Joey mailed lately just another announcement for the m68k port ermeeting. This year in Kiel from August 29th - 31st:

Executive summary:

2008 M68k Linux Porter Meeting
August 29th - 31st
University of Kiel, Germany


This summer we are organising a Linux porter meeting especially
targetting the m68k architecture. During the meeting current problems
of the m68k architecture, its integration in Debian, releases
etc. will be discussed.

The meeting will take place at the last weekend in August (29-31) at
the University of Kiel, Germany. Details and participants are
collected here:

This meeting is evolved from the Oldenburg porter meeting that has
started with the m68k architecture but had to stop two years ago.


Interested developers and supporters are invited to join the meeting
and help develop the m68k port of Linux.

If you are interested to attend this meeting, please drop Christian
(cts) or me a note or add yourself to the Wiki page.

Regards,

Joey

Despite all the problems the m68k faced in the last years, we're still alive and performing fine. Part of the meeting will be discussion about the current changes of the m68k port like Aranym buildds and other stuff.

So, if you're interested in the m68k port or the experience of the m68k porters for your embedded architecture, come to Kiel and visit us! :-)

For those of you wondering how is the battle against the Brazilian Internet Surveillance Bill, I have to report we already got more than 100-thousand people to sign the petition. You can check the current count in the image on the right. I am updating it every 15 minutes, so you can even use its URL in another place (as are some people doing already). The bill will be voted by the Chamber-of-Deputies any time now We heard it would be on yesterday, but apparently it was not even enlisted for this week. This doesn t mean much, since the Deputies can hold an out-of-list voting we ll be watching. Meanwhile, I read an article by S rgio Amadeu that summarizes some of our feeling about that bill. Are we in the Western World (allegedly freedom lovers) turning into control-freaks? A whole lot of people I know are not even offended by this bill! These are the same people that don t think it s weird that USA claimed the right to seize any storage device entering their borders, for any time they want, with no warranted privacy. Are we in a middle of a paradigm shift? Are we accepting less freedom? What would George Orwell think of that? Maybe we got in a wormhole and ended up in 1984

Sure, that sounds fairly formal to send a report for holidays, doesn't it? Anyway, as I have a few (often Debian/FLOSS related) friends around the world who are reading my blog entries, this might interest them so that's indeed a report..:-)...and I have time for it, so... I'm currently going back from Cahors to Maurepas (home), on my way to Debconf. We spent 10 days in Cahors with Elizabeth and the girls, finally joined by Jean-Baptiste on Sunday. We had great time over there, enjoying the richness of Quercy:

• heat (I need that before MDQ winter)
• nice running spots: for once, I could run by starting from the bottom of hills, climbing *up* and finishing down. I ran a lot, sometimes on very hard tours such as 18km with 300m positive height difference. I also did a few "fast" runs ("fast" here would make a few Debian friends laugh a lot, isn't it Ralf, Dirk.....)
• medieval architecture in Gourdon, Martel, St-Cirq Lapopie, Cahors...
• peace of the Lot valley
• Cahors wine: strong and tasty, of course
• Rocamadour and Trappe d'Echourgnac cheese (I won't bring Rocamadour at Debconf as it wouldn't survive)
• rest, sleep
• McDonald's parking lot for network connectivity
• very little hacking

So, I'm now heading back home, assemble stuff and will take off for Debconf on Thursday 7th (Paris Orly to Madrid, then Buenos Aires via Air Europa: IIRC nobody from Debconf is in the same flight). "Assemble stuff" here also means collecting cheese for the now famous Debconf Cheese&Wine party. That one will be tricky to achieve as most of us are coming from quite far away and...there are only 6 French citizens who attend DC8..:-)). Anyway, I already know that my fellow Nicolas Fran ois (namely nominated as Assistance CheeseMaster recently) will bring some good stuff. I haven't decided yet what to bring. I might be influenced by my holidays, so cheeses from South-West France are highly probable. Cahors wine will be the choice (prepare yourself: that is strong stuff). At Debconf itself, we'll have a quite busy schedule. I intend to mostly work along with Felipe, Nicolas, Grisu and others on i18n.debian.net. I'll have to animate the i18n sessions for which I want to prepare some schedule instead of just "lat's gather and talk" which didn't work so well last year, IMHO. And I have that bloody keynote lecture which, BTW, could be rescheduled if I properly read debconf-discuss as, finally 9am for keynotes seems to be considered too early for the late birds at DC8...:-)... We'll see: I will certainly have something that's not very well cooked and prepared. Expect some improvisation: this year I didn't want to stress myself with a talk, slides and blahblah. Elizabeth will come back from Cahors on Saturday with the kids. She'll have a holiday week at her father's place whil ethe kids will....do their stuff at Maurepas (this is what happens when kids are grown up). We'll gather together again on Aug 18th and I go back to work on 19th. Crazy, I know but I have a very busy and full work schedule for the upcoming next 2 months. September will be a hard time to go through: Jean-Baptiste will start his "Licence Profesionnelle" in Automated and Embarked Systems. He'll do it in shared time: half-time at university for classes and half-time working in a company (which turns out to be Essilor, the world leader for progressive glasses....and the company which Elizabeth is working for). He'll stay at my sister-in-law place during the week (30km away from our place but closer from university and work). Sophie, our 18-year old daughter, will spend the year in Toulouse, to prepare the admission in a Social Workers school. She'll have her own apartment, in the very center of the city, 20 meters away from Place du Capitole. Annoying, isn't it ? :-) So, we'll mostly stay with our "little" Magali, our 16 y.o. who will be attending High School, on her way to Baccalaur at. Tell us about shrinking families.... Now time to work on some slides for the Debconf keynote. Damn.

