Stage 1 : working whilst tired, missed a critical dot in a command, removed system /etc/ instead of the local test ./etc/ of a root filesystem test build. Come home early to try to rescue the machine using /etc/ data from machines on the home network (same kernel, same users, same config).

Stage 2 : Get home, start up the office network, UPS alarm goes off, sparks and bang from my main machine, familiar smell of burnt electronics (again) and UPS seems now unable to provide any mains power, battery only.

Stage 3 : despite having the config, the broken laptop is still not fixed. Lots of packages are completely bust, resurrecting /etc/passwd, /etc/group and /etc/shadow from other machines at least provided login and chroot operation via the Lenny Debian installer. I don't want to have to reinstall this box but it is questionable whether setting everything up again after reinstalling is actually less work than fixing the broken config.

Result: My semi-VAC is ongoing, I'm back on my iBook laptop and I'm looking for a new UPS.

So, the last lazyweb question I asked had good results. Time to try again: Whats a good python-accessible, cross-platform-and-trivially-installable(windows users) flexible (we have plain text, structured data, etc and a back-end storage area which is only accessible via the bzr VFS in the general case), fast (upwards of 10^6 documents ), text index system? pylucene fails the trivially installable test (apt-cache search lucence -> no python bindings), and the bindings are reputed to be SWIG:(, xapian might be a candidate, though I have a suspicion that SWIG is there as well from the reading I have done so far, and - we'll have to implement our own BackEndManager subclass back into python. That might be tricky - my experience with python bindings is folk tend to think of trivial consumers only, not of python providing core parts of the system :(. So I'm hoping there is a Better Answer just lurking out there... Updates: sphinx looks possible, but about the same as xapian - it will need a custom storage backend. google desktop is out (apart from anything else, there is no way to change the location documents are stored, nor any indication of a python api to control what is indexed). It looks like I need to be considerably more clear :). I'm looking for something to index historical bzr content, such that indices can be reused in a broad manner(e.g. index a branch on your webserver), are specific to a branch/repository (so you don't get hits for e.g. the working tree of a branch), with a programmatic API (so that the bzr client can manage all of this), with no requirement for a daemon (low barrier to entry/non-admin users).

So I am giving a talk this Friday at the University and here is the English introduction to my talk/paper and below is the Portuguese one. It starts at 9 am in Porto Alegre, Brazil and is being streamed.

*O Departamento de P s-Gradua o da Antropologia e a Associa o Software
Livre.org convidam:
*_*
Palestra com a antrop loga Gabriella Coleman*_
professora da New York University (NYU) *Quando:* Sexta-feira, dia 13 de junho, s 9h
*Onde:* Audit rio do ILEA, Campus do Vale - UFRGS
*Entrada:* Gratuita
*Transmiss o web: *tv.softwarelivre.org *
_Revolu es Silenciosas:_*
*O Ir nico Surgimento do Software Livre e de C digo Aberto
**e a Constru o de uma Consci ncia Legal Hacker* A palestra oferece uma an lise antropol gica e hist rica do
surgimento da comunidade de software livre e de c digo aberto,
procurando mostrar como, ao longo de duas d cadas, hackers e
entusiastas do software livre garantiram para si um dom nio de
autonomia legal para a produ o de software. Em uma poca
marcada por profundas transforma es no regime de Propriedade
Intelectual, a comunidade de software e de c digo aberto se
organiza cultivando uma acentuada consci ncia das transforma es
no mbito legal. O objetivo da palestra o de demonstrar como e
quando se cruzaram as trajet rias parcialmente independentes das
transforma es nas leis de propriedade intelectual com a
consolida o do “movimento” de software livre, para se tornarem
hist rias insepar veis voltadas disputa pelo futuro das
tecnologias - especialmente o computador pessoal e a Internet.
Com este foco, ser discutida uma nova pr tica social de
produ o de tecnologia que fornece uma nova vis o de mundo
insurgente e que desafia as justificativas neoliberais que
animam a expans o das leis de propriedade intelectual. Nesta
discuss o, ao inv s de oferecer hist rico abrangente, ser o
apresentados exemplos selecionados da hist ria do movimento de
software livre e da globaliza o das leis de propriedade
intelectual, com vistas caracteriza o da pr tica de produ o,
distribui o e utiliza o de Software Livre e de C digo aberto
nos Estados Unidos.

