Search Results: "ag"

11 November 2012

Vasudev Kamath: Weekly Log - 27/3 - 112012

OK I became again lazy to log my works and combined 2 weeks again :-). Most of my work is for Debian for this 2 weeks. This week was bit hectic I couldn't dedicate much time for any programming. This week I'm on vacation and will get more time to work on FLOSS and other coding stuffs. Only that I'm on slow network connection :-). Ok cya next week (hopefully) PS: My last weekly log never showed up in planet.d.o not sure what happened may be because I played with feed generating jekyll scripts. Hope this will show up in planet.d.o [1] http://code.metager.de/source/xref/linux/utils/util-linux/sys-utils/setsid.c
[2] http://vasudev.homelinux.net/display/copyninja/34241
[3] https://kakste.com/display/beardyunixer/974150
[4] anonscm.debian.org/gitweb/?p=collab-maint/friendica.git;a=summary

10 November 2012

Martín Ferrari: Amusing ourselves to death

What Orwell feared were those who would ban books. What Huxley feared was that there would be no reason to ban a book, for there would be no one who wanted to read one. --Foreword to the book. Just finished this book today. It was written in 1985, it talks about Dallas, and the 700 Club, Reagan and many other (by now) old fashioned things. It only talks about computers in passing, as this new thing that everybody is talking about. And it is extremely current. It's been 27 years, and it could have been written yesterday. You'll just need to replace some TV shows with Twitter, Reddit, or G+, but it has made me think a lot about my own relationship with information, and amusement. I couldn't help but think about this book when reading various essays that touch culture, education, or politics these days. It has also made me realise my own incongruence: being proud of not owning a TV, while I spent hours of my waking ours watching cat videos, news snippets in Google Reader, or curating links that have been reshared dozens of times. If you're at all interested in understanding our culture and discourse, do yourself a favor and get a copy. It's not long, nor dense in academic jargon. It's only 9 euro with free shipping in the Book Depository, and they even have a Kindle version in Amazon. Tags: Libros, Planet Debian

