For Ada Lovelace Day this year, I want to share my appreciation for Dr. Marian C. Diamond. In years past, I ve saluted women in the field of computing, which is my field as well. Dr. Diamond, however, is a biologist. Her research includes neuroanatomy, environment, immune functions, and hormones. In particular, she is interested in studying the effects of the external environment, aging, and immune responses on the cerebral neocortex. She has, in her words, had a love affair with the brain for about 70 years. I know very little about biology. The content and methods of her research are, frankly, beyond me, though some of her results have garnered popular attention. She has inspired me by demonstrating that rare combination of gifts: a deep understanding of a technical subject, and the ability to explain it to other people in an accessible way. In her interviews, articles and lectures, many of which are available online, Dr. Diamond displays these gifts in abundance. Her skill and enthusiasm for both learning and teaching is unmistakable. After applying her gifts in the classroom for many years, digital distribution has now enabled many more people to see and hear her, through millions of YouTube views. In 1960, she became the first female graduate student in UC Berkeley s anatomy department, and was apparently given the job of sewing a cover for a magnifying machine. I can only imagine the persistence required to continue from there to become a recognized leader in her field. She has gone on to help many other students along their way, and was named an unsung, everyday hero for the support she provided to students outside of the classroom or lab. As if that weren t enough, she has also traveled to Cambodia to apply her expertise in helping children injured by land mines. She still teaches today, just across the bay from where I write this, and will turn 85 next month.

It's become kind of a clich for me to claim that the reason I'm happy working on ACPI and UEFI and similarly arcane pieces of convoluted functionality is that no matter how bad things are there's at least some form of documentation and there's a well-understood language at the heart of them. My PhD was in biology, working on fruitflies. They're a poorly documented set of layering violations which only work because of side-effects at the quantum level, and they tend to die at inconvenient times. They're made up of 165 million bases of a byte code language that's almost impossible to bootstrap[1] and which passes through an intermediate representations before it does anything useful[2]. It's an awful field to try to do rigorous work in because your attempts to impose any kind of meaningful order on what you're looking at are pretty much guaranteed to be sufficiently naive that your results bear a resemblance to reality more by accident than design.

The field of bioinformatics is a fairly young one, and because of that it's very easy to be ignorant of its history. Crick and Watson (and those other people) determined the structure of DNA. Sanger worked out how to sequence proteins and nucleic acids. Some other people made all of these things faster and better and now we have huge sequence databases that mean we can get hold of an intractable quantity of data faster than we could ever plausibly need to, and what else is there to know?

Margaret Dayhoff graduated with a PhD in quantum chemistry from Columbia, where she'd performed computational analysis of various molecules to calculate their resonance energies[3]. The next few years involved plenty of worthwhile research that aren't relevant to the story, so we'll (entirely unfairly) skip forward to the early 60s and the problem of turning a set of sequence fragments into a single sequence. Dayhoff worked on a suite of applications called "Comprotein". The original paper can be downloaded here, and it's a charming look back at a rigorous analysis of a problem that anyone in the field would take for granted these days. Modern fragment assembly involves taking millions of DNA sequence reads and assembling them into an entire genome. In 1960, we were still at the point where it was only just getting impractical to do everything by hand.

This single piece of software was arguably the birth of modern bioinformatics, the creation of a computational method for taking sequence data and turning it into something more useful. But Dayhoff didn't stop there. The 60s brought a growing realisation that small sequence differences between the same protein in related species could give insight into their evolutionary past. In 1965 Dayhoff released the first edition of the Atlas of Protein Sequence and Structure, containing all 65 protein sequences that had been determined by then. Around the same time she developed computational methods for analysing the evolutionary relationship of these sequences, helping produce the first computationally generated phylogenetic tree. Her single-letter representation of amino acids was born of necessity[4] but remains the standard for protein sequences. And the atlas of 65 protein sequences developed into the Protein Information Resource, a dial-up database that allowed researchers to download the sequences they were interested in. It's now part of UniProt, the world's largest protein database.

Her contributions to the field were immense. Every aspect of her work on bioinformatics is present in the modern day larger, faster and more capable, but still very much tied to the techniques and concepts she pioneered. And so it still puzzles me that I only heard of her for the first time when I went back to write the introduction to my thesis. She's remembered today in the form of the Margaret Oakley Dayhoff award for women showing high promise in biophysics, having died of a heart attack at only 57.

I don't work on fruitflies any more, and to be honest I'm not terribly upset by that. But it's still somewhat disconcerting that I spent almost 10 years working in a field so defined by one person that I knew so little about. So my contribution to Ada Lovelace day is to highlight a pivotal woman in science who heavily influenced my life without me even knowing.

[1] You think it's difficult bringing up a compiler on a new architecture? Try bringing up a fruitfly from scratch.
[2] Except for the cases where the low-level language itself is functionally significant, and the cases where the intermediate representation is functionally significant.
[3] Something that seems to have involved a lot of putting punch cards through a set of machines, getting new cards out, and repeating. I'm glad I live in the future.
[4] The three-letter representation took up too much space on punch cards

comments

This is probably an idea obvious to everyone, and probably someone's already implemented this, but just in case they haven't, I'll throw this idea out there for someone to hack on. QR codes are two-dimensional bar codes. You can take arbitrary data and encode it into a barcode, which you can then print out. Later, you can scan it in and decode the barcode, and get the original data back. Given that printed paper is fairly durable and unlikely to go suddenly bad, like hard disks do, this can be used for backups. I did a quick experiment. I put 2000 bytes per barcode and printed it out in various sizes: 10, 20, 30, and 70 mm squares. Then I scanned them in. The 70 mm one was the only one that could be decoded, the others were too small and smudged. It should be possible to fit 12 squares of just under 70 mm on an A4 sized page. That's 24000 bytes of raw data. What could you fit in that space? Or several pages of that? It's not dense enough for storing large amounts of data (images, audio, video), but there's a number of important things that are not so large. Perhaps secret keys, or your Revelation keyring file? For ease of use, it would be good to have a tool to take arbitrary binary data, compress it if possible, divide it into chunks of suitable size, number each chunk, and output a PDF with all the QR codes laid out optimally, ready for printing.

