I've long had the sneaking suspicion that, from the "free software" point of view, the most "threatening" proprietary software systems were not the most tightly locked down ones, where it's difficult to do anything without paying a fortune and control is absolute, but rather those that coopt as much as they can from the open source world. You get source code, you get an open and hackable system, you get to talk with the people who wrote the code, who will tell you all about it if you want to know. You can recompile it for different platforms, or tweak it how you want. You get to talk with other users of it, and maybe even share hacks and additions you've created. Just that you still may have to pay for it, and you don't get the rights to redistribute as you see fit. Gianugo Rabellino, CEO of SourceSense, speaks very well of Atlassian and what they're doing with systems like JIRA, which is a very open commercial offering: http://boldlyopen.com/2008/09/11/sustainable-software-look-down-under/ With the challenge "Can your Open Source vendor do this?". I don't think he's far off the mark; the fundamental problem with open source businesses is finding a way to introduce scarcity, as I've talked about before: http://journal.dedasys.com/articles/2007/02/03/in-thrall-to-scarcity That's not to say it's not possible (it is, obviously), or that open source doesn't work (it has, beyond my wildest dreams), just that we still haven't figured out the part that connects developers with money. One of the most successful (in terms of making Linux user friendly) companies to date is basically running on the "find a guy who already made a bundle elsewhere and is a good patron" model.

People frequently ask me what I am doing typing on my Palm right before logging in one of my remote systems. The answer is quite simple: generating my next password . People always seem puzzled by that answer Maybe I am just too old to have had only telnet sessions available to remote connections (that was the time before SSH took over)... or maybe I am just too paranoid regarding the access to my systems Anyway, I like One Time Passwords, and here is an article I can refer to when I get asked again ;-) One Time Passwords are just that: passwords that are good for one time use. They never repeat and once used you can throw it away securely. They were quite common when the authentication was done in clear text (so that any man-in-the-middle could steal your passwords), back in the r-tools age (rcp, rsh, rlogin, rexec, etc). After the SSH-related tools took over, providing easy tunneling and remote access, MITM attacks were of much concern, so OTPs became less relevant. What a shame, for they even have a couple of standards for those! But there s still room for OTPs Question: Is it easier to deploy a MITM attack or a keylogger? That s right We are always connecting to our remote systems in public terminals (well at least I am right now typing from the hospital computer), and a keylogger is so easily installed in one of those terminals, even remotely, that no one would ever get close to deploy a refined MITM attack just to steal someone s password. One would just install a keylogger! All the security SSH provides would just be gone by then. That s why I use SSH to connect to my remote machines, but use OTPs to authenticate myself. It s so easy to deploy it. In Debian you ll find packages opie-server and libpam-opie and those are the only things you ll need on the server side (besides SSH, obviously). OPIE means One-time Passwords In Everything , and combined with PAM, one can really use it everywhere. After installing it, you ll have to generate the password file for your account:

spectra@home:~$ opiepasswd -c
Adding spectra:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:
ID spectra OTP key is 499 ho6484
HAVE COOK LOLA AIRY NEIL ROAM

The pass phrase will be used to generate the passwords in a step before your login. Please, try not to forget it (specially if you re following this article and playing with some remote system at the same time). Now you can edit /etc/pam.d/ssh file (or its equivalent in non-Debian systems) to require that kind of authentication. Mine just looks like this:

# /etc/pam.d/ssh
auth       required     pam_env.so
auth       required     pam_env.so envfile=/etc/default/locale
auth       required     pam_opie.so

First two lines are unrelated and just load the environment variables. Last line is where the fun is. Please, note two things: (1) I removed references to pam_unix.so, which is what would ask for my real password, that I want to disable (no login is allowed with that password). And (2), I declared it as required, meaning that failing it will keep one out of the system. We are not ready yet! SSH will work by now, but will not present you the OTP challenge. Probably you could still login, but you d have to remember which is the current password (Trust me, you would not!). To get the challenge you ll need to enable it in /etc/ssh/sshd_config change the following line:

ChallengeResponseAuthentication yes

That s it. Now to login to your remote machine, that s what will usually happen:

spectra@hospital:~$ ssh home
otp-md5 498 ho6484 ext, Response:
spectra@home:~$

Voil ! It asks for password #498. By default, it starts with 500 passwords and goes down from that. Password #498 were asked, so the next will be #497. After that, #498 is not useable anymore, and #496 is not useable yet. You can generate a list of those passwords (let s say 10), print it and keep it in your pocket. This is the command you d use for that:

spectra@home:~$ opiekey -n 10 498 ho6484
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Sorry, but you don't seem to be on the console or a secure terminal.
Warning: Continuing could disclose your secret pass phrase to an attacker!
Enter secret pass phrase:
489: CALM INTO WEEK APS LOON VIE
490: HASH GYM RAID GOSH HOYT DUAL
491: BELL GIN RIFT HELM GUY BUNK
492: HEBE OBOE SUP LEG LULU LANG
493: HOYT JOT ASK JOG GIBE BETH
494: NASH MOOT HIND YEAH  YAP CARL
495: MATE OF BARD LAVA LEAK AHOY
496: TAB BAG KEY GILT AVID VEAL
497: MOLE FORM NIB LEER ROSS HAVE
498: SING WERE OVEN SOD VEIN NIBS

