Do you know this experience: A program, in my case subversion, has a bug and starts to eat memory. You can not interact with your system any more, only watch the memory and swap run full (if you have a display for that). Then it takes a while, while the kernel kills the (hopefully right) program. Things start to move again, until they are fully recovered from the swap and you can continue your work. Or the kernel does somehow not kill the right program, and you are screwed.During regular work, though, your swap is hardy ever needed. Only after a while, a few megabytes of never-used RAM is swapped out, to make space for using the RAM as a file cache.I d like to see the kernel not give out more memory to processes than there is physical memory, because that s plenty for normal work, and if there is more requested, then that s most likely wrong. But I still want the kernel to use the rest of the memory for caching files, and also move some unused RAM pages to the swap file.Unfortunately, there does not seem to be a settings that achieves this directly. But if you happen to have the swap about the same size as your RAM, then these settings, when written to /etc/sysctl.d/vm.conf, will do the job:

vm.overcommit_memory = 2
vm.overcommit_ratio = 0

The first one is to make sure the kernel does not hand out more memory than you tell it to, and the second is to make sure that it only hands out (swap size + 0 * RAM size) to processes.Beware that things go wrong if you happen to have no swap any more for some reason, beause then the kernel will hand out zero memory! Therefore, you need to make sure that these settings are applied after swap was enabled. On a Debian machine, rename /etc/rcS.d/S30procps to /etc/rcS.d/S37procps. This would not be possible if you could also specify the ration of swap memory to be used. Then I could set that to zero and the RAM ratio to 100.If anyone knows better ways to achieve this, I m interested to hear them.Update: For my qemu based armel package builder, this is not enough it seems. I m now running it with overcommit_ratio = 50.

It's the X Development Summit in Edinburgh this week, so I've been hanging out with the graphics crowd. There hasn't been a huge amount of work done in the field of power management in graphics so far - Intel have framebuffer compression and there's the lvds reclocking patch I wrote (I've cleaned this up somewhat since then, but it probably wants some refactoring to avoid increasing CPU usage based on its use of damage for update notifications). That still leaves us with some fun things to look at, though.

The most obvious issue is the gpu clock. Intel's chipset implements clock gating, where unused sections of chip automatically unclock themselves. This is pleasingly transparent to the OS, and we get power savings without any complexity we have to care about. However, there's no way to control the core clock of the GPU - it's part of the northbridge and fiddling with the clocking of that would be likely to upset things. Nvidia and Radeon hardware is more interesting in this respect, since we can control the gpu clock independently of anything else. The problem is trying to do so in a reasonable way.

In an ideal universe, we can change these clock frequencies quickly and without any visual artifacts. That way it's possible to leave it in the lowest state and clock it up as load develops. There's a couple of problems with this - non ideal hardware, and the software in the first place. Jerome's been testing a little on Radeon and discovered that changing the memory clock through Atom results in visual corruption. It's conceivable that this is due to some memory transaction cycles getting corrupted as the clock gets changed. If we could ensure that the reclock happens during the vertical blank interval, that's something that could potentially be avoided (of course, then we have the entertainment of working out when the vertical blank interval actually is when you have a dual head output...). The other problem is that 3D software tends to consume as many resources as are available. Games will produce as many frames per second as possible. Demand-based clocking will simply ramp the gpu to full speed in that situation, which isn't necessarily what you want in the battery case (as the number of frames per second goes up, so does the cpu usage - even more power draw) but is probably pretty reasonable in the powered case.

Handwavy testing suggests that this can save a pretty significant amount of power, so it's something that I'm planning on working on. Further optimisations include things like making sure that we're not running any PLLs that aren't being used at the time (oscillators chew power), not powering up output ports when you're not outputting to them and enabling any hardware-level features that we're currently ignoring. And, ideally, doing all of this without causing the machine to hang on a regular basis.

