This weekend I did a hack session with Alan McGovern on Monson. You don't know what Monsoon is? It's the sexy GTK# driven bittorrent client based on the MonoTorrent library developed by Alan McGovern. I created debian packages for Monsoon and wasn't happy with some features and/or bugs so I thought I can contribute some love to it. First thing I implemented was persistency of file priorities for torrents, so when you restart Monsoon it will restore all priorities. I also reported some bugs to Alan in MonoTorrent, like it was ignoring "do not download" flags, so it kept downloading all files of a torrent and the download progress of files were not correctly restored when it was resuming the torrent. He found and fixed the issues right away, great service
Then I implemented auto-start of torrents that were running when Monsoon is closed.
Monsoon will also now not flood your console with lots of debug stuff, as I added a -d / --debug parameter for that, which made my terminal unresponsible without it when downloading big torrents (~1000 files). And this evening, I replaced the usage of Gnome.IconEntry and Gnome.IconSelection with Gtk.FileChooserDialog + a preview widget. Alan asked for this, as he wanted to drop the GNOME# dependency for memory usage reasons. Allright, enough love for today! Now am hungry.... PS: We have now an IRC channel for Monsoon: #monsoon on GIMPnet, if you are interested, please join!

Just a quick pointer to an article in German for those 350+ Subscribers with a t-online-Mailaddress.

T-Online verbessert den Spamschutz - Legitime Mails werden abgelehnt.

Summary: T-Online now blocks non-spam Mail from Debians Listserver.

Exim has the habit of trying to find out about its host names and IP addresses when it starts up. This has, in the past, been an issue for the Debian packages, since a Debian system might be on a dial-on-demand modem line with expensive costs and thus should not do unnecessary DNS lookup when the MTA is started. This article tries to describe the issue and which countermeasures debian took, and asks for tips how to solve this in the case of IPv6, where our past measures unfortunately do not directly apply. I’d like to solicit opinions from people who are more experienced than me with Unix, the local resolver library including /etc/hosts and /etc/nsswitch.conf, DNS, and - especially - the customs that apply on a system running IPv6. To avoid the extra DNS lookups, the Exim packages have a Debconf option to configure exim for “minimal DNS usage”, which hardcodes the hostname into Exim’s configuration at package configuration time. This was necessary since - without this option - exim looks up its own host name in the DNS even when a completely local operation is invoked. In some cases, exim still looks up its IP address when a listening daemon starts up. This is why the Debian installer configures 127.0.1.1 (not 127.0.0.1) for the local hostname on installation, yielding /etc/hosts files like

127.0.0.1       localhost
127.0.1.1       myfoo.localdomain   myfoo
# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

However, in the last few weeks I have heard a few cases where exim does IPv6 AAAA lookups when a listening daemon starts up. An strace shows a gethostbyname2 call for AF_INET6, and if we want to continue the line we went in the past, we’d need an IPv6 address for myfoo.localdomain in /etc/hosts as well. I am now wondering how this could be implemented. In IPv4, we have 127.0.0.0/8 available for the local host and could arbitrarily choose 127.0.1.1 to configure the local host name on. In IPv6, there is only ::1, which is a single address. Would it be possible to choose an arbitrary “link local” address on lo, the loopback interface? Or is there any better way? This being said, I consider the entire 127.0.1.1 business a horrible hack which is one of the most ugly things I have ever seen. Do we have a chance to implement this in a more cleaner way, or is it still the way to go for the distribution, where we don’t know zilch about the environment where an installed system is going to be used? This issue leads to people adding their local host name to ::1 in /etc/hosts, which might re-introduce other issues that we experienced in a phase when we did the same for 127.0.0.1, eventually ending up with 127.0.1.1, or to disabling IPv6 altogether, which is a bad thing in a time where IPv6 should be enabled, not disabled. So I’d like to find a clean solution which could then be implemented in whatever part of Debian might be responsible. I tried asking this question in other places, including Usenet, before pestering my Blog to ask the Lazyweb, but obviously the people I asked before do not care for the special environment that a Linux distribution has to take care of. The only answers I got were like “that would be the local administrator’s task to fix” and “this should be taken care of in the local DNS server/setup (maybe even on the local box being installed)”. A quite frustrating experience.

