Search Results: "ag"

15 June 2012

Thorsten Glaser: Tricks for dealing with modern-day X.org

KiBi is my hero of the day. I ve long wondered why I couldn t select fixed-misc as font on my workstation at the dayjob, which is running Kubuntu Hardon Heroin. (Luckily, I managed to avoid upgrading to Prolonged Pain.) Now I guess that ll work again. My work laptop (running testing) also has got this X.org thingy. My keyboard layout now has got a grml branch (named after the person who first cursed about the insane idea of those toy-breaking boys to rearrange the keycodes) that works with it. Since Debian is marginally more sane than Kubuntu, in contrast to the gnu branch I use on my orkstation, the grml branch still has Meta on the left Alt key, not Mode_switch, as it still works in uxterm, which reduces the diff between the MAIN branch (HEAD) on XFree86 and this beast.

And finally: X.org defaults to a black screen and disabled mouse pointer until an application first requests it. Totally unacceptable for evilwm(1) users, and letting people think it crashed, to boot. The Arch Linux guys found this, among others; the fix is: startx(1) users edit /etc/X11/xinit/xserverrc to add -retro behind the X, or copy the file to ~/.xserverrc and change it there:

	#!/bin/sh
	exec /usr/bin/X -retro -nolisten tcp "$@"

For display managers,similar files exist in /etc/kde4/kdm and related places.

John Goerzen: Windows & a dying hard disk: Solving with Linux

Today, my workstation sent me this email:

The following warning/error was logged by the smartd daemon:
Device: /dev/sda [SAT], 1 Currently unreadable (pending) sectors

and then a little later, this one:

The following warning/error was logged by the smartd daemon:
Device: /dev/sda [SAT], 1 Offline uncorrectable sectors

From the hard disk s SMART data, this is a clue that the drive is failing or will soon. Sigh. Incidentally, if smartmontools isn t installed on your machine, whether it s a laptop, desktop, or server, it should be. Although most of you know I run Linux on the metal on my machines almost exclusively, I do maintain a small drive with a Windows installation that I boot into every few months for various reasons. This is that drive. The drive is non-redundant (no RAID), and although it is backed up, the backup is made via backuppc from the NTFS filesystem mounted on Linux, and is a partial backup backing up certain data, not the OS. There are, of course, bare metal Windows backup solutions, but I generally don t want to back up Windows from within Windows on this machine. Restoring Windows isn t quite as simple as an mkfs, an untar, and a grub-install, either. So my first thought is: immediately save whatever of the drive I can. So I ran apt-get install gddrescue to install the GNU ddrescue tool. ddrescue is somewhat similar to dd, but deals much more intelligently with bad blocks on the drive. It will try to read them repeatedly, with decreasing block sizes, in an effort to get every last good byte off the disk that it can. If it ultimately fails to get certain bytes read, it will write placeholder data to the output file in place of the missing data, so that the output file maintains proper size and alignment. It also saves a log file that notes what it found (see info ddrescue for more on that.) So I created an LVM volume for the purpose (not enough free space on /home, and didn t want to have to shrink it somehow later), and ran:

ddrescue /dev/sda /mnt/sdasave.ddrescue /mnt/sdasave.logfile

Then I went to dinner. When I got back, I discovered there were 1 or 2 bad sectors, about halfway through the disk, but everything else was fine. So now, the question became: did I lose any data? If so, what? I needed to know if I had to revert to a backup for anything or not. To answer THAT question, first I had to figure out the offset of the bad spots on the disk. That s not too hard; the logfile gives it to me:

# Rescue Logfile. Created by GNU ddrescue version 1.15
# Command line: ddrescue /dev/sda /mnt/sdasave.ddrescue sdasave.logfile
# current_pos  current_status
0x3BBB8BFC00     +
#      pos        size  status
0x00000000  0x3BBB8BF000  +
0x3BBB8BF000  0x00001000  -
0x3BBB8C0000  0x38B5346000  +

what we see is that the bad sector starts at byte 0x3BBB8BF000 (256549580800 decimal) and extends for 0 1000 bytes (4096 decimal). Both the drive and NTFS use 512-byte sectors. So dividing by 512, we get sector 501073400 501073407 (4096 bytes is 8 sectors). As a check, I ran grep sector /var/log/kern.log and turned up a bunch of lines like this: Jun 14 21:39:11 hephaestus kernel: [35346.929957] end_request: I/O error, dev sda, sector 501073404 Which is within my calculated range. But this is an absolute sector on the disk. We need the sector within the partition, so for that, we have to enlist fdisk to make that calculation. fdisk shows, among other things:

Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048   976771071   488384512    7  HPFS/NTFS/exFAT

So the Windows partition starts at disk sector 2048. Let s just confirm that. If I use dd if=/dev/sda1 bs=512 count=1 hd head, I see a line beginning with .R.NTFS . Exactly the same as with dd if=/dev/sda bs=512 count=1 skip=2048 hd head, so I read the partition table information correctly. Subtract offset of 2048 from the earlier values, and I get relative sectors 501071352-501071359. That s enough to get some solid info from the filesystem via ntfscluster, part of Debian s ntfs-3g package. I pass -s to it, and ignoring some irrelevant stuff, get my answer:

ntfscluster -s 501071352-501071359 /dev/sda1
Inode 190604 /System Volume Information/ b4816feb-b609-11e1-a908-50e549b934f7 3808876b-c176-4e48-b7ae-04046e6cc752 /$DATA

I even reran it with a much larger sector range, just to be absolutely sure I had wiggle room in case calculations had an off-by-one error or something somewhere. This is really great news, because the file in question is pretty much useless I believe it s a system restore point, which I won t be needing anyhow. So at this point, all that remains is to reinstall this on a different drive. For that, I could just use my ddrescue image. I thought I would take a second image, just to be very extra careful, and use that; I used:

partclone.ntfs --rescue -c -s /dev/sda1 -o sda1.partclone

although ntfsclone would work just as well. This captures only the partition; I ll need the partition table as well, and perhaps also the space between the partition table and the first partition. I could capture it separately with dd, but it s already in the ddrescue image, so there s no need. (GRUB is installed on this drive, but there is no Linux filesystem on it, so it may well exceed the size of the MBR). Note that for Linux ext[234] filesystems, debugfs can provide the same (and more) info as I got from ntfscluster. I happen to have a drive of the right size sitting here, which I was about to install in a different machine. So a wipe and a swap and a restore later, and I should be good to go. This scenario is commonplace enough that I thought I d post how I dealt with it, in case anyone else ever has hard drive issues.

Paul Tagliamonte: debtree.pault.ag - my latest toy

I ve pushed up some code (named familytree) to my GitHub, which lets folks browse the social connections that make up Debian. Many thanks to the number of people who gave me feedback (arno, luca, algernon (at least!)) Y all rock! I ve taken the dump of information from nm.debian.org, and rendered it out into four datasets.

Advocations for a person
People who one has advocated
If the person is a Debian Developer Emeritus
Who a person has AMd for

Mashing this up with an example d3 page, I ve come up with what I m calling debgraph . Here are some notable examples that I think are rad :) By the way - green lines indicate sponsorship, black lines indicate sponsors, and dashed lines indicate AM-ing. Tan nodes are DD-emeritus, and blue is active. I don t think this handles MIA correctly. Anyway, here it is: Me! (paultag)

Algernon

tbm (OK, this one is massive, I ve scaled it down a skitch old computer warning, it ll peg your CPU!)

zack

Matthew Garrett: No, really, secure boot does add security

Carla Schroder wrote a piece for linux.com on secure boot, which gives a reasonable overview of the technology and some of the concerns. It unfortunately then encourages everyone to ignore those legitimate concerns by making the trivially false claim that secure boot is just security theatre.