9 November 2012

Gunnar Wolf: Road trip to ECSL 2012 in Guatemala

Encuentro Centroamericano de Software Libre! Guatemala! During a national (for us) holiday, so it's easy to go without missing too much work time! How would I miss the opportunity? Several years ago, I started playing with the idea of having a road trip Probably this was first prompted with the UK crew and the Three Intrepid Motorcycle Riders arriving by land to DebConf 9 I don't know. Fact is, I wanted to go to DebConf10 in New York by land, as well as to DebConf12 in Nicaragua. Mostly due to a lack of time, I didn't Although we did start making some longish trips. Of course, my desire to show Regina what Mexico is like also helped! So, up until a week ago, our (according to my standards) long distance driving experience included:
  • M xico Guanajuato Puerto Vallarta Guanajuato M xico, in early November 2011, for Festival de Software Libre and with Regina and our Blender friends Octavio and Claudia. Totalling almost 1900Km, mostly consisting of wide, toll highway.
  • M xico Xilitla San Luis Potos M xico, in April 2012, just for fun and for a nice short vacation, alone with Regina. Totalling almost 1200Km, but through Sierra Gorda de Quer taro, a very tough stretch of about 250Km which we did at about 50Km/h on average. Beautiful route for sure! We didn't originally intend to go through San Luis Potos , and it does not appear to make much sense, as it adds ~350Km to the total, but it was even quicker than going back by the same route and according to those who now, even faster than our planned route, via Tamazunchale and Ixmiquilpan!
  • M xico San Luis Potos Zacatecas Aguascalientes Guanajuato M xico, in May 2012, for Congreso Internacional de Software Libre, again with Octavio and Claudia. Totalling 1250Km, and following very good roads, although most of them were toll-free.
But there is always a certain halo over crossing a border, maybe more so in countries as large as Mexico. We convinced Pooka and Moni, and granted, with some aprehension, as we knew of some important security risks in the more rural areas we wanted to go through we decided to go to Guatemala. And, although we wanted to go with a bit more time, Real Life took its toll: We could not take more time than the intersection of what our respective jobs offered. So, here goes a short(?) recap of our six day long, 3200Km trip. Of course, we have a map detailing this. Mexico Veracruz I came to my office early on Wednesday (31-oct), and left with Regina around 10AM towards Veracruz. We agreed to meet there with Moni and Pooka, who would take the night bus, and continue together. Crossing Mexico City proved to be the longest obstacle We arrived to Veracruz already past 3PM, and spent a nice evening walking down the center and port of the city. Veracruz port can still be seen as part of central Mexico; I knew the road quite well. Veracruz San Andr s Tuxtla Catemaco San Cristobal de las Casas We met with our friends at the iconic Gran Caf de la Parroquia at 6:30AM. Had a nice breakfast with coffee, and by 7:30 we were heading south-west. The reason to have a road trip was to get to know the route, to enjoy the countryside So, given we "only" had to make 650Km this day, we took the non-toll road A narrow path stretching along the coastal plains of Veracruz, until Acayucan. Doing so, we also saved some money, as the equivalent toll road is around MX$300 (~US$25)! Veracruz is a hot state. We ended up all sweaty and tired by 19:00, when we reached San Cristobal. We had agreed not to drive at night, due to security issues, but fortunately there was quite a bit of traffic both ways between Tuxtla Guti rrez (Chiapas State capital, around 1hr from San Cristobal, where darkness got us) and our destination, so we carried on. Now, San Cristobal is a high city, almost as high as Mexico City (2100m), and being more humid, it was quite chilly. We went for a walk, and were convinced that at a later time, we had to stay for several days there. The city is beautiful, the region is breath-taking, there is a lot of great handicrafts as well, and it's overall very cheap. Really lovely place. San Cristobal de las Casas Cd. Cuauht moc La Mesilla Guatemala Once again, this day started early. We woke up ready to leave at 7AM, and not earlier because the hotel's parking didn't open earlier. After a very quick visit to San Cristobal downtown, to take some photos that were not right the night before, we took the road to Comit n, stopping just for some tamales de bola y chipil n for breakfast. Central Chiapas is almost continuously populated, differing from most of my experience in Mexico. It is all humid, and has some very beautiful landscapes. We passed Comit n, which is a much larger city than what we expected, went downhill after La Trinitaria, crossed a plain, and continued until hills started taking over again. We stopped in a very chaotic, dirty place: Just accross the border, where Ciudad Cuauht moc becomes La Mesilla. This border was basically what we expected: There is no half-official place to exchange money, so we had to buy quetzales from somebody who offered them on the street, at MX$2 per Q1 (where the real exchange should be around 1.50 to 1). While on the road, I was half-looking for exchange posts in Comit n and onwards, and found none (and being a festive day, they would probably be closed anyway). But we were expecting this, after all, and exchanged just the basic minimum: MX$600 (US$50, which by magic became Q300, US$40). The tramit consists of:
  • Spraying the car against diseases (which has a cost of Q18)
  • Each of us has to go through migration. Note, in case you cross this border: We didn't expressly cross Mexican migration, so officially there was no record of us going out. Be sure to go through migration to avoid problems at re-entry!
    Migration has no cost.
  • Customs. As we were entering by car, I had to purchase a permit for circulation. I don't remember the exact quote, but it was around Q150, and the permit is valid for 90 days.
  • That's it! Welcome to Guatemala!
La Mesilla is in Guatemala's Huehuetenango Department, and from all of the Departments we crossed until Guatemala city (Huehuetenango, Quetzaltenango, Totonicap n, Solol , Chimaltenango, Sacatep quez and Guatemala), this is the largest one. Huehuetenango is home to the Cuchumatanes mountain ridge. We found beautiful, really steep, really fertile mountains. It is plainly amazing: Mountains over 60 , and quite often full with agricultural use Even at their steepest points! The CA-1 highway is, in general, in very good shape. There are however many (many, many) speed bumps (or topes, in Mexican terminology. Or t mulos in Guatemalan), at least a couple at every village we crossed, not always painted. The road is narrow and quite winding; it follows river streams for most of the way. We feared it would be in much worse shape, from what we have heard, but during the whole way we found only three points where the road was unusable due to landslides and an alternative road was always in place when we needed it. After Totonicap n, the narrow road becomes a wide (four lane) highway. Don't let that fool you! It still goes through the center of every village along the road, so it's really not meant for speeding. Also, even though the pavement is in very good condition, it is really steep quite often. It is not the easiest road to drive, but it's (again) by far not as bad as we expected. We arrived to Guatemala City as dawn was falling, and got promptly lost. Guatemala has a very strange organization scheme: The city is divided in several zones, laid out in a swirl-like fashion. East-west roads are called Calle and North-south roads are called Avenida (except for zona 4, I think, where they are diagonal, and some are Rutas while the others are V as). I won't go into too much detail). Thing is, many people told us it's a foolproof design, and people from different countries understand the system perfectly. We didn't... At least not when we arrived. We got quite lost, and it took us around one hour to arrive to our hotel, at almost 19:00 Almost 12 hours since we left San Cristobal. Went for a quick dinner, and then waited for our friends to arrive after the first day of work of ECSL, which we missed completely. And, of course, we were quite tired, so we didn't stay up much longer. Antigua Guatemala On Saturday, ECSL's activities started after 14:00 so we almost-kidnapped Wences, the local organization lead, and took him to show us around Antigua Guatemala. Antigua was the capital of Guatemala until an earthquake destroyed it in the 1770s; the capital was moved to present-day Guatemala city, but Antigua was never completely abandoned. Today, it is a world heritage site, a beautiful city, where we could/should have stayed for several days. But we were there for the conference, so we were in Antigua just a couple of hours, and headed back to Guatemala. Word of caution: Going from Guatemala to Antigua, we went down via the steepest road I have ever driven. Again, a real four-lane highway... but quite scary! The main focus for this post is to give some roadtrip advice to potential readers... So, this time around, I won't give much detail regarding ECSL. It was quite interesting, we had some very good discussions... but it would take me too much space to talk about it! The road back: Guatemala Tec n Um n; Cd. Hidalgo Arriaga So, about the road back: Yes, we just spent three days getting to Guatemala City. We were there only for ~36 hours. And... We needed to be here by Tuesday morning no matter what. So, Sunday at noon we said goodbye to our good friends in ECSL and started the long way back. To get to know more of Guatemala, we went back by the CA-2 highway, which goes via the coastal plains Not close to the Pacific ocean, which we didn't get to see at all, but not through the mountains. To get to CA-2, we took CA-9 from Guatemala. If I am not mistaken, this is the only toll road in Guatemala (at least, the only we used, and we used some pretty good highways!) It is not expensive; I don't remember right now, but must have been around Q20 (US$3). Went South past Palin and until CA-2, just outside Escuintla city, and headed West. All of Escuintla and Suchitep quez it is again a four lane highway; somewhere in Retalhueu it becomes a two lane highway. We were strongly advised not to take this road at night because, as the population density is significantly lower than in CA-1, it can get lonely at times And there are several reports of robberies. We did feel the place much less populated, but saw nothing suspicious in any way. Something important: There are almost no speedbumps in CA-2! The terrain stayed quite flat and easy as we crossed Quetzaltenango, and only in San Marcos we found some interesting hills and a very strong rain that would intermitetntly accompany us for the rest of the ride. So, we finally arrived to the border city of Tec n Um n at around 16:30 Approximately four hours after leaving the capital. The Tec n Um n Cd. Hidalgo cities and border pass are completely different from the disorderly and dirty Cd. Cuauht moc La Mesilla ones. The city of Tec n Um n could be just a nice town anywhere in the country, it does not feel aggressive as most border cities I have seen in our continent. We stopped to eat at El pollo campero and headed to the border. In the Mexican side, we also saw a very well consolidated, big and ordered migration area. Migration officers were very kind and helpful As we left Cd. Cuauht moc, Regina didn't get a stamp of leaving Mexico, so technically she was ilegally out of the country (as she is not a national... They didn't care about the rest of us). The tramit to fix this was easy, simple, straightforward. We only paid for the fumigation again (MX$60, US$5), and were allowed to leave. Anyway, we crossed the border. There is a ~30Km narrow road between Cd. Hidalgo and Tapachula, but starting in Tapachula we went on Northwards via a very good, four lane and very straight highway. Even though we had agreed not to drive at night... Well, we were quite hurried and still too far from Mexico City, so we decided to push it for three more hours, following the coastline until the city of Arriaga, almost at the border between Chiapas and Oaxaca. Found a little hotel to sleep some hours and collapsed. Word of warning: This road (from Tapachula to Arriaga) is also known for its robberies. We saw only one suspicious thing: Two guys were pushing up their motorcycle, from which they had apparently fallen. We didn't stop, as they looked healthy and not much in need of help, but later on talked about this Even though this was at night, they were not moving as if they had just crashed; nothing was scratched, not the motorcycle and not their clothes. That might have been an attempt to mug us (or whoever stopped by). This highway is very lonely, and the two directions are separated by a wall of vegetation, so nobody would have probably seen us were we to stop for some minutes. Be aware if you use this road! The trip comes to an end: Arriaga Niltepec Istmo C rdoba M xico The next (last, finally!) day, we left at 6:30AM. After driving somewhat over one hour, we arrived to Niltepec, where a group of taxi drivers had the highway closed as a protest against their local government's tolerance of mototaxis. We evaluated going back to Arriaga and continue via the Tuxtla Guti rrez highway, but that would have been too long. We had a nice breakfast of tlayudas (which resulted in Pooka getting an alergic reaction shortly afterwards) and, talking with people here and there, were told about an alternative route by an agricultural road that surrounds the blockade. So, we took this road the best way we could, and after probably 1hr of driving at 20Km/h, finally came back to the main road. We planned on crossing the isthmus using the Acayucan-Juchit n road We were amazed at the La Ventosa ("the windy") area, where we crossed a huge eolic plant for electricity generation, so of course we got our good share of photos. From then onwards, not much more worth mention. Crossed the isthmus via a quite secondary road in not too good shape (although there is a lot of machinery, and the road will much likely improve in the next few months/years), then took the toll freeway along Veracruz until C rdoba. We stopped for a (delilcious and revigorizing!) cup of coffee in Hotel Zeballos, where Agust n de Iturbide signed with Viceroy Juan O'Donoj the treaties that granted Mexico the independence. Traveller, beware: When crossing between Puebla and Veracruz, there is a steep slope of almost 1000m where , you will almost always (except if it's close to noon) find very thick fog; taking the highway from C rdoba, this is in the region known as Cumbres de Maltrata. We had the usual fog, and just as we left it, a thin but constant rain that went on with us up until we got home. Crossed Puebla state with no further eventualities, and arrived to Pooka and Moni's house by 22:00. Less than one hour later, Regina and me arrived home as well. This was four days ago... and I have finally finished writing it all down ;-) Hope you find this useful, or if not, at least entertaining! If you read this post in my blog, you will find many pictures taken along the trip below (Well, if you are reading the right page, not in the general blog index...). If you are reading from a planet or other syndication service... Well, come to the blog! Dreamhost woes Oh, and... Yes, it sometimes happens: My blog is hosted at Dreamhost. This means that usually it works correctly... But sometimes, specially when many people request many nontrivial pages, it just gives an error. If you get an error, reload once or twice... Or until your patience manages ;-)