It’s widely regarded that the best practice is to set the time zone of a server to UTC if people are going to be doing sys-admin work from various countries. I’m currently running some RHEL4 servers that are set to Los Angeles time. So I have to convert the time from Melbourne time to UTC and then from UTC to LA time when tracking down log entries. This isn’t really difficult for recent times (within the last few minutes) as my KDE clock applet allows me to select various time zones to display on a pop-up. For other times I can use the GNU date command to convert from other time zones to the local zone of the machine, for example the command date -d "2008-08-06 10:57 +1000" will display the current Melbourne time (which is in the +1000 time zone) converted to the local time zone. But it is still painful. In RHEL5, CentOS 5, and apparently all versions of Fedora newer Fedora Core 4 (including Fedora Core 4 updates) the command system-config-date allows you to select Etc/GMT as the time zone to get GMT. For reference selecting London is not a good option, particularly at the moment as it’s apparently daylight savings time there. For RHEL4 and CentOS 4 the solution is to edit /etc/sysconfig/clock and change the first line to ZONE="Etc/GMT" (the quotes are important), and then run the command ln -sf /usr/share/zoneinfo/Etc/GMT /etc/localtime. Thanks to the Red Hat support guy who found the solution to this, it took a while but it worked in the end! Hopefully this blog post will allow others to fix this without needing to call Red Hat. In Debian the command tzconfig allows you to select 12 (none of the above) and then GMT or UTC to set the zone. This works in Etch, I’m not sure about earlier versions (tzconfig always worked but I never tried setting UTC). In Lenny the tzconfig command seems to have disappeared, now to configure the time zone you use the command dpkg-reconfigure tzdata which has an option og Etc at the end of the list. Updated to describe how to do this in Lenny, thanks for the comments.

Share This

As mentioned elsewhere, LSB 4 is due out soon, and won’t really make a lick of difference when it comes to improving compatibility with non RPM/redhat-like systems. With software appliances and software as a service becoming more relevant, and appliance-oriented non-RPM distributions like rPath, Ubuntu JeOS and Defusion coming around that offer equal (or arguably better) value to customized Fedora/RHEL/CentOS and improved administrative ability due to using tools not stuck in the 1990s (RPM, I am looking at you here), one would think that the LSB working group might actually want to make LSB not suck. Right now, Debian derivitives like Ubuntu JeOS and Defusion can compete by using alien, and rPath has the RPMPackageRecipe for conary, but these are kludges and carry their own share of problems. So, why does the LSB require a specific format? There’s no reason for them to. Really, LSB compliance is a redhat-only club. Not just an RPM-only club… last time I checked, SuSE is in the same boat as everyone else and they use RPMs. A lot of the LSB needs to simply be ripped out in order to do any good. Until the LSB working group is willing to drop a lot of the RedHat-isms they have had, non-RedHat distros will always have problems complying. What about source-based distros like Gentoo for example? There is really no easy way they can comply by default (on the other hand, do they care to?). To put things simply, the LSB sucks. Here’s why:

• The LSB spec depends on RPM. I mean, come on. Seriously. Why do they need to require a specific package manager? If package handling is really required, then why not create a simple package format that can be converted on demand into the system package format? Or why care about packages at all?
• The LSB spec invents things without consulting distros. Like the whole init scripts thing. But that’s not as bad as depending on RPM or requiring a specific layout.

Ideally, the LSB spec would define a config format capable of describing how the system worked, and all of that, but it doesn’t. Until it does, then the LSB spec is worthless, because it can’t handle all distributions (even the common ones).

