Finally got my shit together and got a flight to Argentina for DebConf! Perth -> Sydney -> Auckland -> Buenos Aires -> Mar del Plata. That is quite a bit of flying and a long bus trip ending quite early on the 4th. It will definitely be worth it if DebConf7 was anything to go on. Hopefully by DebConf I can get my hands on an OpenMoko FreeRunner to do some Debian porting work during DebCamp and possibly mapping out the streets of Mar del Plata for OpenStreetMap. Of course I need to work on completing analysis of the results of the Debian user and new contributor surveys and figure out what to say about synfig if I get the chance to do a lightning talk about it. /me now officially excited

Well, I was hoping to get Yet Another Blog Reorg done before posting this, but it just hasn't happened, so here are a few more thoughts on Firefox 3 on this ol' blog. In fact, I'll probably finish the FF3 series here before I switch over. I was in central London on Tuesday and suffered both the rudeness and the black snot (which no-one else I know seems to suffer) so maybe that's why I've been underachieving this week. I've had London lethargy. I had a report about online banking that doesn't work with FF3. NPBS will move into the hall of shame, sadly. I'm almost certain I warned them months ago that their online banking was doing Javascript stunts that aren't going to work forever. I emailed them and haven't heard back since. Back to the browser: I share the contempt for the Firefox 3 and SSL problems and I like the new URL bar too. However, I am finding the FF3 seems to use more CPU (and so power) than FF1.5 and there seems to be some frustrating delays in FF-clipboard communications, so I'm looking at other browsers. Conkeror looks interesting. Still Gecko (useful for work) but stripped down. I spotted another post about microformats, which I mentioned in my last post, about the BBC dropping support for microformats [John Resig] and I also noticed just how good SVG and Minimalist Markup looks in FF3 [Sam Ruby] - I'd love to try it, but my IE-using clients probably wouldn't understand and I hate making single-browser special editions.

Today, I went to the Ekeren district house[1] to get me a passport, in order to be able to fly to Argentina in about a month. As I was queueing at the desk, I realized that I'd forgotten some pictures of myself, so I left the queue, found the closest photo shop, and had them take some pictures of me. When I returned to the district house, gave them my new pictures and my identity card, with the request to furnish me a passport, the lady behind the desk told me that I apparently still had a passport. While no longer valid, I still need to hand that in before I can be given a new passport. Or, alternatively, I could go to the police office, tell them that I cannot find the passport anymore, and use the document they'd give me to get me a new passport. That, too, would work. So that's the option I decided to take. I quickly went to the police office, which is rather close to the district house; luckily nobody was queueing before me there. By the time I got back to the district house, it was about 14:50, while they close at 15:00. So I went ahead and started queueing again. Suddenly, I notice that my pictures were gone. For some reason, the idiots at the photo shop have deviced an "envelope" that does not hold the pictures -- they have three places where they can easily leave the "envelope". And that's exactly what had happened: no more pictures. So I ask the lady behind the desk whether she'd be willing to wait a few more minutes after their official closing time, so that I'd be able to go and look for them. She didn't mind. Unfortunately, I only found one picture. The other five were nowhere to be found... and with only one picture, the district office can't help me; they need two of them. So, now, I've not only lost an hour of my life, but I've also lost 8.00 for pictures that are now no longer useful to me. And I'll have to do all of this again, some time next week. Dammit. [1] although I don't live in Ekeren anymore, officially I do: the apartment where I live does not exist according to the Mechelen city administration. Before I can officially move there, the landlord needs to deal with that, which apparently involves quite some bureaucracy. For one thing, he needs 6—yes, six—copies of the building plans, along with a particular form with a particular number. Probably needs to jump through a number of hoops, too—I wouldn't be surprised.

Katherine Lawrence and Marianne Schreiber, two women at Hewlett-Packard, used the term Glass Ceiling to to refer to invisible barriers that impede the career advancement of females. While on the surface there seems to be a clear path of promotion, in fact women seem to hit a point where there is no way to progress beyond. Carol Hymowitz and Timothy Schellhardt used the term again afterwards in the March 24, 1986 edition of the Wall Street Journal, which is considered by many people the starting point of the usage of that term. Even though the term Glass Ceiling was originally specifically applied to discrimination against women, its meaning has expanded to describe similar situations of other collectives. I was wondering whether there might be a Glass Ceiling in Debian too. I know some of you will be tempted to answer “no way!” or “yeah! of course!” without even thinking about it. Please don’t. Keep in mind that a Glass Ceiling situation is referred to as a “ceiling” as there is a limitation blocking upward advancement, and “glass” (transparent) because the limitation is not immediately apparent and is normally an unwritten and unofficial policy. Give a serious and deep thought about it before commenting. It’s quite likely that if you are too sure about what the answer might be, one way or the other, that you might be wrong. I just wanted to make us think a bit about it.

