Ok, the time has come. I have postponed this change too much - But finally, after three months of having hired my Dreamhost account (and stating so in this very blog), I finally made the switch from Jaws to Drupal.
Now I only hope I don't flood any planets with my RSS (I was careful to check the dates are consistent, but you never know), finish moving over my static content (I carried over about half of it already), play a bit with the theme, and... that's it! :D
Anyway, I promised my oh-so-not-generic-but-what-the-heck Jaws (0.7 at least) to Drupal (5.x) migration script. It worked like a charm - Ok, I only used it to move blog and photo albums/entries, but that's at least the most typical use AFAICT.
Now, I'll have to understand still some more terms and details in Drupal. For example, WTF? Why was jaws_to_drupal.pl renamed to jaws_to_drupal.pl.txt? (stated content-type, I guess) Why do my uploaded tar.gz files get renamed to tar_.gz even if I explicitly requested to allow .tar.gz suffix uploads? (same thing, I guess)

First of all: no, I'm not a huge fan of the genre. In fact, when I don't feel too good, I tend to avoid them, since they can depress me at times. But once in a while, a romantic comedy doesn't hurt, and I do kindof like them at times. Early last week, I picked up a DVD of the first movie at a low-price DVD shop nearby, and watched it. The prince and me isn't my favourite movie in the genre; the plot surely is interesting, but I can't shake the feeling that things work out too easily in the end. Compare with Notting Hill, for example, where the two protagonists need to go through (I believe) three cycles of relationship/no relationship before the end of the movie; this, in my opinion, makes for far more interesting cinema. But, all in all, it certainly was an interesting watch. I might think the plot could've used some improvement; but that doesn't mean it's bad. The entire visual aura of the movie is great; they went through quite some effort to make it look well. For instance, in a number of scenes it's obvious that they made the clothing of the characters blend in with the background; and yet they still managed to create diversity in those colors during scenes, by making the clothing differ just that tiny bit, and different parts of the background as well; the entire scene would be built up of one painting-like shot after another, yet all of them slightly different. Impressive. And then I haven't even mentioned the casting, which was magnificent. Anyway. Since I kindof liked the movie, and since the sequel DVD wasn't expensive, either, I got that DVD as well. Boy. I've never quite seen a movie's sequel be so completely and utterly out of touch with its original. What horror. Except for the male protagonist, not a single actor of the original cast returned for the sequel. They had good reason, so it seems. The plot is utterly stupid. It revolves around an ancient law that made it somehow illegal for the couple to get married. Hello? Do you really think a king wouldn't have the influence to convince parliament to get rid of that law? Of course not, but then you wouldn't have a plot anymore. Now if the rest of the movie would make up for this silliness, then it wouldn't be so bad. Except it doesn't. This movie is bad in... let me count the ways.

1. The plot error, as explained above. Also, the plot was quite incoherent, for the most part.
2. The casting is terrible. The original King Haraald, father of the male protagonist, managed to create a believable king, with that somewhat eccentric and strange flair that most European royals seem to have these days. The queen had a bit of an iciness over her, warming up to an interesting character once she started to like Paige. Even the minor roles were so well played. In the sequel, none of this returned. The queen was just tight; an empty shell. The new Paige had a problem with overacting in some of the scenes. In fact, that was a common issue; I don't think I've ever quite seen this much overacting in one movie. Also, King Haraald didn't even remotely look like the original; not physically, and not in his acting.
3. Speaking of the King, and given the plot of the original movie, he shouldn't even have returned for the sequel; he abdicated because he was terribly ill; he should've been dead, for crying out loud!
4. The CGI was horrible. In the original movie, there were a few scenes where I'll bet CGI was used; not because it showed, but because I don't think it were possible to create that scene otherwise. In the sequel, you could tell when CGI was used due to the utter lack of natural feeling. Ever heard of a randomizer? It's what you use to avoid having a full room of butterflies all shake their wings at the exact same speed. Shudder.
5. The "painting" feeling and attention to detail of the original movie was nowhere to be found. In fact, at some point they show a castle which supposedly is in Denmark somewhere, but it shows the Czech flag, instead. Ugh.
6. Some of the gags were funny, but not as intended; because they were so silly. I've seen 3-year-olds make better jokes.

... I guess I could go on forever, but then there isn't much point in boring my audience. The short version: the original "The prince and me" is an interesting watch, but please forget about the horrible sequel... ... I guess there's a reason why they put it directly on DVD and skipped the theatres.

