For 10 days now, I’ve had ADSL problems. Basically, there is something fishy somewhere between my end and the DSLAM. That can be anything, and for the moment, all I can do is wait for either my ADSL provider or France Telecom, whichever is responsible for the problem, to fix this. Anyways, my network connectivity is sometimes working (though quite slowly, especially on uploads), but more often not, with sometimes connectivity for a few seconds (enough to download small files or pop mail). The glandium.org server being behind this ADSL line, it means that you’re probably not able to see this post. Or maybe a feed-reader/planet/whatever got it while the line was somehow working. Note I’ve been able to setup another MX server, so that mail sent to my domain go somewhere I can fetch them. Don’t worry about sending me messages, they will reach me. Just that it may take time for me to be able to see and/or answer them. Anyways, the main downside is that it makes it harder to handle the upcoming xulrunner transition. On the other hand, the upside is that I finally could take some time to work on ext3rminator again, basically rewriting the code from scratch for reasons I’ll explain when it will be ready for a release. It’s good to see that some new APIs in libext2fs, added since 2002~2003, when I first wrote ext3rminator, make some of the work easier. It’s still sad there is nothing to handle reading the journal. Not that it’s difficult (though not documented much), but that would downsize my code some more ;). Update: It seems to be back to normal.

So, the last lazyweb question I asked had good results. Time to try again: Whats a good python-accessible, cross-platform-and-trivially-installable(windows users) flexible (we have plain text, structured data, etc and a back-end storage area which is only accessible via the bzr VFS in the general case), fast (upwards of 10^6 documents ), text index system? pylucene fails the trivially installable test (apt-cache search lucence -> no python bindings), and the bindings are reputed to be SWIG:(, xapian might be a candidate, though I have a suspicion that SWIG is there as well from the reading I have done so far, and - we'll have to implement our own BackEndManager subclass back into python. That might be tricky - my experience with python bindings is folk tend to think of trivial consumers only, not of python providing core parts of the system :(. So I'm hoping there is a Better Answer just lurking out there... Updates: sphinx looks possible, but about the same as xapian - it will need a custom storage backend. google desktop is out (apart from anything else, there is no way to change the location documents are stored, nor any indication of a python api to control what is indexed). It looks like I need to be considerably more clear :). I'm looking for something to index historical bzr content, such that indices can be reused in a broad manner(e.g. index a branch on your webserver), are specific to a branch/repository (so you don't get hits for e.g. the working tree of a branch), with a programmatic API (so that the bzr client can manage all of this), with no requirement for a daemon (low barrier to entry/non-admin users).

Lessons learned: no unicode in filenames on my blog. I had the great idea, a few days ago, to write a short blog post about my trip to Cologne, and to give the file a name with a UTF-8 character in it (the , to be exact). Except that I forgot how my blog actually works... I use blosxom to manage my RSS feed and other parts of the blog; but to integrate it properly in my website, I wrote a whole lot of stuff around that. It's not just blosxom:

• All files are in a subversion repository.
• On the server, there is a file:/// checkout of the subversion repository in /var/local/blosxom. Files in this checkout are owned by the www-data user.
• The subversion repository has a rather long post-commit hook:

wouter@samba:/var/lib/svn/blog/hooks$ grep -v '^#' post-commit   wc -l
20

It takes care of updating the repository in /var/local/blosxom, and then fixes the timestamps on those files based on the timestamp of the original commit in the subversion repository. It's an ugly amalgam of svnlook date, svnlook history, touch and things, but it works. Sortof. Except if I remove a file, or if the svnlook history thing doesn't find the file itself. Finally, it will call blosxom itself, in the mode in which it creates files on disk rather than trying to do CGI output.
• In blosxom, then, I added two extra flavours: one I call myrss, and another I call php. The myrss flavour is used because I don't like blosxom's default RSS output; it doesn't do anything strange. The php flavour is what you see when you go to my blog on my website: it helps me integrate the blog in the rest of the "design" (ahem) of my website, allows me to add google ads in between my blog posts, and, finally, to hook in my home-brewn comment system (which uses postgres to store comments).

Apparently, however, subversion thinks differently about UTF-8 filenames if you do a checkout from a repository when using a http:// or a file:// URL. As a result, there were some issues in the post-commit subversion hook that I wrote, resulting in the svn up part of the post-commit not entirely succeeding. Or some such. Then, the touch is done, and the svn up doesn't work at all, anymore. In short, things started to break horribly, resulting in empty posts (because the files were created by touch rather than svn up), the comment thing being confused about filenames (and, as a result, postgres complaining about incorrect UTF-8 encodings), and similar other ugliness. So, I just renamed the file, and did a cleanup of the subversion checkout in /var/local/blosxom. I'll just have to cope with the fact that my setup doesn't like unicode, I guess. Or, perhaps, finally switch to ikiwiki some day, which I've been thinking about ever since Joey first blogged about it a few years ago. But that's not urgent...