The Age has an interesting article about proposed DNS changes [1]. Apparently ICANN is going to sell top level DNS names and a prediction has been made that they will cost more than $100,000 each. A suggestion for a potential use of this would be to have cities as top level names (a .paris TLD was given as an example). The problem with this is that they are not unique. Countries that were colonised in recent times (such as the US and Australia) have many names copied from Europe. It will be interesting to see how they plan to determine which of the cities registers names, for the .paris example I’m sure that the council of Paris Illinois [2] would love to register it. Does the oldest city win an international trademark dispute over a TLD? The current situation is that French law unambiguously determines who gets to register paris.fr and someone who sees the URL will have no confusion as to what it means (providing that they know that fr is the ISO country code for France). As well as city names there are region names which are used for products. Australian vineyards produce a lot of sparkling wine that they like to call Champagne and a lot of fortified wine that they like to call Port. There are ongoing battles about how these names can be used and it seems likely to me that the Australian wine industry will change to other terms. But in the mean-time it would be interesting if .champagne and .port were registered by Australian companies. The fuss that would surely cause would probably give enough free publicity to the Australian wine industry to justify an investment of $200,000 on TLDs. The concern that is cited by business people (including the client who forwarded me the URL and requested my comments) is that of the expense of protecting a brand. Currently if you have a company named “Example” you can register example.com, example.net, and example.org if you are feeling enthusiastic. Then if you have a significant presence in any country you could register your name in the DNS hierarchy for that country (large companies try to register their name in every country - for a multinational registering ~200 domains is not really difficult or expensive). But if anyone can create a new TLD (and therefore if new ones are liable to be created at any time) it becomes much more difficult. For example if a new TLD was created every day then a multi-national corporation would need to assign an employee to work full-time on investigating the new TLDs and deciding which ones to use. A small company that has an international presence (IE an Internet company) would just lose a significant amount of control over their name. I don’t believe that this is as much of a concern as some people (such as my client) do. Currently I could register a phone line with a listed name indicating that it belongs to the Melbourne branch of a multi-national corporation. I don’t expect that Telstra would stop me, but the benefit from doing this would be minimal (probably someone who attempted fraud using such means would not gain much and would get shut down quickly). I don’t think that a DNS name registered under a .melbourne TLD would cause much more harm than a phone number listed in the Melbourne phone book. Incidentally for readers from the US, I’m thinking of Melbourne in Australia not a city of the same name in the US - yet another example of a name conflict. Now I believe that it would be better if small companies didn’t use .com domains. The use of country specific names relevant to where they work are more appropriate and technically easier to implement. I don’t regret registering coker.com.au instead of some name in another country or in the .com hierarchy. Things would probably be working better right now if a .com domain name had always cost $100,000 and there were only a few dozen companies that had registered them. But we have to go with the flow sometimes, so I have registered RussellCoker.com. Now when considering the merit of an idea we should consider who benefits and who (if anyone) loses. Ideally we would choose options that provide benefits for many people and losses for few (or none). In this case it seems that the suggested changes would be a loss for corporations that want to protect their brand, a loss for end-users who just want to find something without confusion, and provide more benefits for domain-squatters than anyone else. Maybe I should register icann.port and icann.champagne if those TLDs are registered in Australia and impersonate ICANN. ;)

• [1] http://www.theage.com.au/news/web/rule-changes-to-spark-domain-name-goldrush/2008/06/27/1214472719636.html


• [2] http://parisillinois.org/

Share This

Steve,

If you don't like seeing cumbersome security warnings for insecure https connections, how about not using https when what you really want is http in the first place?

Because I don't necessarily have the choice. When I'm reporting a bug on a given open source Trac, they often put https on them because they think it's better for them (and for them it is because they generated the certificate and so on), and there is no http version. Note that when I use https for myself, I import my CA in firefox, so I don't have a single warning, so I kind of know how to avoid them when I care about https. But there isn't always a plain HTTP alternative, and that is what makes it a real PITA. Okay, you want to warn the user the https isn't secure, there are plenty of ways that don't require you to add an exception on a certificate. I spoke of the little lock, because that's what is even on IE, but please remember than when you browse trusted https, the URL bar is in this kind of yellow. Well, if the https is unsecure, just don't put that background. If you really want, you can add some kind of rosa color to mark that it's "bad" but it in a not too terrible way (in opposition to a broken/invalid certificate and where the URL bar should be blinking red with an air-raid like siren). I repeat, the fact that the HTTPS certificate is self-signed never changes the fact that when a given user goes on this kind of https site, he wants to be there, and HE WILL click on the 5 silly steps of the SSL exception thing. So why bother ? It serve one single purpose: pissing users off. And for what it's worth, I disagree with you, most of the people that are not computer related I know absolutely don't know they could think that http_s_ is more secure than http. Each time I give them an URL without the http:// part they ask, is this https or http ?, because they absolutely don't get the difference, and I don't try to explain it to them, because this would lead them to think https is better. Those kind of people only rely on visual helpers from the browser part. They really do. PS: yes I also believe that bad security is worse than no security because it gives the illusion for people to be safe, and then they have bad behavior. When your condom is broken, things can go really wrong. But you missed my point, in the sense, probably because I'm too annoyed to make it clear inbetween rants. My point really was what I tried to explain, namely that if people don't know they should think there is security in the first place, your remark is moot, and for the other you can activate the different URL background, it's just fine. Of course, invalid certificates must remain a pain to go through, this whole thing is only about the untrusted ones.

There seem to be some heat about the new Firefox feature that only allows you to open https urls with untrusted certificate after 5 clicks. The situation is actually worse than what is depicted. Why? Because not only did they put crap to their users, and actually, if they want to, that’s their problem, but they also imposed their crap on embedders. Yes, this means applications such as epiphany, kazehakase, galeon, and others *must* use this crap. I know, there is a browser.xul.error_pages.enabled to disable the error page (note it also disables standard network connection error messages). But, the alternative is not any better: It opens a dialog, with raw HTML in it, allowing to… do nothing. That’s it, you can only acknowledge you’ve been denied access to the so-called untrusted site. The best part is that these applications can’t (or maybe they can, but in several months nobody found how) make the exception dialog work properly: the user will have to enter, himself, the url to add the exception for. And before even reaching the state where you can get the dialog to open from the error page, or even get the buttons to be displayed in the error page itself, you have to add clutter to your application code. For those still wondering what happened to the Gecko platform or whatever you call it (xulrunner, libxul, mozilla-embed, etc.), here is your answer: Gecko evolves with what Firefox needs. If your application needs something else, well, too bad for you. Firefox developers obviously have a big problem taking embedders into consideration when they change the Gecko API, and while it can be fixed afterwards, it’s not a good thing to “tag” a Gecko milestone at the same time as a Firefox release under such conditions. Anyways, what I did in the xulrunner-1.9 package is to forward-port the old interfaces (nsIBadCertListener) allowing embedders to have their own UI for this. While it was certainly far from perfect (and displaying as many dialogs as different errors on a certificate is definitely not something nice), it is still better than something not working at all.