Hi, it’s that time again: new alpha version of Adept hits the block. For the unaware, Adept is an APT front-end for KDE. You can do all the cool stuff with it that the other kids can’t. Join the fun! New features since Alpha 5 (the list is a little less staggering than the last time, sorry about that, but it’s only been a week)

• Tags are back! Enhance your searches with tags. Very cloudy, very buzzword-compliant, so very web two-oh. It actually works, too! (No irony intended. Maybe…)
• Status-based filtering,
• improved search in installer,
• much better error handling for dpkg and download errors,
• lost icons are back and a load of other bugfixes.

Where to get I have again prepared binary packages, this time even more of them (a Hardy backport is included). Traditionally, in Debian, you can install alpha 6 from experimental:

apt-get install -t experimental adept

The sources.list goes:

deb http://ftp.debian.org/debian experimental main

If you are on Kubuntu Intrepid, the line is:

deb http://ppa.launchpad.net/mornfall/ubuntu intrepid main

and finally, on Kubuntu Hardy, the lines are (BUT: read below!)

deb http://ppa.launchpad.net/kubuntu-members-kde4/ubuntu hardy main
deb http://ppa.launchpad.net/mornfall/ubuntu hardy main

Big fat warning: Due to somewhat unexpected difficulties, Adept requires newer APT than available in Hardy. This means, adding the above sources.list lines will upgrade your apt to a version from Intrepid, that’s also completely untested on anything resembling a Hardy installation. Be wary. Moreover, installing Adept means means KDE 4.1 for Hardy users. (This does not apply to Intrepid users, they are already on the cutting edge and no extra dangers lie this way.) (For all Kubuntu users, there are more instructions to be found on https://launchpad.net/~mornfall/+archive.) Heroes of Alpha 6 I hereby nominate the “Heroes of Alpha 6”, for their deeds that helped Adept move forward:

• Yuriy Kozlov, for early pre-release testing and numerous patch contributions throughout the 3.0 alpha series
• Jonathan Thomas (JontheEchidna), for discovering two bugs:
  • failed downloads resulted in a cryptic internal errors
  • an installer crash when using the search
• Samuel James Sarette (lunarcloud), for discovering that you could start apply changes twice in a row, by switching back to changes and hitting apply again (not surprisingly screwing up Adept)
• and finally, Jonathan Riddell, as there’d be no 3.0 alpha series without him…

(And a totally flirtless wink towards Blauzahl, who somehow inspired me to actually do some bugzilla sorting…) And now, it’s easy to join the ranks of these heroes — just test the new alpha version and find bugs. Immortality won’t escape your grasp. Also, please don’t forget to read the next section. Jobs for Alpha 6 Sorting through Launchpad for bugs that have been fixed in alpha 6 (compared to 2.1) would be really awesome. It is a big list and many of them are likely to need testing. (I can take care of that for the KDE bugzilla, but launchpad is a task just too daunting for me and my time possibilities, so help would be very much appreciated). Notifier is still not included. The components to test are (if you have sudo, kdesu for the rest):

sudo adept
sudo adept installer
sudo adept updater

Please give a go to all of them, report rough edges, crashes and all that, either through IRC (mornfall at freenode, oftc) or mail me-at-mornfall-dot-net or use KDE Bugzilla. Known Issues

• Sometimes, it seems that the installer search manages to break the layout. Change the search text and try again, it might fix itself. If you find a way to reproduce, please let me know!
• The installer search is still a little wonky at times (and maybe slow, dunno). And when there are no results, it keeps whatever groups there were before, they are just all empty. Oops.
• Icons fail to load on Kubuntu Hardy.
• Search seems to crash Adept just after installation on Hardy (could be related to xapian database update). Starting it again seems to help though. UPDATE: this does happen on other distributions as well. You run into the problem if you don’t have apt-xapian-index installed, you install it together with adept and then run adept right away. Then you get a crash on first search. Just restart adept and all should work just fine.
• UPDATE: When recovery fails, Adept will crash instead of reporting the error and closing gracefully. Run dpkg —configure -a.
• UPDATE: Don’t run adept through kdesudo on Kubuntu. It seems to cause mysterious issues with dpkg (and especially hal upgrades). No insight so far as to what is the problem.