Joey Hess: git push over XMPP

Imagine if you could send git pushes to any of your friends on Google Talk or other Jabber (XMPP) servers. Even though you're in different places and your computers probably cannot talk to one-another directly, you can share a git repository, without relying on a git hosting provider such as GitHub.
To xmpp::joey@kitenet.net
  * [new branch]      master -> xmpp/master
That's what I've built over the past week. So far, it's only supported by the git-annex assistant, but it would not be very hard to make this into a separate git-remote-xmpp program, and a push listening daemon, that could be used with non-git-annex repisitories too. You can read about the details in my git-annex assistant dev blog:
  1. day 124 git push over xmpp groundwork
  2. day 125 xmpp push continues
  3. day 126 mr watson come here
And yes, I update that blog every single work day. If you're not getting enough blog updates from me, and are not scared by rather technical posts, you might want to subscribe to it. :)

Richard Hartmann: Release Critical Bug report for Week 45

Erratum Last week's posting had the wrong week. Turns out the script always outputs week 42. As the weeks were so close to each other, I didn't realize this at first. I fixed this by hand for this posting and will have it fixed upstream by next week. Timing I have put a lot of thought into when to publish this. Friday so it's before the weekend? Sat/Sun so it's during the weekend? Monday so it's at the actual start of the week (sorry, people from the U.S.)? Feedback welcome, assuming anyone cares. The actual gist The UDD bugs interface currently knows about the following release critical bugs: How do we compare to the squeeze cycle ?
Week Squeeze Wheezy Diff
43 284 (213+71) 468 (332+136) +184 (+119 ; +65)
44 261 (201+60)
45 261 (205+56)
46 271 (200+71)
47 283 (209+74)
48 256 (177+79)
49 256 (180+76)
50 204 (148+56)
51 124 (124+54)
52 115 (78+37)
1 93 (60+33)
2 82 (46+36)
3 25 (15+10)
4 14 (8+6)
5 2 (0+2)
6 release!