This year, DebianDay will take place in Buenos Aires, on Monday August 18th, the day after DebConf ends. We are still in need of talks for DebianDay, so, if you are coming to DebConf and you’ll be staying a few more days in Argentina after the conference, you are invited to give a talk on whatever you want as long as it’s Debian related. Some suggestions for talk subjects for DebianDay:

• Debian in Latin America
• Internationalization in Debian
• How to help Debian
• Debian Live
• Making a Debian derivative distribution
• Packaging for Debian
• … And anything else you feel might be interesting to people who are not DDs, but are interested in Debian.

We are planning on having two tracks, one for newbies and one for advanced talks; talks in Spanish are welcome, but don’t worry if you don’t speak the language, for talks in English, we will probably have a translator. To submit a talk, just log in to your DebConf account and click in the “New event/Paper” link.

Dear lazyweb number 3. So far, I've asked: high latency net simulations - great answers. python friendly back-end accessible search engines - many answers, none that fit the bill. So I wrote my own :). Today, I shall ask - is there a python-accessible persistent b+tree(or hashtable, or ...) module. Key considerations: - scaling: millions of nodes are needed with low latency access to a nodes value and to determine a nodes absence - indices are write once. (e.g. a group of indices are queried, and data is expired altered by some generational tactic such as combining existing indices into one larger one and discarding the old ones) - reading and writing is suitable for sharply memory constrained environments. ideally only a few 100KB of memory are needed to write a 100K node index, or to read those same 100K nodes back out of a million node index. temporary files during writing are fine. - backend access must either be via a well defined minimal api (e.g. 'needs read, readv, write, rename, delete') or customisable in python - easy installation - if C libraries etc are needed they must be already pervasively available to windows users and Ubuntu/Suse/Redhat/*BSD systems - ideally sorted iteration is available as well, though it could be layered on top - fast, did I mention fast? - stable formats - these indices may last for years unaltered after being written, so any libraries involved need to ensure that the format will be accessible for a long time. (e.g. python's dump/marshal facility fails) sqlite, bdb already fail at this requirements list. snakesql, gadfly, buzhug and rbtree fail too.

Okay, following my irritated post I received (sigh) complaints about me being too harsh. So to these people here is what I say, because I'm tired answering the same thing over and over. For starters, the SSL dialog in firefox is badly designed:

1. My mom doesn't grok it, so it totally fails the "corridor testing" (see JoelOnSoftware if you don't know what it is), stop pretending otherwise;
2. since it fails with the "average not very computer literate user", I, as an advanced user, believe to be representative of this kind of person, say and affirm that this UI is completely broken and horrible, not to mention counter-intuitive.

That said, I have other things to say on the form. Yeah I've been harsh, and I will continue to be about this issue: this has not been designed with the simplicity in mind, but by geeks (FSVO geek) that believe that it's important to educate people about how nice HTTPS is and that everyone should talk in S3kr3t because its 733t. And I'm sure they tried very hard to make it very painful for users to have to deal with HTTPS and not believe in it to be trusted for bad reasons. Why ?

• because geeks want to use https when possible ;
• but they care about it to be secure (FSVO secure);
• and that they want the whole world to do like them because they know the TRUTH.

HELLLOOOO PEOPLE this is the wrong way to do it. People are already aware that it is https, because they did typed https in the URL. And again, my mom doesn't know what the s in https stands for and she doesn't care. What she cares about is to see the small lock when she logs on her bank website, not even when she goes on her webmail. You REALLY want to make a simple UI ? Well, please try to explain and justify (with real arguments) Why on earth is https with an untrusted certificate less secure than http ?. Okay I'll let you 3 seconds to think. 1
2
3 What is your answer ? OH see ? it isn't. So now second 1 question, why does it need to be more painful to use https with an untrusted certificate than plain http ?. Well, I don't have 3 seconds to give anymore, so let's jump to the answer: there is absolutely no reason. See, I'm far from an UI expert, and what I use every day for UIs would revulse 99% of the planet: vim as an editor, awesome as a tiling window manager, vimperator for a browser, and I live most of the time in a terminal. But it takes me like 10 minutes to design what I believe to be an excellent UI for https with untrusted certificate: just don't mind the certificate and show it like plain HTTP. YES I'M ANNOYED That brings me to the last point. I see in my comments, and have received the same by mail, that I should not be harsh with people writing such a brilliant piece of software. Well, the fact that firefox is or is not a good piece of software is totally irrelevant. When you claim no less than trying to reinvent the web, well, if you fuck up this big, you deserve it. No matter if it's a free piece of software or not. (or a piece of free software or not). When you request your users to click on FIVE completely counter-intuitive buttons/urls to finally be able to see a webpage they want to see (and my mom doesn't care about the webmail being insecurely hosted, really), with the first screen being almost the same than what you get when a serer timeouts or 404, well, you're just out of your mind. There is absolutely nothing that can excuse such a bad design, and the SSL thing is a failure. I mean everyone is laughing at the vista way of asking you if you really meant to go pee, well I see no difference here, it's as dumb and inefficient. No matter how much firefox did improved (and it did memory wise, believe me, I feel it, and I'm really glad about that), https is part of my everyday's life. Those five clicks are a real PAIN. When I'm reading documentation, browsing some sources, and so on, I go through this dialog about 3 to 10 times in a row. I'm totally unimpressed, and just because a couple of geeks believed that it was GOOD to educate me about how dangerous untrusted certificates are, I have to break my workflow to grab my mouse in the middle of my work. No sorry, I don't really want to be calm. In fact, what annoys me the most, is that I'm a programmer. And as a programmer, the worst thing to me, is regression. Regression is what happens when you're sloppy, and don't test your program enough. It's what happen when you aren't good enough to keep your concentration, and don't see the big picture, and constantly break your program invariants. So when I see a regression that people did on purpose, well, it shocks me beyond what I can explain with words, that's the worst thing you can do to a piece of software. I won't really mind a new feature that only partially works, I won't mind if a feature that is complicated to write isn't there after 5 years dreaming of it, but this ? I do mind. There is no way to consider that ruining a piece of software like that to the name of A Greater Good is excusable. Oh and last words: wanting to educate people this way is a way worst offense that what I will ever say on the subject. Such a condescending approach to what they think of their users reminds me of various journalists that I met, and that when I tried to rephrase some things so that they can write about it to their readers, answered to me oh you know, they're too dumb, they'll never understand. And as a result, articles or interview are always distorted, can't interest the readers that don't care about the subject a lot, because there's nothing captivating in the article, and is totally inexact and uninteresting to people interested in the matter, because it's void from its substance. Well, the SSL dialog gives me the very same impression: it's annoying to me who knows what a SSL certificate is, and my mom won't know a single bit more what an SSL certificate is and why she should care^[1].