One of the things of getting too much mail is that you will get swamped in it, sometimes to the level of not even managing to figure out there's been replies on your blog for the past several weeks. Oops. Apparently quite a number of people answered to my blog post about the belgian government issues, and I only found out right before leaving for Argentina. They're now all accepted from moderation, but that doesn't mean I can't follow up on them anymore. Most of them just agree with what I have to say, or posit another opinion (which is fine), but some clearly show a misunderstanding of what I was trying to say. So, since I don't want to appear as one posting gibberish, allow me to clarify:

"I could say that some other things about the past deb cle also puzzle me, such as the insistence of some people to get an unconditional split of BHV, thereby destroying all chances of even remotely reaching a compromise." You are saying that you would accept giving in to the demands of the Francophones that the Flemish give up territory. (Think about it, what century are they from? In what other country does one community demand the enlargement of its territory as an exchange for fixing a situation which the constitutional court has ruled to be illegal?)

Thanks for asking, but no, I'm not saying that. Let's be clear about this: there's a huge difference between a position that says "we need to split BHV, period" on the one hand, and "we need to give territory to the francophone community" on the other. It should be perfectly possible to, say, have the flemish community come up with some benefit to the francophone community in some respect somewhere that does not include "giving territory to the south of france"; but apparently the "negotiators" think not. To quote just one example: at some point Reinders (MR) suggested that a federal election circle be created to replace BHV, so that francophone politicians could still be elected in flanders, but also the other way around. This proposal was however killed by flemish politicians before the press as "not even negotiable" without even having discussed it. This, and other similar examples, I do not understand. After all, the fact that the constitutional court has ruled the current situation to be illegal does not change anything about the fact that this is still a request from the Flemish part of the country, and not from the Francophones; anyone telling you anything else is simply lying. There's nothing wrong with wanting something and being declared correct in court, of course; but there is something wrong with wanting that unconditionally. Unless you won a war, that is. And then still. Of course, not caring about much of the definitions of many political parties and not being a politician in any way, I ticked off someone who just happens to be a member of one of the parties I don't even like in the first place. Amedee, in case it matters: I didn't call CD&V a "Catholic" party to imply anything, but simply because I'm blissfully ignorant of the difference between Catholic and Christian. And happily so, too, given the CD&V's current behaviour. Oh, and the SP.A is not my favourite party; it's just that they seemed to be the more sensible of the lot during the last elections' campaigns. What's really my favourite party isn't something I'll tell you (or anyone), though.

When installing Xen servers one issue that arises is how to assign MAC addresses. The Wikipedia page about MAC addresses [1] shows that all addresses that have the second least significant bit of the most significant byte set to 1 are “locally administered”. In practice people just use addresses starting with 02: for this purpose although any number congruent to two mod four used in the first octet would give the same result. I prefer to use 02: because it’s best known and therefore casual observers will be more likely to realise what is happening. Now if you have a Xen bridge that is private to one Dom0 (for communication between Xen DomU’s on the same host) or on a private network (a switch that connects servers owned by one organisation and not connected to machines owned by others) then it’s easy to just pick MAC addresses starting with 02: or 00:16:3e: (the range assigned to the Xen project). But if Xen servers run by other people are likely to be on the same network then there is a problem. Currently I’m setting up some Xen servers that have public and private networks. The private network will either be a local bridge (that doesn’t permit sending data out any Ethernet ports) or a bridge to an Ethernet port that is connected to a private switch, for that I am using MAC addresses starting with 02:. As far as I am aware there is no issue with machine A having a particular MAC address on one VLAN while machine B has the same MAC address on another VLAN. My strategy for dealing with the MAC addresses for the public network at the moment is to copy MAC addresses from machines that will never be in the same network. For example if I use the MAC addresses from Ethernet cards in a P3 desktop system running as a router in a small company in Australia then I can safely use them in a Xen server in a co-location center in the US (there’s no chance of someone taking the PCI ethernet cards from the machine in Australia and sending them to the US - and no-one sells servers that can use such cards anyway). Note that I only do this when I have root on the machine in question and where there is no doubt about who runs the machine, so there should not be any risk. Of course if someone from the ISP analyses the MAC addresses on their network it will look like they have some very old machines in their server room. ;) I wonder if there are any protocols that do anything nasty with MAC addresses. I know that IPv6 addresses can be based on the MAC address, but as long as the separate networks have separate IPv6 ranges that shouldn’t be a problem. I’m certainly not going to try bridging networks between Australia and the US! Another possible way of solving this issue would be to have the people who run a server room assign and manage MAC addresses. One way of doing this would be to specify a mapping of IP addresses to MAC addresses, EG you could have the first two bytes be 02:00: and the next four be the same as the IPv4 address assigned to the DomU in question. In the vast majority of server rooms I’ve encountered the number of public IP addresses has been greater than or equal to the number of MAC addresses with the only exception being corporate server rooms where everything runs on private IP address space (but there’s nothing wrong with 02:00:0a: as the prefix for a MAC address). I also wonder if anyone else is thinking about the potential for MAC collisions. I’ve got Xen servers in a couple of server rooms, I told the relevant people in writing of my precise plans (and was assigned extra IP addresses for all the DomUs) but never had anyone mention any scheme for assigning MAC addresses.

