The Threat Bruce Schneier s blog post about the Mariposa Botnet has an interesting discussion in the comments about how to make a secure system [1]. Note that the threat is considered to be remote attackers, that means viruses and trojan horses which includes infected files run from USB devices (IE you aren t safe just because you aren t on the Internet). The threat we are considering is not people who can replace hardware in the computer (people who have physical access to it which includes people who have access to where it is located or who are employed to repair it). This is the most common case, the risk involved in stealing a typical PC is far greater than the whatever benefit might be obtained from the data on it a typical computer user is at risk of theft only for the resale value of a second-hand computer. So the question is, how do can we most effectively use free software to protect against such threats? The first restriction is that the hardware in common use is cheap and has little special functionality for security. Systems that have a TPM seem unlikely to provide a useful benefit due to the TPM being designed more for Digital Restrictions Management than for protecting the user and due to TPM not being widely enough used. The BIOS and the Bootloader It seems that the first thing that is needed is a BIOS that is reliable. If an attacker manages to replace the BIOS then it could do exciting things like modifying the code of the kernel at boot time. It seems quite plausible for the real-mode boot loader code to be run in a VM86 session and to then have it s memory modified before it starts switches to protected mode. Every BIOS update is a potential attack. Coreboot replaces the default PC BIOS, it initialises the basic hardware and then executes an OS kernel or boot loader [2] (the Coreboot Wikipedia page has a good summary). The hardest part of the system startup process is initialising the hardware, Coreboot has that solved for 213 different motherboards. If engineers were allowed to freely design hardware without interference then probably a significant portion of the computers in the market would have a little switch to disable the write line for the flash BIOS. I heard a rumor that in the days of 286 systems a vendor of a secure OS shipped a scalpel to disable the hardware ability to leave protected mode, cutting a track on the motherboard is probably still an option. Usually once a system is working you don t want to upgrade the BIOS. One of the payloads for Coreboot is GRUB. The Grub Feature Requests page has as it s first entry Option to check signatures of the bootchain up to the cryptsetup/luksOpen: MBR, grub partition, kernel, initramfs [3]. Presumably this would allow a GPG signature to be checked so that a kernel and initrd would only be used if they came from a known good source. With this feature we could only boot a known good kernel. How to run User Space The next issue is how to run the user-space. There has been no shortage of Linux kernel exploits and I think it s reasonable to assume that there will continue to be a large number of exploits. Some of the kernel flaws will be known by the bad guys for some time before there are patches, some of them will have patches which don t get applied as quickly as desired. I think we have to assume that the Linux kernel will be compromised. Therefore the regular user applications can t be run against a kernel that has direct hardware access. It seems to me that the best way to go is to have the Linux kernel run in a virtual environment such as Xen or KVM. That means you have a hypervisor (Xen+Linux or Linux+KVM+QEMU) that controls the hardware and creates the environment for the OS image that the user interacts with. The hypervisor could create multiple virtual machines for different levels of data in a similar manner to the NSA NetTop project, not that this is really a required part of solving the general secure Internet terminal problem but as it would be a tiny bit of extra work you might as well do it. One problem with using a hypervisor is that the video hardware tends to want to use features such as bus-mastering to give best performance. Apparently KVM has IOMMU support so it should be possible to grant a virtual machine enough hardware access to run 3D graphics at full speed without allowing it to break free. Maintaining the Virtual Machine Image Google has a good design for the ChromiumOS in terms of security [4]. They are using CGroups [5] to control access to device nodes in jails, RAM, CPU time, and other resources. They also have some intrusion detection which can prompt a user to perform a hardware reset. Some of the features would need to be implemented in a different manner for a full desktop system but most of the Google design features would work well. For an OS running in a virtual machine when an intrusion is detected it would be best to have the hypervisor receive a message by some defined interface (maybe a line of text printed on the console ) and then terminate and restart the virtual machine. Dumping the entire address space of the virtual machine would be a good idea too, with typical RAM sizes at around 4G for laptops and desktops and typical storage sizes at around 200G for laptops and 2T for new desktops it should be easy to store a few dumps in case they are needed. The amount of data received by a typical ADSL link is not that great. Apart from the occasional big thing (like downloading a movie or listening to Internet radio for a long time) most data transfers are from casual web browsing which doesn t involve that much data. A hypervisor could potentially store the last few gigabytes of data that were received which would then permit forensic analysis if the virtual machine was believed to be compromised. With cheap SATA disks in excess of 1TB it would be conceivable to store the last few years of data transfer (with downloaded movies excluded) but such long-term storage would probably involve risks that would outweigh the rewards, probably storing no more than 24 hours of data would be best. Finally in terms of applying updates and installing new software the only way to do this would be via the hypervisor as you don t want any part of the virtual machine to be able to write to it s data files or programs. So if the user selects to install a new application then the request please install application X would have to be passed to the hypervisor. After the application is installed a reboot of the virtual machine would be needed to apply the change. This is a common experience for mobile phones (where you even have to reboot if the telco changes some of their network settings) and it s something that MS-Windows users have become used to but it would get a negative reaction from the more skilled Linux users. Would this be Accepted? The question is, if we built this would people want to use it? The NetTop functionality of having two OSs interchangeable on the one desktop would attract some people. But most users don t desire greater security and would find some reason to avoid this. They would claim that it lowered the performance (even for aspects of performance where benchmarks revealed no difference) and claim that they don t need it. At this time it seems that computer security isn t regarded as a big enough problem for users. It seems that the same people who will avoid catching a train because one mugging made it to the TV news will happily keep using insecure computers in spite of the huge number of cases of fraud that are reported all the time.