Matthew Garrett: Last day at Red Hat

After four and a half years at Red Hat, I'm about to take the three weeks of holiday I've built up and am then heading off to Nebula at the beginning of December. I'm still planning on being active in UEFI and Secure Boot development, and don't expect anything to change in terms of my Fedora involvement. It's been a fun time here, so just imagine that I'm writing something about exciting future challenges while I go back to saying goodbye to people.

comment count unavailable comments

Olivier Berger: Using a DreamPlug with Debian as an IPv4/IPv6 router for a home LAN behind a FreeBox

The goal of this article is to describe the setup I've made for my home LAN behind a FreeBox (French ISP Free.fr).

1 Principles
The FreeBox is configured :
  • in router mode (with a local IPv4 network on 192.168.0.x/24)
  • with IPv6 support activated (by convention, we'll use the 2a01:e35:1234:5678::/64 prefix below, to represent the IPv6 prefix provided by the FreeBox)
Behind the FreeBox, I have connected a DreamPlug computer (running Debian wheezy with a dual-boot setup as sold by NewIT) on its eth0 etherlink port. Behind the DreamPlug, I have connected a switch (to its eth1 ethernet port), on which the LAN's machines will be connected, on a dual IPv4/IPv6 network. The IPv4 will be on 192.168.4.0/24 (addresses for machines connected to the switch will be static) while the IPv6 will use the addresses auto-generated on the FreeBox's prefix. The DreamPlug will also provide a wifi network (in master mode, through its uap0 interface), only IPv4 on 192.168.3.0/24. On the DreamPlug, the outgoing IPv4 traffic will be masqueraded, while the IPv6 traffic will be bridged so that machines on the LAN can be reached from the Internet directly, passing through the eth0 eth1 bridge. The DreamPlug will also act as a filter/firewall to only allow selected traffic to reach the LAN machines (in particular for the IPv6, since the machines may be reached directly from the Internet otherwise).

1.1 Alternatives
There are a lot of howtos describing the setup of FreeBox + IPv6, but I couldn't find one that was exactly reflecting the kind of setup I have. Some dealt with a FreeBox setup in bridge mode (i.e. not the router mode), but in case the DreamPlug isn't so much reliable, or I've messed with the config, I'm tempted to keep the possibility to connect directly to the FreeBox. Others didn't use the same setup with a router distributing both wired and wifi networks. And note described exactly the setup for a DreamPlug running Debian wheezy and using ferm as a firewall. No, there's no NIH syndrom here ;)

2 DreamPlug router configuration

2.1 Interfaces configuration
The /etc/network/interfaces on the DreamPlug looks like the following (kudos to Dag Bertelsen's Setting up Dreamplug as a router with Shorewall firewall for the wifi configuration bits):
# Note: Order of the interfaces declarations matters

auto lo
iface lo inet loopback

auto uap0
iface uap0 inet static
post-up /usr/bin/uaputl sys_cfg_ssid dream-uAP-XXXX
# Modus WPA2
post-up /usr/bin/uaputl sys_cfg_protocol 32
# WLAN password
post-up /usr/bin/uaputl sys_cfg_wpa_passphrase "WHATEVER PASSWORD"
# Set the Cipher
post-up /usr/bin/uaputl sys_cfg_cipher 8 8
# automatic channel
post-up /usr/bin/uaputl sys_cfg_channel 0 1
post-up /usr/bin/uaputl bss_start
# we deliver addresses for the Wifi with DHCP
post-up /usr/sbin/service udhcpd start
address 192.168.3.1
netmask 255.255.255.0

# Only IP6 traffic passes through the router between the Freebox on eth0 and the LAN on eth1
auto br0
iface br0 inet manual
bridge_ports eth0 eth1
bridge_maxwait 0
pre-up ebtables -t broute -A BROUTING -p ! ipv6 -j DROP
down ebtables -t broute -F

# Connected to the FreeBox, with DHCP in IPv4, masquerading outgoing IPv4 traffic
auto eth0
iface eth0 inet dhcp
up iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
down iptables -t nat -F
post-up sysctl -q -w net.ipv4.ip_forward=1
iface eth0 inet6 auto

# Connected to the LAN with a static IPv4 address
auto eth1
iface eth1 inet static
address 192.168.4.1
netmask 255.255.255.0

2.2 DHCP server configuration
The DHCP config for udhcpd is as such (in /etc/udhcpd.conf):
start 192.168.3.100
end 192.168.3.200
interface uap0
opt lease 86400
opt router 192.168.3.1
opt subnet 255.255.255.0
opt dns 192.168.3.1
opt domain localdomain
max_leases 101
lease_file /var/lib/udhcpd.leases
auto_time 5

