-----------------+
Linux respaldos.local.iiec 2.6.26-1-vserver-amd64 #1 SMP Wed Oct 1 13:08:10 UTC 2008 x86_64

What does this mean? This ASCII-art graph represents your host's public key, which uniquely identifies (or at least, it better damn should uniquely identify!) it. This representation was added mainly because it is way easier to be able to visually record the shape of your most frequently used hosts' IDs than their fingerprint. If you connect from a foreign or untrusted machine (i.e. one that does not yet know your host's identity), make sure to run with this switch - it will protect you from somebody supplanting your server's identity.
Besides, it adds to the general kewlness factor, doesn't it? ;-)
To enable this behaviour by default, add the following to your /etc/ssh/ssh_config (or to your personal .ssh/config):

Host * 
  VisualHostKey yes

Now... What about publishing the list of the 32767 known-bad SSH keys? That'd make for a nice ASCII-art exhibit :-

Phew... that was a lot of work. I have a bunch of small sites that I migrated to slicehost, and at the same time upgraded to Rails 2.1. Here are my notes:

• x86_64 sucks up memory in a bad way. On a 32-bit x86 system davidw 20089 0.0 0.1 3320 1428 pts/1 S+ 11:41 0:00 ruby and on x86-64: davidw 24197 0.0 0.1 16756 1968 pts/0 S+ 18:33 0:00 ruby Ouch! That means that you'll need more memory, and thus to spend more money, to run code that might have fit decently in a similar amount of memory on an x86 machine. For instance, my old server had a gig, and was running low on memory, so on slicehost, I set up one 512 meg slice to handle PostgreSQL, and a gig slice to handle Apache and Rails. The database slice is performing ok, but the 'web' one is kind of iffy in terms of memory. Part of the problem here, I will admit, is that Rails is a memory hog, but still, I had hoped to come out ahead by moving from a machine with 1 gig to two machines with 1.5 gigs between them, and instead I'm more or less where I was before.
• I got caught up in a bit of a mess with Rails and the Ubuntu Intrepid update. I prefer to manage the Ruby stuff with gems, rather than traditional .deb package management, as I've had better luck with that in the past. I do use some of the system packages though, such as libpgsql-ruby1.8. However, the maintainers did something kind of ugly with the package: they swapped out the actual code from one code base to another - "Switched upstream source from ruby-postgres to ruby-pg". Which changes the way you load it, and perhaps a few other things as well. I think I would have been happier seeing the package renamed or something, as all of a sudden, programs stopped working.
• I really like the ability to resize slices. I started both my slices at the 256 size, and then made them bigger when I was ready to put them into production. The process is not instantaneous, but it's pretty handy if you need more capacity in a hurry. Adding new slices is also fast.

So, all in all, I'm happy with the move, although the memory issue is irritating.

Systems Expo 2008 As the last years, Debian was offered a booth at last week's Systems expo here in Munich again. However, this year the Free Projects area was not organized by Rosa Riebl from C&L publishing, but by Wolfgang Drotschmann from LinuxTag e.V.. This made some things a bit more difficult, e.g. we did not know our exact booth number until a couple of days before the expo and the small conference programme was made up in an ad-hoc fashion after the expo started, but in the end most things worked out fine in some way or the other. While the booth (a demo-point, really) was as big (or rather small) as last year, there was much more space around the booth this year (something which seemed to apply to all of Systems), so things did not get too crowded even when a handful of visitors approached the booth at once. Also, the visibility was much improved as our demo point was visible by strolling visitors this year (last year, our demo point was just facing the wall). As nobody else stepped up, I had to organize the booth again. Fewer people than last year were around; only Robert Grimm, Arne Wichmann, Franziska Lichtblau, Johannes Wiedersich, Andreas Barth and I were able to commit to staffing the booth; other people were busy over the week or moved away from Munich since last year, like Robert Lemmen or Wolfgang Lonien. Luckily, we still had the computer the GNOME project donated to us last year, and I took a TFT, keyboard and mouse from the university along. This year, I decided to not show up for the booth build-up the day before Systems starts. On the one hand, I had made the experience that there is not much one can do then anyway, and would have to put the computer/TFT into the central locker room overnight anyway. On the other hand, there was as always a very low attendence in the first few hours of the expo so building up the booth in the morning turned out to be no problem. The Credativ people again provided us with merchandise (due to some miscommunication on my part the package had to arrive directly at the expo, but in the end I was glad about this as I had enough trouble carrying the computer and TFT to the expo). This year, thanks to Credativ, we were able to provide some t-shirts for the first time, something quite some visitors had requested over the years. Besides t-shirts, we had some swirl stickers and the popular Debian keychains provided by Joerg Jaspert through Credativ. In the end the booth mostly consisted of the computer (demonstrating Lenny most of the time) and some A4 sized Swirls I had printed out the day before. From Wednesday on we were able to provide Lenny Beta2 CDs as well thanks to Johannes Wiedersich who organized them. Initially, I asked ADR whether they would produce some CDs for us again as they did last year, but they did not bring the appropriate hardware this time. But thanks to Johannes we were still able to provide interested visitors with CDs through LSK. In the end, we ran out of most t-shirts at some point on Thursday and managed to sell the two remaining Lady shirts on Friday. All the other merchandise was gone by the end of the show as well so the way back was not that difficult, even more so as Andreas Barth helped me carry the computer to the subway and my car. The days I was at Systems (first and last day) the attendance was rather low, so not that many interesting discussions happened. Almost everybody who stepped by knew Debian already and the majority was using it themselves as well, at least on their servers. Those people were also really quite happy, we rarely heard much critizism, even after asking people for some. The most frequently asked question was undoubtly "when will Lenny release?", followed by "do you have that cool t-shirt in L or XL as well?". Overall it was a pretty good experience, albeit slightly stressful organizing it. In any case, this was probably the last time I had to do this as the Systems organizers announced they will rethink their concept and there will be no Systems 2009.