• [1] http://www.schneier.com/blog/archives/2010/03/mariposa_botnet.html
• [2] http://www.coreboot.org/Welcome_to_coreboot
• [3] http://grub.enbug.org/FeatureRequests
• [4] http://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/system-hardening
• [5] http://lxr.linux.no/linux+v2.6.30/Documentation/cgroups/

I must confess I don't remember who I got this invitation from. Anyway, if you are in the right geographic area, you might be interested. I will try to participate: This is a year-long seminar that will be held the second Thursday every month at Fonoteca Nacional (a place I have wanted to visit for a long time!), in Barrio de Santa Catarina, Coyoac n. Among the organizers they have Creative Commons Mexico. Free entrance (but limited space - so they ask interested people to confirm their presence by mail to bvallarta@conaculta.gob.mx). [update] I went with Pooka to the first session. We arrived almost 1hr late (due to me mistaking the schedule :-/ ) but it was interesting. Of course, quite biased towards the Google viewpoints, but interesting. We got the program for the next sessions So, mostly for myself to keep handy, here it goes:

Date	Title	Speakers
2010-03-11	Google and copyright	Manuel Tamez, Hugo Contreras, Mar a Fernanda Mendoza
2010-04-08	Generalities about rights on intelectual property	Jes s Parets, Guillermo Sol rzano, Jorge Mier y Concha
2010-05-13	Copyright's nature and competent authorites	Carmen Arteaga, Luis Schmidt, C sar Callejas
2010-06-10	Moral and patrimonial rights	Guillermo Pous, Eduardo de la Parra, Ram n Ob n
2010-07-08	Reproduction rights for audible material	lvaro Hegewisch, scar Javier Solorio, Marco Antonio Morales, Jos Ram n C rdeno
2010-08-12	Licenses and patrimonial right transmission. Works for hire, works done under laboral relationship, or carried out in official service	Dolores Franco, Jes s Mej a, Ra l Pastor
2010-09-09	Limits to explotation rights and literary plagiarism	Carmen Arteaga, Juan Ram n Ob n, Jorge Mier y Concha, C sar Callejas
2010-10-14	Copyright in a digital setting	Jes s Parets, Gast n Esquivel
2010-11-11	Law-regulated intelectual property rights	Rosalba Elizalde, Salvador Ortega, Gast n Esquivel, Manrique Moheno
2010-12-09	International protection and collective gestive societies	Horacio Rangel, Luis Schmidt, Jes s Mej a

The Opera-Mini Dispute I have just read an interesting article about the Opera browser [1]. The article is very critical of Opera-Mini on the iPhone for many reasons most of which don t interest me greatly. There are lots of technical trade-offs that you can make when designing an application for a constrained environment (EG a phone with low resolution and low bandwidth). What does interest me is the criticism of the Opera Mini browser for proxying all Internet access (including HTTPS) through their own servers, this has been getting some traction around the Internet. Now it is obvious that if you have one server sitting on the net that proxies connections to lots of banks then there will be potential for abuse. What apparently isn t obvious to as many people is the fact that you have to trust the application. Causes of Software Security Problems When people think about computer security they usually think about worms and viruses that exploit existing bugs in software and about Trojan horse software that the user has to be tricked into running. These are both significant problems. But another problem is that of malicious software releases. I think that this is significantly different from Trojan horses because instead of having an application which was written for the sole purpose of tricking people (as is most similar to Greek history) you have an application that was written by many people who genuinely want to make a good product but you have a single person or small group that hijacks it. Rumor has it that rates well in excess of $10,000 are sometimes paid for previously unknown security vulnerabilities in widely used software. It seems likely that a programmer who was in a desperate financial situation could bolster their salary by deliberately putting bugs in software and then selling the exploits, this would not be a trivial task (making such bugs appear to be genuine mistakes would take some skill) but there are lots of people who could do it and plausibly deny any accusation other than carelessness. There have been many examples of gambling addicts who have done more foolish things to fund their habit. I don t think it s plausible to believe that every security flaw which has been discovered in widely used software was there purely as the result of a mistake. Given the huge number of programmers who have the skill needed to deliberately introduce a security flaw into the source of a program and conceal it from their colleagues I think it s quite likely that someone has done so and attempted to profit from it. Note that even if it could be proven that it was impossible to profit from creating a security flaw in a program that would not be sufficient to prove that it never happened. There is plenty of evidence of people committing crimes in the mistaken belief that it would be profitable for them. Should We Trust a Proprietary Application or an Internet Server? I agree with the people who don t like the Opera proxy idea, I would rather run a web browser on my phone that directly accesses the Internet. But I don t think that the web browser that is built in to my current smart-phone is particularly secure. It seems usual for a PC to need a security update for the base OS or the web browser at least once a year while mobile phones have a standard service life of two years without any updates. I suspect that there is a lot of flawed code running on smart phones that never get updated. It seems to me that the risks with Opera are the single point of failure of the proxy server in addition to the issues of code quality while the risks with the browser that is on my smart-phone is just the quality of the code. I suspect that Opera may do a better job of updating their software to fix security issues so this may mitigate the risk from using their proxy. At the moment China is producing a significant portion of the world s smart-phones. Some brands like LG are designed and manufactured in China, others are manufactured in China for marketing/engineering companies based in Europe and the US. A casual browse of information regarding Falun Gong makes the character of the Chinese leadership quite clear [2], I think that everything that comes out of China should be considered to be less trustworthy than equivalent products from Europe and the US. So I think that anyone who owns a Chinese mobile phone and rails against the Opera Mini hasn t considered the issue enough. I don t think it s possible to prove that an Opera Mini with it s proxy is more or less of a risk than a Chinese smart-phone. I m quite happy with my LG Viewty [3] but I wouldn t use it for Internet banking or checking my main email account. Also we have to keep in mind that mobile phones are really owned by telephone companies. You might pay for your phone or even get it unlocked so you can run it on a different network, but you won t get the custom menus of your telco removed. Most phones are designed to meet the needs of telcos not users and I doubt that secure Internet banking is a priority for a telco. Update: You can buy unlocked mobile phones. But AFAIK the Android is the only phone which might be described as not being designed for the needs of the telcos over the needs of the users. So while you can get a phone without custom menus for a telco, you probably can t get a phone that was specifically designed for what you want to do. The Scope of the Problem Mobile phones are not the extent of the problem, I think that anyone who buys a PC from a Chinese manufacturer and doesn t immediately wipe the hard drive and do a fresh OS install is taking an unreasonable risk. The same thing goes for anyone who buys a PC from a store where it s handled by low wage employees, I can imagine someone on a minimum income accepting a cash payment to run some special software on every PC before it goes out the door that wouldn t be any more difficult or risky than the employees who copy customer credit card numbers (a reasonably common crime). It s also quite conceivable that any major commercial software company could have a rogue employee who is deliberately introducing bugs into it s software. That includes Apple. If the iPhone OS was compromised before it shipped then the issue of browser security wouldn t matter much. I agree that having the minimum possible number of potential security weak points is a good idea. They should allow Opera Mini users to select that HTTPS traffic should not be proxied. But I don t think that merely not using a proxy would create a safe platform for Internet banking. In terms of mobile phones most things are done in the wrong way to try and get more money out of the users. Choose whichever phone or browser you want and it will probably still be a huge security risk. Harald Welte is doing some really good work on developing free software for running a GSM network [4]. But until that project gets to the stage of being widely usable I think that we just have to accept a certain level of security risk when using mobile phones.