... finally I got my blog up again and I start with yet another lame post My latest security backports to the upstream abandoned mozilla 1.8.0 branch are now available at http://people.ubuntu.com/~asac/mozilla-security/moz-1.8.1.12a-backports.tar.gz. Those patches should cover all security related fixes that landed on the 1.8 branch (firefox 2) as of 2.0.0.12 RC3. I noticed that I didn’t really release any of the post-mortem security patches released in debian and ubuntu. So, here the patchsets for the 1.8.0 branch that contains them all:

• firefox – http://people.ubuntu.com/~asac/mozilla-security/moz-backports-ffox-all-1.8.1.12.tar.gz


• thunderbird – http://people.ubuntu.com/~asac/mozilla-security/moz-backports-tbird-all-1.8.1.12.tar.gz


• xulrunner – http://people.ubuntu.com/~asac/mozilla-security/moz-backports-xul-all-1.8.1.12.tar.gz

Those tarballs ship quilt patch directories. This means that the sequence to apply them cleanly can be found in the contained series file. To apply them to MOZILLA_1_8_0_BRANCH checkout, just copy the directory contained to your checkout (name the directory patches if you like) and run Have fun!

My. That's a mouthful of a title. I went to this event on Friday, which was run by OpenIsland. I don't really think I was the target audience; I'm already a convert and aware of the opportunities which Free Software offers. However, there were a few bits of interest to me. Brian Doran, director of the Southern Regional College talked about including discussion of Open Source in their computer related courses. He didn't commit to more use in the colleges' IT infrastructure (and indeed Netcraft reports the website as being hosted by a Win2k3/IIS combo), but it's still a significant step forward IMO - rather than just being spoon fed MS based product people will hopefully be encouraged to think about the options available and evaluate them on their merits. We'll see if it pans out in practice. Also notable was Reg Empey, NI Minister for Employment and Learning, giving a speech involving Open Source. It got hijacked into discussion about how they were going to invest in higher education in NI and fund more PHDs in a targeted manor, but I still think the fact that a member of the NI Assembly got up and used the words Open Source (or possibly Free and Open Source Software; I can't remember exactly which speaker used that once a sentence) is quite incredible. Whether or not he's fully aware of it, someone on his staff must have done some research, and decided that it was something government was prepared to think about, or at the very least not boycott. During the day I realised that I'm prejudiced towards Free Software. I'm not sure if this is a good thing or not. I will, in general, accept slightly less functionality as long as the Free option fulfils my primary needs. And I've got used to hanging around with people who also work this way, or at the very least consider Free Software on a level playing field with proprietary stuff. I was reminded that a lot of people work the other way; either they're not aware of the Free alternatives, or they view them with a natural suspicion. So it was really good to see people standing up and talking about how they'd built their businesses on Free Software, and even better, about how they were pushing back upstream fixes/features they'd needed as part of their business. I don't know if anyone in the audience was converted, but it's certainly the sort of thing I like to see - it's important to appreciate that as well as Free Software being a great resource, it's also often beneficial to share any changes you make from a business point of view, as it tends to make things easier for you in the long run. Hopefully the conference did some good in terms of making people aware of Free Software (well, mostly Open Source was talked about, but both got mentioned). I wasn't convinced that there was a need, but having talked to various people I think it's just that I have got used to being surrounded by converts and perhaps lost sight of the fact that there are still plenty of people out there who aren't yet giving Free Software a chance. There are plans for this to be an annual event, so I look forward to the next one (and I think there will be various more targeted meetings over the next year too; I know there was considerable interest in covering the use of Free Software in health).