That is not so secure, since you can loose the paper and be doomed Luckily there are lots of small softwares that does this generation for you. Some you can use from your Palm or from some J2ME-enabled phone (such as N95). Some your can use from another (trusted) computer. Some are even online, written in javascript! There are at least one other side-benefit of using OPIE as above: You can give away your user password (even root password OK, probably not a Good Thing^TM), that the system would still be secure, since it only allows SSH authentications via OPIE! If the session is started with a username whose opiepasswd was not activated (first step scroll back to the beginning of the article), SSH will greet you with a bogus challenge only opie-activated users will be allowed to login with the above configuration. Easy enough, isn t it? Now, next time you see me typing on my Palm before opening an SSH connection you ll know what I am doing ;-)

Some people think that you can recognise a good restaurant by the presence of obscure dishes on the menu or having high prices. The reality is that there are two ways of quickly identifying a good restaurant, one is the Michelin Guide [1] (or a comparable guide - if such a thing exists), the other is how quiet the restaurant is. By a quiet restaurant I certainly don’t mean a restaurant with no customers (which may become very noisy once customers arrive). I mean a restaurant which when full will still be reasonably quiet. Making a restaurant quiet is not in itself a sufficient criteria to be a good restaurant - but it’s something that is usually done after the other criteria (such as hiring good staff and preparing a good menu) are met. The first thing to do to make a room quiet is to have good carpet. Floor boards are easy to clean and the ratio of investment to lifetime is very good (particularly for hard wood), but they reflect sound and the movement of chairs and feet makes noise. A thick carpet with a good underlay is necessary to absorb sound. Booths are also good for containing sound if the walls extend above head height. Decorations on the walls such as curtains and thick wallpaper also absorb sound. A quiet environment allows people to talk at a normal volume which improves the dining experience. It seems to me that the same benefits apply to server rooms and offices, with the benefit being more efficient work. I found it exciting when I first had my desk in a server room (surrounded by tens of millions of pounds worth of computer gear). But as I got older I found it less interesting to work in that type of environment just as I found it less interesting to have dinner in a noisy bar - and for the same reasons. For a server room there is no escaping the fact that it will be noisy. But if the noise can be minimised then it will allow better communication between the people who are there and less distraction which should result in higher quality of work - which matters if you want good uptime! One thing I have observed is that physically larger servers tend to make less noise per volume and per compute power. For example a 2RU server with four CPUs seems to always make less noise than two 1RU servers that each have two CPUs. I believe that this is because a fan with a larger diameter can operate at a lower rotational speed which results in less bearing noise and the larger fans also give less turbulence. While it’s obvious that using fewer servers via virtualisation has the potential to avoid noise (both directly through fans and disks and indirectly through the cooling system for the server room [2]). A less obvious way of reducing noise is to swap two 1RU servers for one 2RU server - although my experience is that for machines in a similar price band, a 2RU server often has comparable compute power (in terms of RAM and disk capacity) to three or four 1RU servers. To reduce noise both directly and indirectly it is a requirement to increase disk IO capacity (in terms of the number of random IOs per second) without increasing the number of spindles (disks). I just read an interesting Sun blog covering some concepts related to using Solid State Disks (SSDs) on ZFS for best performance [3]. It seems that using such techniques is one way of significantly increasing the IO capacity per server (and thus allowing more virtual servers on one physical machine) - it’s a pity that we currently don’t have access to ZFS or a similar filesystem for Linux servers (ZFS has license issues and the GPL alternatives are all in a beta state AFAIK). Another possibility that seems to have some potential is the use of NetApp Filers [4] for the main storage of virtual machines. A NetApp Filer gives a better ratio of IO requests per second to the number of spindles used than most storage array products due to the way they use NVRAM caching and their advanced filesystem features (which also incidentally gives some good options for backups and for detecting and correcting errors). So a set of 2RU servers that have the maximum amount of RAM installed and which use a NetApp Filer (or two if you want redundancy) for the storage with the greatest performance requirements should give the greatest density of virtual machines. Blade servers also have potential to reduce noise in the server room. The most significant way that they do this is by reducing the number of power supplies, instead of having one PSU per server (or two if you want redundancy) you might have three or five PSUs for a blade enclosure that has 8 or more blades. HP blade enclosures support shutting down some PSUs when the blades are idling and don’t need much power (I don’t know whether blade enclosures from other vendors do this - I expect that some do). A bigger problem however is the noise in offices where people work. It seems that the major responsible for this is the cheap cubicles that are used in most offices (and almost all computer companies). More expensive cubicles that are at almost head-height (for someone who is standing) and which have a cloth surface absorb sound better significantly improve the office environment, and separate offices are better still. One thing I would like to see is more use of shared desktop computers, it’s not difficult to set up a desktop machine with multiple video cards, so with appropriate software support (which is really difficult) you could have one desktop machine for two, or even four users which would save electricity and reduce noise. Better quality carpet on the floors would also be a good thing. While office carpet wears out fast adding some underlay would not increase the long-term cost (it can remain as the top layer gets replaced). Better windows in offices are necessary to provide a quiet working environment. The use of double-glazed windows with reflective plastic film significantly decreases the amount of heating and cooling that is required in the office. This would permit a lower speed of air flow for heating and cooling which means less noise. Also an office in a central city area will have a noise problem outside the building, again double (or even triple) glazed windows help a lot. Some people seem to believe that an operations room should have no obstacles (one ops room where I once worked had all desks facing a set of large screens that displayed network statistics and the desks were like school desks with no dividers), I think that even for an ops room there should be some effort made to reduce the ambient noise. If the room is generally reasonably quiet then it should be easy to shout the news of an outage so that everyone can hear it. Let’s assume for the sake of discussion that a quieter working environment can increase productivity by 5% (I think this is a conservative assumption). For an office full of skilled people who are doing computer work the average salary may be about $70,000, and it’s widely regarded that to factor in the management costs etc you should double the salary - so the average cost of an employee would be about $140,000. If there are 50 people in the office then the work of those employees has a cost of $7,000,000 per annum. A 5% increase in that would be worth $350,000 per annum - you could buy a lot of windows for that!