• [1] http://counternotions.com/2010/02/18/mini/
• [2] http://www.faluninfo.net/
• [3] http://etbe.coker.com.au/2009/05/31/lg-u990-viewty/
• [4] http://laforge.gnumonks.org/weblog/2010/02/13/#20100213-six_weeks_to_bcch

Update March 1st, 24 UTC: Reynaldo Verdejo is ok, the list is complete! Update March 1st, 16 UTC: Alejandro Vald s, Fabi n Arias, Carlos R os Vera and Germ n P o-Caama o have been in contact with others in Chile. Probably by now some of you know or are worried about the situation in Chile. I m not chilean nor in Chile but I ve been following closely due to the considerable number of good friends I have there, most of them related to GNOME.
From The Big Picture (AP Photo/Roberto Candia) Juan Carlos Inostroza (blog down) suggested I publish the list of GNOME/Free Software people in Chile that has reported since the earthquake and are fine, here it goes: Known, found and good:

• Andrea Orellana Palma
• lvaro Olivares
• Alejandro Vald s (updated 20100301 @16 UTC, via Felipe Besoa n)
• Adrien Bustany (updated 20100301 @16 UTC, via pvanhoof)
• Cristian Barahona G.
• Carlos R os Vera (updated 20100301 @16 UTC, via his sister on fb)
• Fernando Ruiz Altamirano
• Joo Anfossi Mardones
• Jorge Bustos
• Juan Carlos Inostroza
• Fabio Dur n
• Fabi n Arias (updated 20100301 @16 UTC, via Andrea Orellana)
• Felipe Andres Besoa n Pino
• Fernando San Mart n Woerner
• Germ n P o-Caama o (updated 20100301 @16 UTC, via Pablo Estef )
• Mario Gonz les
• Miguel Angel Ruiz Manzano
• Pablo Estef
• Pedro Villavicencio Garrido
• Ricardo Fuentes
• Reynaldo Verdejo (updated 20100301 @24 UTC, via Claudio Saavedra, Juan Carlos Inostroza)
• Sven von Brand
• Sebasti n Lara

Not know, nor found, we presume good but without cellphones:

• None

If you have been in contact with any of them, leave a comment, send a DM in twitter (@diegoe) and etc. List is not complete, I probably forgot someone, please remind me. Will update if I get news from anyone.