Yoav Shapira wonders about the "rails backlash": http://yoavs.blogspot.com/2008/02/railsshudder.html I'm a big fan of Rails, and of course I realize that it has some flaws and is certainly not the optimal choice for all situations, but I don't buy into the bashing. Sure, Rails was hyped, but there is no way that it could have possible reached the level of popularity it has on hype alone. We're not talking about multi-million dollar marketing budgets commanded by the likes of Sun or Microsoft, but about a video and some nice dressings by DHH and 37signals. A small group like that just doesn't have the resources to push something like Rails as far as it's gone without some substance to back it up. Look at all the imitation. People realize that the basic idea is good, and even though the basic idea is nothing phenomenal, it hadn't really been done before. What is this idea? Take a bunch of components, and good (if not always the absolute best) practices, and integrate them nicely. Database, templating, testing, a clean application structure, ajax/javascript integration, with some code generation, all done with a language that's flexible enough to do all of the above pretty well. All those things existed, but Rails did a great job of tying them all together. And that's been imitated far and wide. That seems to indicate that, even though the imitators may change and improve bits and pieces, they're quite smitten with the idea itself. So much that they've dedicated a lot of time and effort to reproduce it. That's quite a tribute. Look at the adoption. Moving to a new language/platform is a big step, not one to be taken lightly, and for people with lots of existing code in some other language, perhaps simply not possible. Hype will take things only so far, but Rails has been taken up by a large number of people who certainly didn't do so because it was the safe, easy path to take. Perhaps some of those people have found that Rails really wasn't for them, but that's pretty normal. No one said it was perfect. However, when you look at what it takes to make people jump ship from what they know, and are comfortable with, you realize that it really must have been that much better to make people go out on a limb. Furthermore, it's easy to point out the failings and drawbacks of something after the fact, but much more difficult to do creative, innovative work of your own. Compounding that is the fact that criticizing others' work is often an easy and effective way of looking smart; there's an interesting study referenced here http://bobsutton.typepad.com/my_weblog/2006/08/brilliant_but_c.html that talks about this effect. It's something I've come to dislike over the years. Our field is so new, so dynamic, and so immature, that it's usually pretty easy to take a look at something and say that it "sucks". It is much harder to write something of your own and put it out there, knowing full well that lots of people who have never done much of anything will jump on it and bemoan its "copious failings". That's not to say that it's impolite to criticize, but - do it constructively please. Imagine that you were there in the same room, talking to the person who wrote the code in question. You would still say you don't like it, but you'd probably be much more polite and helpful in your commentary. I hope so, at least.

Links in Markdown can be done in a couple ways. First, similarly to HTML links, where you place the link next to the anchor text, like this:

  I am a [Debian](http://www.debian.org) Developer.

Or, if you feel this clutters your paragraphs too much, you can choose an alternate syntax, which I prefer (particulary handy for very long links):

  I am a [Debian][] Developer. Bla bla bla...
    [debian]: http://www.debian.org

There is however a gotcha with this alternate syntax, namely, anchor text with spaces in them. This works fine:

  I study Computer Science in [this University][].
    [this University]: http://www.ua.es

But this does not:

  Some years ago, I started studying Computer Science in [this
  University][]. Bla bla bla...
    [this University]: http://www.ua.es

This actually happens quite a lot when formatting the paragraphs in the editor, which made this otherwise-pleasant syntax almost a no-go for me. (Well, to be honest you could use it like this, but still:

  Some years ago, I started studying Computer Science in [this
  University][uni]. Bla bla bla...
    [uni]: http://www.ua.es

)

---

There is a beta version of Markdown in experimental that almost fixes the problem. This version introduces a new but similar syntax for links: you can omit the second pair of empty brackets. And when using that newer syntax, there is code in the program to change newlines into a space when looking for the link definition. It is not applied to the code path of the old syntax, though, which is a pity. This is all explained in bug #459885, with a patch as well (that applies both to 1.0.1 and 1.0.2). You can find packages with that patch applied here.

Otavio is currently busy preparing the first release of D-I for lenny. He is still polishng the release schedule but, as part of the process, I sent a call for translation updates today. The starting point is: 59 activated languages (including English) but 'only' 18 of them are 100%. For others:

1 100% bg
   100% cs
   100% de
   100% es
   100% eu
   100% fr
   100% gl
   100% gu
   100% it
   100% ja
   100% ko
   100% nl
   100% pt
   100% ru
   100% sk
   100% sv
   100% vi
   100% zh_CN   18
 2 099% hu      1
 3 098% be
   098% ca
   098% dz
   098% eo
   098% he
   098% ml
   098% nb
   098% nn
   098% pl
   098% pt_BR
   098% ro
   098% sq
   098% ta
   098% th
   098% zh_TW   15
 4 097% bn
   097% lt
   097% ne
   097% pa      4
 5 094% ar      1
 6 093% bs
   093% da
   093% el
   093% et
   093% fi
   093% hi
   093% hr
   093% id
   093% ka
   093% km
   093% lv
   093% mk
   093% sl
   093% tl
   093% tr
   093% uk
   093% wo      17
 7 090% am      1
 8 085% ku      1

Languages at 93% had no single updates since Etch. For these, I have some worries and I fear we could 'lose' some if their translator disappeared. Amharic and Kurdish never reached 100% yet but they have translated the most important strings, so we'll probably keep them. So, in short, the message to translators is: *move*. You have about 2 weeks.