2.3 Firewall configuration
The firewall I use is ferm. Here's the /etc/ferm/ferm.conf configuration (YMMV). Thanks to Ren Garcia's R gles de firewall pour un pont IPv6 for inspiration :
## Interfaces of the router

# Our LAN on a switch
@def $DEV_PRIVATE = eth1;

# The ISP router
@def $DEV_WORLD = eth0;

# Our Wifi LAN
@def $DEV_WIFI = uap0;


## IP networks of our LAN

# IPv4 (includes ethernet switch and wifi)
@def $NET_PRIVATE = 192.168.0.0/16;

# IPv6 (the prefix granted by the ISP)
@def $NET6_PRIVATE = 2a01:e35:1234:5678::/64;

# IPv6 Local link
@def $LINK6 = fe80::/10;

# Specific machines on the LAN
@def $MACHINE_MYDESKTOP = 2a01:0e35:1234:5678:1234:5678:9abc:def0;

# Special function to log dropped packets
@def &DROP() =
mod limit limit 1/second limit-burst 10 LOG log-prefix "$DOMAIN-$CHAIN: ";
DROP;


# IPv4 iptables rules
table filter
chain INPUT
policy DROP;

# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;

# allow local packet
interface lo ACCEPT;

# respond to ping
#proto icmp ACCEPT;
proto icmp icmp-type echo-request ACCEPT;

# allow IPsec
proto udp dport 500 ACCEPT;
proto (esp ah) ACCEPT;

# allow SSH connections from the private network and from some
# well-known internet hosts
#saddr ($NET_PRIVATE 123.45.67.89) proto tcp dport ssh ACCEPT;
saddr $NET_PRIVATE proto tcp dport ssh ACCEPT;

# we provide DNS and SMTP services for the internal net
interface $DEV_PRIVATE saddr $NET_PRIVATE
proto (udp tcp) dport domain ACCEPT;
proto tcp dport smtp ACCEPT;


interface $DEV_WIFI
# DHCP
proto udp dport 67:68 ACCEPT;
proto (udp tcp) dport domain ACCEPT;

proto udp dport netbios-dgm DROP;


# LOG all dropped packets
proto (udp tcp) &DROP();



# outgoing connections are not limited
chain OUTPUT policy ACCEPT;

chain FORWARD
policy DROP;

# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;

# connections from the internal net to the internet or to other
# internal nets are allowed
interface $DEV_PRIVATE ACCEPT;
interface $DEV_WIFI ACCEPT;

# LOG all dropped packets
proto (udp tcp) &DROP();



# IPv4 masquerade / NAT support

table nat
chain POSTROUTING
# masquerade private IP addresses
saddr $NET_PRIVATE outerface $DEV_WORLD MASQUERADE;



## IPv6:

domain ip6
table filter

chain INPUT
policy DROP;

# Internal traffic authorized
saddr $NET6_PRIVATE ACCEPT;
saddr $LINK6 ACCEPT;

# accept multicast
daddr ff00::/8 ACCEPT;

interface lo ACCEPT;

# For public traffic
# Only DNS resolution + NTP acceped for UDP
interface br0
proto udp

sport domain ACCEPT;

dport ntp ACCEPT;

&DROP();


# TCP on ports < 1024 forbidden except for SSH
proto tcp

dport ssh ACCEPT;

dport 0:1023 DROP;


# Accepted established traffic
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;

# incoming connections forbidden
proto tcp syn DROP;

# Accept ping
proto icmpv6 ACCEPT;


proto (udp tcp) &DROP();

chain FORWARD
policy DROP;

# All local traffic accepted
saddr $LINK6 ACCEPT;

# All ping accepted unless coming from internet
saddr ! $NET6_PRIVATE proto icmpv6 icmp-type echo-request DROP;
proto icmpv6 ACCEPT;

# Allow SSH to specific machines
proto tcp daddr $MACHINE_MYDESKTOP dport ssh ACCEPT;

# Accept established traffic
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;

# Accept outgoing traffic
saddr $NET6_PRIVATE ACCEPT;

# Accept local outgoing traffic
saddr ::1 ACCEPT;

proto (udp tcp) &DROP();




# ebtables
domain eb chain FORWARD
policy DROP;

# Only accept bridged traffic for IPv6
logical-in br0 logical-out br0
#ebtables -t broute -A BROUTING -p ! ipv6 -j DROP
proto IPv6 ACCEPT;


2.4 DNS config

The DreamPlug will run bind9 to cache the DNS for the wifi network (default config is OK out of the box).

3 Configuration for the LAN machines

3.1 Connection with Wifi
Machines connected with the WPA wifi network should get an IPv4 only address via DHCP on the 192.168.3.0/24 network. There's nothing to be configured specifically.

3.2 Ethernet connection on the switch
Machines connected via ethernet cables to the switch can run either with IPv4 config, in which case they should be configured statically for the 192.168.4.0/24 network, using the router on 192.168.4.1 as a gateway, or with IPv6 auto config. On wheezy, the /etc/network/interfaces will look like :
auto eth1
iface eth1 inet static
address 192.168.4.42
netmask 255.255.255.0
gateway 192.168.4.1
dns-nameservers 212.27.40.241 212.27.40.240

iface eth1 inet6 auto

4 To do list

The setup works fine, but there are a few things I'd like to improve :
  • running a regular Debian distro on the DreamPlug (the kernel used at the moment is patched for the wifi driver in master mode support), possibly using only Free Software.
  • using subnets for the IPv6 machines (but that seems not exactly obvious, requiring NDP proxying and stuff), so that the privacy is improved (the IPv6 auto generated global addresses depend on the MAC addresses hmmm probably not optimal).
  • adding more stuff to the DreamPlug router so that it becomes a full fledged FreedomBox.