As you know, I very often advocate using the bycicle as the main means of transportation in Mexico City. The city is very apt for biking through it, and contrary to the fears of mostly everybody, the city is neither aggressive nor as dangerous as people say. However, I have seen cyclists which seem to be looking for the best ways to be hit by a car, or to hit a pedestrian. Yesterday, I read this note in La Jornada: The local Environment Secretary calls cyclists to respect vial regulations. Many cyclists assume they are a special case of pedestrians, and zig-zag as they please between the road and the walkway, or just stay in the walkway. That is dangerous, both to pedestrians and to themselves. You might find children, elderly or motion-challenged people on your way. Also, not only will pedestrians only expect other people in the walkway, moving at their pace or slightly more, but cars will also not expect somebody moving at 10-20Km/h. A car driver pulling out of his garage, or crossing a street, will not have enough warning when he sees you, and you are very likely to end up in an accident. Since ~5 years ago, Mexico City is growing a grid of Metrob s and confined troleb s cero emisiones (trolleybus) lanes. Many cyclists use those lanes That is VERY dangerous. Public transport vehicles are large, have a lot of inertia, and will take longer to react to finding you ahead of them. Besides, they can go way faster than a regular bike (~60Km/h for metrob s, ~40Km/h for troleb s), and have to stop every couple of blocks. So, you will be uncomfortable if trailing them, and you will be a liability to ~100 people if you go ahead of them. Besides, it is illegal to drive in the confined lanes if you are not a public, semimassive transport vehicle! Surprisingly many people have argued they prefer riding their bicycles against the traffic I think they prefer staring at Death into its blue, glowing eyes (or into its long, thin whiskers)... By far, most cars that hit a bicycle do so from the side, when crossing a road. And if you arrive at a crossing from the wrong way, the way a driver does not expect you, don't expect the driver to be aware of you. Also, in the much less likely event of a car running into you, would it be better to be hit at 80Km/h (60Km/h of the car plus 20Km/h of your own speed on a full frontal crash), or at 40Km/h (substracting instead of adding)? Yes, some people say that looking at the car will allow you to maneuver How far in advance would you know a car coming from the front will hit you? One second? That's 22 meters at 80Km/h (again, if you realize the 60Km/h car is heading straight to you, at 20Km/h). Too short notice for you to do anything Any maneuver will most likely end in an accident. And the driver would not be so much to blame, as he would not be anticipating you riding against the traffic. Make sure you get seen. By night, always use proper lights (red on the back, white on the front, and reflective material to the sides). Day or night, wear bright, reflective clothes (or over-clothes material). Act in a predictable fashion. Remember you are riding a vehicle and are subject to the same rules any driver is A cyclist is not exempt from driving correctly! Do not jump red lights. Never ride on the walkway. Do your best to enjoy the ride. And ride. Yes, ride, take the streets, enjoy the streets. But don't attempt to drive the traffic out of it The streets belong to us all, and we can all share them. PS I also saw this note in the same paper: Sunday Rides in "Campo Militar N mero Uno". The main military field was open as a park this weekend! I have to make sure it is regularly open I am definitively going there!

Halla Tomasdottir gave an interesting TED talk about her financial services company which uses feminine values and thus survived the Icelandic financial crash [1]. She also has a lot of other interesting ideas about how to run a corporation or a country.Hillary Clinton gave an interesting TED talk about national security and women s rights [2]. The US State Department is now making women s rights a priority due to the fact that places where women are mistreated tend to pose a security threat to the US. Unfortunately this talk can t be viewed without flash.Richard Dawkins reads some of his hate-mail while sitting by the fire [3], it s interesting to know that a loving God wants his minions to send hate-mail to scientists. There are a few cheap laughs here.Emily Pilloton gave an interesting TED talk about fixing some of the problems with the education system in rural USA by incorporating design [4]. Instead of having useless projects in shop class the students will complete real projects for their community which have to be designed, planned, and made. The students who end up going to university will learn some generally useful skills through this and the ones who don t go to university will probably have an immediate opportunity to apply the skills that they learn.Elizabeth Pisani gave an interesting TED talk about rational behavior and HIV [5]. She explains why certain behavior that carries great risk can be rational for the people who do it. One of her interesting points is the fact that the poor health system in the US makes it economically viable for the government to refrain from providing free needles to junkies as they don t pay to treat them when they get sick. She makes a good case for political change.Tony Porter gave an inspiring TED talk titled A Call to Men about the way the macho culture socialises men towards violence against women [6].Fraud Magazine has an interesting Interview with Dr. Robert D. Hare and Dr. Paul Babiak about psychopathic fraudsters [7]. Most of the interview is generally about psychopaths and the cases of psychopaths in business, there isn t much that is specific to financial fraud. It has a good summary of what some psychopaths are like.Barbara Fister wrote a Liberation Bibliography a call for knowledge to be free [8]. Currently universities pay researchers who then pay for corporations to accept copyright for their work and then resell it back to the universities. This is sucking money from the university system and denying access to knowledge to the people who can t pay.Charles Limb gave an interesting TED talk about using an MRI to study the brains of Jazz musicians doing Improv and Rappers doing Freestyle [9].Deborah Rhodes gave an interesting TED talk about her new method of screening for breast cancer for women with dense breast tissue [10].Cory Doctorow wrote an interesting article about Net Neutrality and it s importance in helping the less famous writers (the majority of writers) earn money [11]. He also makes some interesting points about Google and about the corporate welfare given to telephone companies.Beyond Zero Emissions has an interesting summary of the current situation regarding Carbon Capture and Sequestration (CCS), among other things the only system that s currently operational is leaking CO2 and killing plants and animals [12].The Brisbane council knew that the flood risks were greater than suggested by published information, they kept this news to themselves to assist property developers in selling low-lying land, and this led to increased problems now that the predicted floods have occurred [13]. Sounds like corruption, we could probably do with a Royal Commission into this.Psychology Today has an interesting article titled Wise Words From Fellow Introverts which is a collection of blog comments from introverts [14].