Lessons learned: no unicode in filenames on my blog. I had the great idea, a few days ago, to write a short blog post about my trip to Cologne, and to give the file a name with a UTF-8 character in it (the , to be exact). Except that I forgot how my blog actually works... I use blosxom to manage my RSS feed and other parts of the blog; but to integrate it properly in my website, I wrote a whole lot of stuff around that. It's not just blosxom:

• All files are in a subversion repository.
• On the server, there is a file:/// checkout of the subversion repository in /var/local/blosxom. Files in this checkout are owned by the www-data user.
• The subversion repository has a rather long post-commit hook:

wouter@samba:/var/lib/svn/blog/hooks$ grep -v '^#' post-commit   wc -l
20

It takes care of updating the repository in /var/local/blosxom, and then fixes the timestamps on those files based on the timestamp of the original commit in the subversion repository. It's an ugly amalgam of svnlook date, svnlook history, touch and things, but it works. Sortof. Except if I remove a file, or if the svnlook history thing doesn't find the file itself. Finally, it will call blosxom itself, in the mode in which it creates files on disk rather than trying to do CGI output.
• In blosxom, then, I added two extra flavours: one I call myrss, and another I call php. The myrss flavour is used because I don't like blosxom's default RSS output; it doesn't do anything strange. The php flavour is what you see when you go to my blog on my website: it helps me integrate the blog in the rest of the "design" (ahem) of my website, allows me to add google ads in between my blog posts, and, finally, to hook in my home-brewn comment system (which uses postgres to store comments).

Apparently, however, subversion thinks differently about UTF-8 filenames if you do a checkout from a repository when using a http:// or a file:// URL. As a result, there were some issues in the post-commit subversion hook that I wrote, resulting in the svn up part of the post-commit not entirely succeeding. Or some such. Then, the touch is done, and the svn up doesn't work at all, anymore. In short, things started to break horribly, resulting in empty posts (because the files were created by touch rather than svn up), the comment thing being confused about filenames (and, as a result, postgres complaining about incorrect UTF-8 encodings), and similar other ugliness. So, I just renamed the file, and did a cleanup of the subversion checkout in /var/local/blosxom. I'll just have to cope with the fact that my setup doesn't like unicode, I guess. Or, perhaps, finally switch to ikiwiki some day, which I've been thinking about ever since Joey first blogged about it a few years ago. But that's not urgent...

 158 Ns+ Jun 04 Debian Bug Trac ( 13K) Bug#250202 closed by Russ Allbery 

That only took, eh, four years. The report started out as a "I'm sick of all these confusing and different ways to package a package, we need a solution", suggesting a few extra targets to debian/rules, but then quickly changed into a proposal to add a README.source file to the debian/ directory. At some point, early on, I started to prefer the README.source solution way more than the extra debian/rules targets thing, but the proposal reached a stalemate as some people did prefer the extra targets thing. A solution was only reached when Russ Allbery wrote a compromise proposal that managed to satisfy everyone, which he first sent out about half a year ago. Now, finally, the update is in. Which makes me really, really happy.