OK, been quiet for a few days, at least on the blog, but in accordance with typical behaviour (for me at least) a quiet blog means a lot of things going on elsewhere. The smallest was a fix for deb-gview - combining a fix for opening files in the current working directory with a fix for the imminent dpkg 1.14.17 which modified the .changes file format a bit. That was relatively easy and I've uploaded 0.2.1 to unstable. gvfs hasn't made testing yet so there's no point in waiting for deb-gview to migrate before 0.2.1.
The largest change? Depends how you define large:

1. Large number of changes to package files - emdebian-tools 1.0.0
2. Large effect on Emdebian workload - dpkg 1.14.17

dpkg
dpkg bugs closed - emdebian-tools 1.0.0 pending - dpkg-shlibdeps is now able to look into directories containing libraries used by cross-built binaries provided that the right environment variable are set. Closes: #453267. dpkg-buildpackage will set PKG_CONFIG_LIBDIR (but not override an existing value) in case of cross-compilation so that pkgconfig finds .pc files in the directory specific to the target architecture. Closes: #439979.
These two changes will have a major effect on the overall workload required within Emdebian and give us a sane cross-building environment in Lenny which is ABSOLUTELY $^ @&*! FANTASTIC. Currently, 1.14.17 is in experimental but I've installed it on my system for testing purposes so that I can complete emdebian-tools 1.0.0:
emdebian-tools 1.0.0
Now here, I'm making some progress. A bug has been bothering me for some time with how emdebian-tools needs a Debian primary mirror to calculate various dependency information and other apt cache stuff whilst taking into account the host architecture. Simon and I now think that we can do the dependency stuff with a continually updated dpkg-cross repository and I can use libcache-apt-perl for the rest. So whereas dpkg-cross might still exist into Lenny, it is looking like apt-cross might not - at least not as an application. However, I'm not taking that step with emdebian-tools just yet. In the meantime, I'm simply using debconf to replace the automated selection of a Debian Primary Mirror and passing that mirror to apt-cross - something I should probably have setup a while ago.
As well as that bug fix, I've added a check to emchain so that users are warned if they don't actually need to run it, added the mirror support to the various scripts and removed the workarounds now fixed by dpkg.
'dpkg-buildpackage -a' is usable for nearly all packages once you have dpkg-dev >= 1.14.7. emdebuild >= 1.0.0 is only necessary IF:

1. You want to modify/update Emdebian patches (not just apply them) - i.e. if you have commit access to Emdebian SVN.


2. You need the one remaining wrapper: 'X-Build-Cross-Libtool: yes' which is my next main target. This is a package-specific problem and each incidence needs a package-specific solution via an appropriate patch. As such, the wrapper is likely to stay in place in emdebuild for some considerable time - at least until someone can rebuild the entire archive with a test that can identify which packages are still affected.


3. You want the build checks currently implemented by emdebuild but which I plan to spin out during the life of emdebian-tools 1.x. I want to standardise those build checks and abstract them into possibly a lintian-compatible check set.

Also, there should now be no need for any wrapper scripts that anyone may have devised to mangle LD_LIBRARY_PATH or PKG_CONFIG_LIBDIR - indeed,
explicit support for these within dpkg means that it is to be considered harmful from now on to touch these variables, except possibly in some specific corner cases.

Today i tried the first time to do GeoCaching with my Nokia N810 running the Maemo (which is a Debian-based Distribution). I already own a Garmin Geko 201 with which i found 100+ Caches, so this is my reference.