• [1] http://www.ted.com/talks/halla_tomasdottir.html
• [2] http://blog.ted.com/2010/12/10/ted-blog-exclusive-hillary-rodham-clinton-at-tedwomen/
• [3] http://www.youtube.com/watch?v=-ZuowNcuGsc
• [4] http://www.ted.com/talks/emily_pilloton_teaching_design_for_change.html
• [5] http://www.ted.com/talks/lang/eng/elizabeth_pisani_sex_drugs_and_hiv_let_s_get_rational_1.html
• [6] http://www.ted.com/talks/tony_porter_a_call_to_men.html
• [7] http://www.fraud-magazine.com/article.aspx?id=404
• [8] http://www.nea.org/assets/img/PubThoughtAndAction/A10Fister1.pdf
• [9] http://www.ted.com/talks/charles_limb_your_brain_on_improv.html
• [10] http://www.ted.com/talks/deborah_rhodes.html
• [11] http://www.locusmag.com/Perspectives/2011/01/cory-doctorow-net-neutrality-for-writers-its-all-about-the-leverage/
• [12] http://beyondzeroemissions.org/next-revelation-ccs-carbon-leaks
• [13] http://www.theaustralian.com.au/news/nation/alarming-report-on-risks-covered-up/story-e6frg6nf-1225986634328
• [14] http://www.psychologytoday.com/blog/the-introverts-corner/201012/wise-words-fellow-introverts

This should solve the yurt's bed problem. Over the past two years I've learned there are really two: It's not a fully dry environment so anything left on the floor will mildew; and the yurt makes no pretense of having a level floor. Thus this custom bed with independently levelable legs, custom sized to hold together a multipart matress. In keeping with the yurt thing, it's disassemblable and portable, but not too easily. :) Couldn't have been done without Mark's skilled ripping of the plywood. Anna cut the smaller boards and assisted, and we were very happy with what we managed to accomplish in a few hours. It's sturdy, and even level.

I meant to participate in Ada Lovelace Day, a day to celebrate and acknowledge the accomplishments of women in science and technology, but I got distracted and then it was late and I fell asleep. Such is my life. Anyway, I'd like to acknowledge a woman who I've only recently met, mostly through the Free Software Foundation's women's outreach events. Marina Zhurakhinskaya works for RedHat, and is a developer for GNOME Shell. She's always enthusiastic about sharing her work with other people in person and inviting others to get involved, and is one of those people who is in there every day getting stuff done. I wish I were as confident about the things that I work on. Marina has also been working on the second incarnation of the GNOME Women's Summer Outreach Program, I believe. And she keeps giving talks all over the place, which is great! Go visibility. Now if only she would blog more. I'd never met Marina before last September, despite living in the same metropolitan area! I'm glad women that I don't know about and who work on free software exist and that I get to meet them and find out that they live nearby.

Today is March 24th, that means Ada Lovelace Day, and it is being pushed as an international day of blogging to celebrate the achievements of women in technology and science. The aim of Ada Lovelace Day is to focus on building female role models not just for girls and young women but also for those of us in tech who would like to feel that we are not alone in our endeavours. There are some very good examples of women that have been important in the development of science and technology, starting with Ada Lovelace herself (the first developer of an algorithm intended to be processed by a machine), Rear Admiral Grace Murray Hopper (developer of the first compiler for a computer programming language), Adele Goldstine (who wrote the complete technical description for the first digital computer, ENIAC), as well as the six women who did most of the programming of if (Kay McNulty, Betty Jennings, Betty Snyder, Marlyn Wescoff, Fran Bilas and Ruth Lichterman), or women scientists, or women inventors, etc. Well, I m not going to write about any of those, even when any of them would surely deserve that and more for sure. I m going to write about a woman who has definitely been very inspiring and supportive for me when I was starting to get in touch with Free Software and Debian, and who is probably the most important single reason I decided to go for it. It is definitely hard to write about someone you admire when she happens to be one of your best friends, and in fact I m pretty sure that most of the people reading this article already know her, so there s no great mistery. I m talking about Amaya Rodrigo, the first european female Debian Developer (AFAIK) and co-founder of the Debian Women project, and also member of Hispalinux Board in the golden days. The first time I met her she was giving a talk in Madrid about a project that was starting then, Debian Women, and it was very inspiring for me. Inspiring enough for me to join the project. Afterwards I ve learnt more about her, how she overcame many dificulties, like starting to work with computers quite late, among others. The real merit of a pioneer is not really to be the best techie out there, but to overcome the difficulties and doing it the best you can, when no one else has done it before. I m not going to write her biography here, it s not really the purpose of this blog entry, and you probably can ask herself directly. This blog entry is, as I said at the beginning, to highlight women in technology that I consider inspiring and relevant. You know, I admire you, Amaya

My relationship with Puppet is one of love and hate. I am forced to use it simply because there is no better tool around, but I hate it in so many ways that I don t even want to start to enumerate (hint: most have to do with Ruby, actually). Today I decided to put an end to one thing that has been driving me insane: the fact that puppetd (the client) and puppetmasterd (the server) use the same working directory, /var/lib/puppet. Since I consider and would like to treatthe machine on which puppetmasterd is running just another puppet client, I was running into funky issues related to SSL certificate confusion, obscure errors, and SSL revocation horrors. The following hence assumes that you have installed or are planning to install puppetd on the machine running your puppetmaster, and that you have two fully-qualified domain names for the machine. For instance, I run puppetmaster on vera.madduck.net, and puppetmaster.madduck.net is an alias for the same machine. I ll use these names in the following as examples. The following may be Debian-specific, as I am solely using the puppet and puppetmaster packages for my experimentation and verification. Your mileage may vary, but the concept shall be the same.