For best system security you want to apply kernel security patches ASAP. For an attacker gaining root access to a machine is often a two step process, the first step is to exploit a weakness in a non-root daemon or take over a user account, the second step is to compromise the kernel to gain root access. So even if a machine is not used for providing public shell access or any other task which involves giving user access to potential hostile people, having the kernel be secure is an important part of system security. One thing that gets little consideration is the overall effect of applying security updates on overall uptime. Over the last year there have been 14 security related updates (I count a silent data loss along with security issues) to the main Debian Etch kernel package. Of those 14, it seems that if you don’t use DCCP, NAT for CIFS or SNMP, IA64, the dialout group, then you will only need to patch for issues 2, 3 (for SMP machines), 4, 5, 7 (sound drivers get loaded on all machines by default), 9, 10, 11, 12, 13, and 14. This means 11 reboots a year for SMP machines and 10 a year for uni-processor machines. If a reboot takes three minutes (which is an optimistic assumption) then that would be 30 or 33 minutes of downtime a year due to kernel upgrades. In terms of uptime we talk about the number of “nines”, where the ideal is generally regarded as “five nines” or 99.999% uptime. 33 minutes of downtime a year for kernel upgrades means that you get 99.993% uptime (which is “four nines”). If a reboot takes six minutes (which is not uncommon for servers) then it’s 99.987% uptime (”thee nines”). While it doesn’t seem likely to affect the number of “nines” you get, not using SMP has the potential to avoid future security issues. So it seems that when using a Xen (or other virtualisation technology) assigning only one CPU to the DomUs that don’t need any more could improve uptime for them. For Xen Dom0’s which don’t have local users or daemons, don’t use DCCP, NAT for CIFS or SNMP, wireless, CIFS, JFFS2, PPPoE, bluetooth, H.323 or SCTP connection tracking, then only issue 11 applies. However for “five nines” you need to have 5 minutes of downtime a year or less. It seems unlikely that a busy Xen server can be rebooted in 5 minutes as all the DomUs need to have their memory saved to disk (writing out the data to disk and reading it back in after a reboot will probably take at least a couple of minutes) or they need to be shutdown and booted again after the Dom0 is rebooted (which is a good procedure if the security fix affects both Dom0 and DomU use), and such shutdowns and reboots of DomU’s will take a lot of time. Based on the past year, it seems that a system running as a basic server might get “four nines” if configured for a fast boot (it’s surprising that no-one seems to be talking about recent improvements to the speed of booting as high-availability features) and if the boot is slower then you are looking at “three nines”. For a Xen server unless you have some sort of cluster it seems that “five nines” is unattainable due to reboot times if there is one issue a year, but “four nines” should be easy to get. Now while the 14 issues over the last year for the kernel seems likely to be a pattern that will continue, the one issue which affects Xen may not be representative (small numbers are not statistically significant). I feel confident in predicting a need for between 5 and 20 kernel updates next year due to kernel security issues, but I would not be prepared to bet on whether the number of issues affecting Xen will be 0, 1, or 4 (it seems unlikely that there would be 5 or more). I will write a future post about some strategies for mitigating these issues. Here is my summary of the Debian kernel linux-image-2.6.18-6-686 (Etch kernel) security updates according to it’s changelog, they are not in chronological order, it’s the order of the changelog file:

1. 05 Jun 2008: CVE-2008-2358 for DCCP and CVE-2008-1673 for ASN.1 (NAT for CIFS and SNMP).


2. 23 May 2008: CVE-2008-2136 memory leak in IPv6 over IPv4 tunnels, CVE-2007-6712 timer related bugs, CVE-2008-1615 ptrace on AMD64 architecture, and CVE-2008-2137 “Validate address ranges regardless of MAP_FIXED”.


3. 07 May 2008: CVE-2008-1669 SMP race


4. 11 Apr 2008: CVE-2007-6694 PPC only, CVE-2008-0007 Add VM_DONTEXPAND to vm_flags in drivers that register a fault handler but do not bounds check the offset argument, CVE-2008-1294 prevent user escape from RLIMIT_CPU, and CVE-2008-1375 fix dnotify race.


5. 10 Feb 2008: CVE-2008-0010 and CVE-2008-0600 Fix missing access check in vmsplice.


6. 25 Jan 2008: Not a security issue, but silent data loss on IA64.


7. 22 Jan 2008: CVE-2007-6151 ISDN memory overrun, CVE-2008-0001 something related to checking the access to a directory, CVE-2007-2878 FAT filesystem related, CVE-2007-4571 ALSA bug that allows user to read kernel memory.


8. 17 Sep 2007: Fix minor DOS attack for slightly privileged users (EG members of dialout group).