Diagnosis A few weeks ago I was referred to a specialist for the treatment of Carpal Tunnel Syndrome. I first noticed the symptoms in early January, it started happening at night with a partial numbness in the fingers of my left hand. I didn t think much of it at first as it s the expected symptom of sleeping in a position that reduces the blood flow. But when it kept happening with my left hand and never happening with my right and then started getting worse (including happening during the day) I sought medical advice. The doctor asked me to bend my hand down (as if trying to touch my left elbow with the fingers of my left hand). Within about 10 seconds this caused numbness this result from bending one s wrist is a major symptom of CTS. Treatment On Thursday I saw a specialist about this, she agreed with the GP s diagnosis and made a wrist brace for me. She started by cutting off a length of a tube of elastic woven material (similar to a sock) and then cutting a thumb hole, that became the lining. Then to make the hard part she put a sheet of plastic in an electric saucepan (which had water simmering) until it started to melt and then used a spatula to fish it out. The melting temperature of the plastic wasn t that high (it was soft at about 50C when she put it on my arm), it wasn t at all sticky when it was partially melted, and it didn t seem to conduct heat well. After wearing the wrist brace non-stop for a few days I have noticed an improvement already. Hopefully I will make a full recovery in a matter of a month or so, I will probably have to wear a wrist brace when sleeping for the rest of my life, but that s no big deal it s more comfortable to sleep with a wrist brace than a partially numb hand. I ve also been prescribed a set of exercises to help remove scar tissue from the nerves. I haven t done them much yet. In terms of being annoying, the wrist-brace has 3mm diameter holes in a square grid pattern with a 25mm spacing. This doesn t let much air through and in warm weather my arm gets sweaty and starts to itch. I m thinking of drilling some extra holes to alleviate this the part which makes my arm itch doesn t need much mechanical strength. The only task which has been really impeded has been making peanut butter sandwiches, maybe it was making sandwiches not typing that caused CTS? ;) In any case I m not giving up typing but I would consider giving up peanut butter sandwiches. I really hope to avoid the surgical option, it doesn t seem pleasant at all. Other One final thing to note is that Repetitive Strain Injury (RSI) is entirely different. RSI is a non-specific pain associated with repetitive tasks while CTS is a specific problem in one or two nerves where they go through the wrist. RSI apparently tends to reduce the effective strength of the afflicted limb, while milder cases of CTS (such as mine) cause no decrease in strength of course a severe case of CTS results in muscle atrophy due to reduced nerve signals, but I shouldn t ever get that. Many people think that RSI and CTS are essentially the same thing I used to think that until a few weeks ago when I read the Wikipedia pages in preparation to seeing a doctor about it. I want to obtain some of the plastic that was used to make my wrist brace, it could be really handy to have something that convenient for making boxes, containers, and supports for various things among other things it doesn t appear to generate static. The low melting temperature will prevent certain computer uses (the hot air that comes out of a cooling system for a high-end CPU would probably melt it), but it could probably be used to make the case for an Opteron system with careful design. I m guessing that the cost of the plastic is a very small portion of the $150 I paid to the specialist so it shouldn t be that expensive and I m sure it would be even cheaper if it wasn t bought from a medical supply store. If I ever get time to do some work on an Arduino system or something similar then I will definitely try to get some of this plastic for the case. Also the Wikipedia page has a picture of what appears to be a mass-produced wrist brace. I think that it might be improved by having the picture of the custom one that I wear added to the page. I unconditionally license the picture for free use by Wikipedia and others under the CC by attribution license. So if anyone thinks that a picture of my hand would improve Wikipedia then they can make the change.

• [1] http://en.wikipedia.org/wiki/Carpal_tunnel_syndrome

Debconf11 This evening, the final decision on which city will host Debconf11 next year will be taken. For the last half year, mostly Andreas Barth, Jan-Marek Glogowski and I have been working hard to make the Munich bid as good as possible. One thing we wanted to make clear from the beginning was that we would go for a conference in the city center - not some conference center in some nearby village or in an industrial area far away from where the city life happens. It was not easy, since the german-wide decision, we had to reshuffle venue plans a couple of times. In the end, thanks to Jan-Marek, we managed to get an excellent venue offer. Our bid consits mostly of:

• Venue: Computer Science building (recently built) of Munich University for Applied Science, we can get as much as we need, for free. The only thing we would have to pay for is additional security personell during the night.
• Network: Leibniz Rechenzentrum is the operator of the Munich Research Network (MWN), the venue is connected with at least 1 GBits fibre optics, and the MWN is connected to X-Win at the same speed. This will be free as well.
• Food: We can either take up the offer from the Studentenwerk, the organisation operating the university restaurants. Of course, the quality is not like in a Michelin-star restaurant, but I have eaten there for several years during my studies and it is on par with previous Debconf offerings. Alternatively, we could look into food catering.
• Accomodation: We tend to go for hostels, similar to Edinburgh, probably 4-6 bed dorms. Munich is pretty expensive for lodging, so this is something we decided early on to keep the costs reasonable. Again, I think this is in line with previous Debconfs. Of course, hotels at a broad price range are available.

The biggest strong points about Munich are, in my opintion:

• Our local team has lots of experience with Debian and Debconfs, as well as organizing conferences
• We have government support via the LiMux-project, and the city mayor of Munich, Christian Ude, has agreed to be the patron of the conference
• Munich is very easy to get to, both for european (via train or car) or american/asian attendees (via plane). The airport is one of the biggest in europe and has direct connections to e.g. Atlanta, New York, Boston, San Fransisco, Los Angeles, Sao Paulo and Tokio.
• Network connection via LRZ/MWN/X-WIN should be superb, especially to Debian machines hosted at euro

It the end, it seems Banja Luka seems to have the stronger bid, especially due to their 150000 EUR governemnt sponsorship. We will see who wins, I believe we did the best we could.

A good friend of mine convinced me to give "The Wire" a try. I've just finished season four of five. This is the best TV programme I have ever seen. I'd have a renewed faith in the TV industry's quality standards were it not for the fact it stands alone, quality-wise. Guardian columnist Charlie brooker says it best:

The Wire's so good, I've lost count of the number of people who've approached or emailed me just to thank ME for convincing THEM to watch it. The Wire's so good, I'm jealous of anyone who hasn't seen it yet, because they get to discover it anew. The Wire's so good, it's come to an end.