• [1] http://www.michelinguide.com/


• [2] http://etbe.coker.com.au/2008/09/10/efficiency-of-cooling-servers/


• [3] http://blogs.sun.com/studler/entry/why_you_should_avoid_placing


• [4] http://en.wikipedia.org/wiki/Netapp

Share This

Undoable apt-get build-dep If I do apt-get build-dep foobar, all the dependencies will be installed, but they will not be marked as autoinstalled: if I then do not need to build the package anymore, I have a hard time finding out what to remove. What I would like is a script that turns build dependencies of a package into a metapackage, so that I can later remove the metapackage and apt-get autoclean will remove everything from the system. It turns out that it already exists: it's called mk-build-deps and is part of devscripts:

# apt-get install equivs
$ mk-build-deps lxlauncher

That will give you lxlauncher-build-deps_0.2-2_all.deb. It also works on arbitrary control files. There is also a repository of such build-deps packages maintained by Frank Lichtenheld.

Init Seven, my favourite Swiss ISP, has offered to collocate one of my machines in their racks with native IPv6-connectivity. I am now searching for a name for this new host. A recent discussion has made me curious about how many people can deduce my host naming theme from the set of names of currently operational machines under the madduck.net domain:

albatross, bell, brick, cigar, cirrus, clegg, diamond, echo, embryo, eugene, fishbowl, gerald, gnome, lapse, lust, mother, pict, pig, piper, pulse, seamus, sheep, time, vera, wall.

If you know what ties this list together, please help me christen the new machine! Update: the responses have been overwhelming, 183 people have written in so far, and 149 of them knew what s going on (though some admitted to cheating with a search engine). Thanks to everyone! In addition to the common theme, which most guessed correctly, I have a few other restrictions, mainly that the words have to be singular names or nouns, and that they have to feel right . Here are the suggestions I ve received which passed my filters, in decreasing order of frequency:

emily, lucifer, fletcher, lunatic, arnold, flesh, gig, bike, moon, brain, hand, balloon, hope, alan, marmelade, wing, heart, summer, thunder, sam, tropez, sky, stethoscope, khyber, lotus, jugband, cymbaline, remergence, dawn, hell, desert, worm, eclipse, dog, sysyphus, julia, scarecrow, sun, overdrive, vizier, matilda, eiderdown, babe, pillow, funkydung, atom, fore, shout, breast, domine, swan, charade, grantchester, money.

Curiously, I forgot about worm and wing, which are in use, so those are out. Some of them are not candidates because I d mistype them all the time ( stethoscope , cymbaline , sysyphus , remergence , scarecrow , eiderdown , marmelade , grantchester ). Some just don t seem right ( tropez , shout , overdrive , flesh , breast , sky , jugband , eclipse , lucifer , money ) Some are not appropriate as hostname for computers ( brain , heart , damage , hell , lunatic , babe ). Those who suggested machine were referred to my SMTP servers greeting banner. I have to scratch fletcher and desert because of their source. I have to do the same to thunder , unfortunately. And I ought to retire pulse , although not really. Noone suggested grimble and crumble . As there are so many, and so many more, I am changing my rule to significant, enigmatic, and memorable singular nouns and names , which brings us down to:

arnold, gig, bike, moon, alan, khyber, lotus, julia, sun, vizier, matilda, atom, domine, swan, charade, grimble, crumble.

Given that list, I think I will be launching gig, khyber, lotus, charade, vizier, domine, and/or swan in the near future. Or if it s a pair, it ll be grimble and crumble. Thanks all, this was fun. PS: you may use the same naming scheme for your hosts, but you take full responsibility in case you and I ever have to fuse networks in any way. NP: Riverside: Out of Myself