Joey, I think your whole post only applies to HAL. Fact is, DBus lets you know through a dedicated signal that you’ve been disconnected from the DBus server; at that point, you cleanup the connection and try to reconnect. Works for me. Now, the fact that HAL (and/or libhal, it seems) provides no way of handling this situation cleanly is obviously a major bug. I’m not a great fan of all the desktop crap that’s being promoted and hyped lately, but I am positive about DBus. DBus provides the mechanisms to handle a DBus restart properly, HAL (and pretty much everything else) doesn’t use them, blame HAL, not DBus, for this one. As for the “DBus should never be restarted”… I have no idea why the DBus upstreams would think that, but that also wouldn’t be the first time distributions disagree with upstreams about what is good and what isn’t. The good news is, this is all free software and we can fix it without upstream’s blessing. If somebody out there really believes that it is OK for applications to crash/exit when DBus is restarted, then I don’t have the words. I won’t even mention the new behaviour of the DBus init script in Sid.

Julien, dbus and hal make handling server reconnection correctly Hard, or impossible, in my limited experience. This information is what I can remember based on git logs from when I beat my brains against this particular wall for a few days. You'd think you could check for an exception after calling libhal_device_get*. Maybe org.freedesktop.dbus.error.disconnected. But this doesn't work if dbus is down. Instead the function, IIRC, crashes. So instead, it seems you have to check dbus_connection_get_is_connected before every attempt to use hal, and reconnect if it's down. But this means you've introduced a race condition. Also, once you notice the connection is down, it'd make sense to tell hal to close the connection to dbus. Except, if dbus is down, hal crashes instead, IIRC. So there's no way to close an old hal connection in this case; the best thing to do seems to be to leave it open, and open a new one. So now your program is not just racey, but it's leaking. The dbus people claim dbus is never supposed to be restarted. Ever. In other words: dbus/hal is badly designed crap. Do not use.

So apparently we hit $138/barrel on oil futures on Friday. Reading a CBC Post on the subject I think there are a couple interesting quotes:

Matt Simmons, chairman of an energy financing company in Houston, believes oil prices are still too low. He told CBC News there are "very strong signs" that the global supply of crude oil has leveled out and is probably now in a gentle decline.

Simmons said he finds it interesting that so many people blame speculators and a weak U.S. dollar for rising prices. "These same lame excuses have been going on for the last nine years, since [the price of oil] has gone up 13-fold," he said

I commented earlier that I'm looking forward to $10/litre (The CBC article shows petrol in Montr al at $1.40). A number of commenters brought up economic accessibility - which is a real concern. So, dear lazyweb: I remember seeing once that there were orgs doing carbon offsets by going into low-income areas and doing volunteer work on houses to fix up insulation, replace aging furnaces and major appliances. I haven't been able to find a reference to it again, though. Given that $10/litre seems inevitable (Heya Brits! Any of you still driving cars at ~ 1.15 according to the Daily Mail), what do we do to prepare for it? We got Angie's bike up and running yesterday, and she went to her day's visits that way. I'm finally cleared to ride a bike, but am not yet up to tackling Rengstorff. I'm practicing by biking around the campus at work and getting used to the changes in my body. The biggest disappointment in going back to Vancouver is just the apathy about smog and fuel consumption there. We saw a total of 2 Prius' (Prii?) on the road across the entire 12 days versus a half-dozen Hummers. I remember in the early 90's being downtown and everyone being shocked when there was a bit of brown haze in the air around the Sears Tower (Sorry, I can never remember WTH it's called now). Now the city is not only permanently like that, but people just expect it to get worse without any real feeling that they could do anything about it. I find myself starting to think again about hacking and what differences I can make. It's unexpected but logical that efficiency results in greater consumption: You can afford to do more, and have time to do more. Is the trick, then, to develop something efficient that takes up time? (Should I work on a text adventure?) Or perhaps the answer is to get away from computers for entertainment. Jim Morrison (Phython) and I have been talking about taking up bagpipes as a fun pre-work activity in the field by the office. But now he's moved to the San Francisco office. Anyone else at in Mountain View interested? =)

finally I managed to book my flight to DebConf8.