I recently announced that German and French reached 100% completion in unstable for po-debconf translations (by the way, both are now 100% in lenny as well). However, l10n efforts also happen for many languages in that area, so it's time to highlight them as well:

• Third is Portuguese at 98.3%. Nearly all complete. It would need some overview by the team, lead by Miguel Figueiredo, to complete the currently incomplete files.
• Czech if 97.85%. The effort is a very longstanding one by Miroslav Kure, nearly alone. Miroslav has small difficulties to cope with changes in eth->lenny release cycle which explains why, despite they once were virtually 100%, cs could never reach it. This will happen for squeeze
• Vietnamese is 84.97%. Clytie Siddall fights with changes and her real life conditions and still succeeds in keeping the l10n effort up. I'm admirative
• Dutch is 80.72%. The Dutch team is an "old" team in Debian with a thorough, but sometimes slow, QA process. I have no doubt about the quality of their work. The manpower seems fairly short, though, with people involved in many other areas in Debian and outside.
• Swedish was slowly vanishing until Martin Bagge recently resurrected it. They even passed over Russian again at 78.76%. Congratulations.
• Russian is constantly progressing. Kudos are due to Yuri Kozlov who efficiently leads the team. They'll make it at 100%, I don't doubt it. 78.71% for now.
• Galician is the longstanding one-man effort by Jacobo. He already described in details his work process and took great advantage of my NMU campaigns to progress constantly. 76.80%: will he pass over Swedish and Russian before lenny?
• Spanish is an "old" team. I expected to see a good progress, which doesn't really happen. The NMU campaigns do not benefit them and I don't see that many bug reports. What's happening there? Tis team is one I'm most worried about.
• Finnish took great advantage of the NMU campaing with Esko Ar j rvi following it very closely. He bumped the stats from less than 40% to 66.5%
• Japanese slowly goes its own way. The effort is less constant than others, but they successfully manage to stay around 60%
• Basque is also constantly progressing. Under the lead of Piarres Beobide, the team reached 60% after starting below 40%
• Brazilian Portuguese is more focused on DDTP these days (they have impressive stats, thanks to Felipe can de Wiel's work) so they just manage to stay around 55%

Other translation efforts are more hectic. I'd like to point the slow decrease of the work on Catalan, probably due to low manpower and other areas of interest for the old timers. I'll try to soon make such report for other areas of translation effort in Debian.

Here some news from the Smuxi front. As you might already know Smuxi 0.6.2 was released. With the 0.6.2 release we have now German translation and Smuxi packages in Debian (Unstable) (as promised), Ubuntu (intrepid) and ArchLinux (AUR)! Now just OpenSUSE, Foresight Linux, Gentoo and Fedora are missing for world domination^W^Wconvering the major Linux distributions. The upcoming 0.6.3 release will contain Spanish (thanks to Juan Miguel Carrero), French (thanks to Clement BOURGEOIS) and British English (thanks to Ryan Smith-Evans) translations. Besides bugfixes this release will contain the famous tray icon support and some other goodies! The release should be ready by this weekend... stay tuned.

I attended the Open Nordic Conference in Norway in June, a conference that brought together people from Norway, Sweden, Finland and Denmark. Attending the conference allowed me to find out what's going on with FOSS in Northern Europe. What I found interesting is that there was a lot of talk about using FOSS in the public sector. A number of countries are working on repositories to exchange software, in particular for public administration. One example is the Software Exchange (softwareborsen.dk), a project by the Danish National Software Knowledge Centre to promote the use of FOSS in Danish public administration. The Norwegian software exchange (delingsbazaren.no) plays a similar role in Norway. It seems as if every country is working on their own software repository to share FOSS. As such, it's great to see that the European Commission is taking a step towards bringing everyone together by introducing the Open Source Observatory and Repository (OSOR) for European public administrations. The goal of OSOR is to provide a platform for the exchange of information, experiences and FOSS code for the use in public administrations. OSOR will officially launch at the Open Source World Conference in Malaga in October. I've always thought that there is not enough cooperation and communication between European countries, so I have high hopes for OSOR. (Originally published on FOSSBazaar)