• [1] http://en.wikipedia.org/wiki/MAC_address

Share This

New testing version of Gammu was just born. It brings quite a lot of fixes and changes API a bit (some things will also change in next testing release). Full list of changes:

• ABI change, because of increasing some limits.
• Config file option rsslevel no longer works, superseded by gammu checkversion.
• Dropped GSM_ReadHTTPFile from API, gammu now uses CURL instead.
• Support for longer notes on Nokia phones (bug #607).
• Add deleteallmemory command.
• Ignore trailing spaces in AT commands.
• Fix crash on long lines in vCards.
• Compatibility with broken iWOW responses (bug #650).
• Do not use hard delete flag for updating entries (bug #634).
• Identify Nokia 1200 (bug #649).
• Fix parsing of date/time reply on Sony Ericsson G900 (bug #647).
• Increased limit for folder name (bug #646).
• Fix parsing of empty date (bug #643).
• Recognize general number on Nokia 6230i (bug #655).
• Fix writing of phone number using HEX charset (bug #512).
• Recognize more CME errors, thanks to Paolo oopla@users.sf.net.

You can download from usual place: http://cihar.com/gammu/, Debian users will find packages in experimental as soon as it passes NEW queue. PS: I still have about 100 unread mails about Gammu, so please be patient.

It is nice when you work for a company where you can say:

"Ice-lolly break..."

The response?

"Me too!"

Tonight has been a productive evening, I guess the ice-lolly helped! I managed to optimize the storage of rejected SPAM mail for my commercial service. That is something I've been obsessing over recently since the volume of SPAM is currently hovering around 2.5 million messages. Still I suspect it is only a matter of weeks before I need to expand. The current setup has me using three machines:

• Primary machine runs:
  • Web Application
  • SMTP processing/filtering/delivery
• Secondary machine runs:
  • SMTP processing/filtering/delivery
• Offsite machine:
  • Runs the blog.
  • Runs the support system.
  • Runs the service status page

Ideally I'd like to split that up further so that I have a single machine running the web application (the part the user interacts with), a pair of MX machines, and the offsite machine doing the minimal work it does. That way the incoming mail will not affect the application at all directly. Thankfully the split should be trivial. The only hard part is finding a fast webhost that can offer me ~1Gb of RAM, ~1000Gb of disk space, and won't charge much. Ideally around £15/$30 a month. (hahaha! hahaha! ha!) ObQuote: L on

I had to learn it the hard way; really cheap plane tickets doesn’t exist unless you buy them months in advance, and killing three hours at an airport can be done by writing a long post on how to kill three hours at an airport. But Finnair does have the funniest instruction videos I’ve ever seen. Going to Helsinki for Assembly 2008 was worth the money. This was my first party outside Norway, and the one thing that really surprised me was that most of the gamers actually did kill all audio and lights when told to do so. Smash told me that some hardcore gamers just put a towel over their head and screen to continue playing, but I still think it deserves some credit. Being at the party place was ok, even with the security check. I think the scene booth organized by Truck was great, even though I don’t have anything to compare it to. It was nice to see someone walk up to the booth and ask a lot of questions. I’m happy about missing out on Hesburger, and sad that it took me two days to find the Pizza Hut. Boozembly was a lot more fun, even with the rain. I found out that Sauli can be a very nice guy, that you don’t need toothpaste when you have mintu, that guys in kilts got nothing under and that kiitos means thanks. I sure hope information like this will be useful to someone someday. It’s always nice to see old friends, like Spiikki, again and even nicer knowing that you can still pick up where you left two years ago. And it’s fun meeting the skilled people you’ve admired for a long time. Actually telling them that got a bit easier when I managed to stop being so shy. I always find it difficult to keep it short and still cover the most important things, so I just want to say the following; I think the 4k by Portal Process and TBC rocks, and the 64k by Fairlight did impress me. Thanks to Leia and Little Bitchard for letting me crash at their place. And thanks to Gargaj for being awesome.

Software Cooperative News has been upgraded to Wordpress 2.6 (and other co-hosted sites too), the “subscribe to comments” plugin has been activated and all comments will be pre-moderated from now on. There’s a few more changes to come, but hopefully nothing as dramatic. WP-2.6 has a few more SALTs and KEYs in the config file, but it was a local change to the wp-settings.php to make virtual hosting work across many domains which took us off-line for a few minutes this morning. Sorry if you missed us. There seem to have been a few changes to the rich text editor (the Icon to add align-left etc has disappeared from blog text editor and some users can’t word wrap) which I need to check, too. In other website news, updates from three people have gone onto the list about Online Banking with GNU/Linux, Firefox-based browsers or Free Software - Firefox-3-related breakages at NatWest and Norwich and Peterborough and a report that Nationwide works with FF3. Thanks to those contributors - as usual, I won’t say who told me what, in order to avoid telling people who banks where, but I’ve added more names to the credits.