Nagios has the - very useful - feature of “parent hosts”. If it deems a host A being down, it first checks its parent host, B, and reports A only as down if B is up. This goes back recursively until a host with state “up” is found and only the first “down” host is actually reported. This keeps on-call people from being bombed with alerts in case of major network outages and makes sure that the alerts that are actually sent out do reasonably accurately describe the actual outage. As an individual who has some “external” servers in various data centers on the Internet, I would like to not be alerted multiple times that my servers at ISP C, D, and E are down if there is an outage at the ISP F hosting my Nagios installation or at one of the various exchange points temporarily rendering the servers unreachable (without me being able to do anything). The solution sounds easy but is surprisingly hard. How one could solve the issue For each host in the manual nagios configuration, do a traceroute and generate host stanzas for each of the hosts found:

$ sudo traceroute -I icmp -n -A 213.239.240.200
traceroute to 213.239.240.200 (213.239.240.200), 64 hops max, 28 byte packets
 1  <snip>
 2  217.243.221.150 [AS3320]  1 ms  0 ms  0 ms
 3  62.154.10.106 [AS3320]  1 ms  2 ms  2 ms
 4  217.239.40.226 [AS3320]  51 ms 217.239.40.234 [AS3320]  3 ms 217.239.40.226 [AS3320]  60 ms
 5  193.159.226.2 [AS3320]  3 ms  3 ms  3 ms
 6  213.239.240.200 [AS24940]  6 ms  7 ms (TOS=238!)  8 ms
$