That last point is an important one. I'm only ten episodes away from it ending. As much as I'm going to hate reaching the end, I'm glad it will. I'm reasonably confident it will end with the same quality as it began: something which I can't say about Battlestar Galactica, for example. I wish I'd discovered "The Wire" sooner: I think you can learn a lot about relationship politics which can be applied to aspects of your own life. A word of advice to the folks who produce the boxed-set: a second set of Season One episodes would be very useful, as things stand I can only loan it out to one person at a time.

After some stability problems and an unresolvable PCI IRQ problem with my Debian server at home (Internet gateway, mail, PostgreSQL, LDAP and NFS server and test system), I decided to get a new mainboard and wireless card last week. I did some research to get hardware that is properly supported and where I can use the rest of my current components. I had

• a AM2 socket AMD Athlon64 3500+ CPU
• 2 1GB DDR2/667 DIMMs
• a ATX chassis
• an IDE Transcend 4GB SSD for my root partition
• 2 750GB SATA hard disks (software RAID-1)
• a Intel EtherExpress 100 Server PCI adapter (that I wanted to use to separate the internal and external networks but which did not work due to the above mentioned PCI trouble)

So I had to find a mainboard with at least 2 DDR2 DIMM sockets, an AM2 compatible CPU socket in ATX format with SATA ports at least one IDE Port, a Gigabit ethernet port (serving NFS home directories) and at least 2 PCI slots (one for the wireless card) that is well supported by the current Debian Squeeze Linux kernel. As I had some issues with the previous board's nvidia SATA chipset I wanted to get something else that is AHCI compatible. After some research I decided to buy a Gigabyte GA-MA74GM-S2H (rev. 3.0) which is available for a good price and fits all my criteria (2 DDR2 DIMM slots, 6 SATA ports, an RTL8169 based Gigabit ethernet ports, 2 PCI slots, ...). The mainboard uses an AMD 740G + SB710 Chipset. It has an integrated graphics chipset which I don't really need because I run the machine as a headless system. As I use the server as a wireless access point I need a wireless network adapter that supports AP mode. There are not many chipsets that are properly supported in AP mode and allow good data rates so I decided to get an Atheros ath9k based card, because I don't need non-free firmware like with broadcom based cards and could find some affordable hardware. The previous was a Netgear WG311 ath5k card that had issues that it lost its connection under more than minimum load and could only be reanimated by a system reboot. I looked at the Linux Wireless pages and found out that D-Link has a matching adapter the DWL-G520. Unfortunatelly they don't tell about the used chipset (as almost all other vendors too) and write about possibly changing hardware at the product sheet. To be sure I looked at their Windows driver's .inf files and found nothing indicating that there are any non Atheros variants of the card. I also ordered two Fantec MR-35 SATA mobile racks for more comfort when one of the RAID1 discs crashes (had 2 crashes last year) and a 12" chassis fan to keep the system cool. Today the package arrived and after unpacking and putting everything together I started the system (with keyboard and a display attached) to see how it works. All hardware was automatically detected by the current Debian Squeeze system and I only had to remove the entries for the old onboard network adapter and the old wireless adapter from /etc/udev/rules.d/70-persistent-net.rules and fix the device names for the new network cards. I added a new stanza for the Intel ethernet adapter in /etc/network/interfaces and setup a set of ferm rules to have a working firewall (thanks to Formorer for the suggestion to use ferm). After this was finished everything worked fine so far and I put the machine at its normal place without keyboard and display. To verify that the stability situation had really improved, I copied some huge files over the network (both wired and wireless and in both
directions). Afterwards I did a bonnie++ benchmark to test the SATA and hard drive reliability. Everything went well and I'm happy with my investment.

As part of some house-keeping I've been checking over my systems and ensuring they're all tickity-boo for the past couple of days. One thing that I'm getting increasingly tempted by is converting my kvm guest to a 64-bit system. I've not quite sold myself on the prospect of what will be a fair amount of downtime, but I'm 90% there. I do think that a lot of my setup needs an overhaul, for example:

• Running all my websites under www-data is beginning to worry me.
• Running services as root is beginning to make me more and more paranoid.

One possible plan is to wipe my system, and then restore data from backups. A perhaps saner approach is divide my guest into two smaller ones, and migrate services over one by one (e.g. website1, website2, .. websiteN, email, etc). For the moment I've taken a complete dump of my existing guest, and I'm running it with an IP in the 10.0.0.0/24 range on my desktop. That's at least given me a clear idea of the amount of work involved. I'm still a little unclear on how best to manage running N websites with the intention they'll each run under their own UID. I guess it comes down to having a few instances of nginx/lighttpd/apache and then proxy from *:80 to the actual back-end. Precisely which mixture of services to use is a little overwhelming. Though at some point soon I need to start enabling IPv6 support, and that changes things a little. (Not least because nginx has no IPv6 support present in the Lenny release - I've got a backported package which I run on the Debian Administration website.) It's possible I could hack mod_vhost_alias to redirect/proxy to a local port based upon the virtual hostname present in the request - that's pretty trivial and I've already done something similar for work purposes. Though something like that should presumably already exist? I would expect a map of some form:

example.org: 127.0.0.1:8080
example.net: 127.0.0.1:9090

That has to be about the minimum necessary information to make the decision; a pair of vhost name & local destination. /me googles some.. Update