9. 18 Dec 2007: CVE-2007-6063 overflows in ISDN subsystem, CVE-2007-6206 core dumping over an existing file can get the wrong ownership (should be possible to use kernel.core_pattern to work around this [1]), CVE-2007-5966 timer issue, CVE-2006-6058 Minix fs DOS attack via corrupted fs, and CVE-2007-6417 tmpfs memory leak.


10. 29 Nov 2007: CVE-2007-3104 local kernel DOS attack (Oops), CVE-2007-4997 malicious frame on wireless interface crashes system, CVE-2007-5500 potential system hang, and CVE-2007-5904 CIFS overflows from server sending corrupt data.


11. 02 Oct 2007: CVE-2007-4573 Xen 64bit with 32bit DomU, CVE-2006-5755 Xen, CVE-2007-4133 memory management DOS, and CVE-2007-5093 DOS when unplugging a webcam that is in use.


12. 25 Sep 2007: CVE-2007-3731 ptrace causing Oops, CVE-2007-3739 memory management Oops, CVE-2007-3740 CIFS not honoring umask, CVE-2007-4573 ptrace of 32bit process on AMD64 bug, and CVE-2007-4849 JFFS2 (flash media) filesystem bug.


13. 27 Aug 2007: CVE-2007-2172 IPv4 memory related issue (local DOS or compromise?), CVE-2007-2875 local user can read kernel memory if cpuset filesystem is mounted, CVE-2007-3105 buffer overflow in random number generator, CVE-2007-3843 CIFS, and CVE-2007-4308 AAC RAID.


14. 11 Aug 2007: CVE-2007-1353 bluetooth, CVE-2007-3513 usblcd, CVE-2007-2525 PPPoE, CVE-2007-3642 H.323 connection tracking, CVE-2007-2172 IPv4 local exploit, CVE-2007-2453 slightly less random numbers, CVE-2007-2876 SCTP connection tracking, CVE-2007-3851 i965 batch buffer usage, and CVE-2007-3848 potential privilege escalation.

• [1] http://etbe.coker.com.au/2007/01/05/core-files/

Share This

During the Emdebian Worksession at TCl, various improvements were made to dpkg-cross, apt-cross and emdebian-tools packages. After a few delays caused by (what turned out to be) a 4 extension cable that blew up 300 of equipment, I'm finally merging those changes into the Debian packages - yet I don't have any control over the same changes in Ubuntu.

I really don't like Launchpad (I have quite enough web-logins thank you very much) or the PTS link that shows Ubuntu bugs that I cannot close from Debian. Lucas' assurance that "I don't expect Debian maintainers to reply to bugs on launchpad", makes it even harder to see the point of the bug listed in the emdebian-tools PTS.

• The bug was opened against (0.2.0), released 10 Apr 2007 and there have been > 50 releases since then, including a complete rewrite of the file in question. In all that time, nothing has happened with the Ubuntu bug.


• emdebian-tools is not intended for Ubuntu but I don't have a way of encoding that in the package. emdebian-tools is tightly integrated into Debian (and Debian unstable in particular) and is, naturally, a Debian native package (it was written to support Embedded Debian after all, not UbuntuMobile). It isn't intended to work on Ubuntu because Ubuntu does not provide the foreign packages needed for linking when cross building, those come exclusively from Debian. Same with apt-cross, it is exclusively designed for Debian, Debian mirrors and Debian buildd configurations. How is emdebian-tools meant to cross-build for ARM on Ubuntu when Ubuntu does not provide ARM packages and makes changes to the equivalent Debian packages? To me it seems highly unlikely that cross versions of Debian packages would install over a Ubuntu base, especially when those packages are the typical debootstrap selection that have a variety of changes in Ubuntu. I don't run Ubuntu, I have no inclination to test for Ubuntu and as no-one else has offered, I cannot support Ubuntu.


• emdebian-tools is documented to advise the use of a Debian sid chroot in situations where the machine in question is not running Debian unstable - this applies as much to Debian Etch as to Ubuntu foo.


• The bug is supposedly "confirmed" when the actual section was removed months ago. The real issue behind the bug cannot be fixed until Ubuntu supports all the architectures that Debian supports and at the same versions - i.e. it isn't going to happen because that would be pointless.


• I don't intentionally want to make things difficult for Ubuntu (so keeping the bug in place merely to prevent installation isn't sensible and would just annoy people).

Makes me wonder if a Not-For-Ubuntu field could be used in debian/control to force the removal of Debian packages from Ubuntu Universe where the Ubuntu setup is simply incompatible with the Debian package. This isn't something that the MOTD can "patch-up" in Ubuntu - it is a fundamental difference between Debian and Ubuntu that goes right back to the roots of why Ubuntu was created in the first place.

Yes, I can ignore Ubuntu (already do) but it is still annoying that there are bugs that simply cannot be fixed (and that the Debian PTS reminds me of that fact).

Maybe if someone who does care about such things and has a Ubuntu launchpad login wants to close the bug as "wontfix" or equivalent . . .
https://bugs.launchpad.net/ubuntu/+source/emdebian-tools/+bug/121369 - just to clear it off my radar?

(Oh and why does LP insist on https??? I'm not logged in, that's the entire POINT!) Bah.