I recently wasted a bit of time reading some right-wing blogs. One thing I noted was the repeated references to news reports about young women from an Islamic background being beaten (and in some cases killed) by their fathers (and other male relatives) for not conforming to some weird cultural ideas that some people associate with Islam. These are spun as examples of Islam being bad and therefore opposing immigration policies that allow Muslims into countries identified as “Christendom” or “The West” (never mind the fact that the vast majority of the population in “Christendom” don’t even attend church twice a year and the fact that Australia is directly south of China, Russia, and North Korea). It seems to me that when young people follow the cultural standards of the country where they live rather than the standards of the country that their parents came from then it’s evidence of “multiculturalism” working. When young Muslim women are beaten by their fathers whether it’s considered an example of Muslims being bad (and who therefore should be excluded) or an example of Muslims as victims who should be protected is a matter of interpretation. It’s not as if there is any shortage of domestic violence cases from any religious or cultural group. It’s often claimed that fundamentalist Muslims hate our culture, strangely the same people seem to claim that our culture will be destroyed by radical Islam. These two ideas seem to conflict, if our culture (the pro-science, free-speech, few inhibitions on clothing standards, do what you want but don’t hurt others culture that most readers of my blog enjoy) can be destroyed by radical Islam then they wouldn’t hate it. I think that the reason why fundamentalist religious people (Christians and Muslims) dislike our culture is because it is so strong. Our culture offers a way of life that is simply better than that which fundamentalist religious groups offer. Any religious person can choose to take a liberal approach to their religion (emphasising the positive aspects of giving to charity, being nice to others, etc) and enjoy our culture. Our culture is based around wide-spread communication, mass media, mobile phones, the Internet, custom clothing design, etc. It can do to religions what the sea does to rocks. It seems that the strongest efforts at attacking our culture come from Christian groups. For example the Exclusive Bretheren [1] runs a high school in my area, according to a local paper it distinguishes itself by having no students enter a university course! The Exclusive Bretheren (and some other radical Christian groups) have a deliberate policy of keeping children stupid with the idea that people who think may decide to change their religion. Some time ago I had a taxi driver start an unsolicited discussion of religion by telling me how much he hated Muslims. I pointed out the fact that there are Muslims of all races and asked why he thought that I was not a Muslim. After that the rest of the journey was very quiet. The mainstream media would have us believe that Muslims have some sort of monopoly on terrorism. Noam Chomsky’s paper “Terror and Just Response” [2] is one of many that he has written on this issue. I realise that many people don’t want to acknowledge the involvement of the US government (and it’s allies such as Australia) in international terrorism. But please read Noam’s position (which is compelling) or read his wikipedia page which lists his extensive accomplishments [3] (if it’s the background of an author that impresses you).

• [1] http://en.wikipedia.org/wiki/Exclusive_Bretheren


• [2] http://www.chomsky.info/articles/20020702.htm


• [3] http://en.wikipedia.org/wiki/Noam_chomsky

Share This

I have previously written about the execmod permission check in SE Linux [1] and in a post about SE Linux on the desktop I linked to some bug reports about it [2] (which probably won’t be fixed in Debian). One thing I didn’t mention is the proof of the implication of this. When running a program in the unconfined_t domain on a SE Linux system (the domain for login sessions on a default configuration), if you set the boolean allow_execmod then the following four tests from paxtest will be listed as vulnerable: Executable bss (mprotect)
Executable data (mprotect)
Executable shared library bss (mprotect)
Executable shared library data (mprotect) This means that if you have a single shared object which uses text relocations and therefore needs the execmod permission then the range of possible vectors for attack against bugs in the application has just increased by four. This doesn’t necessarily require that the library in question is actually being used either! If a program is linked against many shared objects that it might use, then even if it is not going to ever use the library in question it will still need execmod access to start and thus give extra possibilities to the attacker. For reference when comparing a Debian system that doesn’t run SE Linux (or has SE Linux in permissive mode) to a SE Linux system with execmod enabled the following tests fail (are reported as vulnerable): Executable anonymous mapping (mprotect)
Executable heap (mprotect)
Executable stack (mprotect)
Writable text segments If you set the booleans allow_execstack and allow_execheap then you lose those protections. But if you use the default settings of all three booleans then a program running in the unconfined_t domain will be protected against 8 different memory based attacks. Based on discussions with other programmers I get the impression that fixing all the execmod issues on i386 is not going to be possible. The desire for a 15% performance boost (the expected result of using an extra register) is greater than the desire for secure systems among the people who matter most (the developers). Of course we could solve some of these issues by using statically linked programs and have statically linked versions of the libraries in question which can use the extra register without any issues. This does of course mean that updates to the libraries (including security updates) will require rebuilding the statically linked applications in question - if a rebuild was missed then this could be reduce the security of the system. To totally resolve that issue we need to have i386 machines (the cause of the problem due to their lack of registers) go away. Fortunately in the mainstream server, desktop, and laptop markets that is already pretty much done. I’m still running a bunch of P3 servers (and I know many other people who have similar servers), but they are not used for tasks that involve running programs that are partially written in assembly code (mplayer etc). One problem is that there are still new machines being released with the i386 ISA as the only instruction set. For example the AMD Geode CPU [2] is used by the One Laptop Per Child (OLPC) project [3] and the new Intel Atom line of CPUs [4] apparently only supports the AMD64 ISA on the “desktop” models and the versions used in ultra-mobile PCs are i386 only. I think that these issues are particularly difficult in regard to the OLPC. It’s usually not difficult to run “yum upgrade” or “apt-get dist-upgrade” on an EeePC or similar ultra-mobile PC. But getting an OLPC machine upgraded in some of the remote places where they may be deployed might be more difficult. Past experience has shown that viruses and trojans can get to machines that are supposed to be on isolated networks, so it seems that malware can get access to machines that can not communicate with servers that contain security patches… One mitigating factor however is that the OLPC OS is based on Fedora, and Fedora seems to be taking the strongest efforts to improve security of any mainstream distribution, a choice between 15% performance and security seems to be a no-brainer for the Fedora developers.