OK quick update I've added local users for some of my sites, and now have them running under thttpd.

skx:/etc/thttpd# ls -ltr /home/www/   tail -n 4
drwxr-sr-x  4 s-static   s-static   4096 Jan 15 01:41 static.steve.org.uk
drwxr-sr-x  5 s-openid   s-openid   4096 Feb 16 21:31 openid.steve.org.uk
drwxr-sr-x  6 s-images   s-images   4096 Feb 16 21:52 images.steve.org.uk
drwxr-sr-x  5 s-packages s-packages 4096 Feb 16 22:03 packages.steve.org.uk

That seems to work well, with a small wrapper script to start N instances of thttpd instead of a single one. Minor issues are that I'm using mod_proxy to forward requests to the thtpd instances running upon the loopback - and it was initially logging 127.0.0.1 as the source IP. A quick patch later all is well. I'll leave it running a couple of the simple sites for the next few days and see if it kills children. If it does I'll convert the rest. Probably will aim to have nginx in front of thttpd, instead of Apache, but this way I don't have to worry about mod_rewrite rules just yet.

ObFilm: Cruel Intentions

Some of the participants of the BSP here in M nchengladbach asked me to put the blog post from blog.credativ.com on planet Debian. I think thats a great idea as the BSP was not only successfull, but also a lot of fun and it was very nice to meet a lot of Debian Developers and package maintainers. We were glad that so many people followed the invitation! So here we go - please leave your comments at the original blog post.

---

The 2010 Debian Bug Squashing Party turned out to be a great success: around 200 bugs were fixed, ready for the forthcoming version of Debian. The weekend of 22-24 January saw this year s Bug Squashing Party hosted yet again by credativ. The aim of the weekend was to find and fix bugs in the next Debian release. The results were as follows: Altogether that gives a grand total of 200 bugs. In addition, information was gathered on a further 100 bugs, which will help when they come to be fixed. A lot of time was also spent on quality assurance, an under appreciated but very important job. More gossip: it is rumoured that backports.org is not far off becoming an official Debian project and in the meantime it will be launching a brand new website running on ikiwiki. Our guests from far and wide were more than happy with the BSP party: Steve McIntyre: (Debian project leader)

Thanks to the folks at credativ for hosting and participating in the BSP - we got a huge amount of work done towards the next release and had a great time doing it!

Stefano Zacchiroli:

My 1st M nchengladbach BSP, won t be the last! Lots of cool people and hacking, and I ve enjoyed my 1st traditional Formorer s chilli too :).

credativ would like to thank all those who came and got involved - now you can lean back, relax and enjoy the photos of the event.

Yesterday I stumbled upon an interesting and broken behaviour of Django: Running two instances with the same memcached as cache backend might result in displaying the wrong template from the cache in case we have template files with the same name but a different content. This behaviour is also visible in all django applications which use the cache backend without taking care of settings.CACHE_MIDDLEWARE_KEY_PREFIX. As mentioned in the bug report a design decision is necessary here, as the setting was only supposed to be used in middlewares. On the other side not honouring the setting everywhere makes it impossible to use different (unrelated) Django instances with one memcached. While this is not such a big issue for template data, it should be - for example - possible to insert faked django CMS user permissions into memcached as they are cached there, too. One possible solution is to ensure that settings.CACHE_MIDDLEWARE_KEY_PREFIX (or a similar setting with a better name) is used for every access. Using the following snippet as custom cache backend ensures this. Additionally it is much harder to insert faked cache content by using a md5 hexdigest as key. Although you should never store sensitive data in memcached - if you need to cache such data, use locmem, file or db as cache backend, as they allow to limit access to the data properly.

from django.conf import settings
from django.core.cache.backends.memcached import CacheClass as DjangoMemcachedCacheClass
from django.utils.hashcompat import md5_constructor
class CacheClass(DjangoMemcachedCacheClass):
    def __init__(self, server, params):
        self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX
        super(CacheClass, self).__init__(server, params)
    def _genkey(self, origkey):
        return md5_constructor("%s:%s" %(self.key_prefix, origkey)).hexdigest()
    def add(self, key, value, timeout=0):
        return super(CacheClass, self).add(self._genkey(key), value, timeout)
    def get(self, key, default=None):
        return super(CacheClass, self).get(self._genkey(key), default)
    def set(self, key, value, timeout=0):
        return super(CacheClass, self).set(self._genkey(key), value, timeout)
    def delete(self, key):
        return super(CacheClass, self).delete(self._genkey(key))
    def get_many(self, keys):
        return super(CacheClass, self).get_many(self._genkey(key))
    def incr(self, key, delta=1):
        return super(CacheClass, self).incr(self._genkey(key), delta)
    def decr(self, key, delta=1):
        return super(CacheClass, self).decr(self._genkey(key), delta)

The meeting agenda is already posted for tonight s (Wednesday s) SPI board IRC meeting which will be at 2000 UTC (an hour earlier than last month, back at usual time). It s another pretty lean meeting and I don t know why. Last month s comments suggested SPI needs better marketing, which has come up in the comments here before. There s a wish to switch the SPI website to git and ikiwiki which would allow more members to contribute. As I understand it, anyone can set up the git repository and ikiwiki, then announce it to spi-general (or spi-www) and start to port the website. I ll probably get there eventually (after porting Cooperatives-SW and NSCycle websites to django), but if you have a bit of time and would like to help this democratic free and open source software charity, please beat me to starting and tell me where to find your work!