In just under a month, the tenth O'Reilly Open Source Convention will get underway in Portland. Over ten years OSCON has developed—along with the world of open source—into an intense, exciting, informative, diverse and exhausting event. This year I've the privilege of being co-chair, along with Alison Randall. We've packed so much into the show, it's a difficult job even being able to comprehend it as a whole! Fortunately, there's a way to start making sense of things before you arrive there, thanks to the personal scheduler. Just mark the sessions you want to go to with a star, and you'll be able to plan out your time in advance. I wanted to list a few sessions from my own personal schedule that particularly piqued my interest. Then at the bottom of this post I'll share a discount code which can give readers of this blog 15% off OSCON registration. There's bribery for you. Practical Erlang Programming Largely thanks to XMPP enthusiasts and ejabberd, I've been hearing increasing amounts about Erlang, and I'd like to know enough about it to be dangerous. This three hour tutorial looks just the ticket. Open Source Virtualization Hacks This is one of several sessions we have on virtualization, something I'm particularly pleased about. Virtualization may be "done" at the kernel level, but I think we're only just starting out on its application. This session is by my friend and sometime co-author, Niel Bornstein, who works for Novell on just this sort of thing. Using Puppet: Real World Configuration Management Puppet is the piece of open source software that is most exciting to me at the moment. As a developer, it enables me to manage my machines like I'd manage my code libraries. A must-see if you've not used Puppet yet. These are just 3 out of the 300 or so confirmed sessions. Don't forget there's a large number of events and parties happening around OSCON too. And finally, the discount code. Use the code os08pgm when you're registering, and you'll get 15% off the ticket price. See you in Portland!Join the conversation about this post

As some of you may know, the Euro 2008 football championships are on in Austria and Switzerland at the moment. I am not a football fan at all, although I won t mind watching a game between two skilled and fairplaying teams (which is becoming a rarity, I heard). But I don t care much about it, unless it negatively affects those who don t care (which includes myself). For instance, last night, after Germany beat Turkey in the semi-finals, a group of hooligans roamed about in Dresden and vandalised Turkish food shops and hurt the people working there (German only). I can kind of understand fans getting overly excited and driving their cars madly through the city, honking the horns at frequencies directly proportional to their cumulative personality disorders (or inversely proportional to their penis size), but violence in reaction to winning? Fuck you, you low pieces of shit. ! Update: there seems to be no information on whether the attackers were German. A foreigner living in Berlin has written in to complain that my blog post casts a negative light onto Germany in terms of hostility towards foreigners, which he disputes. Germany has had to fight that image for decades, and my blog post puts fresh petrol on the fire. I do not intend that. I leave it up to each individual to make up their own mind, and to me, a group of hooligans is in no way representative of an entire nation. End update Quite clearly, there are people on the street who should be locked up. I won t go there though, at least not in this post. Instead, let s talk more about football and its effects, because encouraging this sort of violence is only one of many consequences, which we are forced to tolerate in the interest of the public. Everyone wants football, right? What follows are somewhat related, but otherwise incoherent rants. Enjoy, or stop reading. I m not a misanthrope, I think. There are many other aspects of this football event which make me want to throw up. One of them is the (sight of the) average organism who participates in the craze. Look at them! Monkeys are more intelligent than that! Has evolution taken a 180 degree turn? Of course, you can t blame the individuals, as their brains have been flooded and effectively shut off, so they don t make any trouble when they trott along the path to dumbification. It s the big companies and the media industry, blinded by short sight, do everything in their power to speed up this decline, fueling the consumerism of the stupified morons making up our the populace, just for the paycheck at the end of the day. The UEFA is primarily a huge money-making machine, and if you want more information on that I suggest that you look a bit into the distribution of media rights for the event. Another instance, which has a little more relevance to the normal person on the street is their ticket distribution: people have to pay hundreds of Euros to UEFA a year before the event for a chance to be given a ticket for any random day. The ticket is made out in their name and cannot be transferred. If you can t make the game, you can return the ticket to get you money back after the event. If you don t get a ticket, you ll also get your money back a year later. Interest-free loans, anyone? But hey, I actually don t care about most of that. Let those who want to consume consume, let those who can t entertain themselves watch television, let the UEFA and media people get rich by making people stupid, and let me go about my daily business. We held a small barbeque party some days ago, and I went out to buy a few kegs of beer from a local brewery. That was my first confrontation with the football circus, as the brewery happens to be about half a kilometre from the stadium where a match was on that night. It took me at least 40 minutes until I had argued successfully with five police officers and could pick up the kegs. Swap brewery for any of the other shops in the area, who did not receive any compensation whatsoever, and you ll note how the football circus takes priority over everyone s everyday life, even if you don t give a single flying food for the sport. I love Zurich, and just like most people, taking a stroll along the lakeside, between Bellevue and the Chinese Garden on a sunny afternoon is one of the more delightful ways to spend time in the city and enjoy its beauty unless they are putting up massive public viewing areas everywhere (and make shitloads of noise in doing so), and even dump elevated VIP platforms into the lake to add noise in the view to the noise in the ear. The official entities of Switzerland surely pushed for the event, as it drives tourism and brings money into the country. But were the people actually considered? Could we have done anything against this craze? I bet noone ever asked. I find it very sad how much garbage these fan monkeys produce. Switzerland is well-organised, and there are plenty of garbage cans around, many of which have been put in place specifically for the event, but it s already too much to ask of these low organisms to put the shit left from their consumption into those bins. And I won t even go near the question of how much energy this entire event wastes. Yay entertainment! Yay stupification of the populace! If you have football to celebrate, you don t have to consider the environment, or poverty, or other such annoying issues. Sunday night, the circus will come to an end, and what ll be left is a few days of cleaning and tearing down all the structures. Then this place will finally retun back to normal, and there ll be a little less idiots on the street, at least in the places I frequent. NP: Dimmer: There My Dear