Four years ago, the last time I was in Brazil, I came as an anthropologist-in-training to attend and give a talk at Debconf4 held in Porto Alegre. I have returned to this city in the south, again in the winter, but this time I have come back as an anthropologist who is giving a talk at the department of anthropology at the UFRGS, based on my research conducted many years ago. This time, thanks to my (really friendly and energetic) hosts, I am seeing far more of the actual city, its beautiful and legendary sunsets, its outlying neighborhoods, and even its subcultures. This has been my first foreign trip where I am interacting primarily with anthropologists and this has been really interesting for me. On the one hand, because of the language difference, there is a lot that is strange and hard for me to follow and I am acutely aware of the general and particular economic gulf between north and south and its impact on students (books are expensive, traveling for conferences is very difficult, and even applying to graduate schools in the north can be impossible because it costs so much to apply to each school!) On the other hand, the methods and subjects of study, the style of analysis, and the teaching are all very familiar, making me feel like I am part of a discipline that (thankfully) transcends national borders. Many of the projects I learned about–the tensions between free software advocacy and development, the role of memory among fan s of a corny country/Gaucho singer from this area and the surgical management of intersex (hermaphrodite) newborns were some of the most interesting projects I have come across and gobbled as much information about them as I could. I was also struck, yet again, by the deep myopias of anthropology, north and south. My own project, which focuses mostly on white, American and European hackers, often does not strike as culturally authentic enough because, well, the people I study are white, American and European (and I am slowly coming to see that if you study the so-called white and male or the North American/European elements of technology and the Internet and the law, you are probably white and male yourself and anything having to do with ethnicity/gender is usually the province of female academics, which I find really problematic). If I had carried out my first project in Brazil, where there is a foreign language, where there is a long tradition of studying various groups, then my project would have been stamped by that mysterious aura of authenticity/approval. On the other hand, two of the students here (those that worked on free software and the country singer) complained that their papers have yet to be accepted by the Brazilian Anthropological Association for being too strange, non-traditional, and it seems in their case, the problem is that they are studying urban Brazilian, popular culture (which for me would have just been just the thing to study). We are located far apart but find ourselves in similar positions by virtue of studying something geographically close to where we live, which is confused and misperceived as being culturally close to our world. But if there is something I wish to hammer into my students and other anthropologists is that there is tremendous plurality and multiplicity within our own societies. We can travel far, in the cultural sense, just by staying home and opening our eyes a little wider. Another nice experience is that I am learning a tremendous amount about free software politics and development from the graduate student, Luis Felipe, who is really responsible for getting me down here. He found me on IRC many moons ago and finally we have been able to compare notes and have long conversations about free software, the differences in how we can gather data due to gender, and a topic close to me, which is the tension between the political and apolitical in free software. Our relationship is at once based on friendship and also one of mentoring. And it reminds me of others who have also mentored me and how crucial this mentoring was to the development of my own work. One of my most important mentors, Chris Kelty, just published his book on Free Software (and I will soon write an entry about the book but the WHOLE THING IS ONLINE) and so it felt quite nice that we were discussing what I think his one of his most amazing chapters on the creation of the copyleft in our class on Friday. Not only was the topic about the genesis of the first free software license appropriate for a class on IP, but in many ways, because of his mentoring, I have gotten to where I am and so it felt also appropriate to honor and recognize that genealogy in my own work.

I've released version 0.4.11.4 of the aptitude package manager (release notes). The main motivation for this release is bug #483920, which would cause the resolver to choose solutions badly (e.g., it might prefer downgrading a bunch of packages to keeping them at their current versions). It also includes a simple fix for bug #136874, the fact that the output of aptitude search is badly suited for scripts (it still is, but now there's a command-line option that will make it better).

The most dynamic segment of the software industry that I'm aware of is web programming. Flamewars rage about frameworks and browsers and standards and whatnot, and the openness of the whole thing feels like some of the things that made me fall in love with computing as a whole and Free Software in particular. The problem with all that openness is that it's rather difficult to navigate. Aside from the obvious issues with browser incompatibilities, there's an enormous amount of software solutions on the server side, spanning languages, libraries, and frameworks. Each one is an ecosystem to itself, often being large and complicated.

This makes it rather difficult to do certain aspects of web programming well. You are constantly switching between tools and languages, as well as coding paradigms, in order to build a web app in full. You'll be writing HTML, CSS, and Javascript on the client side, each with its own peculiarities. On the server side you'll probably have settled on one language with its own very different varieties of coding style and patterns. Some, like Ruby on Rails, are their own unique brand of language that makes you work both in the DSL (Rails in this case) and the parent language (Ruby here). Template engines often will do the same thing, such as in the case of Django.