5 References

Date: 2012-11-09 16:30:34 CET

Michal &#268;iha&#345;: New documentation for phpMyAdmin

I was quite unhappy with shape of our documentation for some time, but this week I finally found some time to dig deeper into conversion into something more usable. Nowadays I'm mostly using Sphinx for writing documentation, which allows to easily write using RST and provides output to various formats. Together with Read the Docs service, it makes great combo for providing user documentation, which I use for example for Weblate. So with a little bit of magic in Python and Beautiful Soup I was able to convert most of the HTML documentation into RST without tons of manual work. The resulting source (and ugly conversion script) temporarily lives on my github and generated documentation is available on Read the Docs. There are of course still many things to improve, but I think even right now it is easier to navigate than previous monolithic HTML file. Now we need to decide if and how to integrate this into official repositories and I can then continue on improving the documentation content.

Filed under: English Phpmyadmin 0 comments Flattr this!

8 November 2012

Jo Shields: Evil, or why Douglas Crockford is harmful to Free Software

Yesterday I received a new serious bug report against Mono in Debian. For those not in the know, serious severity is release critical, and can trigger removal of a package from the distribution in order to make a shipping release (e.g. if Debian is in deep freeze, as is the case right now). Bug 692614 relates to a single source file, ./mcs/class/System.Web.Extensions/System.Web.Script.Serialization/JsonDeserializer.cs, which is part of the System.Web.Extensions assembly. This file was written in 2008 by an upstream Mono developer, and is based on some code from json.org specifically JSON_parser.c and JSON_checker.c json.org code carries a non-standard license. Specifically, it s MIT/X11 with an added clause: The Software shall be used for Good, not Evil. I ve had some discussions with Mono upstream, and they believe that they have resolved the matter to their satisfaction their solution will make its way into Debian soon. But in the meantime, let s talk about the clause. The Free Software Foundation s Freedom 0 reads:
A program is free software if the program s users have the four essential freedoms:
  • The freedom to run the program, for any purpose (freedom 0).
The Debian Free Software Guidelines and Open Source Initiative s Open Source Definition clause 6 reads:
No Discrimination Against Fields of Endeavor The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.
It s fairly clear that the JSON.org license clause goes against both of these, making any piece of software using that license neither Open Source nor Free Software. It is not distributable by any organization which mandates Freedom for its users not in Debian, not in Fedora, not on Google Code. Anybody who cares about their users will reject a clause like this, because it has awful chilling effects. Think it s funny? It really isn t. Who can use the code without being at risk of a lawyer knocking on their doors? Can the Catholic Church? The ACLU? Republicans? Democrats? Military contractors? Genetic engineers? Big pharma? Petrochemicals firms? Communists? Fascists? Mono developers? WikiLeaks? Without a clear definition of good and evil , people need to seriously consider whether they are safe to use the code because if the developer and users interpretations of the terms differ, there could be hell to pay. Would you want to ship a hardware device let s say you re making a smart TV and have some developer of a library send his lawyers around to tell you sorry, TV rots kids brains, it s clearly evil to get your entire distribution channel shut down by injunction? It s not an oversight, kids. Upstream are well aware of the pain this childishness causes anyone who takes software licenses seriously. They giggle about it at conferences, like tweenagers who think they ve one-upped the adults in the room. This non-Free license is intended to mock people who take licensing seriously. In fact, one could easily categorise efforts to pollute the Free Software ecosystem with fake, non-Free software as evil, which would mean all JSON.org code fails to comply with its own license, due to shipping with its license (Inception, anyone?). Before the jokers in the room claim that this kind of problem is deserved by Mono, let s take a look at all the software in Debian which Douglas Crockford endangers with his childishness. PHP? OwnCloud? jQuery? You think Debian serves its users well by pulling jQuery from the next release in order to serve the ego of a man behaving like an eleven year old? It is also interesting to note that the author of this do no evil clause works at PayPal. Read that twice, go and repair your irony meters, then come back. In conclusion: thank you so VERY much Doug Crockford for making the world of Free Software measurably worse.

Paul Tagliamonte: an update on debuild.me

Between working on dput-ng, I ve been working more on debuild.me s infrastructure for the last month or so (slowly). In the end, this should support some pretty exotic setups, including a mixed AWS node farm (which scales with the package load) and physical nodes (for stuff like ARM, etc), AWS only, or real host only. I need to finish up a lot, but this shot looks like it s going to be a lot more viable. After I get back from a trip, I ll be working on this more. Soon. Soon.

Tanguy Ortolo: Licence to kill -9

The title of the next James Bond movie! Or will that be the next OpenBSD release song? ;-)
Parody of a James Bond movie poster: licence to kill -9