Today I received a Dell PowerEDGE T105 for use by a client. My client had some servers for development and testing hosted in a server room at significant expense. They also needed an offsite backup of critical data. So I suggested that they buy a cheap server-class machine, put it on a fast ADSL connection at their home, and use Xen DomU’s on that for development, testing, and backup. My client liked the concept but didn’t like the idea of having a server in his home. So I’m going to run the server from my home. I selected a Dell PowerEDGE tower system because it’s the cheapest server-class machine that can be purchased new. I have a slight preference for HP hardware but HP gear is probably more expensive and they are not a customer focussed company (they couldn’t even give me a price). So exactly a week after placing my order I received my shiny new Dell system, and it didn’t work. I booted a CentOS CD and ran “memtest” and the machine performed a hard reset. When it booted again it informed me that the event log had a message, and the message was “Uncorrectable ECC Error” with extra data of “DIMM 2,2“. While it sucks quite badly to receive a new machine that doesn’t work, that’s about the best result you can hope for when you have a serious error on the motherboard or the RAM. A machine without ECC memory would probably just randomly crash every so often and maybe lose data (see my previous post on the relative merits of ECC RAM and RAID [1]). So I phoned up Dell (it’s a pity that their “Packing Slip” was a low quality photocopy which didn’t allow me to read their phone number and that the shipping box also didn’t include the number so I had to look them up on the web) to get technical support. Once we had established that by removing the DIMMs and reinserting them I had proved that there was a hardware fault they agreed to send out a technician with a replacement motherboard and RAM. I’m now glad that I bought the RAM from Dell. Dell’s business model seems to revolve around low base prices for hardware and then extremely high prices for extras, for example Dell sells 1TB SATA disks for $818.40 while MSY [1] has them for $215 or $233 depending on brand. When I get the machine working I will buy two 1TB disks from MSY (or another company with similar prices). Not only does that save some money but it also means that I can get different brands of disk. I believe that having different brands of hard disk in a RAID-1 array will decrease the probability of having them both fail at the same time. One interesting thing about the PowerEdge T105 is that Dell will only sell two disks for it, but it has four SATA connectors on the motherboard, one is used for a SATA DVD player so it would be easy to support three disks. Four disks could be installed if a PCIe SATA controller was used (one in the space for a FDD and another in the space for a second CD/DVD drive), and if you were prepared to go without a CD/DVD drive then five internal disks could probably work. But without any special hardware the space for a second CD/DVD drive is just begging to be used for a third hard disk, most servers only use the primary CD/DVD drive for installing the OS and I expect that the demand for two CD/DVD drives in a server is extremely low. Personally I would prefer it if servers shipped with external USB DVD drives for installing the OS. Then when I install a server room I could leave one or two drives there in case a system recovery is needed and use the rest for desktop machines. One thing that they seem to have messed up is the lack of a filter for the air intake fan at the front of the case. The Opteron CPU has a fan that’s about 11cm wide which sucks in air from the front of the machine, in front of that fan there is a 4cm gap which would nicely fit a little sponge filter. Either they messed up the design or somehow my air filter got lost in transit. Incidentally if you want to buy from Dell in Australia then you need to configure your OS to not use ECN (Explicit Congestion Notification [2] as the Dell web servers used for sales rejects all connections from hosts with ECN enabled. It’s interesting that the web servers used for providing promotional information work fine with ECN and it’s only if you want to buy that it bites you. But in spite of these issues, I am still happy with Dell overall. Their machine was DOA, that happens sometimes and the next day service is good (NB I didn’t pay extra for better service). I expect that they will fix it tomorrow and I’ll buy more of their gear in future. Update: I forgot to mention that Dell shipped the machine with two power cables. While two power cables is a good thing for the more expensive servers that have redundant PSUs, for a machine with only one PSU it’s a bit of a waste. For some time I’ve been collecting computer power cables faster than I’ve been using them (due to machines dying and due to clients who want machines but already have spare power cables). So I’ve started giving them away at meetings of my local LUG. At the last meeting I gave away a bag of power cables and I plan to keep taking cables to the meetings until people stop accepting them.

• [0] http://etbe.coker.com.au/2008/06/13/ecc-ram-vs-raid/


• [1] http://www.msy.com.au/


• [2] http://www.ietf.org/rfc/rfc3168.txt

Share This

My random thoughts of the day go to the "triggers" feature in dpkg. The addition of that feature triggered a lot of noise, discussions and flames a few months ago. Actually more about the way it was added and the schedule that was followed, more than the feature itself. No need to come back on this. That's Debian's life...:-) These days are over: the feature is here. And frankly I love it even though I probably don't understand more than 10% of it... Today, I ran quite huge "dist-upgrade" of my laptop (where I try to stick with unstable) after 3...days not upgrading it. And I noticed that:

.../...
D paquetage de la mise   jour de foo
Pr paration du remplacement de foo
.../...
Param trage de foo
.../...
Traitement des   d clenchements (triggers)   pour   menu  ...
.../...

(isn't the French localization of dpkg rocking?). So, as I understand, update-menus is now only called once per run instead of being launched on every package configuration. If I'm correct, this is what triggers are for. And, frankly, that rocks. This is one of these improvements that will never be noticed by Joe Random User, but exactly one that makes our favourite distro and its derivatives the best all around. So, that random blog post is dedicated to all people who made this possible. Such things are the reason I'm still stuck to Debian after so many years.

I have just watched an interesting lecture by Steven Levitt about car safety for children in the 2-6 age range [1]. The evidence he presents shows that the benefits for children in that age range are at best insignificant and that in some corner cases (EG rear impacts) the child seat may give a worse result than an adult seat belt! He advocates a 5-point harness [2] for children in the 2-6 age range that is based on a standard adult seat and seems to be advocating a child “booster seat” integrated into the adult seat (which approximates the booster seats offered by some recent cars such as the VW Passat). He has a picture of a child in a child-sized 5-point harness to illustrate his point. But one thing that should be considered is the benefit of a 5 point harness for adults. Race car drivers use 5 point harnesses, I wonder how the probability of a race car dying during the course of their employment compares with the probability of an average adult dying while doing regular driving. I also wonder how a 5 point harness compares to a three point harness with a pre-tensioner, it seems quite possible that a 5 point harness would be cheaper and safer than the 3 point harness with pre-tensioner that is found in all the most expensive cars manufactured in the last few years. He believes (based on tests with crash-test dummies) that part of the problem is that the child seat will move in an accident (it’s attached to a soft seat). It seems that one potential solution to this is to have child seats that firmly attach to some solid part of a vehicle. I had previously suggested that child seats which replace existing seats as an option from the manufacturer would be a good idea [3]. But there is a good option for making better child seats for existing vehicles. It is becoming common in the “people mover” market segment to design vehicles with removable seats. For example the Kia Carnival has three seats in the middle row which are removable and which attach to four steel bars in the floor. It should not be difficult to design a child seat which attaches to those bars and could therefore be plugged in to a Carnival in a matter of minutes. The Carnival is designed to have the mid row seats installed or removed easily and safely by someone who is untrained, while for comparison it is recommended that a regular child seat should only be installed by a trained professional (IE your regular mechanic can’t do it).