2008-08-03 IB3537
7:45 / Munich, Franz Josef Strauss, Terminal 1
10:25 / Madrid, Barajas, Terminal 4



2008-08-03 IB6845
12:25 / Madrid, Barajas, Terminal 4S
19:40 / Buenos Aires, Pistarini, Terminal A



2008-08-25 IB6844
21:45 / Buenos Aires, Pistarini, Terminal A
14:30 day +1 / Madrid, Barajas, Terminal 4S



2008-08-26 IB3564
16:30 / Madrid, Barajas, Terminal 4
18:55 / Munich, Franz Josef Strauss, Terminal 1

& I'm still surprised how frequently the prices for the same flights change ...

Regular readers of this blog (ed: oxymoron alert) may recall tales of woe with our beloved (ha!) cable internet provider such as this; then there are of course minor tales like this or this or this or the other stories on on this page but I am probably forgetting others. Anyway, yesterday's highlight was initiated with a mail, seemingly sent to all customers, informing me that

ACTION REQUIRED: Comcast has determined that your computer(s) have been used to send unsolicited email ("spam"), which is generally an indicator of a virus. For your own protection and that of other Comcast customers, we have taken steps to prevent further transmission of spam from your computer(s).

and the email went on to recommend some Windows anti-spam measures, including a reference to a page I could only open with IE at work and one URL to a page that doesn't exist. Nice. Not. Needless to say, there are now Windows computers sending mail (via Comcast) here (as the lone windows box, my wife's work laptop goes straight to her university webmail). And obviously, they blocked port 25, so no more mail sending from home. So I grumpily logged a compaint having been on hold and in telephony menu hell for fifteen or twenty minutes. I was promised to hear back in 72 hours. Hasn't happened yet, naturally, but we're only half way through... Anyway, to make a long story short and this post constructive: Here is what you do on a Debian or Ubuntu system running exim as your mail transport:

• sudo editor /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp_smarthost and add a line port = submission in the remote_smtp_smarthost block (assumming you have the split configuration chosen for the exim4-config package). Setting port to 'submission' switches from plain old STMP to the authenticated version running on port 587; submission is mapped to 587 in /etc/services.
• sudo editor /etc/exim4/passwd.client and add your user and password id as e.g. for comcast web-login
• sudo update-exim4.conf to update the configuration
• sudo /etc/init.d/exim4 restart to restart exim

And it may pay to check /var/log/exim4/mainlog for any irregularities. Barring those, you should now be sending mail to you smarthost using authenticated transfer over port 587. In the meantime, it looks like they unblocked port 25 at some point today...

In May 2002 I had an idea for securing access to GNUPG [1]. What I did was to write SE Linux policy to only permit the gpg program to access the secret key (and other files in ~/.gnupg). This meant that the most trivial ways of stealing the secret key would be prevented. However an attacker could still use gpg to encrypt it’s secret key and write the data to some place that is accessible, for example the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg“. So what we needed was for gpg to either refuse to encrypt such files, or to spawn a child process for accessing such files (which could be granted different access to the filesystem). I filed the Debian bug report 146345 [2] requesting this feature. In March upstream added this feature, the Debian package is currently not built with --enable-selinux-support so this feature isn’t enabled yet, but hopefully it will be soon. Incidentally the feature as currently implemented is not really SE Linux specific, it seems to me that there are many potential situations where it could be useful without SE Linux. For example if you were using one of the path-name based MAC systems (which I dislike - see what my friend Joshua Brindle wrote about them for an explanation [3]) then you could gain some benefits from this. A situation where there is even smaller potential for benefit is in the case of an automated system which runs gpg which could allow an attacker to pass bogus commands to it. When exploiting a shell script it might be easier to specify the wrong file to encrypt than to perform more sophisticated attacks. When the feature in question is enabled the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg” will abort with the following error:
gpg: can’t open /root/.gnupg/secring.gpg’: Operation not permitted
gpg: symmetric encryption of /root/.gnupg/secring.gpg’ failed: file open error Of course the command “gpg --export-secret-keys” will abort with the following error:
gpg: exporting secret keys not allowed
gpg: WARNING: nothing exported Now we need to determine the correct way of exporting secret keys and modifying the GPG configuration. It might be best to allow exporting the secret keys when not running SE Linux (or other supported MAC systems), or when running in permissive mode (as in those situations merely copying the files will work). Although we could have an option in gpg.conf for this for the case where we want to prevent shell-script quoting hacks. For editing the gpg.conf file and exporting the secret keys we could have a program similar in concept to crontab(1) which has PAM support to determine when it should perform it’s actions. Also it seems to me that crontab(1) could do with PAM support (I’ve filed Debian bug report 484743 [4] requesting this). Finally one thing that should be noted is that the targeted policy for SE Linux does not restrict GPG (which runs in the unconfined_t domain). Thus most people who use SE Linux at the moment aren’t getting any benefits from such things. This will change eventually.