I'm really pleased to announce here that one of the projects Maj and I have been working on for a long time has finally come to fruition. Today Wikitravel Press launched its first two Open Content printed guidebooks -- Wikitravel Chicago and Wikitravel Singapore. When we started Wikitravel back in 2003 (!), our sincere hope was that at some point in the future, people would be able to carry Wikitravel guidebooks with them on a trip. I think that mobile technology is excellent, and it's amazing how much you can read on a cell phone or PDA these days. But there's still something so convenient about a printed guidebook: it never runs out of batteries; you don't need an uplink to read it; you don't have to worry about it getting stolen because you flashed it out in the wrong caf or restaurant. To be honest, I thought that one of the "traditional" guidebook publishers would step in and use Wikitravel content in their guides. But that didn't happen, and along with our partner Jani Patokallio, Maj and I decided to start a publishing company ourselves. Thus Wikitravel Press, and our first two books. We have a number of other books in the pipeline, and our hope is to have a few dozen available by the end of the year, and a few hundred by the end of the following year. I'm working on the Wikitravel guide to Montreal, and Maj and I are collaborating on Buenos Aires. We're taking a 6-week trip to Argentina in February/March, so this should be a great time for research. I heartily encourage any writers or editors who are interested in working on travel books to contact Wikitravel Press about your ideas of bringing Wikitravel content to print. I think this is a great opportunity for people who want to encourage Open Content, or who want to get into the travel writing field, or who just love the idea of wikis-to-books. tags: wikitravel wikitravelpress travel guidebook singapore chicago

With pristine-tar version 0.5, I've added a new feature: The ability to easily inject enough information into a git repository so that a pristine tarball can later be regenerated from that repository. If a package's upstream branch contains the upstream source corresponding to the tarball to be imported, it's very simple to use.

joey@kodama:~/src/fbreader> pristine-tar commit ~/lib/debian/unstable/fbreader_0.8.12.orig.tar.gz 
pristine-tar: committed fbreader_0.8.12.orig.tar.gz.delta to branch pristine-tar

Otherwise, you also have to specify a tag (or any tree-ish really) where the upstream source can be found.

joey@kodama:~/src/fbreader> pristine-tar commit ~/fbreader_0.8.9.orig.tar.gz upstream/0.8.9
pristine-tar: committed fbreader_0.8.9.orig.tar.gz.delta to branch pristine-tar

Here's what it puts in the pristine-tar branch that it creates. In this example, the delta files are 40-some kilobytes, which is much nicer than if I'd had to check the 2 megabyte tarballs into git directly.

joey@kodama:~/src/fbreader> git checkout pristine-tar 
Switched to branch "pristine-tar"
joey@kodama:~/src/fbreader> ls -l
total 104
-rw-r--r-- 1 joey joey 46583 Jan 31 21:26 fbreader_0.8.12.orig.tar.gz.delta
-rw-r--r-- 1 joey joey    40 Jan 31 21:26 fbreader_0.8.12.orig.tar.gz.id
-rw-r--r-- 1 joey joey 45267 Jan 31 21:26 fbreader_0.8.9.orig.tar.gz.delta
-rw-r--r-- 1 joey joey    40 Jan 31 21:26 fbreader_0.8.9.orig.tar.gz.id

Don't forget to push the pristine-tar branch to your server for safekeeping.

joey@kodama:~/src/fbreader> git push origin pristine-tar

Once a tarball's delta is checked in, you can easily and quickly regenerate the original tarball.

joey@kodama:~/src/fbreader> pristine-tar checkout ../fbreader_0.8.12.orig.tar.gz
pristine-tar: successfully generated ../fbreader_0.8.12.orig.tar.gz

Yes, it's really the same file. :-)

joey@kodama:~/src/fbreader> md5sum ~/lib/debian/unstable/fbreader_0.8.12.orig.tar.gz ../fbreader_0.8.12.orig.tar.gz 
8045abe1acc75dbdd220400df541f23f  /home/joey/lib/debian/unstable/fbreader_0.8.12.orig.tar.gz
8045abe1acc75dbdd220400df541f23f  ../fbreader_0.8.12.orig.tar.gz

The above example is from the perspective of a maintainer of a Debian package. But this can also be used by the authors who generate the pristine tarballs in the first place. Check them into git using pristine-tar. Then you can regenerate any tarball you've ever released using just your project's git repository.

joey@kodama:~/src/pristine-tar> pristine-tar commit ../pristine-tar_0.5.tar.gz tags/0.5
pristine-tar: committed pristine-tar_0.5.tar.gz.delta to branch pristine-tar

One word of warning: For pristine-tar to check out the tarball, git needs to be able to check out the tree that you referred to when you committed it in the first place. If that was a tag that you've told git to delete, you're SOL. If it was a branch and the branch has changed in the meantime, that's fine, so long as git can find the original id that is stored in the .tar.gz.id file.