My previous post titled AppArmor is Dead [1] has inspired a number of reactions. Some of them have been unsubstantiated opinions, well everyone has an opinion so this doesn’t mean much. I believe that opinions of experts matter more, Crispin responded to my post and made some reasonable points [2] (although I believe that he is overstating the ease of use case). I take Crispin’s response a lot more seriously than most of the responses because of his significant experience in commercial computer security work. The opinion of someone who has relevant experience in the field in question matters a lot more than the opinion of random computer users! Finally there is the issue of facts. Of the people who don’t agree with me, Crispin seems to be the first to acknowledge that Novell laying off AppArmor developers and adding SE Linux support are both bad signs for AppArmor. The fact that Red Hat and Tresys have been assigning more people to SE Linux development in the same time period that SUSE has been laying people off AppArmor development seems to be a clear indication of the way that things are goind. One thing that Crispin and I understand is the amount of work involved in maintaining a security system. You can’t just develop something and throw it to the distributions. There is ongoing work required in tracking kernel code changes, and when there is application support there is also a need to track changes to application code (and replacements of system programs). Also there is a need to add new features. Currently the most significant new feature development in SE Linux is related to X access controls - this is something that every security system for Linux needs to do (currently none of them do it). It’s a huge amount of work, but the end result will be that compromising one X client that is running on your desktop will not automatically grant access to all the other windows. The CNET article about Novell laying off the AppArmor developers [3] says ‘“An open-source AppArmor community has developed. We’ll continue to partner with this community,” though the company will continue to develop aspects of AppArmor‘ and attributes that to Novell spokesman Bruce Lowry. Currently there doesn’t seem to be an AppArmor community, the Freshmeat page for AppArmor still lists Crispin as the owner and has not been updated since 2006 [4], it also links to hosting on Novell’s site. The Wikipedia page for AppArmor also lists no upstream site other than Novell [4]. The AppArmor development list hosted by SUSE is getting less than 10 posts per month recently [6]. The AppArmor general list had a good month in January with a total of 23 messages (including SPAM) [7], but generally gets only a few messages a month. The fact that Crispin is still listed as the project leader [8] says a lot about how the project is managed at Novell! So the question is, how can AppArmor’s prospects be improved? A post on linsec.ca notes that Mandriva is using AppArmor, getting more distribution support would be good [9], but the most important thing in that regard will be contributing patches back and dedicating people to do upstream work (Red Hat does a huge amount of upstream development for SE Linux and a significant portion of my Debian work goes upstream). It seems to me that the most important thing is to have an active community. Have a primary web site (maybe hosted by Novell, maybe SourceForge or something else) that is accurate and current. Have people giving talks about AppArmor at conferences to promote it to developers. Then try to do something to get some buzz about the technology, my SE Linux Play Machines inspired a lot of interest in the SE Linux technology [10]. If something similar was done with AppArmor then it would get some interest. I’m not interested in killing AppArmor (I suspect that Crispin’s insinuations were aimed at others). If my posts on this topic inspire more work on AppArmor and Linux security in general then I’m happy. As Crispin notes the real enemy is his employer (he doesn’t quite say that - but it’s my interpretation of his post).

• [1] http://etbe.coker.com.au/2008/08/23/apparmor-is-dead/


• [2] http://blogs.msdn.com/crispincowan/archive/2008/09/02/go-ahead-make-my-day.aspx


• [3] http://news.cnet.com/8301-13580_3-9796140-39.html


• [4] http://freshmeat.net/projects/apparmor/


• [5] http://en.wikipedia.org/wiki/Apparmor


• [6] http://forge.novell.com/pipermail/apparmor-dev/


• [7] http://forge.novell.com/pipermail/apparmor-general/


• [8] http://forge.novell.com/modules/xfmod/project/memberlist.php?group_id=1864


• [9] http://linsec.ca/blog/2008/09/03/crispin-responds-to-allegations-that-apparmor-is-dying/


• [10] http://www.coker.com.au/selinux/play.html

Share This

I had to do it once and now the time came. Floating around hundredths of unread mails for Gammu is not a way to go. I'm just middle of processing it, but most of you will get just generic reply, asking you to either file bug report to bug tracker or to write to mailing list. There is simply no reason why so much communication should be private between me and you. I think this is generally valid for any open source project, it usually does not make sense contact main developer directly when there are more appropriate ways to communicate. If you find a bug or something does not work, simply report it! If you can search for duplicates before it is even better and you might be able to include some additional information, but even if you skip this step, it is much easier to track problems in bug tracker than in mailbox. Also in bug tracker the issue will not disappear until it is not fixed, in mailbox, it gets quickly out of focus and I will forget it. Once more: If you've found a bug, report it! If you have some question, you have much better chance to receive answer on mailing list. Simply there are more people hanging around and somebody might have already seen the problem. What is another good thing on mailing list is that they have archives, so that you can look whether somebody did not solve similar problem before. Also others will be then able to find your solution. Summary again: If you have a question, ask on mailing list!

I don't know what it says about Debian but while the political content of my last post was ignored, I have received a steady stream of email today saying Michael Palin was in fact the lumberjack in "And Now For Something Completely Different" Obviously I am unfit to be a heartbeat away from the DPL. obTheOtherPalin: Today is Ganesh Chaturthi so I have been to busy praying to watch it. I presume it will be on youtube or something by tomorrow. In any case as long as she didn't embarass herself, my view that she will be a plus for the McCain campaign still stands.