It's pretty obvious that having to juggle all these tools places a fairly large burden on the coder. Much to their credit, it's not difficult to work in any of these languages, but to work in them at a high level becomes more difficult the deeper and wider the software stack reaches. You get this a bit in systems programming, juggling C/C++ with a build system and a scripting language, but that's usually it. You can get that number of moving parts just on the client side of the web with HTML, CSS, and Javascript.

Something interesting that seems to be happening is that people are moving to decrease this cognitive burden. One good example is the Google Web Toolkit which lets you write all your AJAXy client-side stuff in Java, and let it get compiled in to Javascript. That way you cut the languages you have to work in. A similar concept is behind Microsoft allowing Ruby (and Python, if I've heard correctly) in Silverlight. Alternately, you can bring Javascript (back) to the server side, which is the motivation behind Helma and Rhino on Rails (the latter of which I hope sees the light of day).

Personally, I'm rooting for Javascript to not become an assembly language, but to take over the server side again. It's a capable and powerful language (much better than Java in my opinion), and we're collectively leveraging it very poorly. Rhino is interesting and has enormous potential, but it needs library binds in the worst way. Currently it's basically using Javascript to write Java, which is rather atrocious (COBOL in any language, etc) but with some Javascript-style wrappers around the Java classes it could be phenomenal. Alternately, there's Spidermonkey, which could be wrapped in a more capable shell with a good FFI, and we could easily have wrappers to our favorite Free Software libraries. This project seems far along here, but it's currently very windows-centric.

There's a lot of potential here though. Unifying the development language for both web and system apps would benefit the Free Software desktop, and give us the ability to better integrate our stuff with the web. One of the best things about Free Software is that it dropped the barrier to entry in software development. I think we can repeat that success again here.

pommed v1.19 has landed, with improvements wrt CPU usage. This is especially true for gpomme, which won’t cause 10 wakeups/sec anymore. PowerTop fans, rejoice! I plan to fix wmpomme too, but as I’m probably the sole user, this can wait. pommed will also consume a bit less CPU, especially on machines without ambient light sensors. The new code in pommed makes use of the timerfd API introduced in Linux 2.6.25, hence you’ll need to run a 2.6.25 kernel or later; pommed will not operate properly on earlier kernels.

Over the past couple months, I gave a couple talks on Revealing Errors -- my project to try and use errors to teach non-technical people about technology, the effects it has on our lives, and the ways in which we (as users) might want to control it. The first version was at LUG Radio Live USA and went off reasonably well. A couple weeks later, I gave a version of the talk again at PenguiCon which went great. Unfortunately, neither recording seems to have worked out. I'll be giving talks on the subject at least twice more this summer. The first will be on June 18th at Boston Linux Unix at 19:00 at MIT in E51-315. It will be my first talk to BLU in something like three years. I'm also currently scheduled to give an abbreviated version of the talk as a keynote at OSCON under the title Advocating Software Freedom by Revealing Errors. In addition to all that, I'm having a whole lot of fun updating the Revealing Errors blog (although not as often as I'd like) and am currently in discussions about publishing a longer version of the Revealing Errors article as a book chapter at some point in the next year. Thanks to everybody who has been supportive of the project and read the blog, has told their friends, and who has told me about telling technological errors they've seen around. Please keep it up!

At times, when I'm working with an HTML file - an article about programming, for instance - I need to include a snippet of code inside a <pre> tag or a <code> tag. It's very annoying to have to indent that code by hand, and since the language may be anything from Hecl, to Erlang, to Java to C, I don't want to use something like two-mode-mode for Emacs, so I threw the following elisp together:

(defun indent-region-as (other-mode)
  "Indent selected region as some other mode.  Used in order to indent source code contained within HTML."
  (interactive "aMode to use: ")
  (save-excursion
(let ((old-mode major-mode))
  (narrow-to-region (region-beginning) (region-end))
  (funcall other-mode)
  (indent-region (region-beginning) (region-end) nil)
  (funcall old-mode)))
  (widen))

To use it:

1. Put it in your .emacs file.
2. Select the region to indent according to the other mode.
3. M-x indent-region-as - which will prompt you for the other mode to use. You need to give the function for that mode, such as tcl-mode, java-mode, ruby-mode or whatever.

My elisp is a bit rusty, so I'm sure it's possible to improve the code above, but it does the job for me.