• [1] http://etbe.coker.com.au/2007/02/10/execmod/


• [2] http://en.wikipedia.org/wiki/AMD_Geode


• [3] http://en.wikipedia.org/wiki/One_Laptop_per_Child


• [4] http://en.wikipedia.org/wiki/Intel_Atom

Share This

My primary e-mail domain deuxchevaux.org was offline for one and a half week due to my (former) domain provider Korypet went bankrupt and probably hadn’t paid the registrar’s invoice for deuxchevaux.org although I had paid Korypet’s invoice. (The domain wasn’t expired. Its expiration date was somewhen in 2009.) Korypet itself just told its customers (and told it only on request) that they a) will shut down their business because it doesn’t pay off and that b) their service won’t be as good as usual since their head is currently in hospital. I should have noticed that there is something fishy and some details were missing at lastest when they told customers (also only on request) that they have to shut down some services earlier than announced because one of their providers has terminated their agreement with Korypet at short notice. I also should have expected that they couldn’t keep their promise to continue domains and DNS until May 2009 as they couldn’t keep other promised grace periods. I’m quite sad about how Korypet went down and how bad blood they caused — not only for me — since they offered not only good services for money but also had really good (and personal) support. But I guess that this quality at very low prices was also one of the reasons why they couldn’t keep up their business for longer. I had one of their UML based, low-end virtual “VD” servers for about six years, and used it as secondary DNS server and IRC client host. I also often thought about getting a second one at some other geographical location (they offered virtual servers in three German cities). That was the reason why I started to move my domains to them a while ago. They even could fully answer me domain registration questions for which the eDNS and the Hetzner staff only had partial and therefore confusing answers. Since it was the easiest way, I tried to transfer the domains I had registered with Korypet to the B2C division of their registrar Key Systems, to DomainDiscount24. The web interface isn’t as bad as the name “DomainDiscount24” suggests, but they seem to have communication problems if – as in this case – more than one of their business divisions are involved. It took at least two phone calls until they did the all the necessary things to get the domains transferred from Korypet’s business customer account to my newly created end customer account although they have a special form for former Korypet customers. Domains I registered after Korypet stopped accepting new domains (well, they just didn’t answer on my domain registration requests anymore) I have registered via eDNS which was a recommendation form someone on the DaLUG mailing list. My conclusion after these hassles: No more domain registration resellers, only directly interacting with registrars. Never register all domains at the same company. Have more than two DNS servers at different hosters. Don’t have domain registrations and DNS servers at the same company. So I now register my domains either at DomainDiscount24 or at eDNS. And .ch domains of course directly at SWITCH. (If only all domain registrations would be so simple and uncomplicated as with SWITCH!) And my DNS servers are currently hosted at x encon in Hannover (Yes, it’s a Xen DomU :-) and Hetzner in Erlangen. And a third one in Switzerland is already planned.

I wonder what would have happened if Obama had put lipstick on a pitbull would there be any less of this circus put up by the Republican monkeys? Are we back in Kindergarten? Mom! Mom! He hit me! . Is the next thing we ll see tears on stage? Or some sort of fake emotional outbreak? Anything goes in America, I say Both, Obama and McCain have used the lipstick analogy in the past (see previously linked article, and this AP writeup), so why are the Republican monkeys trying to nail him on sexism? They are (trying to) play the gender card (thanks to Erinn Clark for the link). Sexism surely is a word to grab attention, especially in the Excited States of America. By shifting attention to sexism, the Republican monkeys are not only stealing Obama s show and dragging the short-attention-span media (and populace) away from any Palin-related scandals, they are also covering up that they don t have anything else to say. Finally, sexism is an emotional topic, unlike the other political and policy crap the entertainment-hungry television crowd has to put up with, so hooray for excitement! I am disgusted by this American election circus. And I wish we d get about as much coverage of American news in these times as international news gets airtime on American TV. Even though I hope Obama wins for no other reason than that he s not in the same political camp as George W. International Terrorist and War Criminal Bush, I couldn t really care less and don t have any reason to believe that things will improve when the Democrats move back into the White House. And neither do lobbyists care who s sitting at the top. Idiots exist on every level and all over the globe. The rich will still pull the strings. The capitalist avalanche (euphemistically called the strive for democracy ) doesn t slow down. Other countries political monkeys have tasted totalitarianism and lost their senses, and no US government will get them back on track. And the media, who controls it all anyway, is just cashing in on the whole spectacle, which is why I have to continue to be subjected to it. Which brings us back to the rich I wouldn t be surprised to find the likes of Haliburton in the financial support list of the Republican monkeys. PS: I know and respect many American citizens, and I know most of them think like me. Nevertheless, I feel it necessary to point out that none of the above is an attack on those of you with a clue. I feel sympathy at the same time as I feel the rage expressed in the above, but this rage is solely with the political monkeys, the media, and merciless capitalists. None of those are US-specific, it just happens that you seem to have the most pronounced combinations. NP: Mogwai: Come On Die Young

New testing version of Gammu was just born. It brings quite a lot of fixes -- I simply release it because changelog got too big :-). Full list of changes:

• Report more verbosely that some feature has been disabled on compile time.
• Add ID for Nokia 5200 (thanks to Andreas Metzler).
• Add two IDs for Nokia 2600 (bug #659).
• Add ID for lot's of Sony Ericsson phones.
• Use AT parser for AT+CPBS? reply.
• Use all possible ways to get memory status (bug #687).
• Detect more error codes from Nokia phones (bug #659).
• Fix decoding of text using iconv (bug #687).
• Fix linker flags check, caused failures on MacOS X.
• Add second ID for Nokia 2610 (thanks to Nicolas Forget).
• Add ID for Nokia 6060.
• Try to use OPP and PBAP Bluetooth profiles also (not tested!).
• DumpMessage is not printing last char (bug #692).
• Support for favorite messaging number (bug #693).
• Add ID for Nokia 2630 (bug #693).
• First attempt for Bluetooth support on OS X.
• Do not open debug file for second time when using global debug.
• Fix DC memory name printing (bug #698).
• Add API function GSM_MemoryTypeToString.
• Report correct size of DC/RC/MC memory on DCT4 phones (bug #699).
• Store favorite messaging as phone number, not only as ID (bug #693).
• Avoid empty line at beginning of vCard backup (bug #701).
• Add ID for Nokia 2760.
• Catch not acceptable errors in OBEX (bug #702).
• Operation not allowed is not an unknown problem (bug #678).
• Add ID for Nokia 5000 (bug #677).
• Increase limit of files for DCT4 and check array size (bug #676).
• Allow to enter PIN code from stdin (bug #633).
• Handle HEX reply instead of UCS-2 from Motorola (bug #697).
• Avoid decoding of @ in email address (bug #697).

You can download from usual place: http://cihar.com/gammu/, Debian users will find packages in experimental soon. PS: I still have about 50 unread mails about Gammu, so please be patient.

To solve performance problems I've now started to switch my SMTP servers from using the "forkserver" version of qpsmtpd to using the "prefork" version. Under testing qpsmtpd-prefork performed significantly better than the qpsmtpd-forkserver for handling incoming SMTP connections. The loadavg of one machine has dropped from a constant 2.xx to 0.4x! I'd love to see what the asynchronous server would behave like, but that would require re-writing all my plugins to work in an asynchronous manner which would be a significant undertaking. (It would be nice if the qpsmtpd package available to Debian would allow you to choose between the two version of the server - I will file a wishlist bug.) ObQuote: Dune

Ultimate Debian Database (UDD) is a GSoC project (now finished) which aimed at importing all different data sources that we have in Debian in a single SQL database, to make it easy to combine that data. Currently, we import information about source and binary packages, all bugs (both archived and unarchived), lintian, carnivore, popcon, history of uploads, history of migrations to testing, and orphaned packages. The goal is really to have that data, without really thinking of a specific use cases: there will be lots of use cases. Buildstat is a project by Gon ri Le Bouder, that provides a framework for running QA tests (rebuilds and lintian currently, but buildstat is built in a very extensible way) on packages, using both packages in the archive, and packages in the VCS repositories of teams. This is pretty cool: it allows teams to get an overview of the status of their packages, not using the archive as reference, but using their VCS. Buildstat schedules and runs the tests, store the data in an SQL database, and allows to browse the data using a web interface. Buildstat also import some data from other sources (only the BTS currently, using the LDAP dump) to display it on the web interface. Since both projects are using an SQL DB, people have been asking why we don’t simply merge them. The big advantage would be that the data is synchronized: buildstat would display more up-to-date info about the data sources it doesn’t generate locally (like bugs), and UDD would get fresh buildstat data. We have been talking a lot with Gon ri, considering the different possibilities. But I don’t think it’s a good idea. I think that both projects should try to do one thing, but do it very well, instead of trying to fix the world. UDD focuses on importing data that exists elsewhere. Sometimes it means doing some complex processing. But data should be be generated by UDD. Merging the projects would mean having a very big piece of software that does everything (or tries to do everything). Both databases were designed differently, with different goals. UDD tries to stay close to the data it imports. There might be some incoherences in the data sources, but that’s fine: one of the goal of UDD is to make it easy to find them (and fix them), so we need them in the DB. In buildstat, since the goal of importing data is to display it on the web interface, with a strict use case, you can freely “simplify” data if it helps. Another big difference is that UDD is designed to be easy to use (ie write and run queries) by a human user: UDD uses multi-column primary keys, while buildstat uses surrogate keys (integer “id” keys), that ORM tools usually require. There are also more technical concerns: currently UDD makes a compromise, for each data source, on what it imports: it tries to import the data that is useful, not all the data available. Merging buildstat and UDD would mean increasing the DB size significantly, by adding all the “private” data that buildstat needs. Another problem is the stable API problem: if buildstat and UDD are merged, it means that buildstat cannot change its DB schema without making sure that it wouldn’t break what UDD users are doing. So, what should we do, from my POV, instead of merging? - Continue to talk, and get Gon ri into the UDD “team”. He gathered a lot of experience working on buildstat, and he probably would be able to help a lot. - Data that is not generated by buildstat (bugs data) should be imported from UDD. Doing SQL->SQL will probably make things easier there. - A summary of buildstat’s infos should be imported into UDD. There’s also the issue of providing the data through a web interface, to the DDs, which buildstat tries to address partially. The Debian Developer Packages Overview (DDPO)’s main limitations are: - lack of knowledge about VCS (what buildstat solves) - lack of knowledge about complex organizations (you can’t get any list of packages, or list of packages maintained by teams not using a consistant Maintainer/Uploaders scheme, or list of packages from tasks, etc) - poor handling of large amount of packages. In teams with lots of packages, it’s useful to have restricted views, such as “packages outdated compared to upstream”, “packages which have bugs/RC bugs”, “packages which are newer in the VCS than in the archive”. The perl team’s work on PET clearly shows the kind of things that are needed. At this point, I think that DDPO would benefit from a full rewrite (using the existing code as a source of inspiration, and making sure that there are no regressions, of course). Using UDD as the data source, it should be easy to get something done (even if UDD still lacks some of the data DDPO has currently). But it still requires web developer skills, which I don’t have. If you are interested, contact me!