1. Stop everything:

   /etc/init.d/puppetmaster stop
   /etc/init.d/puppet stop
   
   

   (also verify that you have not instructed cron to restart these services)
2. Rename the working directory:

   mv /var/lib/puppet /var/lib/puppetmaster
   
   

   and amend /etc/puppet/puppet.conf accordingly:

   [main]
   #  
   vardir=/var/lib/puppetmaster
   ssldir=$vardir/ssl
   #  
   [puppetmasterd]
   certname=puppetmaster.madduck.net
   #  
   
   

   I am doing this in [main], planning to override it for puppetd later, because puppetd is the only program which makes sense to be separated from the rest. Since only the puppetmaster needs a special certificate name, that is set specifically in the [puppetmasterd] section. If you use apache2 or nginx in front of your puppetmasters, make sure to amend the SSL file locations in the virtual host definition and restart (!) the service. You can verify that the configuration has been amended by making sure that there is no output from the following command:

   # puppetmasterd --genconfig   grep -q '/var/lib/puppet/' && echo SOMETHING IS WRONG
   
   

3. Now restart puppetmaster:

   /etc/init.d/puppetmaster start
   
   

   and verify that it starts. If your puppetmaster previously ran under a different name, it will create itself a new certificate and sign it. Since the client will get its own working directory (and thus a new SSL certificate), you want to remove all records of the old certificate:

   # puppetca --list --all
   + puppetmaster.madduck.net
   + vera.madduck.net
   # puppetca --clean vera.madduck.net
   
   

4. Change the configuration file to tell puppetd about its working directory:

   [puppetd]
   server=puppetmaster.madduck.net
   vardir=/var/lib/puppetmaster
   ssldir=$vardir/ssl
   #  
   
   

   This you can verify with the following command, which should not print anything:

   # puppetd --genconfig   grep -q '/var/lib/puppet[^/]' && echo SOMETHING IS WRONG
   
   

5. Now install puppet, or (re)start it if it s already installed:

   # /etc/init.d/puppet stop
   # puppetd --no-daemonize --onetime --verbose --waitforcert 30 &
   info: Creating a new SSL key for vera.madduck.net
   warning: peer certificate won't be verified in this SSL session
   info: Caching certificate for ca
   info: Creating a new SSL certificate request for vera.madduck.net
   # puppetca --list
   vera.madduck.net
   # puppetca --sign vera.madduck.net
   notice: Signed certificate request for vera.madduck.net
   notice: Removing file Puppet::SSL::CertificateRequest vera.madduck.net at '/var/lib/puppetmaster/ssl/ca/requests/vera.madduck.net.pem'
   # fg
   info: Caching certificate for vera.madduck.net
   info: Caching certificate_revocation_list for ca
   [ ]
   # puppetca --list --all
   + puppetmaster.madduck.net
   + vera.madduck.net
   # /etc/init.d/puppet start
   
   

   Do yourself the favour and check that it s all working.
6. Optionally, you can now clean up the client stuff in the server s working directory, for instance like this (it worked for me, but this is the sledgehammer approach):

   # /etc/init.d/puppetmaster stop
   # cd /var/lib/puppetmaster
   # tar -cf /tmp/puppetmaster.workingdir-backup.tar .
   # find ../puppet -type f -printf '%P\n'   xargs rm
   # /etc/init.d/puppetmaster start
   
   

7. If you stopped cron before (and your puppet recipes have not since restarted it):

   /etc/init.d/cron start
   
   

All done. I wish puppet, or at least Debian s puppet packages would do this by default. Please let me know if the above conversion works for you. Then I might start working on an automated migration. NP: Genesis: Selling England by the Pound

In the past, several of my Puppet modules have been tightly coupled. A perfect example is Apache and Munin. When I install Apache, I want munin graphs set up. As a result my apache class has the following snippet in it:

munin::plugin   "apache_accesses":  
munin::plugin   "apache_processes":  
munin::plugin   "apache_volume":  

This should make sure that these three plugins are installed and that munin-node is restarted to pick them up. The define was implemented like this:

define munin::plugin (
      $enable = true,
      $plugin_name = false,
      )  
   include munin::node
   file   "/etc/munin/plugins/$name":
      ensure => $enable ?  
         true => $plugin_name ?  
            false => "/usr/share/munin/plugins/$name",
            default => "/usr/share/munin/plugins/$plugin_name"
          ,
         default => absent
       ,
      links => manage,
      require => Package["munin-node"],
      notify => Service["munin-node"],
    
 

(Note: this is a slight simplification of the define). As you can see, the define includes munin::node, as it needs the definition of the munin-node service and package. As a result of this, installing Apache drags in munin-node on your server too. It would be much nicer if the apache class only installed the munin plugins if you also install munin on the server. It turns out that is is possible, using virtual resources. Virtual resources allow you to define resources in one place, but not make them happen unless you realise them. Using this, we can make the file resource in the munin::plugin virtual and realise it in our munin::node class. Our new munin::plugin looks like:

define munin::plugin (
      $enable = true,
      $plugin_name = false,
      )  
   # removed "include munin::node"
   # Added @ in front of the resource to declare it as virtual
   @file   "/etc/munin/plugins/$name":
      ensure => $enable ?  
         true => $plugin_name ?  
            false => "/usr/share/munin/plugins/$name",
            default => "/usr/share/munin/plugins/$plugin_name"
          ,
         default => absent
       ,
      links => manage,
      require => Package["munin-node"],
      notify => Service["munin-node"],
      tag => munin-plugin,
    
 

We add the following line to our munin::node class:

File<  tag == munin-plugin  >

The odd syntax in the munin::node class realises all the virtual resources that match the filter, in this case, any that is tagged munin-plugin. We've had to define this tag ourself, as the auto-generated tags don't seem to work. You'll also notice that we've removed the munin::node include from the munin::plugin define, which means that we no longer install munin-node just by using the plugin define. I've used a similar technique for logcheck, so additional rules are not installed unless I've installed logcheck. I'm sure there are several other places where I can use it to reduce such tight coupling between classes.