(Playing Kraftwerk - The Telephone Call.) Warning: This is a long-wound complaint post. The only reason this is going to the Planet is because I have no method yet of disabling individual posts for syndication. Please skip, with my apologees for the noise, if you don’t want to listen to complaining. May contain nuts. May drive you nuts. Drove me nuts. Mmm, pistachio. When I was around 11, I got my first cellphone. I was very proud. This was back when being 11 and having a cellphone was a real novelty; pagers were still being sold, and the NMT network was still running. Like many things I appreciate, I found it in a dumpster. It was ancient, even then: a Motorola MicroTAC brick, missing its antenna. I borrowed one of my grandmother’s hairpins, and voila, working phone - as long as you didn’t leave Oslo. It had a certain cyberpunk look to it, even then: I loved it. I remember that I first bought a NetCom pay-as-you-go card; I don’t quite remember the number, but it had “283″ in it at the end, if you want to wardial. For some reason, Dad needed a SIM card so I gave him mine. So I bought myself a new one, a Telenor card, pay-as-you-go, number 91 85 95 08. I must have been around 12 at the time. And that number served me very well. Fast-forward 6 years, to late March, 2006. I had just turned 18, and one of the first things I wanted to do was get a massively cheaper, proper subscription. I’d been procrastinating it for a bit - as I am wont to - but when a nice gentleman at the subway station told me about a nice new company called SEA Norway and their wonderful prices, I accepted. Big mistake. Here begins the saga of woe… For a good while, I was very happy with their service - even though GPRS data never worked, I never used it anyway. Their name changed to Vitel somewhere along the way. I received a phone call from an enthusiastic salesman who told me how much cheaper Vitel’s power subscription is. It seemed very reasonable, so I went for it. One of the arguments he gave me was that I could collect all those utilities into one bill. I told him that I couldn’t have this: Since I’m a live-alone student, my power bill is covered entirely by the city council, so I need a proper bill to hand over every month. “Sure, that’s no problem”. I check and double-check that, and I stress it. Sure, no problem. OK, deal. Big, big mistake. They draw 2700 Kroner from my account, using the automated pay system (AvtaleGiro) that I had set up for the phone bill. 2700 Kroner (530 US Dollars) is a lot of money, especially when your monthly income, 5000 Kroner (1000 US Dollars) barely covers the necessities. So I cancel the autopay system. (I still have not received that money!) 23rd of January, my subscription is cut, since I hadn’t paid the bill. They hadn’t mailed it to me, and I’d told them I’d cut the AvtaleGiro, but I simply did not receive the bill. So I call them up in February some time and try to figure out a solution. “You didn’t pay the bill, so the subscription is closed.” -”So if I pay the bill, will you reopen it?” -”No, sorry. It is closed now.” -”So then I’ll have to transfer the number to another provider?” -”No, you can’t do that; it’s closed now.” -”You can’t refuse to transfer the number, that’s simply not legal.” -”Sure it is, the subscription’s been closed.” Urgh. So some time in the middle of March, before The Gathering, I call NetCom up: I want to transfer my number to them, please. Sure, no problem. No, this number is registered as active in our system. All is well. We’ll make the switchover on March 28th, and you will get your SIM card in the mail: It should be in your box by then. Fantastic! The 28th of March came and went with no great ceremony, not even a SIM card. No switchover occurred. I give them the benefit of the doubt for more than a fortnight. Some time in April, then, I get sufficiently annoyed to call them up and ask what had happened. “Oh, no, it seems Vitel is using the old transferral system”. -”OK?” -”Yes, you will have to send us a form with your signature by fax to carry this transfer out.” -”Sigh, alright. Where can I get this form?” -”I’ll email it to you.” Great. So I get the form. May was very busy, so I didn’t get an opportunity to fill the form out, and by now I was getting fairly tired of the whole thing anyway! The thing that finally got me, however, was a bill from Vitel - on the “closed” subscription - for not only the monthly fee, but also several kroner of SMS “content services” (Read: ring tones) and GPRS data (Which never even worked even when the subscription did!) So last Tuesday, June 3rd, I send them the damned fax. Wednesday, June 4th, I call NetCom up and ask what the status is of my subscription. “Oh, yes, this is now active with us.” -”Really?!” (I was happy in the way that only someone who’s gone 5 months without a working phone could be.) -”Sure, we’ve sent the SIM card to Bekkeveien (something).” -”…Bekkeveien? But I’ve never lived at any Bekkeveien. My last name is Bekkedal, but..” -”Alright, then that’s probably a mistake. What you can do, though, is go to a NetCom dealer and pick up a new SIM card.” -”Perfect! I’ll do that, then.” (I stress “pick up” for a reason which will later become apparent.) Goodie. I’ll get a working phone! I was very happy as I took the tram down to Aker Brygge and looked everywhere for the damned NetCom dealer. Having finally found it, I happily stride inside and ask for a SIM card for my subscription. “Sure. That’ll be 200 Kroner.” Argh! I hadn’t brought enough money! She did say pick up. Oh well. Aker Brygge is a center of business, I’m sure there are other shops. So I ask to use one of their phones to call NetCom. Sorry, no phones you can use. Sigh. Fine. Do you know of any phone booths around? They didn’t, but I found one anyway, finally. I deposit the necessary $1 for a local call (See, this is the problem with having a cellphone company run the phone booths!) and dial NetCom customer service. They take my number and - Sorry, that number isn’t yet active, it’s still registered to Vitel. ARGH! Fine. So what’s standing in the way? Well, Vitel can’t refuse it - (thanks, I know that already) - but the form that I was sent wasn’t the right form. The form I need to send is from Vitel to Vitel, authorizing the transfer.While I’m trying to hold a conversation with the customer support guy, some drunk guy is accusing me of stealing phones, and begins reading out loud the sponsor company names on the back of my DebConf T-shirt. But Vitel has already told me that I cannot transfer this number, under any circumstance! They consider it closed! “Yes, but you have to talk to Vitel.” -”I have!” -”Well, we can’t really do anything…” Alright. So I hang up and I try to call Vitel. But that doesn’t work: They closed at 3 PM!. So finally tired of Netcom failing to port my number for a while, I call Telenor. I talk to a very cheerful and helpful lady who admits to not knowing about the particulars of that situation. Fantastic! At least she isn’t going to fib it! She says that she has a vacation Thursday, but she can call me back on Friday after discussing the matter with the number transfers department. Wow! She’s actually going to confer with the relevant expertise! This is too good to be true! So she said she’d call me back Friday at 1PM with a status update. As I am writing, it is Friday at 11:01, I am anxiously awaiting the telephone call. But now I get a funny SMS message:

From: NetCom Message from NetCom: Your number has been ordered by another operator. We would like to remind you that violation of the commitment period will be billed to the order of 1500 kroner. For questions, call 05050.

My subscription with Vitel was made in 2006, more than the 12 months I and knowledgeable friends believe to be the maximum legal commitment period (I doubt I would have agreed to more anyway!). Besides, the text message keeps saying that it’s from NetCom. So my deduction is: It’s from NetCom, who I have registered an active subscription and are now complaining that I’ve moved the subscription I’ve opened with them (but which they have not successfully moved from Vitel), over to Telenor. I don’t think this is an unfair conclusion. So I call NetCom customer service - which to NetComs infinite credit is a number you always can call, almost like 112 (technically it’s accomplished completely differently, but you get my point. The number is never blocked in a blocked subscription.) And they say it’s not from NetCom, even though it says it’s from NetCom. So I’ll keep both of my readers posted on the developing situation. At least the text message indicates that something is happening with my subscription. I just want the dialtone!

In May 2002 I had an idea for securing access to GNUPG [1]. What I did was to write SE Linux policy to only permit the gpg program to access the secret key (and other files in ~/.gnupg). This meant that the most trivial ways of stealing the secret key would be prevented. However an attacker could still use gpg to encrypt it’s secret key and write the data to some place that is accessible, for example the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg“. So what we needed was for gpg to either refuse to encrypt such files, or to spawn a child process for accessing such files (which could be granted different access to the filesystem). I filed the Debian bug report 146345 [2] requesting this feature. In March upstream added this feature, the Debian package is currently not built with --enable-selinux-support so this feature isn’t enabled yet, but hopefully it will be soon. Incidentally the feature as currently implemented is not really SE Linux specific, it seems to me that there are many potential situations where it could be useful without SE Linux. For example if you were using one of the path-name based MAC systems (which I dislike - see what my friend Joshua Brindle wrote about them for an explanation [3]) then you could gain some benefits from this. A situation where there is even smaller potential for benefit is in the case of an automated system which runs gpg which could allow an attacker to pass bogus commands to it. When exploiting a shell script it might be easier to specify the wrong file to encrypt than to perform more sophisticated attacks. When the feature in question is enabled the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg” will abort with the following error:
gpg: can’t open /root/.gnupg/secring.gpg’: Operation not permitted
gpg: symmetric encryption of /root/.gnupg/secring.gpg’ failed: file open error Of course the command “gpg --export-secret-keys” will abort with the following error:
gpg: exporting secret keys not allowed
gpg: WARNING: nothing exported Now we need to determine the correct way of exporting secret keys and modifying the GPG configuration. It might be best to allow exporting the secret keys when not running SE Linux (or other supported MAC systems), or when running in permissive mode (as in those situations merely copying the files will work). Although we could have an option in gpg.conf for this for the case where we want to prevent shell-script quoting hacks. For editing the gpg.conf file and exporting the secret keys we could have a program similar in concept to crontab(1) which has PAM support to determine when it should perform it’s actions. Also it seems to me that crontab(1) could do with PAM support (I’ve filed Debian bug report 484743 [4] requesting this). Finally one thing that should be noted is that the targeted policy for SE Linux does not restrict GPG (which runs in the unconfined_t domain). Thus most people who use SE Linux at the moment aren’t getting any benefits from such things. This will change eventually.