The GPS-Receiver of the N810 is better than the one in the Geko (at least since i use the fixed gpsd, which normally shouldn't do something on the performance, but in my case... it made me feel better), so fixes come faster, and more accurate than on the Geko. (from hearsay the SirfIII-Chip is even better)

I run Maemo Mapper on the N810, a free (as in speech) Software written to do things better than GpsDrive at least on the Nokia Internet Tablets.

I wrote some programs to be the glue between Geocaching-Websites and GPSdrive (which depends on MySQL) and i modifed those to put the information into SQLite, which is the Database used by Maemo Mapper.
If i pump all my waypoints in such a file (which are currently 94607) Maemo Mapper gets slow. so slow that Maemo Mapper becomes useless.

On the Garmin-GPS-Receiver, i can have only 500 Waypoints, but i have a 'goto'-function, so i store my destination coordinates and say 'Goto' and the thing provides me an arrow which points to my destination and shows the distance (it doesn't know about ways so it points the direction directly, but that is usually fine as GeoCachers often are so abroad that no one has maps about the area.).

In Maemo Mapper i couldn't find such a function. I can say 'Goto Coordinates' and then it centers the map to there, but there isn't a sign and no line or arrow which direction i have to turn to. This is a problem (or something for the wishlist.)

So from GeoCachers view (and those people who want to navigate for other reasons) free Navigation-Software for Linux is an area where more work is needed.

I started a bread journal. It seemed that I was always taking pictures of my breads and showing them to people so I decided this is the best thing to do — people can look at or ignore it as they choose.

OpenStreetMap party at Kaohsiung, Taiwan Apparently, yesterday we had the first OpenStreetMap event in Taiwan! We met in a caf /restaurant equipped with power plug, wireless network and overhead projector and we had a bit of an introduction, chat and lunch. Then we split in groups and exploited the fact that the newly built underground (KMRT) system is still free of charge, to spread around and map around the stations. Finally, we reconvened at someone's house to see how to put the data together, draw roads, tag and upload. Highlights of the day:

• How to turn a serial GPS into a data logger with 6 hours battery life . Then attach it to your bike using magnets from broken hard drives. Totally rocks!
• Previous OpenStreetMap data was collected by only one person, who took the fancy new High Speed Rail from the opposite side of the country and joined the party. This also made discussion about standardising tags for Taiwan rather easy.
• A group of people appeared wielding a number of "totally insane in every regard" Garmin GPSMAP units: it turns out they are with a civil action group that goes around mapping historical trails, abandoned railroads, aboriginal routes and mountain crosses and so on. Apparently, they did not know about OpenStreetMap: hopefully they'll join in.

Technical bits:

• The eeePC was very popular, and very handy for going around storing tracks, as you can just chuck it in one bag. JOSM runs fine, although it could really use an interface redesign to fit in the small screen. In fact, it could really use an interface redesign to fit in the standard 1024x768 screen of my laptop.
• We could not use the tracks made with the Garmins because we did not know we had to do "Setup -> Map -> Lock On Road = Off" and it was on by default. Now we know it for next time.
• Something like a SirfStarIII really helps in a city made mainly of very tall buildings with lots of steel and glass. My Sony-based cheap gps receiver that worked ok in the Bolognese countryside was next to useless here, continously losing the fix and producing a crazy zigzagging track of doom, only useful to figure out big long straight roads.
• Geocorrelation of digital camera pictures rocks! Who needs to store waypoints when you can just take pictures with the digital camera and have them show up as waypoints in JOSM? The trick of taking a picture of the GPS time and use that to compute time offset is great. Also, we found it easier to just fire up gpscorrelate to do the geocorrelation rather than figuring out how the tools in JOSM work.

Issues to address:

• There is a strong need for a zh_TW translation plugin of JOSM; I'll try to find out how to do it and pass on the information to who can do it.
• Road names could be written either in English or in Chinese characters. Currently English has been used for the name tag because osmarender cannot render Chinese characters. There is some planining to create an OSM mirror in Taiwan which renders twice, and allows to choose the rendering language for the map. I will try to get a planet.osm extract for Taiwan that people can use to experiment with this; thanks to people in #osm for giving me names of people to contact. I will try later after Europe wakes up from this even-earlier-than-usual sunday morning.