I've just uploaded awesome 3.0-rc1 to experimental. For people who can't wait, the git repository is on Alioth. awesome 3 should stay in experimental until it gets fully released. I plan to rename current awesome 2.x package to awesome2 and get awesome 3 as the new default awesome package. So Debian will still provide awesome 2 for people who don't want to upgrade.

Linux has this great thing called locales. You can basically control everything through a few system variables. The system is so flexible that you could in fact have English language with Swedish dates and Chinese error messages. The problem with the current system is that it's controlled mostly with one variable. Just about everyone I know (including me) set the system locale to en_US because they don't want to use their local language as the system language. This in turn causes new problems, mostly due to the metric system used in the sane countries. I finally got around to debug how to get the system to speak my language. The key here is the file /etc/default/locale which on Debian based systems contain the locale settings. Usually there is just one line in that file. LANG=en_US.UTF-8 Since I live in Finland and want my computer to speak English I can add the following lines: LC_NUMERIC="fi_FI.UTF-8"
LC_PAPER="fi_FI.UTF-8"
LC_NAME="fi_FI.UTF-8"
LC_ADDRESS="fi_FI.UTF-8"
LC_TELEPHONE="fi_FI.UTF-8"
LC_MEASUREMENT="fi_FI.UTF-8" This replaces the settings for numerals (decimal separator and such), paper (yes, the rest of the world uses A4), name, address, telephone and measurement (YAY, metric system!). This way I have a nice English speaking system with Finnish settings. I tried setting LC_ALL to fi_FI.UTF-8 but that causes gnome to speak Finnish to me, even though the LANGUAGE and LANG settings are set the English. LC_TIME is something I'd like to use, but I find the Finnish abbreviations for weekdays and months to be confusing. LC_MESSAGES causes gnome to talk partially Finnish, the general locale is English as it's supposed to be, but for example gnome-panel changes the menu entries to Finnish. I wish that it was easier to set these settings. I also doubt that various tools know how to respect these settings and will overwrite that file with the default setting. That is why I'm writing this entry so that I remember how to fix it when that happens. In the end the system is flexible but it's built in a funny way. The actual variable built by combining 2 or 3 values: language, country and possibly encoding. So to make thing easy for me I would have to declare en_FI.UTF-8 locale and start translating applications to that locale. I don't want to, so I'm sticking to this "temporary" solution.

I had a great time at DebConf 7 last year in Edinburgh and am looking forward to another great time at DebConf 8 in Mar del Plata this year. Hopefully this year's trip to DebConf will be less hectic than last year's (I still need to finish my blog post about that). See you in Argentina!

Have you ever wondered how long it would take to create a 32768 bit RSA key with ssh-keygen? Well, I did.

   $ time ssh-keygen -t rsa -b 32768 -f ~/.ssh/tmp32768 -N foobar -q
   real    244m31.259s
   user    244m15.664s
   sys     0m4.736s

In other words, on my test system (AMD X2 CPU with 1.8 GHz per core) it took ca. 4 hours. This is likely very dependent on how much entropy you can get (and how fast), so take the numbers with a grain of salt. A second key with 32767 bits (one less) took 16 hours, for instance. The resulting tmp32768 (private key) file is ca. 25 KB big, the tmp32768.pub (public key) file is 5 KB big. There's likely no noticeable performance hit for ssh or scp AFAICS, as all data transfers are done with a symmetrical session key, not the RSA key itself. Only the initial connection "handshake" will take ca. 40 seconds longer... And yes, 32768 is the maximum RSA key size you can currently create with OpenSSH, go file a bug report if that's not enough for you ;-) However, as I then noticed, this key will not actually work. When you put it in some authorized_keys file and try to login, the handshake will fail and the server-side will see the following error in /var/log/auth.log:

  sshd[xxxxxx]: error: RSA_public_decrypt failed: error:04067069:lib(4):func(103):reason(105)

I first thought I found an off-by-one error, but the 32767 bit key (one bit less) didn't work either. After looking through the OpenSSH and OpenSSL code as well as the RSA_private_decrypt(3SSL) manpage a bit, I saw that OpenSSH uses the RSA_PKCS1_PADDING parameter. My current theory is thus that some padding is making the key not work. I'm now creating a key with 11 bits less bits than 32768, let's see what happens. For the record, a key with 16384 bits does work just fine. Anyway, I'll probably report this as "bug" (more a theoretical than a practical problem, though) as ssh-keygen let's you generate RSA keys which will never work in practice...