Security isn't some magic binary state where you're either secure or insecure and you can know which. Right now I'd consider my web server secure. If someone finds an exploitable bug in Apache then that would obviously no longer be the case. I could make it more secure by ensuring that Apache runs in a sufficiently isolated chroot that there's no easy mechanism for anyone to break out, which would be fine up until there's also a kernel exploit that allows someone to escalate their privileges enough to change their process root. So it's entirely possible that someone could right now be breaking into my system through bugs I don't even know exist. Am I secure? I don't know. Does that mean I should just disable all security functionality and have an open root shell bound to a well known port? No. Obviously.

Secure boot depends on the correctness of the implementation and the security of the signing key. If the implementation is flawed or if control of the signing key is lost then it stops providing security, and understanding that is important in order to decide how much trust you place in the technology. But much the same is true of any security technique. Kernel flaws make it possible for an unprivileged user to run with arbitrary privileges. Is user/admin separation security theatre? SSL certificate authorities have leaked keys. Is it security theatre for your bank to insist that you use SSL when logging in?

Secure boot doesn't instantly turn an insecure system into a secure one. It's one more technology that makes it more difficult for attackers to take control of your system. It will be broken and it will be fixed, just like almost any other security. If it's security theatre, so is your doorlock.

Why is this important? Because if you tell anyone that understands the technology that secure boot adds no security, they'll just assume that you're equally uninformed about everything else you're saying. It's a perfect excuse for them to just ignore discussion of market restrictions and user freedoms. We don't get anywhere by arguing against reality. Facts are important.

comments

Cyril Brulebois: Fixed!

A while ago, I used to use the Fixed font, which I very much liked, since it featured a quite decent Unicode coverage, and was available in tiny sizes. Then time passed, I switched systems a few times and it kind of disappeared. Terminus is also nice, but quite bigger (for a given terminal geometry, 60 lines for Terminus, 72 for Fixed). Today, wondering why some fonts I dropped in ~/.fonts weren't picked up by fc-cache -rv ~/.fonts/, I found out a configuration file was preventing fontconfig from considering them: /etc/fonts/conf.d/70-no-bitmaps.conf Kill it with fire, and tada: Fixed is back!

14 June 2012

John Goerzen: How to debugging Linux failure to resume from suspend?

I m running a computer with a Gigabyte Z68A-D3H-B3 motherboard, and have never been able to get it to properly resume from suspend to RAM in Linux. It has worked fine on the rare occasion I ve tried it in Windows 7. My somewhat limited usual for debugging aren t particularly helpful. The system appears to suspend perfectly fine. It just doesn t resume. To be more precise, when I push the button to resume, the power comes up (fans whir, HDD spins up, etc.) but nothing happens. The USB keyboard and mouse don t respond, Caps Lock doesn t toggle any LEDs, it doesn t respond on the wired LAN, and the display stays off. Although it s a desktop, I d really like to save power on this thing by suspending it when it s not in use. There s no sense in wasting power I don t need to be consuming. I ve tried what I used to try on laptops. I tried running in single-user mode, without X, or even the kernel modules for video acceleration loaded. I tried unloading whatever hardware modules I thought I could without completely destabilizing the system. I updated the BIOS to the latest release. I tried various combinations of video tweaks. I tried using s2ram from uswsusp instead of pm-suspend. Nothing made any difference. They all behaved exactly the same. Googling showed a lot of resources for people that had trouble getting their machines to go to sleep. And also for people whose machines would wake up but just wouldn t re-activate the display. But precious little for people with my particular symptoms. What s a good place to start looking to fix something like this? Some details CPU is Core i5-2400. Kernel is wheezy s 3.2.0-2-amd64, though this problem has persisted as long as I ve had this machine, which was running squeeze at install time. Video is NVidia GeForce GTX 560 (GF114). Hard drives are SATA, Ethernet is integrated RTL8111/8168B. Userland is up-to-date amd64 wheezy.

Sorina Sandu: Testing

Hello!