• [1] http://www.gnupg.org/


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=146345


• [3] http://securityblog.org/brindle/2006/04/19/security-anti-pattern-path-based-access-control/


• [4] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484743

Share This

Some days ago I wrote a little mail asking for volunteers for the FTP assistant role. Right now we got 4 people mailing us with some kind of volunteer offer and the same amount of replies talking about total different topics. From those 4 volunteers I think we are doing step two - handing out tasks to check the knowledge of the volunteers with two of them. The other two seem to want to limit themselves too much in what work they want to do. I will look and hand out tasks / reply to the mails somewhere soon, like this Saturday/Sunday. In case you want to volunteer too, please read the mail I linked to, it contains a description of what you would volunteer for and then maybe mail us. Comments: 0

I think that for the first time, when I go to vote this November, I will probably not have to hold my nose as I make a selection for president. I don't agree with Obama on everything, of course, but the core of what he stands for -- that it is time to enter a post-racial, post-partisan time -- and that putting the interests of the people before those of the corporation -- is a powerful message.

And I'm not the only one that thinks so. One interesting read is Why This 55-Year-Old White Lifelong Republican Wants Obama To Win by Frank Schaeffer. He's a pro-life, pro-military Republican that actually campaigned for McCain in 2000, and this year he's supporting Obama. He pointed out another key point: Obama does not play on our fears.

Then there's A Transformational Moment by Jim Wallis, who grew up in a time when white people that supported civil rights were literally putting their lives on the line. He ends with:

This morning I heard several interviews on NPR with black Americans about their response to Obama's nomination. One older woman said, "A black man running for president, did you hear what just I said? A black man running for president of the United States ...." She just kept repeating the words, and succinctly captured my own personal feelings.

Yes, it is truly historic, and the U.K. newspaper headlines captured that sentiment as did papers around the world. Nothing could change the image of America around the world more than this. But it is more than historic; it is very personal for many of my generation. A new generation just sees this as natural -- he's an inspirational leader who happens to be black, which matters little to them. But for my generation -- I'm dating myself now -- this is a transformational moment, one we didn't think would come in our lifetimes. Race was the issue that changed us, shaped us, determined our path, and even defined the meaning of our faith. Now a black man is running for president of the United States. Amazing grace.

Tom Hayden reflects on the similarities between Obama and RFK, another interesting read. He concludes with:

Those who denounce Obama -- and the possibilities of all electoral politics- - should ponder the effectiveness of sitting judgmentally on the sidelines while an Unexpected Future arrives through the sheer will of a new generation. They should consider whether politics and history can be reduced to a fixed determinism that is endlessly repeated, as if there are no surprises. We can have our differences with Obama's specific policies, as I certainly do, but those should be measured against the prospect that a movement might transform him even as his very rise continues to transform the rest of us.

And now for something less inspiring. If you go look over at the latest blog entry at hillaryclinton.com and read the comments, these readers frankly sound more than a little loony. There are rampant accusations that Obama "stole the election" with the help of the DNC. That makes no sense to me; he followed the rules, and the DNC gave Clinton more delegates than she should have had with the rules as they were at the start of the game (which she supported then). The Obama campaign even rejected a plan that was less favorable to Clinton at the DNC rules committee meeting on Saturday. They also go on and on about how Obama has had so many scandals (though the Clinton real estate scandals really are far more serious than a former pastor). It all looks so very petty, and I wonder why Clinton has whipped up her supporters to such a fervent extent. Perhaps it was an accident, but you'd think things like this are rarely an accident with her.

So, I’ve been trying to figure out inheritance in Python. In Lisp (and even C++ and Java), derived objects will have the cons of their parent called. For example, look at the following C++ snippet:

#include <iostream>
using namespace std;
class B  
public:
	B()  
		cout << __PRETTY_FUNCTION__ << endl;
	 
 ;
class A : public B  
public:
	A()  
		cout << __PRETTY_FUNCTION__ << endl;
	 
 ;
int
main(int argc, const char **argv)
 
	A *foo = new A();
	delete foo;
	return 0;
 

This outputs the following:

B::B()
A::A()

As you can tell, the parent object’s constructor is called and then your derived object’s constructor is called. But, in this Python code, the parent object’s constructor is not:

class B:
    def __init__(self):
        print "B.__init__(self)"
class A(B):
    def __init__(self):
        print "A.__init__(self)"
A()

This outputs:

A.__init__(self)

Instead you have to do:

class B:
    def __init__(self):
        print "B.__init__(self)"
class A(B):
    def __init__(self):
	B.__init__(self)
        print "A.__init__(self)"
A()

To get the right output:

B.__init__(self)
A.__init__(self)

This seems broken to me. But maybe I’m not understanding something. The way I got bit by this was by trying to design a new replacement to debian/rules which used subclassing. (More on this later.) Oh, and I intend to try to keep my blog updated more often.