There are many online blacklists which are populated by volunteers. I'm looking for such a blacklist which contains records of hosts conducting portscans, ssh brute-forcing, or other similar "badness". dshield looks good - but doesn't make the scanning IP availble - just shows the port data. denyhosts allows you to upload/download a list of IPs trying to run ssh bruteforce attacks - but when I wrote my own RPC code to poll that list of IPs I found I couldnt' get the full list.

I'm aware that I could run denyhosts on a spare IP, then just copy the IPs it downloads but that feels icky...

I'm unaware of any existing service that I could use for my purposes. So would there be any interest in a service listing only portscanning/ssh brute-force IPs? (Allowing DNS queries, XML-RPC, or rsync downloads of the submitted data.) Obviously I have my own reason for wanting such a list of bad IPs... Those are probably obvious, but it does seem like it would be generally useful. I'd be willing to host a server to process the submitted reports, and make the results available, but I guess thats the easy part. The hard part is persuading people to run my "submit IP" client. Which has to understand ssh logs, iptable logs, or something similar.. Ugh. I guess between the machiens I work with and the machines I host myself I've got a fair number of IPs which I could collect scans from - I could populate the database myself. But this is a perfect job for distributed submission. ObQuote: Batoru rowaiaru

I just commited to phpMyAdmin trunk (will be released once as 3.1) few small patches, but the change is quite important - phpMyAdmin will now default to cookie authentication method and it will not allow to login as root user without password (unless it is explicitly enabled in configuration). Reasons for both changes are simple - most people change default authentication to cookie in production environment anyway, so why not to make it default and giving remote access to freshly installed MySQL server has been always considered a bit security issue. Well it was an user problem, but why not to prevent such issues?

I’ve been seeing a bit about Canada recently, what with plastic-bottled water (more on that next month), the airline I used for my last trip (Zoom) going bust and stranding passengers and being a fan of Co-op Radio’s documentaries, so I was particularly interested to see this news:

“FACIL, a non-profit association, which promotes the collective appropriation of Free Software, contests the Quebec government purchasing methods for software [...]” (first seen at Lawsuit, etc - Diary of a CrazyFrench)

In England, discrimination against free software has been less obvious, with the whole national, county and district government system being officially open to free software (or rather, open source that meets gov.uk’s own definition of the term), but very biased towards large service providers. Like most countries, England doesn’t seem to have large pure-free-software service providers yet, so this usually means that the best we can do is get some mix of free and non-free software. This only gets beyond token gestures towards free software when lots of the project development and leadership is internal, as in nearby Bristol City Council, or the Department for Innovation, Universities and Skills. I’m surprised that Quebec has been overt enough to make a lawsuit possible and I’m very encouraged that FACIL is the group to do this. I’ll suggest to SPI and a few other groups that they should join to show support, but I don’t know whether the “political interventions” policy of FACIL will cause problems for non-profits.

While sitting on a bench in Hyde Park, watching the leaves fall from the trees, thinking that fall is just around the corner, I started to write on the back of an old receipt. One that says 108,- for a Banana Passion Split and a bottle of Coca Cola. It’s just something I do when I’m nervous, excited, lonely, happy or all of the above. Sometimes I spend so long thinking about how to express myself, that I forget what I was going to write. I spend too long trying to find the right adjectives. And I wish I could find the right words to describe some of the best moments. My trip to London was more than just Big Ben, The London Eye, Madame Tussauds and Oxford Street. A lot more. Another receipt says 590,- for a haircut. It’s from July 15th, 2008. My ramblings on the back, blue ink, some words crossed out, some misspelled; at least 1 of the 268 Underground stations has a staircase with 78 steps, a shop on Oxford Street sells salt from the Dead Sea, and some very big soap bubbles were seen in Camden Town. There are some keywords at the bottom of the second receipt. Just to remember all the other things that happened. Like the time we almost got lost on the Underground, the elevator with no buttons, the Kanye West sunglasses in white and pink, and the lack of a proper breakfast - even though I don’t mind white bread and strawberry jam. There was just one small thing I wasn’t too happy about; you can’t write on receipts from Tesco. They have THANK YOU FOR SHOPPING WITH US printed all over it. And it took me a while to find that piece of paper in my bag. This time I saw fall in London, and a white pigeon. I will make sure I have my notebook with me next time.