7 November 2012

Russell Coker: Rape Apology and LCA 2011

After a lecture at LCA 2011 included some inappropriate slides there was a long discussion on several mailing lists about the issues related to this. In February 2011 I wrote a blog post debunking some of the bogus arguments in question [1]. Of course the matter didn t end there, at LCA 2012 I was drawn into a few debates IRL about the issues, as long as there are more than a few men who want such porny pictures used in LCA talks the issue can t be properly resolved. The most serious aspect of the discussion in question is that of rape apology, the bad ideas that were presented have a real impact on the way people behave, merely making public statements saying that something is OK is going to increase the incidence of it happening. The Geek Feminism Wiki has a good page summarising the issue [2]. The Finally Feminism 101 post about Rape Culture is also worth reading in this context [3]. Recently Valeria Aurora wrote a post for the Ada Initiaive blog about the rape apology issue and how the community needs to act to prevent such behavior [4]. This inspired Matthew Garrett to write about the issue and state the position that In the absence of an apology and explanation from Ted, I ll be interacting with him to the bare minimum that I m compelled to as a result of my job [5]. I agree with Matthew s article, everything he writes is logical and I believe that it is all for the benefit of the FOSS community as a whole. I think that most guys have quietly defriended guys who are rape-positive in the past (for example when I was 12 I refused to play D&D with boys who were raping NPCs). But blogging about it, explaining the problem, and giving the offender the possibility to reform is a good idea and it s something that should be done more often. Sam Varghese has written about the issue for ITWire [6]. He has taken the wrong approach to this, he specifically claims that Matthew Garrett has kicked off what could be a damaging episode . I think that Matthew s approach is necessary and the situation demands it. If Matthew had been on holidays and I had read the TAI post earlier then I would probably have written a blog post which Sam could have described in a similar manner. So I don t think that Matthew kicked anything off (I think that someone had to do it). I also don t think that this has to be damaging it depends on how everyone reacts. On her personal blog Valerie says When I first read Ts o s comments, I couldn t sleep for two nights. I wanted to throw up every time I thought about it. I was furious and frightened at the same time. Every time I think about this, even now, I literally have nightmares. I can t bear the thought of working with him even over email, much less attending the same conferences [7]. I don t think that any of us who are seriously involved in the FOSS community have a way of avoiding this issue, allowing Valerie and other women who have the same understanding of the situation to go through that without any support is not a neutral action. I think we need to consider whether someone who gives other delegates and speakers nightmares should be welcome to attend a conference. Valerie s post makes sense to me and I can understand why she doesn t want to associated with Ted, my understanding of the issue isn t important or even required, I merely note this because I m sure that there are lots of readers who will ignore anything that a woman might say. ITWire has a follow-up article with Ted s response, Ted fails to address all the issues and seems to think that the people who disagree with him merely don t appreciate his nuance [8]. The thing is that the issue of the incidence of rape was raised in discussion to consider the probability that rape survivors would have been in the audience for the Mark Pesce talk in question. None of Ted s claims indicate that rape could be rare enough that a crowd of 500+ random people could be expected not to have multiple rape survivors so his comments weren t even relevant to the discussion. Ted seems unwilling to try to understand the position of all the people who disagree with him.

Pablo Lorenzzoni: That s a lot to do!

Reading about Michael Stapelberg s codesearch I bet a lot of people had the same idea. I just had to post a screenshot of it: It seems we have a lot to fix :-)

Michal &#268;iha&#345;: RTL languages support

While working on tool for online translating, I should have probably expected this, but somehow it surprised me - Weblate should support RTL languages. This issue was brought to me today by Yaron Shahrabani (Hebrew translator of Wine) and I simply had to look at this quite unexplored area for me. Fortunately it seems to be pretty easy, just matter of adding few html attributes to right places. I've quickly adjusted the code (the hardest thing was to get list of RTL languages) and Weblate should now properly support RTL languages on both sides - as an user interface language and as a translated language. In case you understand any of Arabic, Farsi, Hebrew, Urdu or other RTL language, I'd really like to hear from you if Weblate shows them correctly.

Filed under: English Weblate 1 comments Flattr this!

MJ Ray: Adrift @coopsutd in @coopParty workshop

image

Welney washes

Sometimes I felt at home at Cooperatives United, like at the wonderful fringe dinner at Eighth Day last Thursday night. Sometimes I felt overwhelmed by the flood, like at the cooperative party workshop on Friday morning. The workshop addressed the key questions: why do we want cooperative politicians, what could they do and what are the needs and challenges facing them? Personally, I felt the first is obvious and the answer is all the second. It s both frustrating (few ask why other movements want to influence politicians) and reassuring (no taboo topics) that the first question is asked. There were many fascinating answers to the other two questions from around the world. As so often with workshops, few hard conclusions were reached, but I think some interesting conversations were started there, which we might hear again in the future. What would I call the top challenge? Persuading open and transparent co-op members to join the party. I ve written about my difficulty with joining political parties in the past, as some forms of collective responsibility are against my beliefs and I m not sure that joining a small party will help anyone much, but I think I ll take another look at the cooperative party, all the same. The picture above is of the Welney washes, some miles south-west of Lynn. It s a stunning wetland environment, and it surprises me every time the train crosses the floods, as it did on the way to Manchester. And yes, I ve shoehorned a picture I liked into this article!

6 November 2012

Jon Dowland: Debian Day #12

A few bits and pieces:

Jon Dowland: Microsoft Windows Surface RT

Some quick first impressions of the Windows Surface RT I just can't figure out what Microsoft are aiming to achieve with this. They've overpriced it and sold it short at the same time by promising a much better amd64/x86_64 one in the future. The end-to-end secure code execution means they're stuck waiting for the app store goldrush but there's no market for people to bother porting software to it. Even the most basic apps (google link on home screen/whatever it's called) don't work/can't be installed. It's telling that Redhat, a multi-billion dollar company, don't feel it's worth investing the $99 required to get an ARM Fedora boot path signed so that you could run Fedora on the hardware. No doubt that is a convenient side effect for MS: As much as it would be nice to imagine they consider Linux enough of a threat to have purposefully locked it out, I suspect the resilient to viruses is the key reason. And indeed, in tablet land, poor Android is the most pest-ridden platform. Who would have seen that coming? The USP, if there is one, is "full office", but the text lag makes it a fairly unpleasant experience to write anything serious on it. The basic keyboard is utterly unusable, and the posh keyboard pushes the price deep into proper laptop territory. Heck, my beloved x121e, the machine I live on for work and play, cost less than the tablet with even the basic keyboard.