• [1] http://www.gnupg.org/


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=146345


• [3] http://securityblog.org/brindle/2006/04/19/security-anti-pattern-path-based-access-control/


• [4] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484743

Share This

I think that for the first time, when I go to vote this November, I will probably not have to hold my nose as I make a selection for president. I don't agree with Obama on everything, of course, but the core of what he stands for -- that it is time to enter a post-racial, post-partisan time -- and that putting the interests of the people before those of the corporation -- is a powerful message.

And I'm not the only one that thinks so. One interesting read is Why This 55-Year-Old White Lifelong Republican Wants Obama To Win by Frank Schaeffer. He's a pro-life, pro-military Republican that actually campaigned for McCain in 2000, and this year he's supporting Obama. He pointed out another key point: Obama does not play on our fears.

Then there's A Transformational Moment by Jim Wallis, who grew up in a time when white people that supported civil rights were literally putting their lives on the line. He ends with:

This morning I heard several interviews on NPR with black Americans about their response to Obama's nomination. One older woman said, "A black man running for president, did you hear what just I said? A black man running for president of the United States ...." She just kept repeating the words, and succinctly captured my own personal feelings.

Yes, it is truly historic, and the U.K. newspaper headlines captured that sentiment as did papers around the world. Nothing could change the image of America around the world more than this. But it is more than historic; it is very personal for many of my generation. A new generation just sees this as natural -- he's an inspirational leader who happens to be black, which matters little to them. But for my generation -- I'm dating myself now -- this is a transformational moment, one we didn't think would come in our lifetimes. Race was the issue that changed us, shaped us, determined our path, and even defined the meaning of our faith. Now a black man is running for president of the United States. Amazing grace.

Tom Hayden reflects on the similarities between Obama and RFK, another interesting read. He concludes with:

Those who denounce Obama -- and the possibilities of all electoral politics- - should ponder the effectiveness of sitting judgmentally on the sidelines while an Unexpected Future arrives through the sheer will of a new generation. They should consider whether politics and history can be reduced to a fixed determinism that is endlessly repeated, as if there are no surprises. We can have our differences with Obama's specific policies, as I certainly do, but those should be measured against the prospect that a movement might transform him even as his very rise continues to transform the rest of us.

And now for something less inspiring. If you go look over at the latest blog entry at hillaryclinton.com and read the comments, these readers frankly sound more than a little loony. There are rampant accusations that Obama "stole the election" with the help of the DNC. That makes no sense to me; he followed the rules, and the DNC gave Clinton more delegates than she should have had with the rules as they were at the start of the game (which she supported then). The Obama campaign even rejected a plan that was less favorable to Clinton at the DNC rules committee meeting on Saturday. They also go on and on about how Obama has had so many scandals (though the Clinton real estate scandals really are far more serious than a former pastor). It all looks so very petty, and I wonder why Clinton has whipped up her supporters to such a fervent extent. Perhaps it was an accident, but you'd think things like this are rarely an accident with her.