Shortly after I wrote my last article about ACTA and the lack of transparency, I was delighted to find out that a report of the recent negotiations in Mexico has been leaked. I find it a bit disconcerting that our politicians, who are theoretically supposed to represent our interests, are writing documents that can leak to the public, when they should have been available to the public from the start. The document and the coverpage are available for direct download. Michael Geist has a first analysis

A brief report from the European Commission authored by Pedro Velasco Martins (an EU negotiator) on the most recent round of ACTA negotiations in Guadalajara, Mexico has leaked, providing new information on the substance of the talks, how countries are addressing the transparency concerns, and plans for future negotiations. (read more )

NP: Dimmer: Degrees of Existence

Tollef forced me to take over libpam-passwdqc after I had reported bug #517967. passwdqc is a toolset that can be used to enforce password strength policies at exactly the right place: there s a PAM module, and with the next version, you can also use a library and command-line tools read on below. The toolset gives administrators flexibility in defining the minimum password length based on the number of character classes a user tries to use. It also includes libpam-cracklib functionality and prevents the use of trivial passwords. I appreciate this functionality, so I had little choice but to make the best out of it:

• I uploaded libpam-passwdqc 1.0.5-1 to unstable, fixing a few bugs on the way, and bringing the packaging up to speed.
• I wrote a message to upstream introducing myself and was happy when I got an almost immediate response from two developers, suggesting that development was thriving. Yay!
• Having been pointed to the upstream CVS-Git clone, I based the packaging off the repository, rather than the tarballs. This required me to juggle directories a bit, as well as to repack the tarballs. Oh well.
• Next, I fixed the bug I reported, and now libpam-passwdqc can be installed and configured in a jiffy, thanks to Steve Langasek s impressive work on pam-auth-update. Someone also reported this feature request as LP#314775, but I don t use Launchpad, so someone else will have to triage it there.
• Finally, I imported the latest upstream work into the repository, which had me change the source package name. The benefit of version 1.1.4 in addition to improvements and bugs fixed is that the functionality is now also available through client programs in the passwdqc package, as well as in an independent C library. Due to the new packages, the upload is currently waiting in the Debian NEW queue, so hold your horses for a few days.

Debhelper 7 is really nice. Thanks, Joey.

Contained in the recent billionth-spam report from Project Honeypot is the revelation that The volume of spam drops approximately 21% on Christmas Day and 32% on New Year s Day. (Thanks to Raphael for the pointer.) Happy Christmas to those of you who celebrate it

This post is about Barbara Liskov, for the Ada Lovelace Day. Barbara Liskov is the first woman in the United States of America that obtained a Ph.D. from a Computer Science department, in 1968. However, this isn't by any chance her greatest achievement. She's the creator of the CLU programming language, a language created in the mid-70s, that we would find crufty and ugly nowadays, but that with its strong emphasis in abstraction, the use of clusters (basically equivalent to what we call classes today) and iterators, was to become the rock foundation of Object Oriented Programming. Apart from that, she worked in the design of a timesharing operating system, called Venus; designed another programming language, called Argus, that was oriented to distributed applications, and also set the foundations for much of what is currently done as distributed computing. Aged 70, she's currently still working at MIT, as the leader of the Programming Methodology Group, researching ways to tolerate byzantine faults. For all this work, she received the John von Neumann medal in 2004, and the Alan Turing award in 2008. All in all, what I find the most inspiring of all her life, is the fact that she was able to pursue her career, working on a new way of creating programs, while she was also a wife and a mother; and that today, aging 70, she's still researching, leading a group, and working towards making computing better.

Modern daemon implementations can be run in a variety of ways, in a range of contexts. The daemon software itself can be a useful tool in environments where the associated traditional system service is neither needed nor desired. Unfortunately, common debian packaging practice has a tendency to conflate the two ideas, leading to some potentially nasty problems where only the tool itself is needed, but the system service is set up anyway. How would i fix it? i'd suggest that we make a distinction between packages that provide tools and packages that provide system services. A package that provides the system service foo would need to depend on a package that provides the tool foo. But the tool foo should be available through the package manager without setting up a system service automatically. Bad Examples Here are some examples of this class of problem i've seen recently:

akonadi-server depends on mysql-server

akonadi is a project to provide extensible, cross-desktop storage for PIM data. It is a dependency of many pieces of the modern KDE4 desktop. Its current implementation relies on a private instantiation of mysqld, executed directly by the end user whose desktop is running. This means that a sysadmin who installs a graphical calendar application suddenly now has (in addition to the user-instantiated local mysqld running as the akonadi backend) a full-blown system RDBMS service running and potentially consuming resources on her machine.Wouldn't it be better if the /usr/sbin/mysqld tool itself was distinct from the system service?

puppetmaster depends on puppet

Puppet is a powerful framework for configuration management. A managed host installs the puppet package, which invokes a puppetd service to reconfigure the managed host by talking to a centralized server on the network. The central host installs the the puppetmaster package, which sets up a system puppetmasterd service. puppetmaster depends on puppet to make use of some of the functionality available in the package. But this means that the central host now has puppetd running, and is being configured through the system itself! While some people may prefer to configure their all-powerful central host through the same configuration management system, this presents a nasty potential failure mode: if the configuration management goes awry and makes the managed nodes inaccessible, it could potentially take itself out too. Shouldn't the puppet tools be distinct from the puppetd system service?

monkeysphere Build-Depends: openssh-server

The Monkeysphere is a framework for managing SSH authentication through the OpenPGP Web-of-Trust (i'm one of the authors). To ensure that the package interacts properly with the OpenSSH implementation, the monkeysphere source ships with a series of test suites that exercise both sshd and ssh.This means that anyone trying to build the monkeysphere package must pull in openssh-server to satisfy the build-depends, thereby inadvertently starting up a potentially powerful network service on their build machine and maybe exposing it to remote access that they didn't intend. Wouldn't it be better if the /usr/sbin/sshd tool was available without starting up the ssh system service?

Good ExamplesHere are some examples of debian packaging that already understand and implement this distinction in some way:

apache2.2-bin is distinct from apache2-mpm-foo

Debian's apache packaging recently transitioned to split the apache tool into a separate package (apache2.2-bin) from the packages that provide an apache system service (apache2-mpm-foo). So apache can now be run by a regular user, for example as part of gnome-user-share.

git-core is distinct from git-daemon-run

git-core provides the git daemon subcommand, which is a tool capable of providing network access to a git repo. However, it does not set up a system service by default. The git-daemon-run package provides a way for an admin to quickly set up a "typical" system service to offer networked git access.

vblade is distinct from vblade-persist

vblade offers a simple, powerful utility to export a single file or block device as an AoE device. vblade-persist (disclosure: i wrote vblade-persist) provides a system service to configure exported devices, supervise them, keep them in service across system reboots, etc.