Here comes my short post on the blog for this week :D

Thinks are going better now, in the last days, I have done some testing and I do believe that now I should not have anymore problems with debconf and that I am on the right way. What I have tried was to scan the wireless interface and list all the available networks names. After that I have tried to do this while using debconf to display the messages. Everything worked just fine for this part, but it took me a while to figure out how to scan the interface. Now I think I've got it.

I have done separate tests for cdebconf and scanning and after that merged them into a third test, containing the scanning part with some basic, very simple templates just to get an idea of how it should/could look in the end. It's not in its final version yet, but I think it will work.

I have pushed all my attempts into some personal repository on github, but do not expect much, those are just some tests. You can find it here [1].

[1] https://github.com/sorinasandu/testing

Russell Coker: The Financial Value of a University Degree

I ve read quite a few articles about the value of a degree. Most of them come from the US where the combination of increasing tuition fees and uncertain job market makes a degree seem like a risky investment. I think that most analysis of the value of a degree are missing some important points. The Value of Money at Different Times The value of money is different at various stages of your life. The impression that I get is that when a married couple have their house fully paid off and they either don t/won t have children or their children are old enough to leave home the amount of money that they earn seems to matter a lot less. Doing a university degree involves 3 or 4 years not earning money (or more if doing post-graduate studies), which is usually starting at the age of 18. Effectively getting a degree involves giving up some money while young for the opportunity to earn more when older. Any analysis based on directly comparing the money spent on the degree to the amount of financial return without considering when money is needed is not very useful. I think that a reasonable analysis would exclude income earned after the age of about 45. By that age most people have either achieved a solid financial position and learned to live within their means or messed up their finances so badly that they won t live long enough to recover. A Degree as a Signal The Wikipedia page on economic signalling gives education as an example of a signal. A signal in this case means something that doesn t inherently mean anything but which signifies something else. So completing a degree doesn t necessarily mean that you learned anything relevant to work, but if you are able to do it then it means that you can probably also do things which are economically useful for an employer. This raises the question of how else one might signal their ability to work. One obvious answer is by working, someone who has remained steadily employed for 3 or 4 years has demonstrated their ability to work reliably and get along with other people which should be at least as useful as a signal. It s Not Only the Degree Most analysis seem to compare average income of people with degrees with the average of income with people who didn t attend university. That is based on the assumption that the degree was the only difference. When I was young my parents spent a moderate amount of money on a full set of paper encyclopedias (about 2 meters of shelf space). I m sure that this gave me some educational benefit as they intended, and it was something that was apparently quite rare I don t recall seeing a full encyclopedia in anyone else s house before the Wikireader [1]. My parents also bought me quite a lot of computer gear (back when hardware was really expensive), were always available to drive me to computer users group meetings etc, and did everything else that seemed likely to have an educational benefit. The value of such learning opportunities is significant. I think that almost everyone who had similar learning opportunities to me when they were young will probably have experienced similar support and pressure to attend university. I also think that almost everyone who receives such opportunities will be able to earn more than the median income even if they don t attend university. To a large extent people who are going to be successful attend university. A university degree doesn t make anyone successful if they couldn t succeed without a degree. There are some careers that just aren t options if you don t have a relevant degree (such as medicine and law). But I believe that anyone who is capable of completing a difficult course such as medicine or law (or any other career that has legal requirements for a degree) is capable of being successful without a degree in many other fields. So comparing the wages of a doctor or a lawyer to an average person doesn t make sense, it makes more sense to try and compare their wages to someone of similar skill who didn t have such a qualification. Conclusion It seems to me that the question is, of the people who had great learning opportunities when they were young and who wanted to succeed, would they have earned much less if they hadn t attended university? The next question is, of the people who might earn significantly less without getting a degree, would that salary difference really have mattered, or would it just be a matter of earning some luxury money when they are too old to really need it?

[1] http://etbe.coker.com.au/2010/11/25/the-wikireader/

Ideas for a Home University There seems to be a recent trend towards home-schooling. The...
university degrees Recently someone asked me for advice on what they can...
Microsoft Hires University Drop-Out for Recruiting Campaign news.com.au reports that MS has hired former Miss Australia Erin...