I think I should follow up on Victor's lament. Yes, we have a Rails application which works fine most of the time... But quite often, throws out a segmentation fault I just have been unable to pin-point. It might be related to rmagick, the only non-pure-Ruby component I am using (and I'm tempted to try minimagick instead, even if I prefer in-memory operations than on-disk, piping an image and slurping it again).
Victor came up with an easy script to check the server - but to reduce the impact it has (I was running a single Mongrel instance, which meant, whenever it dies the whole system becomes inaccessible for everybody; I replaced it with a mongrel_cluster of five processes, plus pound as a easy-to-use balancer which looks quite nice), the very simplistic and to-the-point script did no longer work.
Anyway... Ruby rocks ;-) I'm sharing this with you mostly because I am sure some readers will find more than one useful construct, not because it is precisely beautiful code. And besides, we should work on fixing the cause, not the consequence, of the bug! :)

Works out of the box for any Debian-packaged mongrel-cluster. Sadly, mongrel-cluster does not provide a way to restart individual servers - Of course, I could (should, even) work it out to build the specific command-line... but at least, it works for now.
Uh-oh... Does that mean it's permanent?

This is the second installment of my article about the Serial Console Server for the Poor. First installment here. The last part of the article having covered the hardware and the udev part creating the device nodes, this part addresses the part of the software that connects the user to the device node. The idea of the software side is to allow users access only to certain serial ports without giving out a shell account on the server itself. Communication between user and the console server should be encrypted (which certainly means ssh), and users should be able to authenticate both with a key and with a password. Serial parameters (baud rate, parity, stop bits etc) should be configured on the console server to keep this possible error source away from the users. For years, I have been thinking about using UUCP’s cu to access the serial port. This time, it’s not going to be used because it offers a shell escape which cannot be turned off. That would give a user shell to the users indirectly, which is not what I want. Minicom seems still to be the most-used application to access a serial port. I have never understood the sense of using a terminal emulator inside a terminal emulator, especially if one has to break the terminal emulator’s habit of trying to initialize a non-existent modem. So I settled on the application that I usually use to access a serial port: ser2net. This is a Linux implementation of Cisco’s “reverse telnet” feature which “connects” a TCP port to a serial port with a given set of parameters. For example,

4016:telnet:600:/dev/USBserial6:38400 8DATABITS NONE 1STOPBIT banner

connects TCP port 4016 with /dev/USBserial6 with an 38400 8n1 parameter set. If you telnet to localhost 4016, you’ll find yourself talking to the device connected to the appropriate serial port. This moves the security risk to the telnet client, which - unfortunately - offers a shell escape function from the telnet command line reachable with the escape character. The only way to remove this is to use the -E command line option, which turns off the escape function completely. This unfortunately excludes the user from cleanly quitting the telnet session, so the only way to get out of a telnet -E is to have the remote side close the serial port (which ain’t happening on a serial console) or to kill the telnet process, for example by closing the carrying ssh session. That’s a turn-off, but one that one can live with. Now, the only challenge left is to have the appropriate telnet client started automatically for the user. I decided on connecting this to the account being connected to, so that ssh USBserial4@hostname will automatically do the right thing. Since password authentication needs to work (optionally), this precludes the use of the command modifier in an authorized_keys file. Another possibility to force a command being executed on login is to set it as the users’ login shell in /etc/passwd. One drawback: The command must not have any parameters, so one needs to pass needed parameters to the program some other way. Additionally, the program must be listed in /etc/shells or it will be silently ignored. My /etc/passwd entries look like

USBserial2:x:1002:1002:USBserial2,,,:/home/USBserial2:/usr/local/sbin/serialconnect-shell

with /usr/local/sbin/serialconnect-shell looking like

#!/bin/bash
set -eu
case “$(id --user --name)” in
  USBserial1) PORT=“2011”;; 
  USBserial2) PORT=“2012”;;
  USBserial3) PORT=“6013”;;
  USBserial4) PORT=“6014”;;
  USBserial5) PORT=“2015”;;
  USBserial6) PORT=“2016”;;
  USBserial7) PORT=“6017”;;
  *) echo “called from unknown account, terminating.”; exit 1;;
esac
telnet -E localhost $PORT