As I type this my internet connection is being once again powered by my DG834G. It's also very dark, but that's because I'm observing Earthhour (I don't think it'll change the world, but I don't mind sitting in the dark that much and there's only me in the house). After my last OpenWRT/AR7 experiment I thought I'd bricked the Netgear. I ended up using my BT Home Hub as a stop gap solution and wondered how to proceed. I bought a Conexant Accessrunner USB modem and tried it with the WGT634U. This proved more stable than the USB Speedtouch, but still resulted in a couple of line drops a day at least. AR7 still seemed the way forward. I picked up a D-Link DSL-502T off eBay. This has a USB port, an ethernet port and no wireless. However it's AR7 based and has 4MB of flash and 16MB of RAM; the same as the Netgear. It also has a serial header already soldered on, so it was easy to connect my level shifter up and have a play. I built up a recent OpenWRT and managed to install it successfully and then hook it up to my ADSL. All seemed quite stable and I was feeling pretty happy. In parallel with this I'd picked up a cheap D-Link G604T off eBay - this has a 4 port switch and wireless and is basically the same hardware as the Netgear. It was listed as faulty, but I was hoping to be able to use it for parts or at the very least for testing. As it turned out it worked perfectly; didn't need to reflash it or anything to get it going. I put the image I had working on the 502T on it and hooked it up. Again, everything seemed stable. I managed to get the wireless detected ok, but the driver doesn't seem to support AP mode that well - there are big warnings in dmesg when you enable it. It's an acx111 chipset and unfortunately there doesn't seem to be a lot of upstream activity - there's some work on a version using the in kernel 802.11 stack, but it doesn't currently compile with 2.6.24 AFAICT. Anyway. I had working ADSL with OpenWRT, albeit without wireless (having the switch was useful though, as the router lives beside the media box but also needs to be connected to the switch upstairs in the study). I'd chased Enta a week ago about IPv6 but still not heard anything, so I gave them another prod. This time I got a speedy response indicated my account was now enabled for IPv6 and providing me with a /64. I added +ipv6 to /etc/ppp/options and restarted PPP and it all just started working. In addition I've configured up radvd on the box so everything on the ethernet autoconfigs. Flush with the success of all this I thought I'd try my Netgear again and see if it was really dead or if I could get the original firmware back on it. For some reason that worked first time and the router booted fine. So I thought I'd try OpenWRT again, given that I had an image I knew worked fine on another AR7 router - if it didn't work on the Netgear I'd know there was some sort of hardware difference or problem rather than a build issue. And it worked. My DG834G is now running OpenWRT SVN r10685, doing IPv6 and generally everything I need except for wireless. I've updated my DG834G page a little bit, including a link to the OpenWRT config I'm using. Hopefully the wireless will get there; certainly most chipsets seem to be getting much improved upstream support these days and I'm sure it must be possible for the ACX guys to make use of the in kernel stack to reduce their work.

As blogged before, Debian is in the Google Summer of Code 2008.So far, we have rather few applications - much less than last year. This doesn't seem specific to Debian, other organizations have also been reporting fewer applications, and Google is considering a deadline extension. Maybe the low number is related to Easter holidays. Also at least at my university the summer term will start only on April 1st, just past the deadline. So many students probably are still away in holiday.Anyway: if you are interested in participating in the Google Summer of Code, chances are still pretty good. We don't have too many applications yet; not even all of the projects on the Wiki Ideas page have received a submission yet, only a few have received more than one; and even with those a well-written submission standas a good chance. Also some new ideas have been added in the meantime.In particular missing from our submissions list are:

• MergeMaster port
• debexpo
• CDD webtools
• security policy

(see the Wiki page for details on these projects).Especially the lack of a submission for the MergeMaster port is surprising. Many people would love to see a good configuration file merging tool in Debian. I can only guess that people are thinking "awh, everybody is going to submit an application for this one, I don't have a chance here". You currenlty DO have a chance, because there is no single proposal in for this one yet!If you have any questions, IRC channel #debian-soc in OFTC is pretty useful.