13 June 2012

MJ Ray: Bibliohack London

Well this isn t Edinburgh. This is London calling. More from kohacon later.

Today I was at OKFN s bibliohack . There were several interesting projects there and it was a good opportunity to get back into coding, metadata and APIs after thinking about conference practicalities for too long. BibSoup and its biblioserver software was my chosen hack. I didn t really make the most of it because I had to workaround broken wifi drivers that I hadn t noticed before, and I had to fix a broken java install that I did know about. BibSoup is mostly python and I think web.py, but it uses elasticsearch which is java. Oh and it s python 2.7 with virtualenv which is, erm, entertaining to get working on debian 6.0, as far as I can tell: I installed python2.7 from testing, backport python-virtualenv and I don t think anything broke. The approach to a hackfest was very different to kohacon s. Whereas people at kohacon hackfest were gathered around tables, moving to the talks table(s) when there was a talk they wanted, bibliohack started off classroom-style and didn t gather into workgroups until after coffee. The so-called non-coders were shunted off elsewhere after the welcome to do I-don t-know-what (maybe Library Co-op will write about it) and weren t seen again until the day s end. There were some nudging comments about being able to hack late into the night, which I m not sure is healthy if you ve done a full day. I left feeling a bit unsettled and disconnected from reality, although I got what I wanted from it playing with some new tech that we can maybe do good things with: thanks OKFN!

Paul Tagliamonte: Poshto: an update

I ve been working on Poshto a bit, and after a few shots at getting it right, I ve started another rewrite. The code started getting pretty krufty, so a rewrite was in order. To keep a clear head, I ve also removed all the front-end code I had. I m breaking it into a sync routine and a front-end. It s seeming to work OKish so far, but hopefully there will be even more progress soon.

12 June 2012

C.J. Adams-Collier: pki via IPv4 is back online

It turns out I didn t have IP forwarding turned on in my shorewall config and so DNAT wasn t working. Oops. You should be able to get to the HKP, ntp, RADIUS and kerberos servers now via IPv4. IPv6 was working before now. Sorry for the outage! http://pki.colliertech.org:11371/pks/lookup?op=vindex&search=0x8E562765BA27A83C

Bernd Zeimetz: bug squashing party in Salzburg

Just as a little reminder, the Bug Squashing Party in Salzburg will start in three days. We still have sponsored accomodation for ~~five~~ four people left, so don't hesitate to come! Squashing as many RC bugs for Wheezy as possible is on the TODO list for the weekend! Also we'll work on making Debian a proper Spacewalk client. This might be a bit too late for Wheezy, but there will be backports

See YOU in Salzburg!

Brett Parker: Mira Grant - Countdown

Hmm, so, at the end of Deadline, there appears to be the first chunk of the novella Countdown - and a notice "If you enjoyed Blackout look out for Countdown, an ebook only Newflesh novella also by Mira Grant" - it then seems to have the first chunk of that in print, I'm reasonably certain that it's not the full novella (it doesn't end cleanly enough for that). Now, last year (way back when Countdown was originally announced I commented asking when the UK release was going to happen for it (there's a US release, after all) - that was August 2nd 2011 - 10 months later, we've still not got any news on the UK release, and now we've even got a teaser at the end of Blackout. There's also notes that there's going to be some more novella for the series soon - which will be fantastic, if we ever get them in the UK :/ Ah well, hopefully we'll get it soon!