---

I hope that tools like git-import-orig and git-debimport can get support for automatically calling pristine-tar commit when importing tarballs into git, and that tools like git-buildpackage and gitpkg can use it to check out the tarballs.

It seems that my blogging contest idea is a failure. Could the interested people please meet me near the LCA registration desk at the start of the lunch breakh today for a post-mortem. Any last-minute entries can be submitted by telling me the URL then.

Share This

I have this USB hard drive enclosure that can also share the files on the local network (LAN DRIVE HD9-U2LA, vendor id - 05e3:0702). Due to that it has an operating system and some other software inside. Unfortunately this software is rather slow to start and that cause the following kernel error when trying to mount this enclosure:

[90459.236000] usb 5-5: new high speed USB device using ehci_hcd and address 9
[90459.368000] usb 5-5: configuration #1 chosen from 1 choice
[90459.368000] scsi4 : SCSI emulation for USB Mass Storage devices
[90459.368000] usb-storage: device found at 9
[90459.368000] usb-storage: waiting for device to settle before scanning
[90464.368000] usb-storage: device scan complete
[90470.148000] usb 5-5: USB disconnect, address 9
[90470.148000] scsi 4:0:0:0: scsi: Device offlined - not ready after error recovery
The device is fine, it is just slow to start. To work around this bug you can change /sys/module/usb_storage/parameters/delay_use from a default 5 second delay to something larger. 60 seconds worked fine in my case.
echo 60 sudo tee /sys/module/usb_storage/parameters/delay_use
Anyone know what a proper solution could be?

On Sunday, the day before LCA 2008 officially started, Kelly and Rusty asked us first-timers to blog about events, specifically about what we liked and disliked. So far, this conference has been really enjoyable and busy, and I have not found the time to write about its content. The talk I just heard leaves me without an excuse, so there: I have recently had a very interesting and enlightening discussion with a blind Debian developer. When I saw on the conference schedule that Jason White would talk about using Linux with speech and Braille output interfaces, I passed up my opportunity to hear Andrew Tridgell talk about clustered Samba and attended his lecture instead. Jason covered a great number of aspects: from the history of the Braille system, and current, Free implementations thereof, via speech output, to strategies of integrating these techniques into existing programmes which are generally not designed with visually-impaired users in mind. He has a collection of references on his webpage, to which I shall refer for the technical content. His presentation left me very excited and impressed. Excited to see him giving a presentation with such enthusiasm and energy, and impressed because his talk (without notes or slides) was by far better than the job of the average presenter with access to notes and slides to display. Jason conveyed a lot of information in a very well-structured, capitivating report. I think he left most of the audience speechless (figuratively speaking; there were good questions). I feel uneasy with thanking Jason explicitly, or even writing this blog post. If you bear with me for a minute, then let me bridge to women involvement in open-source software. My position on this topic is quite clear: I make no distinctions where they are not obvious, and simultaneously I think it s awesome that more and more women are joining the predominantly male crowd (and their influence undeniably makes the community a more comfortable place). Every now and then, I would like to comment on that, such as I think it s awesome that you are working on this, being a woman (an oversimplified example). What I am trying to say is given how few women are involved with OSS, I appreciate all the more what you are doing. This is non-judgemental, I don t say this because I am trying to highlight someone s gender or sex. It s a communication issue, and I am learning, but I d also rather not limit what I say by making absolutely sure never to offend anyone. But when I utter such a comment, it might still greatly annoy someone or yield vicious returns. This is not always the case in fact, less than it used to be but I ve encountered it here and there, which made me more careful. So when I write about Jason s presentation and how great it was, I want to highlight how it s a greater achievement for him than it would be for me, because he is blind and I am not. I don t mean to single him out or put him on the spot. I am simply impressed, very impressed. And being who I am, I d like to say so. Thanks, Jason. Update: David Schmitt makes an interesting point:

The important question is now, why are we blind people doing great presentations more impressing than people with working eyes doing a great presentation? My personal answer isn t so great: because I didn t expect it. No wonder people get offended if you tell em to their face that I m impressed with his achievements, because I wouldn t have expected it.