El Reg reviewed the Archos 705 yesterday. They only gave it 50%, which I think is a little harsh. I bought one of these back in November when they first came out, as something to help easy my daily commute by train. I have to say I don't regret the purchase; while there are various niggles that annoy me it basically does what I want. My main drive was the size of the screen. There are plenty of options available if you want in the region of 4", but I wanted something bigger that could still be shoved in a bag without any hassle. The 705's 7" screen is great. I can sit it on the tray table on the train and it gives a clear viewable image that doesn't leave me squinting trying to see it. The second concern was the battery life. At 7" you start to get into the UMPC area. However there didn't seem to be anything around that both offered enough battery life and had the grunt to decode DivX. I need a guaranteed 2hrs (ideally a bit longer) so I can watch something without being interrupted. I've certainly had over 3hrs on the Archos and various reviews claim it'll do 5hr for video without problems. Archos call the 705 a DVR. I've no idea why; I certainly wouldn't consider it one. I have the DVR station, but I've only used it to connect the Archos up to a hotel room TV and never for actually recording anything. There's no tuner (neither analog nor digital), so you need a Freeview/cable/satellite or similar box to provide a signal. Plus it seems pointless to convert a digital TV signal to analog and then for the Archos to have to re-encode it. Much more sane to record TV on your PVR and pull the file off that and onto the 705. Except there you hit a bit of a problem. By default the Archos supports DivX and WMV. To get MPEG2 or H.264 support, or indeed AC3 audio, you need to pay extra for a license that will enable the appropriate codec. This is annoying and I've ended up just using mencoder to convert Freeview records to an Archos friendly format rather than shelling out more for the codecs. Archos do seem to have dropped the ball here. The MPEG2 license fee seems to be $2.50 per device. The TI licensing seems to be about $2 for MPEG2 + AC3. Archos sell the plugin for €19.99. I doubt AC3 licensing is over $15, which rules out Archos merely keeping the cost down for customers by allowing them to pick and chose which codecs they want to avoid paying license fees. The 705 also comes with a web browser. Which, of course, you have to pay for. I ended up getting this thrown in with my 705 + DVR station bundle. It's powered by Opera and reasonable enough. The only time I've really made use of it is while staying in a hotel; it was quite nifty to have the 705 hooked up to the TV and be able to lie on the bed with the keyboard remote control and lookup film times or interesting places to go. Internet access is provided by wifi; if it had bluetooth as well then I might make use of it on the train, but as it is it's not really something I use much. As I said at the start I'm still happy with my purchase. It's not a cheap item, but it has the screen size and battery life I wanted and there wasn't a lot else out that offered both. Having to pay for codecs is a bad move on Archos' part, but I've avoided doing so by re-encoding. If you want something that's a decent media player of this size then the 705 is definitely worth considering; if you're not sure about the size aspect you may be better off with a 605 (the 4.3" screen version) or even something from Cowon (who unfortunately don't seem to have anything in the 7" range). Finally, if you already own a generation 5 Archos device, you might be interested to know that shell access has been obtained. The device is pretty locked down (signed kernel modules, no /dev/mem, signed root cramfs filesystem), but there's an arcwelder exploit to get an ssh login over wifi and an Archos Hacking forum on Archosfans.

Yesterday, I read an article on CNN called From $70K to food bank.

It describes a woman who was laid off in February from a job paying $70,000 a year. "Weeks later", with bills "piling up and in need of food for her family", she went to a food bank.

The article proceeds to talk about the subprime lending situation at great length, which is largely irrelevant to this person's situation.