Just for reference, here are the appropriate entries in /etc/ser2net.conf:

2011:telnet:600:/dev/USBserial1:9600 8DATABITS NONE 1STOPBIT banner
2012:telnet:600:/dev/USBserial2:9600 8DATABITS NONE 1STOPBIT banner
6013:telnet:600:/dev/USBserial3:115200 8DATABITS NONE 1STOPBIT banner
6014:telnet:600:/dev/USBserial4:115200 8DATABITS NONE 1STOPBIT banner
2015:telnet:600:/dev/USBserial5:9600 8DATABITS NONE 1STOPBIT banner
2016:telnet:600:/dev/USBserial6:9600 8DATABITS NONE 1STOPBIT banner
6017:telnet:600:/dev/USBserial7:115200 8DATABITS NONE 1STOPBIT banner

If one wants to authenticate for a given serial port with an ssh key, all you need to do is put the appropriate key into the authorized_keys file of the appropriate account, and you’re all set. I do sincerely hope that I didn’t put any blatant security goofs into this setup, but if I did, you’ll tell me in the comments, right? Just one more challenge for my valued readers: The port numbers in my ser2net.conf have a system. Can you explain it to me?

Finally, Galician is 8^th in the po-debconf translation ranking. What makes it special is that I have finally overtaken Spanish, so Galician is the highest-ranking language from Spain in that list :) Also, I am now less than 200 strings away from Russian. That had not happened for a very long time… ;)

Today is World Environment Day 2008 and also Recycle Week in the UK. Locally, our poor recycling record has attracted attention. The main Somerset CC area averages 50% recycling and composting, while North Somerset only does 36%. This will cost us money, as explained under the subtly-titled local newspaper article 'REDUCE WASTE NOW OR FACE A 12M FINE' It's very annoying to read a Conservative councillor say

"The message we really have to get out to people is that this is their problem too."

We know it's a bloody problem. Have you tried to use your stupid recycling system? Criticism of the stupid collections is strangely absent from the local Lib-Dem's Mid table place shouldn't be good enough when it comes to recycling (Mike Bell) and I can't even find recycling mentioned on local Labour sites - I think those two groups may have been in coalition when the stupid system was introduced. It's left to local residents to explain the problem. Local waste collections have been simplified recently but it still seems bloody awkward, taking different types of waste to different places. The most recent edition of the council's North Somerset Life magazine explained that they don't collect plastic bottles from the doorstep because it would add 10 per year to our local tax. I'm damn sure it already costs me more than that to store them and ferry them into town over a year. The only people rewarded by saving that 10 seem to be those who live near the town centre collection point, drive to that Tesco anyway, or don't recycle plastics. Why reward them? Speaking of Tesco... those national and local favourites have applied to build Two more Tesco stores for Weston [The Weston Mercury] including one directly opposite another supermarket. The application number is 08/P/1230/F if you want to respond. The planning system seems my main chance to protect my local environment at the moment. Next Monday evening at 7.30pm, 08/P/1070/F - Erection of 5 storey building to provide 14 flats, restaurant and office with basement parking following demolition of restaurant will be considered by a Kewstoke village council planning meeting in the village hall. As I understand it, the public may make statements at the start of the meeting and 2 Kewstoke Road is currently the Castle.

Sound Juicer "Harder Now With Higher Speed" 2.23.0 has finally been released.. Tarballs are available on burtonini.com, or from the GNOME FTP servers. Hot new features!

• Port to GIO (Michael Terry)
• Update URL handling for New GIO World Order (Bastien Nocera)
• Fix display problems with the cluebar (Pekka Vuorela)
• Add audio preview when overwriting (Luca Cavalli)
• Use GtkVolmeButton instead of BaconVolume (MT)
• Fix crash when no profile is selected (Matthew Martin)
• Add []
• to the special character list (MM)
• Make the year and disc entries a11y (Patrick Wade)
• Fix error handling in CD playback (Tim-Philipp M ller)
• Require intltool 0.40

I really need some heavy testing on the GIO rewrite, so please try and extract tracks to as many different targets as possible. Although I expect confirmation that using an unmounted remote location currently fails, it should be possible to use this to write to Samba, OBEX-FTP, and so on.