Tools are not Services: a ProposalLet's consider an existing foo package which currently provides:

• the tool itself (say, /usr/sbin/foo) and
• sets up a system service running foo, including stock foo daemon configuration in /etc/foo/*, startup scripts at /etc/init.d/foo, service configs at /etc/default/foo, etc.

I suggest that this should be split into two packages. foo-bin would contain the tool itself, and foo (which Depends: foo-bin) would contain the service configuration information, postinst scripts to set it up and start it, etc. This would mean that every instance of apt-get install foo in someone's notes would retain identical semantics to the past, but packages which need the tool (but not the service) can now depend on foo-bin instead, leaving the system with fewer resources consumed, and fewer unmanaged services running. For brand new packages (which don't have to account for a legacy of documentation which says apt-get install foo), i prefer the naming convention that the foo package includes the tool itself (after all, it does provide /usr/sbin/foo), and foo-service sets up a standard system service configured and running (and depends on foo). Side Effects This proposal would fix the problems noted above, but it would also offer some nice additional benefits. For example, it would make it easier to introduce an alternate system initialization process by creating alternate service packages (while leaving the tool package alone). Things like runit-services could become actual contenders for managing the running services, without colliding with the "stock" services installed by the bundled tool+service package. The ability to create alternate service packages would also mean that maintainers who prefer radically different configuration defaults could offer their service instantiations as distinct packages. For example, one system-wide foo daemon (foo-service) versus a separate instance of the foo daemon per user (foo-peruser-service) or triggering a daemon via inetd (foo-inetd-service). One negative side effect is that it adds some level of increased load on the package maintainers if the service package and the tool package both come from the same source package, then some work needs to be done to figure out how to split them. If the tool and service packages have separate sources (like vblade and vblade-persist) then some coordinating footwork needs to be done between the two packages when any incompatible changes happen. Questions? Disagreements? Next Steps? Do you disagree with this proposal? If so, why? Unfortunately (to my mind), Debian has a long history of packages which conflate tools with services. Policy section 9.3.2 can even be read as deliberately blurring the line (though i'd argue that a cautious reading suggests that my proposal is not in opposition to policy):

Packages that include daemons for system services should place scripts in /etc/init.d to start or stop services at boot time or during a change of runlevel.

I feel like this particular conflict must have been hashed out before at some level are there links to definitive discussion that i'm missing? Is there any reason we shouldn't push in general for this kind of distinction in debian daemon packages? Tags: daemons, packaging, policy

We got back from our brief visit to Canada last night. We had a great time, Vancouver and Victoria were both very nice. YVR (Vancouver Airport) This airport has to win the award for nicest airport I've seen. Clearly they pulled out all the stops in preparation for the Winter Olympics next year. The airport is very bright, airy and open. Before you even hit the immigration line, you pass through a couple of water features, some indigenous art, all of that jazz. Immigration is done in the open in a huge hall, instead of in the dark bowels of the airport, which was a pleasant change from the usual US airport immigration experience. (That said, Houston airport had a pretty nice immigration experience). Oh, and it was blanketed with free WiFi, which was a nice touch. Ferry to Victoria The brief geography lesson I got was that Victoria is on Vancouver Island, and Vancouver (the city) is not on Vancouver (the island). Go figure. Getting to Victoria from the airport via BC Ferries was a very seamless experience. You board a bus from the side of the airport terminal, and it drives to Tsawwassen, drives onto the ferry, and then you get off the bus and go sit on one of the passenger levels of the ferry. BC Ferries BC Ferries deserves special mention. The ferry itself is huge - 7 decks (three of them for vehicles). It's a veritable shopping mall on water. It's got some stores, buffets, exclusive $10 entry lounges, video arcades, cellular payphones, the works. The trip to Victoria The ferry ride took about 1.5 hours, and was very scenic. We passed by a few smaller islands, and I had an instant flashback to the TV show The Beachcombers that I used to watch as a kid, particularly the opening sequence. Victoria Victoria is a beautiful city. It's the capital of the province of British Columbia, and I likened it to Canberra in a lot of ways. It had more modern conveniences than a town with a population of its size would otherwise normally have. It was a government and university town. Nice houses, very green in general, and being an island, there was water everywhere. It seemed to have lots of bays, and harbours and rivers. It was very nice. Flight back to Vancouver We took a Harbour Air seaplane back to Vancouver on Sunday afternoon. That was fun. I've never been on a seaplane before. It took about 35 minutes. Vancouver First order of business in Vancouver was the purpose of the whole trip: renewing our visas. That went fine, I'll write a separate post about the process. Afterwards, we bought tickets for the Big Bus, and toured the city for the remainder of Monday and Tuesday. Drive to Whistler For Wednesday and Thursday, we hired a car, and went a bit further afield. On Wednesday, we drove up to Whistler to check it out. The drive up took about 5 hours, because we stopped at every scenic spot we came by. Waterfalls abounded. There was a lot of work being done on the roads between Vancouver and Whistler, upgrading them for the Olympics. Whistler itself was pretty spectacular. Some crazy looking ski runs. The village looked like Squaw Village on steroids. The drive back only took about 2 hours. Cleveland Dam, Lynn Canyon suspension bridge For the last day, we drove to Cleveland Dam, where there was a salmon hatchery, and checked out the dam, hatchery and surrounding area. It was lovely and green. After that, we drove to Lynn Canyon to check out the suspension bridge there (unlike the Capilano Suspension Bridge, which costs $26 a pop, the Lynn Canyon one is free). That was all we had time for really. The weather wasn't fantastic during our stay, but it didn't really prevent us from doing anything either. I'd have liked to have checked out Stanley Park if we had more time, and Sarah wanted to go to Grouse Mountain. We had a near-100% success rate at being picked as Australians, unlike when we're in the US, where more often than not, people ask us if we're British. Apparently this is mainly attributed to the fact that Australians run all of the ski lifts at Whistler. We certainly heard a lot of Australian accents while we were getting around. I'd also never seen such a saturation of Starbucks before. In Vancouver, there were literally Starbucks across the road from Starbucks, and around the corner from another one. Whistler village had two. The Canadian accent is cute. They really do tack "eh?" on the end of everything, although it's phonetically more like "ay?". "House" and "about" are also pronounced distinctively differently. Overall, Vancouver wasn't what I'd call bursting at the seams with tourist attractions, but seemed like a nice city. It was fairly flat. The beggars were well dressed. Everyone was very friendly. A lot of the taxis were Priuses. It seemed pretty clean. I could handle living there. Not sure how bad it gets in winter.