I have been asked about the current status of Lenny SE Linux on the Desktop. The first thing to consider is the combinations of policies and configurations. I will number them if only for the purpose of this post, if the numbering is considered generally helpful it could be more widely adopted to describe configurations.

1. Default configuration. This has the default policy and is configured with all users having the domain unconfined_t and daemons such as POP servers are allowed to access home directories of type unconfined_home_dir_t. This allows such daemons to attack privileged user accounts.


2. Some restricted users. This is the same as above but with some users restricted. Daemons such as POP servers are only allowed to access the home directories of restricted users. This means that if a user is to have an unconfined account and receive email they must have two Unix accounts or receive their mail under /var/spool/mail. This is one setsebool command and one (or maybe a few) “semanage login -m” commands from the default configuration.


3. All users restricted. The system administrator has the domain sysadm_t and users have domains such as user_t. This requires a few more semanage commands. It is equivalent to the old strict policy.


4. MLS. This is anything that is based around the MLS policy.

Currently I have two Desktop machines running Lenny (a test machine and my EeePC) and one server. I have only just switched my test machine to enforcing mode so have no good data on it (apart from the fact that I can boot it up and login - which is always a good start). The server is running in permissive mode because I have not yet written the policy to allow the POP server to read from unconfined_home_dir_t. I could get it working by switching from level 1 to level 2 or 3, but I want to get level 1 server policy working for the benefit of others else first. My EeePC however is fully functional, I have been doing some work on it - that mostly means running a ssh client under GNOME but that’s OK (desktop environments such as GNOME and KDE are quite complex and demanding, getting a machine to boot and run such a desktop environment tests out many parts of the system). It’s only at level 1 for the moment because I want to get level 1 working everywhere before moving to the higher levels. I want to get things ready for real users ASAP. With the way the policy is managed now it will be possible to move from level 1 to 2 or 3 without rebooting or interrupting running services. So once users have systems running well at level 1 they can easily increase the security at a later date. The problems that I have had are due to text relocations in libraries (see my previous post about execmod permission [1]). I’ve filed bug report #493678 against libtheora0 [2] in regard to this issue and included a patch from Fedora (which disables the non-relocatable assembly code in question). It seems that upstream have some new assembler code to try and fix this issue, so hopefully we’ll have something that can make it into Lenny! I’ve filed bug report #493705 against libswscale0 for the same issue [3]. I included a patch to turn off the assembler code in question but that was not well received. If anyone has some i386 assembler skill and some spare time I would appreciate it if you could try and find a way to make the code position independent while losing little or no performance. One thing to note is that I am now using an Opteron 1212 (2.0GHz dual-core) system for compiling, I run the i386 DomU with a 64bit kernel (I expect that 32bit user-space runs faster with a 64bit kernel than a 32bit kernel), and the disks are reasonably fast. Even so it takes about 15 minutes to build libswscale0 and the other packages from the same source tree. Previously I was using a 1.0GHz Pentium-3 for my Lenny i386 development until I had the libswscale0 build process go for more than 90 minutes before running out of disk space! If your build machine is old enough to only be 32bit then you should probably plan on watching a movie or going to bed while the build is in progress. I have built packages that work around the above bugs and included them in my Lenny repository [4]. If you take the packages from that repository plus the Lenny packages then you should have a functional desktop system at level 1. I would appreciate it if people would start testing that and providing feedback. One important issue is the discovery of libraries that want shared stacks, text relocations, and executable memory. The deadline for fixing them properly is even more of a problem due to the number of people who have to be involved in a solution (as compared to the policy where I can do it on my own). One finally problem is a bug in xdm which causes it to give the wrong context for login sessions due to having an old version of the SE Linux related code [5]. Due to a combination of this and some policy bugs you can not login with xdm. This is not a hugely important issue as most people will use gdm (which has the newer patch) or kdm (which has no SE Linux patch but can use pam_selinux.so). Also another option is wdm which works with pam_selinux.so. I’ve had a response to my bug report suggesting that there’s a bug in the patch (which was taken from gdm so maybe there’s a bug in gdm code too). I haven’t responded to that yet as I’ve been concentrating on the things that will make the most impact for Lenny. At this stage I’m still unsure of when the release team will cut me off and prevent further SE Linux related fixes from going in Lenny. I need at least one more update to the policy packages before Lenny is released. I could release one right now with some useful improvements over what is currently in unstable, but am waiting until I get some other things fixed. If I get everything fully working at level 1 (both client and server) before Lenny then I will provide a similar status report for users and testers of levels 2 and 3. I don’t expect that I will even get a chance to test level 4 (MLS) properly before Lenny releases.