Everybody is talking about that these days, since information on Google Chrome leaked. But the fact is, this is what is going to happen with Google Chrome: stupid people proving that 2 + 2 = 5. I haven’t tried IE8 nor am I willing to, but one of the rare things I read about IE8 when people were discussing how not innovative Google Chrome was, is that it uses a process per tab. Now let’s assume IE binary code + libraries fit in 10MB (which is probably a small estimate), and you open 10 tabs. Here you are : 100MB RAM consumed. OH MY GOD! Except that memory is shared between the processes. That’s 100MB virtual memory. Reality is that you’ll have a hard time calculating the actual amount of memory used. Update: It has already started.

Using a separate process for each web page and each component has been something I've always wanted a web browser to do. It's so conceptually clean and has such nice properties, and processes are so cheap in linux. Hats off to the people who made that a reality. On the other hand, I'm guessing that chrome's guts will be tied into the google backend services so tightly that you can't really tell where the one stops and the other begins. Since I'm not interested in being a sharecropper, and would prefer to see people empowered with services they control, I have worries. It's easy to forget how much of the modern browser's er ... chrome ... is based on web services that could change, go away, or be DNS hijacked at any time. I'd like to see a web proxy that takes all traffic to *.google.com and rot-13's it, to demonstrate how many things rely on this one company.

Last week I started my personal RC bug quest, to get the RC bug counter down and Lenny released some time this year. Sadly, a release in September 2008 is not possible anymore.

Since last week I've been mostly with other stuff, like coming back home after DebConf8 and catching up on some real life issues... So I wasn't very productive and only downgraded 496967 and verified that 484045 can really be closed by now. But at least it brought the counter down a bit :-)

Last week we were at 428 open RC bugs, today it's "only" 383. If we keep this speed, Lenny will be released in 15 weeks. So I certainly hope for some removals to happen soon..! ;-)

Using the alternative BTS view, I see 359 RC bugs effecting lenny, or 339 if I exclude contrib and non-free. So "only" 13 weeks...

While writing this blog post I thought that rc-alert should be able to list only bugs, which effect a specific distro and much to my joy, rc-alert from devscripts in lenny and sid has a "-d" option :-)

Google have announced a new web browser - Chrome [1]. It is not available for download yet, currently there is only a comic book explaining how it will work [2]. The comic is of very high quality and will help in teaching novices about how computers work. I think it would be good if we had a set of comics that explained all the aspects of how computers work. One noteworthy feature is the process model of Chrome. Most browsers seem to aim to have all tabs and windows in the same process which means that they can all crash together. Chrome has a separate process for each tab so when a web site is a resource hog it will be apparent which tab is causing the performance problem. Also when you navigate from site A to site B they will apparently execute a new process (this will make the back-arrow a little more complex to implement). A stated aim of the process model is to execute a new process for each site to clear out the memory address space. This is similar to the design feature of SE Linux where a process execution is needed to change security context so that a clean address space is provided (preventing leaks of confidential data and attacks on process integrity). The use of multiple processes in Chrome is just begging to have SE Linux support added. Having tabs opened with different security contexts based on the contents of the site in question and also having multiple stores of cookie data and password caches labeled with different contexts is an obvious development. Without having seen the code I can’t guess at how difficult it will be to implement such features. But I hope that when a clean code base is provided by a group of good programmers (Google has hired some really good people) then the result would be a program that is extensible. They describe Chrome as having a sandbox based security model (as opposed to the Vista modem which is based on the Biba Integrity Model [3]). It’s yet to be determined whether Chrome will live up to the hype (although I think that Google has a good record of delivering what they promise). But even if Chrome isn’t as good as I hope, they have set new expectations of browser features and facilities that will drive the market. Update: Chrome is now released [4]! Thanks to Martin for pointing out that I had misread the security section. It’s Vista not Chrome that has the three-level Biba implementation.