11 June 2012

Aigars Mahinovs: New camera research

So, I was reading the coverage of the newly announced Canon 650D last week and it so happened that a friend needed a camera, so I sold my old Canon 550D and started looking for a replacement. For the last few years 95+% of the photos I have taken were with Canon 35mm f/2.0 lens on my Canon 550D, sometimes helped with a bounce&swivel flash. Which is very close to 50mm in full-frame equivalent. So I am looking to continue shooting in a similar way with a near-50mm prime lens and sometimes with bounce flash. As a given I have: Canon 35mm f/2.0, Canon 50mm f/1.8, Canon Speedlite 430EX II (bounce&swivel flash) and a budget of around 1k USD. It is a fun time to be looking around for a new camera body, so I found that I have many interesting options: Option 1: safe bet. Wait a bit and get the new Canon 650D body and continue shooting with the 35mm and the Canon flash. Pros: safe, new tech, good video. Cons: rather bulky and heavy, boring. Option 2: old school. Get a used Canon 5D Mark II body that pros are selling off to buy their Mark III and then start taking photos with the Canon 50mm f/1.8 lens and the Canon flash. Sell Canon 35mm f/2.0 to cover the price difference between bodies. Pros: full frame, higher resolution, huge viewfinder. Cons: very heavy and bulky, evolutionary dead-end, used, bad corner performance even with best lenses. Option 3: new wave. Sell the rest of my Canon stuff and buy into one of the new mirrorless cameras. The problem with this approach is that I can not find a mirrorless camera with all of: 18+ Mpix, sharp and fast near-50mm-equivalent prime autofocus lens, bounce&swivel external flash. Pros: light and small, new tech, funky. Cons: lens fragmentation, bad adapters (no AF), bad flashes. So, basically I am torn three ways. Any advice? Which mirrorless camera system would best match my needs? P.S. Due to work issues and the long distance, I am *not* attending this years Debconf.
P.P.S. To keep this slightly more on-topic how is the RAW files support on Linux for the new crop of the mirrorless cameras?

Petter Reinholdtsen: Debian Edu - some ideas for the future versions

During my work on Debian Edu based on Squeeze, I came across some issues that should be addressed in the Wheezy release. I finally found time to wrap up my notes and provide quick summary of what I found, with a bit explanation.

We need to rewrite our package installation framework, as tasksel changed from using tasksel tasks to using meta packages (aka packages with dependencies like our education-* packages), and our installation system depend on tasksel tasks in /usr/share/tasksel/debian-edu-tasks.desc for package installation.
Enable Kerberos login for more services. Now with the Kerberos foundation in place, we should use it to get single sign on with more services, and avoiding unneeded password / login questions. We should at least try to enable it for these services:
- CUPS for admins to add/configure printers and users when using quotas.
- Nagios for admins checking the system status.
- GOsa for admins updating LDAP and users changing their passwords.
- LDAP for admins updating LDAP.
- Squid for users when exam mode / filtering is active.
- ssh for admins and users to save a password prompt.
When we move GOsa to use Kerberos instead of LDAP bind to authenticate users, we should try to block or at least limit access to use LDAP bind for authentication, to ensure Kerberos is used when it is intended, and nothing fall back to using the less safe LDAP bind
Merge debian-edu-config and debian-edu-install. The split made sense when d-e-install did a lot more, but these days it is just an inconvenience when we update the debconf preseeding values.
Fix partman-auto to allow us to abort the installation before touching the disk if the disk is too small. This is BTS report #653305 and the d-i developers are fine with the patch and someone just need to apply it and upload. After this is done we need to adjust debian-edu-install to use this new hook.
Adjust to new LTSP framework (boot time config instead of install time config). LTSP changed its design, and our hooks to install packages and update the configuration is most likely not going to work in Wheezy.
Consider switching to NBD instead of NFS for LTSP root, to allow the Kernel to cache files in its normal file cache, possibly speeding up KDE login on slow networks.
Make it possible to create expired user passwords that need to change on first login. This is useful when handing out password on paper, to make sure only the user know the password. This require fixes to the PAM handling of kdm and gdm.
Make GUI for adding new machines automatically from sitesummary. The current command line script is not very friendly to people most familiar with GUIs. This should probably be integrated into GOsa to have it available where the admin will be looking for it..
We should find way for Nagios to check that the DHCP service actually is working (as in handling out IP addresses). None of the Nagios checks I have found so far have been working for me.
We should switch from libpam-nss-ldapd to sssd for all profiles using LDAP, and not only on for roaming workstations, to have less packages to configure and consistent setup across all profiles.
We should configure Kerberos to update LDAP and Samba password when changing password using the Kerberos protocol. The hook was requested in BTS report #588968 and is now available in Wheezy. We might need to write a MIT Kerberos plugin in C to get this.
We should clean up the set of applications installed by default.
- reduce the number of chemistry visualisers
- consider dropping xpaint
- and probably more?
Some hardware need external firmware to work properly. This is mostly the case for WiFi network cards, but there are some other examples too. For popular laptops to work out of the box, such firmware need to be installed from non-free, and we should provide some GUI to do this. Ubuntu already have this implemented, and we could consider using their packages. At the moment we have some command line script to do this (one for the running system, another for the LTSP chroot).
In Squeeze, we provide KDE, Gnome and LXDE as desktop options. We should extend the list to Xfce and Sugar, and preferably find a way to install several and allow the admin or the user to select which one to use.
The golearn tool from the goplay package make it easy to check out interesting educational packages. We should work on the package tagging in Debian to ensure it represent all the useful educational packages, and extend the tool to allow it to use packagekit to install new applications with a simple mouse click.
The Squeeze version got half a exam solution already in place, with the introduction of iptable based network blocking, but for it to be a complete exam solution the Squid proxy need to enable filtering/blocking as well when the exam mode is enabled. We should implement a way to easily enable this for the schools that want it, instead of the "it is documented" method of today.
A feature used in several schools is the ability for a teacher to "take over" the desktop of individual or all computers in the room. There are at least three implementations, italc, controlaula og epoptes and we should pick one of them and make it trivial to set it up in a school. The challenges is how to distribute crypto keys and how to group computers in one room and how to set up which machine/user can control the machines in a given room.
Tablets and surf boards are getting more and more popular, and we should look into providing a good solution for integrating these into the Debian Edu network. Not quite sure how. Perhaps we should provide a installation profile with better touch screen support for them, or add some sync services to allow them to exchange configuration and data with the central server. This should be investigated.