• [1] http://www.ted.com/talks/view/id/30


• [2] http://en.wikipedia.org/wiki/Seat_belt#Five-point_harnesses


• [3] http://etbe.coker.com.au/2007/12/22/a-better-design-for-child-seats/

Share This

I ve just tested the improvements in the performance of Javascript in Firefox 3 and WOW! Javascript in FF3 is really fast. While googling about it I just ran across a recent interview with Brendan Eich about the future of Javascript and I got excited about two things about this future. First was what we already have, still in the beginning, but with a lot of potential: HotRuby. Really interesting to script a webpage in Ruby (which is my favorite language) and, while it s not embedded the way Javascript is, it gets compiled in the server side with YARV (the new bytecode compiler for the next version of Ruby, 1.9), and then served to the browser in the form of JSON objects, so it can be interpreted by the Javascript engine in it. All this is transparent and work with XMLHttpRequest. It s not a coincidence that Eich mentions it as being a form of ARAX (changing the J in AJAX for R from Ruby). I already do a lot of coding in Ruby not having to deal with Javascript anymore is surely a plus. ITOH, Eich is talking about improvements in Javascript that would render it as a real programming language Maybe coding in it would not be so painful anymore by then ;-) The whole interview have to do with this Project Tamarin, a high-performance, open source implementation of the ECMAScript 4th edition (ES4) language specification [ ECMAScript 4 is the same thing as Javascript 2 ] by the Mozilla developers. And this is the second thing I got excited for: they ve planned to glue IronRuby (Ruby compiler for argh! .NET) to it via IronMonkey. So exciting news! Either via Tamarin or via HotRuby, we ll get Ruby browser scripting. My free mind tends to favor HotRuby instead of IronRuby/IronMonkey/Tamarin But in the end what matters is that all those people now cursed by Javascript will finally have a taste of what a real programming language feels like.. Who knows! They might even like it ;-D

I have to agree with Wouter regarding Firefox Iceweasel 3's suckyness. It might be a superior product in many fronts (I prefer it overall to its predecesor), but were it not for the usefulness of its many available extensions (most notably Web Developer, which has become an integral part of my everyday life), I'd have jumped ship for basically any other browser.
I'm just... adding an <AOL>ME TOO!</AOL> on Wouter's comments... WTF, just go to about:config...

So... Are you telling me that Firefox (even if it were the original, Mozilla-blessed version) has a warranty? No? Didn't think so... Go to about:license. You will see the very familiar and expected:

7. Disclaimer of warranty
Covered code is provided under this license on an "as is" basis, without warranty of any kind, either expressed or implied, including, without limitation, warranties that the covered code is free of defects (...)

Other than this downright stupid issue (which by and large goes against the regular Free Software culture), my main gripe is the number of active regions in the location-entry boxes - Yes, I can jump straight to the search box with Ctrl-K and to the location bar with Ctrl-L, but if I happen to try to move between them with good ol' Tab, why must it be inconsistent?
What do I mean? Go to the search field, press Tab. As expected, you are in the Location entry. Now, press Shift-Tab. For 5 points, where are you now? Bzzzt, no, you are not back where you began - You are in a stupid button which looks like your favicon giving you the identity information about the page you are looking at.
Having this button is a great idea - but why does it have to sit in the way of my tabulation? Were it because, in an inspired moment, the Firefox interface designers decided that buttons should be keyboard-accessible, I'd be most happy (it is by far my most mouse-intensive application, and I hate that... But it's just a button embedded in what should be a clean text-entry box.
And for that matter, it is not even a consistent button - Shift-tabbing from the search field will not get you to the search engine selector. And no key combination will lead you to the noisy (and also, mutually inconsistent) iconic buttons at the far right of both fields... Which, again, have no reason to be inside a text entry field!
Oh, and I found another pretty little jewel: Go to any site which has a self-signed SSL certificate. Of course, Firefox will go to great lengths to make sure you understand how unsafe is it for you to trust anybody who didn't pay big bucks to Verisign... But this is enough reason for me to send a bug report:

I am connecting through a crypted HTTPS connection. The site is providing identity information - not certified, right, but it does provide something. And the connection is crypted. Firefox/Iceweasel 2 showed me the URL in a light-yellow background showing the connection was secure - Now it just denies penta.debconf.org the right to call itself secure.
(Yes, I am not an interface designer... But it seems neither are they)
[update]Bug filed. Any comments will be welcome in Bugzilla. The bug with the Debconf site (and I do regard it as a bug) is that Iceweasel displays that Your connection to this web site is not encrypted because some of the elements (i.e. the CSS, images..) are sent in the clear - Even though the real information is crypted. Ever heard of data/visualization decoupling?

This one had been a long time in the making, but here it goes: I'm orphaning Planner. Why? Because upstream hasn't been too active in ages, save from a few random bug fixes, and because the GCC 4.3 transition at Debian has exposed yet more bugs that make it FTBFS. The package had been marked as RFA for a while, but I decided that I'm not gonna wait any longer; O it is. Hopefully, an experienced GNOME maintainer will take over and revamp the upstream code into a usable shape. If not, then I guess we just found another dead package in the archive. So be it.