Finally, I got my notebook working again. It seems a full Gnome installation isn t exactly what my old MacBook needed. So it lay around for weeks, or rather months now, not being used for anything remotely relevant to anything. After all I then decided to get rid of Gnome at least on the notebook and instead installed LXDE what can I say? It s amazing. Removing all the stuff I don t need anyways on this system (even the pbuilder/cowbuilder stuff is gone) made it really fast again. I m happy now and the vacation can come with my notebook at hand, since it s running again. Yet that s actually not what I wanted to write about. After a three week break due to illness (and, I admit, bad weather although it still is pretty snowy and icy outside) I m back on the track. And it wasn t even that bad. Of course I m not back on the level I had before but at least it s about 5.5 km in 35 minutes. For a beginner who just had a forced break from training, I m quite satisfied with myself. So, I m running again. Yay!

As you might have read, we do have automated rejections of packages uploaded to the Debian archive, based on lintian, for some time now. Today, triggered by some other thing, I got some numbers out of that. Pretty much waste of time, but fun to look at, so here it goes:

• November 2009 had us rejecting 36 packages, the winner triggered 425 tags on which we would reject. Place 2 went to a package that triggered 128 tags, place 3 had 26.
• December 2009 saw 24 packages not going through, with the winner triggering 50 tags, place 2 followed with 23 and the third place actually went to two packages, both triggering 5 tags.
• January 2010 said goodbye to 20 packages. The winner here leads with 2055 tags triggered, place 2 goes to a package triggering 46, place 3 is held by one having 16 tags.

(Of course for tags that can appear multiple times like binary-or-shlibs-defines-rpath they are counted multiple times). (And for a grin: October 2009 had 10 rejects, 7 of which false positives while testing the code, one a test package made especially to get rejected and 2 real hits, with one tag each.)

The following developers got their Debian accounts in the last month:

• Jakub Wilk (jwilk)
• Axel Beckert (abe)
• Vagrant Cascadian (vagrant)
• Albert Huang (ash)
• Iustin Pop (iustin)
• Thorvald Natvig (thorvald)
• Marco Silva (marcot)
• Marcelo Vieira (metal)
• Thorsten Glaser (tg)

Congratulations!

mixi android client notes. I am using the unpublished API from Mixi to access mixi, which uses atom publishing protocol (?) with WSSE authentication. The plan was to switch to Mixi Connect with OAuth, however I have not yet heard back from them although they were supposed to have released their protocol about a year ago, and found a security issue.

My dear Ubuntu, I think the time has come that I make a confession. You may be wondering why I haven t spent much time with you those last months, and you have the right to know. The case is, I have another one. She s called Debian. No, it s not because of you. It s also not because of your parents; while they aren t perfect, they are great in many ways and I certainly don t want to run away from then. Just wait and let me explain this. You surely remember that I spent a week with her some time ago? Well, now that I want to join Debian s family, I decided that after all that wasn t much time to get to know here, so I gave her another chance, and with this second experience I fell in love with her unstable character. Ubuntu, you are really extraordinary, and I m still telling anyone who wants to listen about your wonders, but you just can t appease my desire for trying out new things as well as Debian does. Now, this doesn t mean we won t see each other anymore. I ll still take you with me whenever I travel, and I ll continue helping you with the household. In fact, all this wouldn t signify a big change at all, if it wasn t that at the same time I also decided to refocus most of my efforts on raising children, which is what really reduced the time I spent helping you. So, while currently I m not seeing you as much as before, I hope you all the best, and I ll still try to help you advance, be it indirectly (1, 2) or, while probably to a lesser degree, continuing with direct contributions. By the way, hello Planet Debian!

---

3 comments
Siegfried-Angel Gevatter Pujals, 2010. Permalink License Post tags:

My dear Ubuntu, I think the time has come that I make a confession. You may be wondering why I haven t spent much time with you those last months, and you have the right to know. The case is, I have another one. She s called Debian. No, it s not because of you. It s also not because of your parents; while they aren t perfect, they are great in many ways and I certainly don t want to run away from then. Just wait and let me explain this. You surely remember that I spent a week with her some time ago? Well, now that I want to join Debian s family, I decided that after all that wasn t much time to get to know here, so I gave her another chance, and with this second experience I fell in love with her unstable character. Ubuntu, you are really extraordinary, and I m still telling anyone who wants to listen about your wonders, but you just can t appease my desire for trying out new things as well as Debian does. Now, this doesn t mean we won t see each other anymore. I ll still take you with me whenever I travel, and I ll continue helping you with the household. In fact, all this wouldn t signify a big change at all, if it wasn t that at the same time I also decided to refocus most of my efforts on raising children, which is what really reduced the time I spent helping you. So, while currently I m not seeing you as much as before, I hope you all the best, and I ll still try to help you advance, be it indirectly (1, 2) or, while probably to a lesser degree, continuing with direct contributions. By the way, hello Planet Debian!

---

4 comments
Siegfried-Angel Gevatter Pujals, 2010. Permalink License Post tags: Debian, Programari lliure, Ubuntu

Nobody cares about me, I thought. Whatever I say is just like throwing a bottle to the infinite ocean. No comments, no hopes of getting any, for several days. Weeks maybe? Not even the spammers cared about me. Until I read this mail, by Thijs Kinkhorst commenting to my yesterday post:

( )
(BTW, I was unable to comment on your blog - couldn't even read one letter of the CAPTCHA...)