• [1] http://etbe.coker.com.au/2007/02/10/execmod/


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493678


• [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493705


• [4] http://etbe.coker.com.au/2008/07/31/installing-se-linux-on-lenny/


• [5] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493524

Share This

I found an interesting but old analysis from Don Stewart about trends in the tiling window manager market. I was curious so I tried to make it again to see the result 8 months later. I took the vote data rather than installed, because it's more accurate: it tries to count people who use the software rather then people that just installed it. And we all know that installing a software does not mean you're using it. awesome is rising fast. It has overtaken larswm and xmonad very quickly. Now it seems it just kicked wmii out of the game, and the next target will be the famous ion3, which should be deprecated in some weeks. I'm very impressed. I never though it will happen that way. That stats, so it means anything you want them to mean, but I think it's very cool anyway. I think that the next thing to do is to beat the floating-only window manager like the *box, etc An interesting challenge, so stay tuned!

So, I should be at DebCamp, but I'm back home after driving 800km in one day.  
Why?   I still don't know.

The main reason for this post is the irrational and unilateral response I got 
from the DebConf Orga Team, with no right to replica of any kind, and with 
the violence and humiliation we were treated with. I've helped to make 
3 DebConf's possible, and have been involved in many ways for the past years 
in Debian, so this shocked me deeply.

The short story is that there was an extra bed in the room I was staying in, the 
person who was suppose to be in that bed is a close friend of mine, so I asked 
if someone else could use it while they weren't, since that meant I could take 
the necessary equipment that I managed to get for DebConf, and also introduce 
to Debian someone who is very active and well known in our local community 
(and also part of the umbrella foundation used for local finance issues). 
I was excited about getting there, like every year. Just to make this extra 
clear, this person had already booked the full week of DebConf, just not 
DebCamp, as he previously thought he couldn't attend. When he found out he 
could, he was thrilled to be able to go and help setup. So, I made the mistake 
of not notifying the Orga team about the switch. I did this because it truly 
was harmless action, where a bed which would otherwise be wasted would get 
used, and, I did not notify the Orga team because they've been very 
aggressive, inflexible and unhelpful throughout the planning of the 
conference. This doesn't justify it, just explains why someone who generally 
is helpful decides to take the wrong path to solve something.

Up to here, nothing very exciting. What made this special, is that when one 
of the organizers, Margarita Manterola, found out about the switch, instead 
of coming to talk to me, even though she's known me for *years*, she went 
and informed the hotel that somebody had committed a crime, and checked in 
under a different name, as if me or the person that came with me where 
some random stranger. All I can say is, WTF?

Let me stress this, the email that was sent out[1] twisted the facts, to the 
extent that some of them are a lie, like the problem arrived at check-in, 
when it actually happened while we where napping a few hours after we had 
arrived, and any effort made by the Orga team with the hotel where wasted, 
as it was one of them who had originally created the problem.

Instead of solving this among us as a group, and, again, "solve" is a 
bureaucratic thing, because no one was being harmed, Marga decided to 
actually *harm* me personally, the person who I had brought, and DebConf 
as a group. What got solved?  Nothing. I left, along with someone who 
would of otherwise been helping out build DebConf, while the Orga team 
demanded a ridiculous fee for me to stay in the hotel.
Rules are rules, I understand, but I also understand everybody listens to 
downloaded music, people in Germany install[2] nmap, and a very long list 
of rules that we tend not to follow because they're unreasonable or 
unnecessarily complicated.
Is this really what DebConf is turning into?

All I can say is I'm very sad and shocked that the people I've worked with 
for so many years decided to condemn me over such a meaningless issue, and 
especially that the local team, Martin Ferrari, Damian Viano, Maximiliano 
Curia and Margarita Manterola would do such thing to "one of there own", 
and that the international Orga team would mindlessly follow through with it.

I apologized to the hotel, I do want to apologize to the innocent people who 
had to deal with this, and, even though my intentions where good and unselfish, 
I regret what happened.

Despite all of this, I'm still deeply committed to Debian, have worked during 
the year and deserve to relax and enjoy it, so I will be there for DebConf 
as a regular attendee.

See you there!

[1] http://lists.debconf.org/lurker/message/20080802.231856.66c7d3fd.en.html
[2] http://it.slashdot.org/article.pl?sid=07/05/31/1629259&from=rss