I don t agree, or at least I fail to see it. I was impressed, I did not expect it (which isn t to say that I came in to Jason s talk expecting it to be any less than a good talk, I had no expectation! Please think for a second if this isn t immediately clear!) is that offensive? I didn t know Jason, had no way to know whether his presentations are great or less so, but then he pretty much blew me away. The presentation was better than what I am used to (from anyone), and the achievement is all the more greater because it seems to me that he has had to put much more effort into it, purely for accessibility reasons. I guess I should know better, but I still, after all these years, have a problem seeing through the end of it, understanding it. Kant to the rescue, my intentions are good (I claim), but this goes both ways regardless: in any communication, one ought to try hard never to offend. At the same time, one ought to try hard not to be offended until one can be reasonably sure that offence was intended. When I brought this up in Adaora Oniya s miniconf talk on communication challenges, Bdale Garbee recalled the policy in use when he was involved in protocol design work groups: send politely, receive with an open mind. I don t remember his exact words, but I think I got the gist. Update: I just talked to Jason and got his feedback on the issue. It boils down to a quote I ll transcribe: I want my work to be judged by its merit and not by who I am. It only leaves me wondering about the situation at hand: I was impressed by his very well-structured and presented talk and by the fact that he did such a good job given his visual impairment. In any case, I ll close the issue. Jason told me he d happily engage in further discussion and I stated that he is not offended. There is another lesson I learnt: the next time I blog about someone else in such a way, I should really get his/her clearance before publishing! Just to be sure

I started this blog 5 years ago. In that time, I've written about Linux on the desktop, photography, international peace, version control systems, ice storms, Haskell, health care, rural life, Kansas, and infants.

Today I realized something: I am the #1 hit on Google when you search for smelly ducting. This will take you to a story I wrote back in 2005 about an odd odor in our house. I believe it is my most popular story ever, with almost 100 comments -- and comments continue to trickle in, a few a week.

What's the right word to use for that? When the great worldwide democratizing force that is the Internet collectively decides that your most important blog post is about smelly ducting?

I'm glad folks know what matters. Wouldn't want to worry too much about what's going on in Iraq, Washington, or Kansas if your ducts smell, that's for sure.

Obviously every single Presidential candidate has missed out on a key issue in voters' minds. If only someone would come out with a freshly-scented ducting platform, this country could finally move forward!

Reading Russels post about Write Intent Bitmaps I thought “Well, lets try out if the performance impact is really only small”. Having done that I can only warn people and advice to not use them, at least not with internal bitmaps. The whole thing may be different if you have them on an own drive, but internal and as such on the raid device itself is really bad. So, having turned them on I just waited to see what happens with the machines under normal load. Not doing any stresstests, as they don’t show normal load situations anyway. And a little performance impact was expected. A little, not the thing that happened… I’m impressed, haven’t seen that much IO wait ever before. Even the old packages.debian.org code, which was really bad IO-wise (thanks to multiple greps per search), didn’t have such a bad impact. I mean - a Dual Core Athlon 3800, running a few Xen domains, usually without any noticable load, now having a load of 20 and more, while IO wait is at some 90% (as shown by top for both cores), constantly. (2 RAID1 devices). Or a Desktop System with a RAID5 (mad of 4 SATA discs), which normally unpacks a kernel tarball in some 10 seconds - now needs about 2 minutes to get it unpacked. Removing that tree now uses 5 minutes. No, bitmap internal is nothing one ever wants to use. One possibly might want to use that feature with a file for the bitmaps which is stored on a different device. That might actually make sense and wont hurt as much as internal does. I have one positive thing to say about them: Resyncing an array is indeed much much faster. But I go with longer resync times and slightly less performance during that time, the cost of having the bitmaps all the time massively impacts, a recovery of even a day doesn’t cost as much in total.