In the office, Christian has just unwrapped a very carefully packed box containing a bulging tin of Surstr mming. Apparently due to the “unique” smell you have to open it outside, and he’s invited people to come to his house to try it. Now, I’m not keen on various types of fish even at the best of times, so add a year or so of fermentation, and I am very, very scared. In unrelated news, some people in the office have decided to take up vegetarianism.

In Debian the BIND server will by default append statistics to the file /var/cache/bind/named.stats when the command rndc stats (which seems to be undocumented) is run. The default for RHEL4 seems to be /var/named/chroot/var/named/data/named_stats.txt. The output will include the time-stamp of the log in the number of seconds since 1970-01-01 00:00:00 UTC (see my previous post explaining how to convert this to a regular date format [1]). By default this only logs a summary for all zones, which is not particularly useful if you have multiple zones. If you edit the BIND configuration and put zone-statistics 1; in the options section then it will log separate statistics for each zone. Unfortunately if you add this and apply the change via rndc reload I don’t know of any convenient way that you can determine when this change was made and therefore the period of time for which the per-zone statistics were kept. So after applying this to my servers I restarted the named processes so that it will be obvious from the process start time when the statistics started. The reason I became interested in this is when a member of a mailing list that I subscribe to was considering the DNSMadeEasy.com service. That company runs primary DNS servers for $US15 per annum which allows 1,000,000 queries per month, 3 zones, and 120 records (for either a primary or a secondary server). Based on three hours of statistics it seems like my zone coker.com.au is going to get about 360,000 queries a month (between both the primary and the secondary server). So the $15 a year package could accommodate 3 such zones for either primary or secondary (they each got about half the traffic). I’m not considering outsourcing my DNS, but it is interesting to consider how the various offers add up. Another possibility for people who are considering DNS outsourcing is Xname.org which provides free DNS (primary and secondary) but request contributions from business customers (or anyone else). Updated because I first published it without getting stats from my secondary server.

• [1] http://etbe.coker.com.au/2008/06/05/date-1970-01-01/

Share This

So I've been playing with Mnemosyne recently, using it to help brush up on my woeful Latin vocabulary. I thought it would be a good idea to get some of that data out of my head an into Ubuntu (which has a Latin translation). Imagine my surpise when, after installing the latin language pack (through the gui), I could not log into Ubuntu in Latin?! It turns out that there is no Latin locale in Ubuntu, or indeed in glibc. This is kind of strange (there is an esperanto locale). Remember that locales combine language and location - they describe how to format money, numbers, telephone details and so on. So clearly, I needed to add a latin locale. I could add one for just me (e.g. la_AU), or I could add a generic one (helpfully using AU values) on the betting chance that at this point there are not enough folk wishing to log in in latin (after all you can't!) for us to need one per country. And even more so, doing la_AU doesn't make a lot of sense - there isn't a pt_AU locale even though there are portuguese speakers living in Australia. (The root issue here is that location and language are conflated. POSIX I hate thee). So, a quick crash course in locales, some copy and paste later, and there is a Latin locale. Installing that on my system got me a latin locale, but gdm still wouldn't let me select it. It turns out that gdm feels the urge to maintain its own list of what locales exist, and what to call them. I thought duplication in software was a bad idea, but perhaps I don't understand the problem space enough. Anyhow, time to fix it. And because this is something other people may be interested in, and the patches are not yet in Ubuntu because upstream glibc may choose a different locale code (e.g. la_AU), I've finally had reason to activate my ppa on launchpad, so there are now binary packages for hardy for anyone that wants to play with this!