First, a question: dear lazyweb, how do I completely disable non-SSL access with lighttpd? I can't seem to find how to have a lighttpd SSL-only configuration. (and only binding port 80 on localhost does not count for an answer)

On to the subject. While it's easy to add SSL to lighttpd and enable PHP (through fastcgi) — and Debian makes it even easier with it's lighty-enable-mod tool — if you only do it once in a blue moon then it's not exactly resident knowledge. So here are the steps to do it, on Debian Etch:

1. apt-get the lighttpd, php4-cgi or php5-cgi, and openssl packages
2. lighty-enable-mod fastcgi
3. if using php5, update the path to the cgi binary in /etc/lighttpd/conf-available/10-fastcgi.conf (it's preconfigured for php4)
4. lighty-enable-mod ssl
5. update the path to the SSL certificate in /etc/lighttpd/conf-available/10-ssl.conf
6. restart the lighttpd server

That's all there is to it. Well, strictly speaking there's a step 4a: install a certificate; but that's arguably not a part of the configuration process.
(for reference: openssl req -new -x509 -keyout /etc/lighttpd/selfcert.pem -out /etc/lighttpd/selfcert.pem -days 365 -nodes will generate a self-signed certificate)

Bus line #23 here starts in Mutxamel, goes through San Juan, reaches the Hospital, and then goes all the way to Alicante. Many months ago already, a new bus line was created: 34L. This line shares parts of its way with #23, namely from Mutxamel to the Hospital. After that, they diverge. After all this time, still today (and every other day too) many people mistakenly take 34L thinking it is #23. And it’s not as if the buses don’t carry a big yellow-on-black sign with their number...

I really don’t mind if Debian lags behind with package versions. And I’ve gotten used to running an ancient version of “pgadmin3″ (the GUI client for PostgreSQL). But now that I upgraded a few pgsql servers from 8.2 to 8.3 and started pgadmin3 I was surprised - in a not at all fun way. Several [...]

Galax in Debian version 0.9.9 in experimental / NEW Executive summary: Galax (a fast XQuery implementation with support for static typing) is now in Debian. After my introductory post on XQuery and how to use it in Debian I've got motivated again in finishing the Debian packaging of Galax. (Or was the motivation coming from the fact that Saxon-B is terribly slow and also the annoying thought that one has to pay for extra-optimizations and static typing?) Galax, on the contrary, is really fast, Schema-aware, and supports static typing out of the box (you won't discover too late that you've added an integer to a string-valued node). Galax is now (almost) in Debian: yesterday I've uploaded version 0.9.9 to experimental, but of course it will need to pass through NEW before being available to the public. In the meantime it is available from my repository, here's the needed sources.list line:

deb http://people.debian.org/~zack/debian unstable main

in case you wanna look at the source package you can do one of:

$ dget http://people.debian.org/~zack/debian/pool/galax_0.9.9-1.dsc
$ debcheckout svn://svn.debian.org/svn/pkg-ocaml-maint/trunk/packages/galax/trunk

Getting started with Galax Mini howto for evaluating XQuery queries with Galax:

# aptitude install galax
$ cat sample.xq 
<bookshelf>
  for $book in doc('books.xml')//book
  where
    some $surname in $book/author/last
    satisfies $surname eq "Stevens"
  return <title>   xs:string($book/title)   </title>  
</bookshelf>
$ head -n 7 books.xml 
<bib>
  <book year="1994">
    <title>TCP/IP Illustrated</title>
    <author><last>Stevens</last><first>W.</first></author>
    <publisher>Addison-Wesley</publisher>
    <price>65.95</price>
  </book> 
$ galax-run sample.xq   xmllint --format -
<?xml version="1.0"?>
<bookshelf>
  <title>TCP/IP Illustrated</title>
  <title>Advanced Programming in the UNIX Environment</title>
</bookshelf>

The galax-doc package contains much more documentation of course ...
PS this evening I'll travel to Paris, where I'll be for a week, moving to FOSDEM for the week-end. Drop me a note if you want to get in touch for beer/keysigning/whatever.