Last year at LCA Crispin Cowan suggested to me that I make a joint offer of a combined tutorial on SE Linux and AppArmor as a way of publicly comparing the two technologies. I ended up not accepting the challenge, among other things I had a long-term project going in production in early December that needed some ongoing support. Crispin’s plan B was to just give a lecture about AppArmor. Recently Crispin joined Microsoft [1] and John Johansen of Suse was going to give the talk in his place. The LCA people made a minor mistake by having the conference web site give the description of the tutorial option [2] (which I don’t believe was ever going to happen as I had not accepted the offer), but it’s easy to understand the webmaster copying the wrong description when the one person makes two offers (which I believe is not a common practice). So this morning I and about 150 other people were waiting in the main lecture theatre and no-one from Suse turned up. Being fairly audacious when the announcement was made that the event was officially cancelled I stood up and asked if anyone would like an impromptu talk about SE Linux instead. The audience received that idea quite well. My talk wasn’t as good as I had hoped, not having had a proper breakfast or any caffeinated drinks reduced my mental stack space. So I could talk well on one topic but when questions diverted me to a side topic I found it difficult to remember the previous point I was making. Fortunately when giving an impromptu talk with no notes or presentation materials the audience expectations for a consistent plan of the talk seem reasonably low. ;) I started by talking about my SE Linux Play Machines. Some of that material had been covered in previous talks at other conferences (such as at a previous SE Linux Symposium), but some things (such as my use of Xen) I had not previously covered, but none of it had been mentioned in a talk in Australia for a while. Having given an hour-long talk about SE linux yesterday to an audience with many of the same members I wanted to start by talking about something that they hadn’t heard before, and I was also wearing a Play Machine T-shirt (with the root password printed on it) [4]. After I finished talking about my Play Machines and started covering some of the same material as yesterday about a quarter of the audience left (which was fair enough). I then spoke about general SE Linux issues, largely in response to questions. I covered the differences between the policies (including the history of policy development), the JFFS2 XATTR development (and how SE Linux couldn’t be used on an iPaQ without it), issues of disk space usage for XATTRs for SE Linux labelling on various filesystems and how it drives the use of context mount options, poly-instantiated directories (including some discussion on how the actual storage location for such directories can be on a different filesystem and how this could be convenient when using encrypted filesystems), how Apache/PHP work in a SE Linux environment, and a lot more. I couldn’t resist mentioning to the audience the irony that I had declined a challenge for a joint presentation and then got a sole presenter spot (and a large audience) due to the Suse guy not showing up. For future situations I plan to load lecture notes from all my common talks on my iPaQ. Then next time I have such a speaking opportunity I can give a better prepared talk. Update: It turned out that the LCA people had been informed that the Suse talk was cancelled and had made a mistake, see this link for details.

• [1] http://blogs.msdn.com/michael_howard/archive/2008/01/17/crispin-cowan-joins-the-windows-security-team.aspx


• [2] http://linux.conf.au/programme/detail?TalkID=210


• [3] http://www.coker.com.au/selinux/talks/sage-2006/PolyInstantiatedDirectories.html


• [4] http://www.cafepress.com/play_machine

Share This

It’s probably impossible to get too much of Bruce Schneier, although I honestly wouldn’t mind if he stopped Friday Squid Blogging. His latest Wired.com article on the false dichotomy between security and privacy is an excellent counterpoint to a recent Lawrence Wright profile in the New Yorker on Director of National Intelligence Mike McConnell. The Lawrence Wright article was surprisingly uncritical, considering the New Yorker’s usual zealous approach. Check out, for example, his description of the “Clipper” chip:

In the nineties, new encryption software that could protect telephone conversations, faxes, and e-mails from unwarranted monitoring was coming on the market, but the programs could also block entirely legal efforts to eavesdrop on criminals or potential terrorists. Under McConnell s direction, the N.S.A. developed a sophisticated device, the Clipper Chip, with a superior ability to encrypt any electronic transmission; it also allowed law-enforcement officials, given the proper authority, to decipher and eavesdrop on the encrypted communications of others. Privacy advocates criticized the device, though, and the Clipper was abandoned by 1996. They convinced the folks on the Hill that they couldn t trust the government to do what it said it was going to do, Richard Wilhelm, who was in charge of information warfare under McConnell, says.

(emphasis added). Compare, for example, EPIC’s Clipper Chip information page. Schneier, by contrast, sees right through the core:

We’ve been told we have to trade off security and privacy so often — in debates on security versus privacy, writing contests, polls, reasoned essays and political rhetoric — that most of us don’t even question the fundamental dichotomy. But it’s a false one. Security and privacy are not opposite ends of a seesaw; you don’t have to accept less of one to get more of the other. Think of a door lock, a burglar alarm and a tall fence. Think of guns, anti-counterfeiting measures on currency and that dumb liquid ban at airports. Security affects privacy only when it’s based on identity, and there are limitations to that sort of approach. Since 9/11, approximately three things have potentially improved airline security: reinforcing the cockpit doors, passengers realizing they have to fight back and — possibly — sky marshals. Everything else — all the security measures that affect privacy — is just security theater and a waste of effort. By the same token, many of the anti-privacy “security” measures we’re seeing — national ID cards, warrantless eavesdropping, massive data mining and so on — do little to improve, and in some cases harm, security. And government claims of their success are either wrong, or against fake threats. The debate isn’t security versus privacy. It’s liberty versus control.