So, when I like something, I tend to yap about it for weeks and weeks. Take Icelandic Yogurt, for example. After re-discovering it a month ago, I went on a mini-binge (not a mega as it is too expensive) and spread the word to anyone who would listen. The stuff, especially with fun flavors like ginger and orange, just made my morning. Another fine fine thing out there is the performance group What We Know So Far who give performance-based lectures that mix intellectual insight with artistic flair. They put us regular academics to shame who are a bit more staid, to put it mildly. After seeing them a few weeks ago at the 3rd Ward, I snagged them to give a version of their A-mazing talk on Memes in my class and am organizing a much larger event at NYU for the fall of 2009. This is a sort of long winded way of announcing their up and coming show on April 27th the Hannah Complex, which entertains, among other topics, the nature of common sense: Can there be more than one common sense? they ask on their site. And I can t wait to hear the answer as this is a recurrent topic that anthropologists like to entertain. And in fact one of my favorite essays to teach is on this topic, Clifford Geertz Common Sense as Cultural System, a short excerpt which I found here and below is his thesis in a nutshell:

There are a number of reasons why treating common sense as a relatively organized body of considered thought, rather than just what anyone clothed and in his right mind knows, should lead on to some useful conclusions; but perhaps the most important is that it is an inherent characteristic of common-sense thought precisely to deny this and to affirm that its tenets are immediate deliverances of experience, not deliberated reflections upon it. Knowing that rain wets and that one ought to come in out of it, or that fire burns and one ought not to play with it (to stick to our own culture for the moment) are conflated into comprising one large realm of the given and undeniable, a catalog of in-the-grain-of-nature realities so peremptory as to force themselves upon any mind sufficiently unclouded to receive them. Yet this is clearly not so. No one, or no one functioning very well, doubts that rain wets; but there may be some people around who question the proposition that one ought to come in out of it, holding that it is good for one s character to brave the elements hatlessness is next to godliness. And the attractions of playing with fire often, with some people usually, override the full recognition of the pain that will result. Religion rests its case on revelation, science on method, ideology on moral passion; but common sense rests its on the assertion that it is not a case at all, just life in a nutshell. The world is its authority.

So, when I like something, I tend to yap about it for weeks and weeks. Take Icelandic Yogurt, for example. After re-discovering it a month ago, I went on a mini-binge (not a mega as it is too expensive) and spread the word to anyone who would listen. The stuff, especially with fun flavors like ginger and orange, just made my morning. Another fine fine thing out there is the performance group What We Know So Far who give performance-based lectures that mix intellectual insight with artistic flair. They put us regular academics to shame who are a bit more staid, to put it mildly. After seeing them a few weeks ago at the 3rd Ward, I snagged them to give a version of their A-mazing talk on Memes in my class and am organizing a much larger event at NYU for the fall of 2009. This is a sort of long winded way of announcing their up and coming show on April 27th the Hannah Complex, which entertains, among other topics, the nature of common sense: Can there be more than one common sense? they ask on their site. And I can t wait to hear the answer as this is a recurrent topic that anthropologists like to entertain. And in fact one of my favorite essays to teach is on this topic, Clifford Geertz Common Sense as Cultural System, a short excerpt which I found here and below is his thesis in a nutshell:

There are a number of reasons why treating common sense as a relatively organized body of considered thought, rather than just what anyone clothed and in his right mind knows, should lead on to some useful conclusions; but perhaps the most important is that it is an inherent characteristic of common-sense thought precisely to deny this and to affirm that its tenets are immediate deliverances of experience, not deliberated reflections upon it. Knowing that rain wets and that one ought to come in out of it, or that fire burns and one ought not to play with it (to stick to our own culture for the moment) are conflated into comprising one large realm of the given and undeniable, a catalog of in-the-grain-of-nature realities so peremptory as to force themselves upon any mind sufficiently unclouded to receive them. Yet this is clearly not so. No one, or no one functioning very well, doubts that rain wets; but there may be some people around who question the proposition that one ought to come in out of it, holding that it is good for one s character to brave the elements hatlessness is next to godliness. And the attractions of playing with fire often, with some people usually, override the full recognition of the pain that will result. Religion rests its case on revelation, science on method, ideology on moral passion; but common sense rests its on the assertion that it is not a case at all, just life in a nutshell. The world is its authority.

At work, we have a bit of a vested interest in the Puppet and Facter packages that are in Debian, because we ultimately consume them in Ubuntu. We noticed that what was in Debian unstable was lagging a bit behind what was released upstream, and when one of my co-workers tried getting in contact with the Debian developers that were maintaining the Puppet package and got no response, I got involved. I got in touch with Micah Anderson and got myself and Nigel Kersten added to the Alioth project for Puppet. Despite Jamie Wilkinson being listed as the maintainer of the facter package in Debian, he claimed this was news to him, and Matt Palmer, who was listed as an uploader, didn't really claim much knowledge of maintaining the package either, so we took that as blessing to take over that package as well. This is where the fun begins. I've been meaning to try out Git ever since Debconf 7, where all the cool kids were using it and raving about it. I've been meaning to make the Debian DHCP package collaboratively-maintained, and use Git for the revision control, but I haven't quite gotten off my good intentions and done it yet. Part of the problem is not knowing exactly what workflow I should use, and suffering from paralysis by analysis, reluctant to experiment, because I don't want to go down the wrong path. Anyway, this is about Puppet, not DHCP. The Puppet package, as it turns out, is already maintained in Git on Alioth, so the problem here was more one of figuring out what the current workflow was, and trying to follow it. This is where Nigel came in. Conveniently, the upstream Puppet development is done in Git also, and Nigel is a contributor to Puppet upstream, so he had some Git-fu. So between the instructions on how to get started with Git on Alioth and what he knew, we could start fumbling around. It seems like the Alioth Git repository was also tracking the upstream Puppet repository, as there were commits in the Alioth one by Luke Kanies, and we didn't really imagine that he was doing Debian-specific stuff. Here's what we ended up doing to try and get what was in the Alioth repository up to the upstream version 0.24.8 of Puppet:

git clone ssh://apollock@git.debian.org/git/pkg-puppet/puppet.git

This part was fairly straight forward. Clone what's in Alioth locally.