Then we learn she applied for food stamps, but was denied. There's a quote from this person about how frustrating that was, and general "tugging at the heartstrings" trying to make us feel sorry for this woman with two children whose mother moved in to help make the house payment. It seems to me that this is a correct decision; someone that can pay a $2500 mortgage each month ought to move into an apartment before trying to leech food or money from social service agencies.

And that's where this story gets interesting.

She has an interest-only mortgage, and is managing to pay the $2500 bill each month.

If you're not familiar with an interest-only mortgage, here's how it works. The bank loans you money to buy your house -- say, $200,000. This is a loan, and you have to pay interest on it each month, just like a regular mortgage. But with an interest-only mortgage, you never pay off the loan. You could be making monthly payments for 30 years and still owe $200,000. In general, the only ways to "pay off" this kind of loan is to sell your house, or get a conventional mortgage that pays off the interest-only loan.

Interest-only mortgages were largely banned after the Great Depression. Prior to that time, they were how mortgages normally worked. But there are several problems with them. One is that you have to pay on them forever, even after you retire. Another is that you can't move unless you can sell your house for at least as much as the bank financed, even if you've lived there for 20 years. In times of declining housing prices and unemployment, that really stinks. People often default on the loans, and from a bank's perspective, that really stinks, too.

Interest-only mortgages are usually used by banks financing construction (we had one for a few months when we renovated our farmhouse) or other short-term projects such as professional real-estate investors that buy old houses and fix them up to sell at a profit. Except for these things, in general, they should never be used for a primary house. It's not in the interest of the bank or the homeowner.

But since you never pay off the principal, the monthly payments can be lower. It seems likely that this woman took a knowing gamble, buying a home more expensive than she could afford, and somehow found a bank willing to finance this. Problem is, both she and the bank took a knowing risk. If she ever ran into financial difficulties, she'd have to sell the house quick. But now the house is probably worth less than the value of the mortgage, so selling it won't remove the loan -- BUT it would let her pay off a large part of the principal, reducing her monthly payments and giving her some wiggle-room to buy food and pay off the rest of it.

It seems to me that she is unwilling to own up to the calculated risk she took, and wants society to help bail her out. Don't get me wrong; I think we need to help people that run into hard times. We need to help make sure they still have the tools they need to find a job and a place to stay. But bailing out people that take huge financial risks shouldn't be the job of society. Let's help them land softly, but not be enablers keeping them in a home they never could -- and still can't -- afford. Fortunately, I don't think anyone in government (or running for president) is suggesting we should.

Not only that, but her bank shouldn't have ever made that loan. Banks should be held accountable to not sell unwise products to people that rely on them for their primary residences.

Here's another interesting point: in just a few weeks, she had burned through her entire savings.

This, unfortunately, is a quite typical situation for many Americans. My financial planner, and I think most experts, suggest that everyone ought to have 6 months of income in liquid non-retirement assets (savings accounts, investments, etc.) in case something like a layoff happens. Very few Americans have this.

And when it comes down to it, isn't that part of the problem? The economy thrives on consumer spending. Or, put more starkly, overconsumption. If people start saving like they ought to, and stop feeling like they're outcasts just for not keeping up with the Joneses and buying every last gadget or the biggest house, we'd all be in better shape -- but the economy wouldn't have grown as much.

The growth it would have seen, had we all been more responsible, would have been a lot more durable and recession-proof, I think.

NMs, I’ve just realized who’s gonna help you. Her name is Morgan le Fay.

Adria — You will all burn in the fires of eternal DAMnation.
Morgan le Fay — Not if I have anything to do with it!