Read the whole essay. And send it to your mother, as well. Technorati Tags: Schneier, Privacy, Security

Share This

I've been thinking about this for awhile, so time to put down some thoughts.

First, what is socialized medicine? If we listen to the politicians that label health care as "socialized", it seems to be "anything that is paid for by taxes and delivered free or cheaply to citizens." Putting aside the question of whether that meets the academic definition of socialism for the moment, let's look at things in the United States that are already socialized:

• K-12 education
• Police
• Fire fighters
• Public Libraries
• Roads
• Airports and air traffic control
• Military defense and offense

That's right. We trust the government with our children all day long for 13 years. For free!

Yet this is a country in which hospitals dump the homeless in the gutter for being unable to pay their bills. Even insured Americans find claims turned down for arbitrary reasons. People are afraid to change jobs for fear of losing health insurance.

Why is it bad to have the government pay for health care?

Here in the United States, our health care system is far from best in the world. It's not even top 10. Or 20. Our system encourages minimizing health care, and doesn't encourage preventative care.

I'd suggest that, in a democracy, it's best to have the government pay for health care. That's because, in a democracy, we are in control of the bureaucrats. If we wish to exercise common sense and pound into their heads that paying for preventative care makes good long-term sense, then we can do so at the ballot box.

So why the scare tactics about government being involved in health care?

Perhaps our real problem is that we have let government get out of our control? Perhaps we are too frightened of change to vote. Perhaps we've given up on a responsive government. Perhaps we think that the insurance companies and drug companies will never let us have a good health care system.

Yes, the lobbyists have a lot of power. But we have the power to remove it, and it's high time we used it.

The audacity of Obama to have hope. To say that we can do better. When Hillary Clinton falls in line with the Republicans and accuses him of having "false hope", effectively saying that we can't do any better, then is she -- or any Republicans -- really a candidate of change? I think that all these accusations from conservatives and Hillary that Obama has "false hope" has finally convinced me that he's the one to vote for. If everyone else claims that his ideas are too good, that his dreams too big, then I like him.

Oh, and you could substitute "college education" for "socialized medicine" everywhere in this article and get equally valid arguments.

I live in a cooperative living group, and during the fall semester a person who we’d invited to live with us who is a dwarf and relies on a scooter for most of his transportation decided he’d like to move in. Unfortunately, while he can get out of his scooter and come inside by himself, we had no stepless entrances such that he could bring his scooter inside to protect it from the angry Cambridge winter. Mmm, frozen batteries. So, we’re a coop and we maintain the house ourselves—so we decided to build one, of course. A ramp up to the back porch! Nevermind the fact that we need to sink four-foot foundation holes in the ground in January. We got started right away at the beginning of IAP, while people were still trickling back into town from all over the country. First we surveyed out where the posts should be sunk: Then it was time for excavating the holes where concrete would eventually be poured. This involved a power auger of DOOM: It’s advertised as a 2-man tool. Two 200-pound construction workers, that is. We had to put four people on it plus one person with a shovel clearing dirt to make it manageable, and even then it was a pain. There’s a delicate rhythm you have to get into to avoid getting the bit stuck—DOWN. UP. CLEAR. And inevitably there are rocks and roots that have to be dealt with. We lucked out with a fairly warm weekend to do the digging on, but on the first day we still had to deal with a couple inches of frozen ground: There was also some fun stuff involving having to clear away our (frozen) mulch containers and use a concrete cutter on a weird old concrete pathway that used to run through the same area: Next we mixed and poured concrete: And placed hardware in the concrete to hold the posts: Framing: Eventually it became functional, woo: And done! (except for metal handrail): This all took place over the course of about three weeks. And now our scooter-bound housemate can bring his wheels inside! The house still isn’t totally accessible to wheelchairs/scooters, but at least the first floor is. It really brings me pride to see things like this go from start to finish here. We can do it! This guy who is moving in has really influenced my life—he’s really good at making people feel comfortable talking to him, and for me it’s gone from “wow this is awkward, I have no idea what to say” to “talking to a person with different physical abilities and characteristics seems normal”. And that’s made me a better person.