I'm just bouncing the news from Jesse Noller blog about Guido van Rossum accepting the PEP for pyprocessing.
There were a lot of discussions about pyprocessing inclusion in Python (here a couple of blog posts and the mail to python-dev), and now it finally made it! I'm really happy since Richard is a very prepared and responsive guy.

Well, it's just by chance I co-maintain python-processing in Debian :)

I think I should follow up on Victor's lament. Yes, we have a Rails application which works fine most of the time... But quite often, throws out a segmentation fault I just have been unable to pin-point. It might be related to rmagick, the only non-pure-Ruby component I am using (and I'm tempted to try minimagick instead, even if I prefer in-memory operations than on-disk, piping an image and slurping it again).
Victor came up with an easy script to check the server - but to reduce the impact it has (I was running a single Mongrel instance, which meant, whenever it dies the whole system becomes inaccessible for everybody; I replaced it with a mongrel_cluster of five processes, plus pound as a easy-to-use balancer which looks quite nice), the very simplistic and to-the-point script did no longer work.
Anyway... Ruby rocks ;-) I'm sharing this with you mostly because I am sure some readers will find more than one useful construct, not because it is precisely beautiful code. And besides, we should work on fixing the cause, not the consequence, of the bug! :)

Works out of the box for any Debian-packaged mongrel-cluster. Sadly, mongrel-cluster does not provide a way to restart individual servers - Of course, I could (should, even) work it out to build the specific command-line... but at least, it works for now.
Uh-oh... Does that mean it's permanent?

I’ve just joined SAGE AU - the System Administrators Guild of Australia [1] . I’ve known about SAGE for a long time, in 2006 I presented a paper at their conference [2] (here is the paper [3] - there are still some outstanding issues from that one, I’ll have to revisit it). They have been doing good things for a long time, but I haven’t felt that there was enough benefit to make it worth spending money (there are a huge variety of free things that I can do related to Linux which I don’t have time to do). But now Matt Bottrell has been promoting Internode and SAGE, SAGE members get a 15% discount [4]. As I’ve got one home connection through Internode and will soon get another it seems like time to join SAGE.

• [1] http://www.sage-au.org.au/


• [2] http://www.sage-au.org.au/past/sage-au2006/speakers.html#coker_paper


• [3] http://doc.coker.com.au/papers/polyinstantiation-directories-in-se-linux/


• [4] http://matt.bottrell.com.au/archives/216-Sourceforge-mirror-now-on-Internode.html

Share This

This is the second installment of my article about the Serial Console Server for the Poor. First installment here. The last part of the article having covered the hardware and the udev part creating the device nodes, this part addresses the part of the software that connects the user to the device node. The idea of the software side is to allow users access only to certain serial ports without giving out a shell account on the server itself. Communication between user and the console server should be encrypted (which certainly means ssh), and users should be able to authenticate both with a key and with a password. Serial parameters (baud rate, parity, stop bits etc) should be configured on the console server to keep this possible error source away from the users. For years, I have been thinking about using UUCP’s cu to access the serial port. This time, it’s not going to be used because it offers a shell escape which cannot be turned off. That would give a user shell to the users indirectly, which is not what I want. Minicom seems still to be the most-used application to access a serial port. I have never understood the sense of using a terminal emulator inside a terminal emulator, especially if one has to break the terminal emulator’s habit of trying to initialize a non-existent modem. So I settled on the application that I usually use to access a serial port: ser2net. This is a Linux implementation of Cisco’s “reverse telnet” feature which “connects” a TCP port to a serial port with a given set of parameters. For example,

4016:telnet:600:/dev/USBserial6:38400 8DATABITS NONE 1STOPBIT banner

connects TCP port 4016 with /dev/USBserial6 with an 38400 8n1 parameter set. If you telnet to localhost 4016, you’ll find yourself talking to the device connected to the appropriate serial port. This moves the security risk to the telnet client, which - unfortunately - offers a shell escape function from the telnet command line reachable with the escape character. The only way to remove this is to use the -E command line option, which turns off the escape function completely. This unfortunately excludes the user from cleanly quitting the telnet session, so the only way to get out of a telnet -E is to have the remote side close the serial port (which ain’t happening on a serial console) or to kill the telnet process, for example by closing the carrying ssh session. That’s a turn-off, but one that one can live with. Now, the only challenge left is to have the appropriate telnet client started automatically for the user. I decided on connecting this to the account being connected to, so that ssh USBserial4@hostname will automatically do the right thing. Since password authentication needs to work (optionally), this precludes the use of the command modifier in an authorized_keys file. Another possibility to force a command being executed on login is to set it as the users’ login shell in /etc/passwd. One drawback: The command must not have any parameters, so one needs to pass needed parameters to the program some other way. Additionally, the program must be listed in /etc/shells or it will be silently ignored. My /etc/passwd entries look like