I think I want a netbook. Although I'm still happy with my R200 (especially since I replaced the battery) something smaller would be handy for the train and general carting about. With the R200 being 12" I'm more drawn to the 8.9" variants; 10" isn't a lot smaller and at the cheaper end doesn't appear to result in any higher a resolution than 8.9"

Really I'd like something with built in 3G/HSDPA, but only the Dell Inspiron Mini 9 seems to have this, and the Linux model isn't even on sale yet in the UK, let alone the 3G version.

If I can't get 3G then I'm drawn to the EEE 901. It seems to have the best battery life, has bluetooth and isn't too expensive (though at the higher end of what I'd want to pay for a 2nd machine). Plus it has the appeal that I should be able to walk into a shop and pick one up. Main drawback is that I've read the Ralink RT2860 wifi ain't great (and the driver isn't in mainline yet, though there is one kicking around). Any truth in this? Any other gotchas?

Thoughts, people? I've seen an MSI Wind in the flesh and it was a bit big. The Acer Aspire One looks nice enough, but not great battery life and no bluetooth. Any others I should be looking at instead of the 901? Must be easily available in the UK. I will, of course, be running Debian on it.

One thing I had wondered was why home air-conditioning systems are more efficient than air-conditioning systems for server rooms. I received some advice on this matter from the manager of a small server room (which houses about 30 racks of very powerful and power hungry servers). The first issue is terminology, the efficiency of a “chiller” is regarded as the number of Watts of heat energy removed divided by the number of Watts of electricity consumed by the chiller. For example when using a 200% efficient air cooling plant, a 100W light bulb is rated as being a 150W heat source. 100W to Heat it, 50W from the cooling plant to cool it. For domestic cooling I believe that 300% is fairly common for modern “split systems” (it’s the specifications for the air-conditioning on my house and the other air-conditioners on display had similar ratings). For high-density server rooms with free air cooling I have been told that a typical efficiency range is between 80% and 110%! So it’s possible to use MORE electricity on cooling than on running the servers! One difficulty in cooling a server room is that the air often can’t flow freely (unlike a big open space such as the lounge room of your house). Another is the range of temperatures and the density of heat production in some parts (a 2RU server can dissipate 1000W of heat in a small space). These factors can be minimised by extracting hot air at the top and/or rear of racks and forcing cold air in the bottom and/or the front and by being very careful when planning where to place equipment. HP offers some services related to designing a server room to increase cooling efficiency, one of the services is using computational fluid dynamics to simulate the air-flow in the server-room [1]! CFD is difficult and expensive (the complete package from HP for a small server room costs more than some new cars), I believe that the fact that it is necessary for correct operation of some server rooms is an indication of the difficulty of the problem. The most effective ways of cooling servers involve tight coupling of chillers and servers. This often means using chilled water or another liquid to extract the heat. Chilled water refrigeration systems largely remove the problem of being unable to extract the heat from the right places, but instead you have some inefficiency in pumping the water and the servers are fixed in place. I have not seen or heard of chilled water being used for 2RU servers (I’m not saying that it doesn’t get used or that it wouldn’t make sense - merely that I haven’t seen it). When installing smaller servers (2RU and below) there is often a desire to move them and attaching a chilled-water cooling system would make such a move more difficult and expensive. When a server weighs a ton or more then you aren’t going to move it in a hurry (big servers have to be mostly disassembled before the shell can be moved, and the shell might require the efforts of four men to move it). Another issue related to water cooling is the weight. Managing a moderate amount of water involves a lot of heavy pipes (a leak would be really bad) and the water itself can weigh a lot. A server room that is based around 20Kg servers might have some issues with the extra weight of water cooling (particularly the older rooms), but a server room designed for a single rack that weighs a ton can probably cope. I have been told that the cooling systems for low density server rooms are typically as efficient as those used for houses, and may even be more efficient. I expect that when designing an air-conditioner the engineering trade-offs when designing for home use favor low purchase price. But someone who approves the purchase of an industrial cooling system will be more concerned about the overall cost of operations and will be prepared to spend some extra money up-front and recover it over the course of a few years. The fact that server rooms run 24*7 also gives more opportunity to recover the money spent on the purchase (my home A-C system runs for about 3 months a year for considerably less than 24 hours a day). So it seems that the way to cool servers efficiently is to have low density server rooms (to the largest extent possible). One step towards this goal would be to have servers nearer the end users. For example having workgroup servers near the workgroup (instead of in the server room). Of course physical security of those servers would be more challenging - but if all the users have regular desktop PCs that can be easily 0wned then having the server for them in the same room probably doesn’t make things any worse. Modern tower servers are more powerful than rack mounted servers that were available a few years ago while also being very quiet. A typical rack-mounted server is not something you would want near your desk, but one of the quiet tower servers works quite well.