• [1] http://googleblog.blogspot.com/2008/09/fresh-take-on-browser.html


• [2] http://www.google.com/googlebooks/chrome/


• [3] http://en.wikipedia.org/wiki/Biba_Integrity_Model


• [4] http://www.google.com/chrome

Share This

Yesterday I made a new release of the chronicle blog compiler. This fixes a bug in the handling of comments. Previously comments were sorted badly, when they crossed a month boundary. Now they are always sorted first to last - which makes reading entries with multiple comments more natural. Other than that I've been readying for the launch of a new MX machine for my mail filtering service. The process went pretty smoothly, and so I'm happy.Still have that paranoid feeling that something will break, but at the very least I'll hear about it quickly thanks to the SMS-alerts! ObMovie: Brief Encountery

I hate the Plesk server control panel webapp but our webmaster cooperative still maintains one (but only one) server that uses it. That non-free software means that it’s under our “limited support agreement” which essentially says “you understand that the lack of copyright permissions means this system may break in ways we’re legally forbidden to fix and you have to go beg the copyright holder for help”. Recently, a site broke because it wanted to use a PEAR module and Plesk’s PHP configuration includes an open_basedir which forbids access to /usr/share/pear - that’s stupid. If someone has enough permission to install dangerous stuff into that folder, they definitely have enough permission to edit the PHP configuration. The httpd.include file which contains that PHP configuration has a comment at the top that helpfully tells you to create a vhost.conf file alongside it, instead of editing the httpd.include which gets regenerated by Plesk (wiping out any changes at some near-random time in the future). It doesn’t mention that you need to run /usr/local/psa/admin/sbin/websrvmng -u --vhost-name=your.domain after creating it, else no amount of reloading the Apache httpd configuration will make it use the new file. I found the idea from this Re:morse.nl blog post and then read the –help output to pick the best options for me. It’s not obvious on SWSoft’s Plesk help, which is also stupid. Finally, you can’t edit the httpd.include template (to mention the websrvmng command to future sysadmins, or to change the open_basedir across all sites) because it is a string inside websrvmng and not a template file - very very stupid. I didn’t find the source code for websrvmng and I doubt we have permission to modify it, so I guess this is another thing we can’t fix in a reasonable way, like the limited support agreement says. I could recompile PHP to ignore those open_basedir settings or add /usr/share/pear to it, but that’s one hell of a work-around. It seems like having non-free software (like Plesk) rewrite the configuration files of free software (like PHP) is a good way to cripple the free software. One day I want us to be like Bristol Wireless and have a policy of refusing to deal with such non-free-software systems, but that’s a decision I’ve never won in any organisation I’ve joined yet.

Back from Argentina, back from DebConf. As always, the ~3 weeks I spent there were really great, in as many fronts as I can imagine or describe. But I won't go into that now - For the purposes of this posting, the single thing that I got out of DebConf was looking with envy at all the people that had something that used to be called a sub-notebook some time ago, and now morphed into the more modern(?) name netbook.
Several people were seen with their tiny Asus Eee machines, of various models. And I definitively decided I want one - I was quite close to buying one in Argentina, as they are readily for sale there (surprisingly, in Mexico Asus sells motherboards, but no netbooks)... But I've always prefered waiting or paying a little premium for having an on-country seller and warranty.

Back home, Pooka told me that several stores in Mexico do sell the Acer Aspire One. After a little research, I decided to go for it. Office Depot sells the AAO for MX$4500 (around US$450). The only model they carry comes with Windows XP installed (instead of Linpus Linux), which is a shame I thoroughly repeated to the vendor - But it does come with 1GB RAM and 120GB HDD, much better for my needs than the other model, with 512MB RAM and 8GB SSD. This is, after all, a full (although very small) machine. It has an Intel Atom 270 CPU - I haven't yet measured how it fares, but it feels quite responsive so far for typical desktop tasks.
But what made me really happy about it is the Debian support. The only tricky part was to get the installer going, as it does not have a CD drive to boot from (and I didn't want to completely overwrite my only available USB stick's data). Don't try installing Debian Etch, as its kernel will not support the built-in Realtek RTL8101E network card (maybe etch-and-a-half's kernel does?). My greatest ally in this was, of course, the wiki.debian.org article on the Acer One - I rebooted with Lenny's debian-installer, and everything was smooth from that point on. Propietary firmware is required for the wireless AR5007 card and webcam, but -exactly as documented in the wiki- they are covered respectively by madwifi and linux-uvc.
I did a very regular install, with basically the default desktop and notebook setup. I continue to be amazed... Everything just works! It is not even fun, there are no funny drivers to recompile, no bang-your-head-against-the-wall... Even suspend-to-RAM. It just works.
The only glitch I found so far is that, after suspend-to-RAM, the madwifi module must be removed and reloaded to have wireless network. This is a well-known glitch that can be easily worked around. But besides that, it is... as easy as it gets. And, at such a price, and under 1Kg weight... This computer will get used to go out with me quite often! Battery life is just 2 hours, but for most situations, it's more than enough.