And, yes, Drupal module captcha introduced in its 2.1 release (January 2) feature #571344: Mix multiple fonts. Only... no fonts were selected. Grah.

Kiwis have to be one of the cutest birds of all time. A bit chubby and clumsy looking, they are (to me, at least), walking, breathing icon of furry cuteness. Truth be told, I did not see one live in action during my recent trip to New Zealand, but I did see a Weka bird which is pretty similar. (Micah and I just consulted the Internets and agreed that we did in fact see cherubic Kiwi not a Weka. In fact, Micah almost ran one over on the west coast of the southern island but his quick reflexes born from years of saving servers while typing saved the bird. So as you can tell by now I finally got to go to New Zealand for a few weeks, even able to travel the south island before attending THE Linux conference of the region, LCA where I gave a talk (video to be posted when available). I jumped at the opportunity and was thrilled to find out that I could actually spend some time traveling around before the intense week long conference. So on January 5th I headed down with Micah to what I have found out is one of the windiest cities on earth ( Windy Wellington ) for a few days before heading to the south island to do a loop on the northern half of the island. I wanted to conquer the mountains made famous by a certain set of movies, but last semester was all about sitting in front of the computer, a sort of agonizing life of the mind, which did not prepare me physically for mountain trekking or as it call it there, tramping. So we decided to stick close to the coast (with one transalpine train that serenaded us through some awesome mountain passes) and hike along the coast, snorkel and swim, and kayak. After Andrew showed us around Wellington, we headed to the sea town of Kaikoura brimming with sea life, such as seals, dolphins, and birds. The two highlights there were our snorkeling trip and a hike along the peninsula. Originally we were going to go diving but I arrived to NZ with a head cold so we opted for the sinus friendlier version and snorkeled in the massive kelp forest, which was strikingly beautiful (I am used to tropical reefs and waters). There happened to be a lot of seals and given their curious nature, they would dart over right next to you and play. One seal I called him the twirler was chubby and mellow and twirled next to me for a long while. The lady seals were sleeker and faster and liked to dive deep down and the zoom up and surprise you. As someone who has spent a lot of time underwater, I found it fun and weird to be with animals that pay attention to you given that most of the sea life ignores you. The hike in Kaikoura was fantastic as well. You go high on a bluff and stare down at this water sparkling with the most beautiful blue hues brought out even more majestically by the white rocks. If I were to go back I would hike along the water and up above on the bluff. After a brief stopover in Christchurch to visit a friend, we took the transalpine train (across Arthur s pass) which was superbly beautiful and arrived on the west coast whose seas are far more rough, rocky, andtemperamental than on the east coast. The vegetation is lush as lush can be and you get the feeling that dinosaurs would have been a happy lot in these parts. The cool part about this area are the many rivers that feed into the ocean (we spent an afternoon swimming and exploring the caves in one) and then what are called the pancake rocks, which are odd geological creatures that really amaze. We then made our way to the Marlborough Sounds area, which includes the city of Nelson (apparently the sunniest in New Zealand) as well as many olive and grape vineyards in outlying areas. We spent some time in the Alpine lakes region hiking but more of the time on the coast. The highlight for me and it is a place I would love to go back to is the Abel Tasman National Park. We spent time hiking and kayaking there and you can even hike down the coast for 5-6 days (there are excellent camping facilities along the way). The coast is simply majestic with alpine like forest conditions (unfortunately a cool old tree whose name I can t remember is no longer common). This forest is situated along the most stunning waters, an electric but totally clear turquoise blue deceivingly inviting because the water was quite cold (but not as cold as the Oregon coast over the summer, which I went swimming in only once after weeks of bike travel). Along with the blue, parts of the coastal waters were a stunning clear green that I have never seen despite my many sea travels. If you ever plan on going to the South Island, I would not miss this area and might even try to spend a few days or more hiking the coastal trails and listening to the cool-as/sweet as birds, one of which has double vocal cords so it sings what sounds to be like totally electronic bird calls. We returned via the same ferry a massive 7 story ship from Picton to Wellington but the conditions were far far worse during our return trip. When we got out of the sounds, we hit the Cook Straight, notorious for being rough and tumble. And indeed, once we hit the waves, I felt like I was no longer in a boat but amusement park ride, the bow of the ship thrown high only to fall hard on upon the waves. It was sort of fun or fun for about 10 minutes until people, most especially kids, started yaking all over the place. It was really the most flagrant yakfest I have ever experienced (I mean it is a 7 story ferry, you can fit a lot of people on that boat) and that made the sail particularly difficult. I have pretty strong sea legs, never once getting sick sick during the year I spent at sea but massive yaking will bring out the sea sick feeling in even the hardiest of sea souls and I was thrilled to arrive in Wellington. Wellington is the only large city I spent any considerable time in and it is a pretty awesome one. The city center area is flat and by the water, with a magnificent area filled with museums, the national library, parks, breweries, and piers where kids like to jump off high things. The botanical gardens were the most beautiful I have been to and since I am a flower nut, I was in high heaven. In this area there are a ridiculous number of great coffee shops (NYC has a thing or two to learn as we don t have enough, I suspect it has something to do with insane real estate prices). The city is surrounded by hills populated by houses, some of the precipitously perched on cliffs that require lifts to get to! It was a wonderful home base for what was a sweet as conference (as they would say down there). And I hope to write about it sometime soon.