git remote add reductive git://reductivelabs.com/puppet
git remote update
git fetch --tags reductive

Next, we added a remote branch that tracked upstream. We called it "reductive", and we updated it. The bit that took some fiddling with was fetching the tags. Nigel later figured out that tags are inherently private to a repository, and normally stay that way. So if I have a local clone of say the upstream Puppet repository, I can tag it to my heart's content, and normally those tags would stay in my local repository, because they're probably only meaningful to me.

git checkout -b upstream/0.24.8 0.24.8

This bit took a bit of work to arrive at as well. What we wanted to do was create a new branch called upstream/0.24.8, which was at what was tagged 0.24.8 in the reductive repository. Nigel pondered what would happen if you already had a tag or a branch called "0.24.8" before you added the remote repository. This is also why we had to fetch the tags from the remote repository, so we had something to check out.

git checkout master
git merge upstream/0.24.8

Next, we switched back to the master branch and merged the contents of our local upstream/0.24.8 branch that we just created. This now got the Puppet source in the master branch up to what was released as version 0.24.8. (and this is better than just running uupdate?) We did some fiddling with the debian/control file and debian/changelog and fixed up a few things that Lintian was bitching about, and were done. I'd set up a sid chroot with cowdancer previously, and had to do some faffing around with git-buildpackage to convince it to use pbuilder. I ended up using

git-buildpackage --git-builder="pdebuild --debbuildopts '-i\.git -I.git' --basepath /var/cache/pbuilder/base-unstable.cow"

So now we've got most of what we want to ship checked into Git on Alioth. I have no idea if we've done it "right", I suspect we may have done something wrong by operating on the master branch. Looking at the revision history in the Git repository on Alioth, it looks like previously things have been done a few different ways. I certainly want to write up a definitive workflow once we've figured one out. We haven't uploaded the new package to unstable yet, because we're still trying to give it a modicum of testing, and we'd like to sort out the Facter package as well. The Facter package was a more greenfield exercise, as while there was already a Git repository on Alioth for it, it was empty. So Nigel had to do some futzing around to get it checked in the right way to make git-buildpackage want to build it. He did this by himself, so I'm not sure exactly what he did. I've since discovered that it's probably lacking some dependencies it needs, so that'll need to get fixed before it gets uploaded. I look forward to reading blog posts from the smart people who actually know how to use Git properly, telling me how we should have done it. I'm still very interested in coming up with a proper workflow for preparing packages and committing the changes, and for doing code review.

Two days ago I read about the Ada Lovelace day, which was an event were men and women were asked to blog about the women in technology which made an impact on them, in an effort to present girls (and women) all over the world with female role models in technology.

In similar though more personal motivation I choose my machine naming scheme at home two years ago: my (virtual) machines at home are named after women who made a difference, mostly in IT, but also some in more general science. Even though this list is not 100% in the spirit of pointing out the one woman who made a personal difference to one self, I thought I share my list, as I found it very interesting to learn about these great women myself.

goldberg is named after Adele Goldberg, who pioneered the smalltalk programming language in the 70s. According to a sympathetic annecdote she refused to show the system to Steve Jobs and only did so after her superiors ordered her to do so. Thats were Apple got many ideas which made them famous for being innovative...

goldwasser is named after Shafi Goldwasser, who is a RSA professor at MIT, doing research in complexity theory, cryptography and computational number theory. She is the co-inventor of zero-knowledge proofs.

lovelace is named after Ada Lovelace, and is widely recognized as the first programmer, who wrote a program (something that manipulated symbols according to rules) for a machine which has not even been build at that time. Of course, some men on this planet object to her being the first programmer, as work by women is always insignificant... </irony or maybe sarcasm>

bunten is named afer Danielle Bunten Berry, who was a game designer and programmer best known for the games M.U.L.E. and Seven Cities of Gold.

holberton is named after Betty Holberton, who was one of the six original programmers of ENIAC, the first general-purpose electronic digital computer, during and after World War II.

hopper is named after Grace Hopper who wrote the first compiler ever, the A compiler. She was also heavily involved in creating COBOL and standardizing COBOL and FORTRAN.

koller is named after Daphne Koller who does AI research at MIT and who seems to behind the idea of bayesian machine learning, which you might know from your spam filters... (I can only state her involvement in bayesian learning so vaguely as I'm basically clueless about the topic :)

leveson is named after Nancy Leveson who is also an MIT professior and is an expert in systems and software safety.

Last but not least I like to remark that none of the women above is even nearly covered with what I wrote here or what is written in wikipedia, which I used as my main source for this blog post. It's simple impossible to sum up one life that brief and be close to accurate.

And then there is another group of women whose achievements are noteworthy as well and who choose to present themselves on that webpage to show others that Debian is not a mens club. Thank you (a lot) for that and for your other contributions to Debian! If you want to learn more about these giants, I recommend this talk. Guess who's achievements I admire most in this group ;-)

Somewhat unrelated I wish to shout cheers to Yvonne, who tought me many things and who died six years ago today. You will also not be forgotten, though the pain is mostly gone now (well, it's gone, except for days like today). Thank you, among other stuff, for teaching me to celebrate and cheer every day, even if not everything is cheerful. Wenn die Nacht am tiefsten, ist der Tag am n chsten! :-)