Stargate: The Ark of Truth (1:29:18)

We are all going to DebConf8, wanna start a meme?
Last week I've bought the plane tickets for DebConf8, ... I'll be there this year as well! Since I've liked this year FOSDEM "meme" of sticking images saying "I'm going to FOSDEM" onto blog posts, here is my small contribution: an "I'm going to DebConf8" sticker for your posts. It comes in .png format, but given that my gimp skills are quite limited here is the original .xcf in case someone wants to improve upon my work. Just let me know and I'll update the online version. Here is the HTML snippet for your pages:

<a href="http://debconf8.debconf.org">
<img src="http://media.debconf.org/dc8/images/debconf8-going-to.png"
     alt="I'm going to DebConf8, edition 2008 of the annual Debian developers meeting" />
</a>

See you in MDQ. Update: thanks to Ganneff the sticker is now hosted on media.debconf.org, the links and the snippet have been updated accordingly Update: thanks to Tincho the sticker has now better (i.e. wider) margins

At the moment I’ve got more time to work on these things than I have had for a while. I’ve got Etch support going quite well (see my post about my Etch repository [1]), the next step is to back-port some packages for AMD64 to get it working as well as i386. I’ve got an i386 Xen server for SE Linux development (which is also used for my Play Machine’s [2] DomU - so it’s definitely not for anything secret). I can give accounts and/or DomU’s to people who have a good use for them (the machine has 512M of RAM so could have 4-5 DomU’s). Currently it seems that the 2.6.24 kernel in Debian doesn’t work for Xen (at least on with an i686 CPU). I have filed bug report #472584 about it not working as a DomU [3]. This combined with the fact that according to bug report #466492 it doesn’t work as a Dom0 (which I have verified in my own tests) [4] makes the package linux-image-2.6.24-1-xen-686 unusable. Due to the inability to use 2.6.24 Xen I can’t do SE Linux development for Lenny in a DomU (Lenny tools build policy version 21 and the Etch kernel I’m using only supports policy version 20). So I have repurposed one of my servers for Lenny (unstable) development. I can give user accounts on that machine to anyone who has a good reason (and there are some people who I would give root access to if they need it). The current policy packages in Unstable are built without MCS support. This is a problem as converting between a policy which has MCS or MLS and one which doesn’t is rather painful (purge policy, reinstall policy, and reboot are all required steps). I have filed bug report #473048 with a patch for this - my patch may not actually be much good (I don’t understand some aspects of Manoj’s code) but it does achieve the desired result [5]. I won’t be making Apt repositories for such things as I expect that the changes will get into Debian fast enough. The next thing I am starting to work on is MLS support for Debian (currently it only supports the Strict and Targeted policies). See the Multilevel Security Wikipedia page for some background information on the technology [6]. I don’t expect that many people will use MLS on Debian in production environments, and it wouldn’t surprise me if no-one used it on a production server (although of course it would be impossible to prove this). But I still believe that it’s worth having for educational purposes. I am sure that there are packages in Debian of a similar size that will get less use so it’s not a waste of disk space on mirror servers! The only real down-side to adding MLS support is that it will increase the build time for the Debian SE Linux policy packages, currently they take 13 minutes to build on a 1.1GHz Celeron system (the Xen server I mentioned previously) and I expect that the machine in question will have build times greater than 20 minutes with MLS included. I will probably need to set up an Unstable DomU on a dual-core 64bit machine for the sole purpose of building policy packages. I will also have to investigate use of the “-j” option to make when building the policy to take advantage of the dual cores. I often do small tweaks to policy and it’s annoying to have to wait for any length of time for a result. The version of Coreutils that is currently in Unstable will have ls display a “+” character for every file when running SE Linux (I have filed bug report #472590) about this [7]. It is being actively discussed and at this stage it seems most likely that the functionality from Etch in this regard will be restored (which is using “+” to represent ACLs only not SE Linux contexts). It seems likely to me that I will find a few other issues of a similar nature now that I have started seriously working on Unstable. For the benefit of Debian and upstream developers who get involved in such discussions, please do not be put off if you join a discussion that is CC’d to the NSA SE Linux mailing list and have your message rejected by the list server. The code of conduct is much the same on most mailing lists, and the SE Linux list is not much different to others. The difference is that before your get your email address white-listed for posting you have to agree to the terms of service for the list. The people who run the list server appear to work more than 40 hours a week so there should not be a great delay. If anyone wants to get a message about Debian SE Linux development sent to the list without delay on a weekend then they can send it to me for forwarding. I am aware of some discussions about SE Linux and the Debian installer. I have not responded to them yet because I wanted to get some serious coding done first as an approach of “I haven’t done much coding recently but trust me I’ll fix the problems for you” might not be accepted well. I will start investigating these issues as soon as I have my Debian/Unstable server working well in enforcing mode. Update: I’ve just filed bug report #473067 with a patch to enable MLS policy builds [8].