• [1] http://en.wikipedia.org/wiki/Computational_fluid_dynamics

Share This

As some might know, I've been working at the university for a few weeks now. I'm very happy how it all worked out, because of the people there and the subjects to work on. It's just great to think through some mind-bending index structure to improve reverse-k-nearest-neighbor queries. And the professor (who is very well known for his work on R*-Trees, the X-Tree, and the DBSCAN and OPTICS algorithms) really manages to aggregate excellent people.(rkNN is the problem of finding those points for which a Nearest Neighbor Search [Wikipedia] would return the given point. There are many use cases for example in location based services.)A lot of my work involves a framework which has been published recently on the SSDBM 2008 conference: ELKI - Environment for DeveLoping KDD-Applications Supported by Index-StructuresThe goal of ELKI is to become what WEKA is for machine learning. And it's well on it's way for that.ELKI aims at the data mining researcher, it's not designed to squeeze out the last bit of performance. Instead it allows you to compare different algorithms, try different index structures (including various spatial and metrical trees) and offers all kinds of functionality you can reuse. If you are planning to do some real world applications, it likely is still useful for prototyping.In the last weeks I've already put quite some effort in ELKI, so expect the next version to be released with significant changes and new functionality. In fact some working functionality was just left out of the release because we hadn't cleaned up the code yet.Currently, getting started with ELKI can be a bit tricky. It's not hard to use, but you just need to find out where to start. The next release will therefore include a "dummy algorithm" that mostly serves as being a template for implementing custom algorithms (it can also be used for benchmarking an index structure, though).

I previously described the goals for SE Linux development in Lenny and assigned numbers to the levels of support [1]. I have just uploaded a new policy to unstable which I hope to get in Lenny that will solve all the major issues for level 1 of support (default configuration with the unconfined_t domain for all user sessions - much like the old “targeted” policy). The policy in question is in my Lenny SE Linux repository [2] (for those who don’t want to wait for it to get into Unstable or Lenny).

• [1] http://etbe.coker.com.au/2008/08/04/lenny-se-linux-on-the-desktop/


• [2] http://doc.coker.com.au/computers/installing-se-linux-on-lenny/

Share This

The word is out! Carles, Jonathan, Sabri and I will be throwing a hopefully great 30th anniversary party next weekend. It will start at 12:00 on Saturday and finish at some point during the next day. We have planned fun games during our 30thlon , prepared infinite hours of all kinds of music (including Chimo Bayo, NO LESS!), bought a supermarket worth of drinks. Do not miss!

Uno, que no pare ninguno!

To follow-up on my recent posting about oldsys-preseed: I uploaded a new version of netcfg yesterday that can be told via preseeding not to use a gateway. I also uploaded a new version of oldsys-preseed that will properly handle static IP configs without a netmask or gateway. Additionally, oldsys-preseed will now use DHCP when the static IP config is incomplete (i.e. when either the IP address or DNS are missing). This makes oldsys-preseed much more robust and will hopefully get rid of many problems users ran into with etch.

While drafting emails to be sent out as part of my research, I just had an idea about a new mail header field, let s call it X-Respond-By. This header field allows the sender to specify when s/he requests/requires/needs a response. The recipient could make use of this in multiple ways:

• automatic expiry of messages whose deadlines have passed, possibly with an acknowledgement issued to the sender,
• delayed delivery of messages until they are due,
• prioritisation of message display within the user agent to highlight messages which require action.

Obviously, care would have to be taken to prevent abuse, e.g. by some senders who make all their messages require responses on the next day. One way to achieve this would be to give the recipient sender-specific policies to ignore the field, extend it by a fixed period, or simply reject messages with the field set. I already use a tickler system (which works locally as well as remotely) inspired by the GTD concept of a tickler file, which allows me to have email messages delayed to a given point in the future. I could very well imagine how such an approach could extend into a cooperative communication method. I am looking forward to your comments. Update: Jan Hudec wrote in to tell me about the Reply-By field used by Outlook, which sends messages with those headers:

X-Message-Flag: Follow up
Reply-By: Wed, 10 Sep 2008 12:00:00 +0200

According to Jan, this will

will mark the message with specific symbol,and at the time specified it will pop up a notification in the same way as it does for calendar events and after that it will show the mail in red in the index until it s marked completed .

He also notes that Reply-By stems from X.400 via RFC 2156 and has indeed been standardised by RFC 4021. I shall investigate this further when I have time. NP: Foo Fighters: Echos, Silence, Patience & Grace

So, I am pleased to announce that my course on hackers, which has already started, will be hosting a class blog, STDIN. Starting next class when we address phone phreaking, we will have one entry summarizing in some details each class readings and discussions. There is one student in charge for every class and then anyone else can post as they wish. I am also making an effort to post various definitions and examples of hackers, hacking, hacks and compile a master list at the end. I am not sure it will produce anything interesting except a list of definitions, but sometimes you see new associations and meanings when with such a comparative potpourri.