Matt Bottrell writes about the Oracle Linux offerings presented at LCA 2008 [1] The one thing that Oracle does which I really object to is the “unbreakable” part of their advertising. They have pictures of penguins in armour and the only reasonable assumption is that their system is more secure in some way. As far as I am aware they offer no security features other than those which are available in Red Hat Enterprise Linux, CentOS, and Fedora. The unbreakable claims were also made before Oracle even had their own Linux distribution, which gave them even less reason for the claims. If someone is going to be given credit for making Linux unbreakable then the contributors list for the SE Linux project [2] is one possible starting point. Another possibility is that credit could be given to Red Hat for introducing so many security features to the mainstream Linux users before any other distribution. In terms of improving the security of databases it’s probably best to give credit to Kaigai Kohei and the PostgreSQL team for Security Enhanced PostgreSQL [3]. I believe that NEC also deserves some credit for sponsoring Kaigai’s work, I am not sure whether NEC directly sponsored his recent work on SE-PostgreSQL but they certainly sponsored his past work (and are credited on the NSA web site for this). Oracle’s Linux distribution is based on CentOS and/or Red Hat Enterprise Linux (RHEL). The situation with RHEL is that the source is freely available to everyone but binaries are only available to people who pay for support. CentOS is a free recompile of RHEL and a good choice of a distribution if you want a server with long-term support and don’t want to pay Red Hat (I run many servers on CentOS). While Matt gets most things right in his post there is one statement that I believe to be wrong, he writes “One of the craziest statements I heard during the talk was that Oracle will only support their products running under a VM if it’s within Oracle VM“. My knowledge of Xen causes me to have great concerns about reliability. My conversations with MySQL people about how intensive database servers are and how they can reveal bugs in the OS and hardware are backed up by my own experience in benchmarking systems. Therefore I think it’s quite reasonable to decline to support software running under someone else’s Xen build in the same way as you might refuse to support software running under a different kernel version (for exactly the same reasons). Matt however goes on to make some very reasonable requests of Oracle. The demand for native packages of Oracle is significant, I can’t imagine official Debian package support appearing in the near future, but RPM support for RHEL etc would make things easier for everyone (including Oracle). A better installation process for Oracle would also be a good thing. My observation is that most Oracle installations are not used for intensive work and use database features that are a sub-set of what MySQL offers. I’ve seen a few Oracle installations which have no more than three tables! The installation and management of Oracle is a significant cost factor. For example I used to work for a company that employed a full-time Oracle DBA for a database with only a few tables and very small amounts of access (he spent most of his time watching videos of fights and car crashes that he downloaded from the net). Adding one extra salary for a database is a significant expense (although the huge Oracle license fees may make it seem insignificant).