This sounds easy and surely can be accomplished in a few hundred lines of perl. However, this makes it necessary to parse Nagios configuration if one wants to obtain the list of configured hosts directly from there. Unfortunately, the syntax of Nagios configuration is “historically grown” which makes it quite illogical and awfully hard to parse - this would easily double the size of the traceroute-based configuration generator. Additionally, the (real) traceroute given above shows three other issues that might arise from such a setup. Dynamic Routing Network paths are not as static as a traceroute suggests. On the Internet, the ISPs use BGP to connect their networks together and to ensure connectivity. In case of network reconfiguration (which may be caused by desired technical or policy changes or actual failures), the traceroute to a given network host may change. Considerable experience is needed to judge whether a change in the traceroute is only short-term while one looks at it, or long term meant to stay. Of course, only long term changes should be reflected to Nagios configuration. The possibility of changes makes it necessary to distinguish between “manually” and “automatically” generated Nagios host entries and to have a mechanism to quickly re-generate the “automatic” entries according to the current situation found on the network. Alternative Network Paths If you look at hop 4 of the traceroute given above, you see two IP addresses. This is a common “one packet left, one packet right” setup where two identical lines are sharing the load and this one sees different interfaces of the next hop router. Which IP address should one put into the parent host declaration then? Later Nagios versions supposedly are able to handle multiple parents to a host, but the docs of course don’t cover this complex configuration and I didn’t yet find the time to find out how this mechanism works and whether it can be used to represent a network layout like that in Nagios. Unpingable Routers For some network operators, ICMP echo request packets (ping) pose a significant load on their network equipment. To remedy that load, they have disabled ICMP echo reply transmission on these machines to keep the load down. This makes the router still show up in a traceroute (as this is done by sending packets with short TTL values and making them expire in transit, resulting in an ICMP TTL exceeded message being sent back), but it cannot be pinged. Hop Number 5 on the traceroute above is such a box: It shows up fine in the traceroute, but pinging it will always return “DOWN”. Currently, I simply omit such hosts from the Nagios configuration, but this may result in extra and inaccurate alerts once the unpingable host itself fails. A different possibility would be to check the host’s availabilty by sending an appropriately TTLed packet either to the host itself or to a host that is “behind” that host. The latter introduces even more complexity since one needs to find out a host “behind” the unpingable box, but this may be necessary since in the case of Hop Number 5 above, the IP address of the hop does not even seem to be in AS3320’s internal routing and tracing to the hop itself stops well before the expected place of the host regardless of from where one traces. Conclusion This is a surprisingly hard issue if one wants to do network monitoring while generating accurate alerts. Surely, it’s a topic that needs to be addressed in network monitoring, so I am quite interested in how other people tackle this. Please comment! Thanks in advance.

Without emailing us in advance, UK.domains.coop just expired our software.coop domain on 29 October instead of 5 November. When I looked at the renewal option in the control panel, the fees have increased by about 30% since last year. I don’t remember being told that and it’s more than what was authorised at the last TTLLP members’ meeting. If I remember correctly, the old price for the dot-coop domain was already five times the price of our dot-UK - now it’s more like six or seven times. I’m sick of the service from UK.domains.coop. The services are owned and run by cooperatives, but it’s not one we can join, as far as I know. Their control panel is rented uncooperative software which doesn’t meet current accessibility standards - I have to reconfigure my browser each time I use it. The support has been a little slow and it’s apparently easy to configure a domain into a non-working setup that one can’t recover without help from the support staff. When I complained, it was suggested that we should work with them, but when I asked how, I never saw a reply. So, I’m transferring our cooperative domain to a non-cooperative registrar. The DotCooperation LLC is a wholly-owned subsidiary of the US coop federation and not a cooperative itself, so does it really matter? After working through a long list of registrars that claim to offer dot-coop domains and eliminating all those which only offer paper registrations (because I don’t want to wait for air-mail) or don’t appear to accept domain transfers, I was left with two and neither were cooperatives. I’ve picked one and only after ordering, I’m told it will take a week to transfer. Grrr. At least the support staff response was pretty quick. That means that these news pages are at a temporary URL for a while. Email to software.coop addresses and the main information pages are offline. If the registrar we’re using turns out to be any good and responsive to feedback, I’ll see if we can resell their services next year.

The Debian Lenny release has still quite a big list of Release Critical bugs, and as Debian developer I feel that I should do my share, and at least look at the list of bugs and see if there's any I could do something for.

Almost always though, I find that I won't touch the remaining bugs in the list.because of one or more of these reasons:

1. a package I really don't care about
2. hugely complex package or might also use something obscure like cddb
3. it seems like people are already looking into it
4. it requires a political solution, not a technical one
   

As part of the effort to get Lenny released, Joss Mouette started the Debian Bug Sprint.
This is really a cool concept, and it is a shame not more people participated.

The reason for me it is cool is that it forced me to break the rules I mentioned above, because I got a bug which fitted 1 and 4 of my list above!

Turned out this bug is really a border case in interpretation of Debian policy.

The package is perfectly usable without any extern dependencies, hence it is currently in the main section of Debian. However it doesn't end there. The package also has a download script that can fetch firmware images for certain printers. It appears for people with these printers the package is NOT usable without external files.

Aparantly though, the current, as one person involved in the bug calls it, "spirit" of Debian is to tolerate this, as it is good enough that it is usable without external dependencies for SOME persons.

However the bug submitter doesn't agree, and thinks this is a case that needs addressing withing the Debian project.

I suggested splitting up the package and moving the download script to contrib, but this was mostly dismissed as idea.

The end result is that the maintainer decided to escalate the problem to the Debian CTTE.
This means it probable won't be solved by today, soo I will have to bake cookies for someone :)