USBserial2:x:1002:1002:USBserial2,,,:/home/USBserial2:/usr/local/sbin/serialconnect-shell

with /usr/local/sbin/serialconnect-shell looking like

#!/bin/bash
set -eu
case “$(id --user --name)” in
  USBserial1) PORT=“2011”;; 
  USBserial2) PORT=“2012”;;
  USBserial3) PORT=“6013”;;
  USBserial4) PORT=“6014”;;
  USBserial5) PORT=“2015”;;
  USBserial6) PORT=“2016”;;
  USBserial7) PORT=“6017”;;
  *) echo “called from unknown account, terminating.”; exit 1;;
esac
telnet -E localhost $PORT

Just for reference, here are the appropriate entries in /etc/ser2net.conf:

2011:telnet:600:/dev/USBserial1:9600 8DATABITS NONE 1STOPBIT banner
2012:telnet:600:/dev/USBserial2:9600 8DATABITS NONE 1STOPBIT banner
6013:telnet:600:/dev/USBserial3:115200 8DATABITS NONE 1STOPBIT banner
6014:telnet:600:/dev/USBserial4:115200 8DATABITS NONE 1STOPBIT banner
2015:telnet:600:/dev/USBserial5:9600 8DATABITS NONE 1STOPBIT banner
2016:telnet:600:/dev/USBserial6:9600 8DATABITS NONE 1STOPBIT banner
6017:telnet:600:/dev/USBserial7:115200 8DATABITS NONE 1STOPBIT banner

If one wants to authenticate for a given serial port with an ssh key, all you need to do is put the appropriate key into the authorized_keys file of the appropriate account, and you’re all set. I do sincerely hope that I didn’t put any blatant security goofs into this setup, but if I did, you’ll tell me in the comments, right? Just one more challenge for my valued readers: The port numbers in my ser2net.conf have a system. Can you explain it to me?

Managing a transition is not always easy, because many times they are bigger than you, and have parts you can’t directly take care of yourself because it’s not your area of expertise, you don’t have access, or whatever else. You end up, then, nagging people to do stuff for you, which for types like me is slightly uneasy. It is a pleasure, though, when you find supportive fellow developers on the other side, just willing to help you, even if you always have more work for them. Thomas and Michael, thank you! (And thanks, in general, to everybody who helps the release team, past and future. We just can’t do everything!) On reflection, I notice that I also find very gratifying to do stuff for others myself (particularly if I enjoy the task, of course), because it has an immediate payoff. Highly recommended.

Today is World Environment Day 2008 and also Recycle Week in the UK. Locally, our poor recycling record has attracted attention. The main Somerset CC area averages 50% recycling and composting, while North Somerset only does 36%. This will cost us money, as explained under the subtly-titled local newspaper article 'REDUCE WASTE NOW OR FACE A 12M FINE' It's very annoying to read a Conservative councillor say

"The message we really have to get out to people is that this is their problem too."

We know it's a bloody problem. Have you tried to use your stupid recycling system? Criticism of the stupid collections is strangely absent from the local Lib-Dem's Mid table place shouldn't be good enough when it comes to recycling (Mike Bell) and I can't even find recycling mentioned on local Labour sites - I think those two groups may have been in coalition when the stupid system was introduced. It's left to local residents to explain the problem. Local waste collections have been simplified recently but it still seems bloody awkward, taking different types of waste to different places. The most recent edition of the council's North Somerset Life magazine explained that they don't collect plastic bottles from the doorstep because it would add 10 per year to our local tax. I'm damn sure it already costs me more than that to store them and ferry them into town over a year. The only people rewarded by saving that 10 seem to be those who live near the town centre collection point, drive to that Tesco anyway, or don't recycle plastics. Why reward them? Speaking of Tesco... those national and local favourites have applied to build Two more Tesco stores for Weston [The Weston Mercury] including one directly opposite another supermarket. The application number is 08/P/1230/F if you want to respond. The planning system seems my main chance to protect my local environment at the moment. Next Monday evening at 7.30pm, 08/P/1070/F - Erection of 5 storey building to provide 14 flats, restaurant and office with basement parking following demolition of restaurant will be considered by a Kewstoke village council planning meeting in the village hall. As I understand it, the public may make statements at the start of the meeting and 2 Kewstoke Road is currently the Castle.