• [1] http://etbe.coker.com.au/2007/10/19/my-se-linux-etch-repository/


• [2] http://www.coker.com.au/selinux/play.html


• [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=472584


• [4] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466492


• [5] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=473048


• [6] http://en.wikipedia.org/wiki/Multilevel_security


• [7] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=472590


• [8] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=473067

Share This

I've never been much of a podcast listener, largely because I haven't gotten my act together and downloaded any on a regular basis, and partly because the iPod is tied to Sarah's iTunes on her laptop, so it's not convenient to go fiddling with the iPod. If I ever manage to get back into the swing of things and get to the gym regularly, I think I'd prefer to listen to a podcast rather than straight music, so I can hopefully expand my brain while I'm slogging my guts out on the treadmill. Kynan and Shona have both talked about LugRadio events from when they lived in the UK, and I've been vaguely aware of it as a podcast (it's probably the first podcast I'd name if you asked me to name one). I vaguely knew that Kynan had been trying to organise something LugRadio related in the Valley for a while now. Well, it turns out he's succeeded, and it's good to see he's gotten some credit for it as well. Onya Kynan! So I got all excited when I went and looked at the schedule and discovered it was going to be something vaguely like a mini-linux.conf.au, I scurried off and bought a couple of tickets. Then Sarah pointed out that it's the weekend that we're going to San Diego for a four-day weekend. Oh well, at least the tickets were pretty cheap. So, if, unlike me, you'll actually be in the Bay Area on April 12th and 13th, check it out, it sounds like it'll be fun.

I switched from Pine to Mutt as my primary email client around the time I decided to become a Debian developer, because Pine's PGP support was abysmal (it also beat building Pine packages by hand all the time). The other bonus feature was it threaded emails, which made it easier to follow mailing lists. It's been a very gradual learning process since I switched, and I certainly don't consider myself to be a Mutt power user. I initially really hated it, I think largely because of the concept of "old, unseen" messages, versus "new" messages, and the behaviour of the Tab key. Once I unset the mark_old variable, it got a lot more tolerable. I think at some point I either plagiarised someone's .muttrc from the Internet, or sat down with the manual (or possibly a bit of both) and came up with a config that I could live with, and it's been workable ever since. One problem I (more recently) started having was that when I had 200-odd unread emails in my inbox, which has been pretty common occurrence in the last couple of years, and someone replied to an email in an old thread, because I wasn't necessary scrolling through all 200-odd emails (as new, unthreaded emails usually sorted chronologically at the bottom of my inbox), I'd miss the fact that the email had arrived, often for extended periods of time. I was lamenting this problem to Sarah over dinner last night, and saying how I preferred Gmail's behaviour, where the position of a thread in the inbox was determined by the date of the most recent email in the thread. I figured Mutt must have a sort option to be able to deal with this, and so I went rummaging in the manual last night, and discovered the sort_aux configuration variable. I've set that to last-date-received, and now I'm very pleased. I should never miss an email again. Of course, I should really try practising Inbox Zero, then it wouldn't be an issue.

Filip, I like my music loud, that's one of the main reasons I go to clubs in the first place. I also find it acceptable that people in the clubs I go to smoke, even if I don't. Coolness of earplugs is achieved by buying them in military shops, by the way.