• [1] http://matt.bottrell.com.au/item/163/


• [2] http://www.nsa.gov/selinux/info/contrib.cfm


• [3] http://www.kaigai.gr.jp/index.php?sepgsql

Share This

Matt Bottrell wrote an interesting and informative post about laptops for school kids [1]. His conclusion is that based on technical features the OLPC machine is best suited for primary school children and one of the ASUS EeePC, the Intel Classmate, and the Everex Cloudbook would be best suited for high-school students. The Asus EeePC [2] is a good option, it runs a variant of Debian and the Debian Eeepc Team are active in getting full Debian support for it [3]. The Intel Classmate [4] has a choice of Windows XP, Mandriva, and Metasys Classmate. The web page says that it’s designed “for primary students (ages 5-14)“, so I think that Matt made a mistake in listing this as a possibility for high-schools, of course when running Mandriva it could have software installed for any age group but the hardware design may be better suited to younger children. The Everex Cloudbook [5] runs the GOS Rocket [6] OS which seems to be an Ubuntu variant with an Enlightenment based GUI and a configuration aimed at using Google services (blogger, gmail, etc). Configuring Ubuntu to suit your needs is easy enough (it’s based on Debian). Note that Matt did not mention where one might purchase a Cloudbook in Australia and I don’t recall seeing one on any of my many window-shopping expeditions to Australian consumer electronics stores, while the EeePC is widely available (except when sold out). But I’m sure that if the government wanted to place an order for a couple of million units then Everex would ramp up production quickly enough. Matt made one statement that I strongly disagree with, he wrote “A traditional notebook is far too heavy for high-school kids to lug around“. To test this theory I searched for some high-school text books and a set of scales. A year 11 Maths A text book from ~1988 weighed 600g and the pair of year 12 Maths A and Maths B texts weighed 1.6Kg. When I was at high-school the day was divided into seven “periods”, some classes took two periods so four different classes which required text books (or other books) was typical. Carrying 3Kg of books to school would not be uncommon for year 12 students. The Lenovo T series (advertised as “premier performance” and the model I personally prefer) is listed as having a starting weight of 2.1Kg (which presumably doesn’t include the power pack). My Thinkpad T series (from about 2004) weighs about 2.4Kg according to my kitchen scales and has a battery weighing just over 400g. My practice for a long time was to own a spare power pack for my Thinkpad so that I could leave it at work (saving 400g when travelling to and from work). I have also had the practice of buying a spare battery when I buy a Thinkpad (you need a spare battery for a long trip). So if I had really wanted to save weight I could have left a battery at work and reduced by travel weight by another 400g (with the cost being that I couldn’t use it when on a train or bus). A spare power pack is not overly expensive. In the usual case students would only need a battery when at school (it’s a little known fact that Thinkpads work perfectly without a battery plugged in). So if a student had a power pack at home as well as one at school and if they left their battery at school and they owned one of the latest Thinkpad T series (listed with a starting weight of 2.1Kg) then their travel weight might be about 1.7Kg. If the majority of school texts could be stored on their laptop then the result of using a Thinkpad T series would be a significant weight reduction! If the students were using a Thinkpad X series (more expensive so maybe not a good option) then the list weight is 1.57Kg and the travel weight might be as low as 1.3Kg (at a rough estimate). The EeePC offers significant benefits for school use, it is light, cheap (children tend to break or lose things more frequently than adults so you should budget for buying two of anything that they use), and having no hard drive (flash storage) it should cope well with being dropped. The screen on the EeePC is unreasonably small buy Asus could release a new model with a bigger screen (they may do this in the future anyway or a government contract could encourage them to do it sooner). I agree that the EeePC or the Everex Cloudbook is probably the best option for high-school students, but I can’t agree with any claim about a traditional laptop being too heavy, the only reason for excluding a traditional laptop is that those new ultra-lights are better. Another reason that might be cited for not using laptops is the cost. While prices of $1000 or more for a traditional laptop are rather expensive, the $500 for an EeePC is not that expensive - and the government could surely negotiate a better deal, I would be surprised if they couldn’t get the price down to $350 by some bargaining and by removing the middle-man. A careful child could use the same laptop for the entire duration of high-school and their parents would incur less expense than they currently would spend on text books. As for the current lack of electronic text books. Currently when the education department selects a book it’s a license to print money for the author and publisher. All that the education department has to do is to declare that they will do a deal with the first company to release their books under a creative commons license. The idea would be that an author (or publishing company) would get paid a fixed sum of money for a CC release of a text book which would then be available for use by anyone anywhere in the world. World-wide free distribution would be no loss to the author (each country tends to have unique books anyway) but would be a good act of charity from our government to developing countries. Once books were available under a creative commons license (without the “no modifications” clause) they could be freely improved by anyone. Improving text books for younger students could be a good school project. Update: Thanks to Steve Walsh for pointing out that the Classmate can run Linux. It’s a pity that he didn’t link to my post so that his readers could see what he was referring to. I take it as a good sign of the quality of my posts that such small errors get pointed out.

• [1] http://matt.bottrell.com.au/item/166/


• [2] http://eeepc.asus.com/au/index.htm


• [3] http://syn.theti.ca/articles/2008/02/16/bits-from-the-debian-eee-pc-team


• [4] http://www.classmatepc.com/


• [5] http://www.everex.com/


• [6] http://www.thinkgos.com/

Share This

ARPA just turned 50 and Ronda Hauben, long time author on the politics and culture of the net, has written a nice reflective piece on the significance of the organization of ARPA. Challenging the idea that military roots had dug into the organizational logic of the ARPA institution and especially the ARPAnet, she instead provides the following narrative:

The organizational structure of ARPA made possible the creation of the
computer science research office within ARPA begun by Licklider. That
office has demonstrated the importance of the support for basic
research in the field of computer science. The IPTO supported a
general area of research, one with a far reaching impact. The
achievements of this research office were not specific defense related
applications, nor were the goals narrowly aimed at defense specific
applications. If this reality is not recognized, however, it is
possible to mistakenly attribute significant computer science
achievements to defense specific objectives. A common and widespread myth exists that the Internet has grown out of
a defense specific objective, i.e. from the goal to create a computer
network that could survive a nuclear war. This is a striking example
of how a false narrative can spread and gain public credence. This false narrative finds its roots in the failure to understand that
ARPA was not an agency created for defense specific applications, but
to support the basic research which would lead to new concepts and
ideas.