Jon Dowland: Chronic

I've been ill for around 18 months. I started off ill, and more recently became more ill, so that I'd mentally divided my illness into two distinct periods. The truth, it turns out, is not quite so clear-cut. My more recent period of malaise spurred me on to seek a different treatment, which has restored me to a state of well-being which I had honestly forgot existed. It's quite possibly a combination of the desired outcome of treatment and also a side-effect of the drugs I'm on at the moment but I feel both mentally and physically the best I have in a long time. My mind is burning with ideas once again. Responsibilities and chores that used to sap me now seem less daunting. Having acclimatised to a steady-seeming state of being, which turns out to not be "well", I'd started to wonder if, in some respects, I'd reached the limits of my abilities. The knock-on effect of that was, to me, to consider what the future held, in many regards, including in terms of career. There were some benefits to my prior state of being. I'd begun to learn how to relax, how to wind down, how to not bite off more than I could chew. In particular I'd stopped worshipping at the alter of multitasking and started to give proper attention to one significant task at a time, with corresponding improvements in my productivity. These useful chunks of self-discipline have fallen to the wayside a little bit now. I'm enjoying a holiday in the body-and-mind landscape of my past. I don't feel too guilty about it. I think I deserve it. But I mustn't linger here too long, lest I forget those hard-won lessons. I've not managed to follow through on a lot of things I've tried to pick up over the last year and a half: software half-finished; Debian committments uncompleted; and I've felt a lingering sense of guilt about that, but at least I now have an explanation. Currently reading: Chronic City, by Jonathan Lethem.

Michael Stapelberg: Debian Code Search

I hereby announce a new Debian project: Debian Code Search. Debian Code Search is a search engine for program source code within Debian.
It allows you to search all 17000 source packages, containing 130 GiB of
FLOSS source code (including Debian packaging) with regular expressions. You can use the search engine at http://codesearch.debian.net/
Here are a few sample queries: The corresponding thesis (and source code, of course) will be released soon
(2013-01-15 being the deadline, but I hope I can do it earlier).

Stefano Zacchiroli: bits from the DPL for October 2012

Freshly baked, bits from the DPL for October 2012.
Dear Project Members,
another month, another periodic report of DPL-ish activities, this time for October 2012. Highlights Debian on public clouds I've spent quite some time to improve Debian presence on the so called "public clouds". Following up to an inquiry of a fellow developer, I've reached out to Microsoft to investigate the possibility of having Debian as an option on Windows Azure. Around the same time, I've been approached by Amazon to have Debian as an option on the AWS marketplace. In both cases, we will need to overcome challenges of various kinds, at the technical (e.g. image preparation), bureaucratic (e.g. terms of the agreements we'll need to accept to be present), and political (e.g. chain of trust, platform freedom) levels. Up to now, discussions have been going on mostly in private, simply because they started as 1-to-1 inquiries and continued from there, but there is no good reason they should remain so. Hence, thanks to the listmasters and in particular Alexander Wirt, we have setup the new debian-cloud mailing list. If you are interested in these topics please join the list. For both Azure and AWS there is good progress on the technical part already; summaries will soon be posted on the list so that we are all on the same page. Similarly, I'll post there status reports about the bureaucratic requirements. And of course there is no reason to focus on specific clouds, if you'd like to support others and are willing to put some work to that end, please join the list and let us know. DPL helpers meeting I've already bothered you at least in my last platform and DebConf13 talk with observations about how non-scalable the DPL job is. After having collected applications of DPL helpers for a while, I've finally sat down and tried to put those applications into good use. The idea is simple: to the extend of possible, we should shift from a one-man-band job to a more "board-like" job, with people sharing an agenda, a list of outstanding tasks, and public communication. We have started slowly, setting up the #debian-dpl IRC channel and running periodic bi-weekly meetings there. You can find the meeting minutes and full logs at the usual place. We are still ramping up, so we don't have yet "fancy" stuff like a mailing list or an issue tracker entry, but they're in the working. Some of the outcome are starting to show, too (e.g. as part of recent discussions on 3rd party orphaning, or on our inbound trademark policy, or even in the forthcoming DMCA policy to make mentors.d.n an official project service). It's an experiment and a big challenge. I'm, for one thing, not yet convinced there are enough people interested in sharing the load of DPL duties (that look boring, for many tech geeks) in the long run. But I'm also convinced that the sustainability of the Debian organization model depends on this, so it's worth trying. If you're interested in the challenge and willing to volunteer some of your time, please join us on #debian-dpl . I'll take care of keeping the project informed of further evolution, in particular about the communication channels we will pick for day to day activities and accountability. Events / public communication I've spent most of my remaining Debian time in October attending events on behalf of the Project, in particular: On the topic of public communication, I've also coordinated with the press team an answer to a press inquiry about Secure Boot (which has become part of this article), and happily vouched for the Ubuntu charity marathon, adding some Debian challenges to it. Delegations As largely overdue matters, I've finalized the delegations mentioned last month, namely: FTP masters, New Members Front Desk, and Policy editors. Assets and legal stuff Miscellanea Now let's all go back to RC Bug squashing to make Wheezy a reality. SPAM-my link of the month is http://udd.debian.org/bugs.cgi and its various "views" at the bottom of the page. Cheers.
PS the day-to-day activity log for October 2012 is available at the usual place master:/srv/leader/news/bits-from-the-DPL.txt.201210

Next.

Previous.