I guess we will discover more as we continue to work on the Wheezy version.

Maximilian Attems: 1.5M CPU hours in 2012

1.5M CPU hours runs on the Vienna Scientific Cluster by my 3D+3V hard expanding loops code. It is simulating the Chromo-Weibel instability of a non-Abelian plasma in an 1d expanding background to account for the expansion of a Quark-Gluon plasma fireball in a heavy ion collision. The code is parallellised using Open MPI and one single run roughly needs 0.5TB memory to hold all the needed 5-dimensional matrices and ~ 72h to complete. The resulting heavy operation is of course matrix multiplication of those physical and auxilliary fields. I tried to use git-annex on the resulting physical fields data output of ~ 150Gb and 300k files. Currently I do prefer git itself for it's speed and it only doubles the amounted space. I'm thrilled to see that git annex is still considering this "semi-extreme" usecase of lots of data files as it would help collaborators to have partial checkouts for laptop usage and quick checks. As the git-annex kickstarter is a rocket, i'd add my wish to see the current symlink mess go: desymlink git-annex. Now it is the time to properly analyse all this data and get the full 3d paper follow up on Instabilities of an anisotropically expanding non-Abelian plasma: 1D+3V discretized hard-loop simulations (previous paper) out maybe soon. (;

Brett Parker: Newsflesh Trilogy

So, on Thursday the final part of the Newsflesh trilogy by Mira Grant came out, I'd only been waiting on it for a year. The series is fantastic, and the last book answers the over hanging questions from the second nicely - there's some twists along the way, and it's a Damned Good read. I didn't pick up Blackout (the last book) until Saturday night, as I was re-reading Feed and Deadline first - I'd finished Feed on Wednesday but didn't finish Deadline until Saturday. I picked up Blackout Saturday night at ~ 2200 and didn't go to sleep until ~ 0200 - then, waking up on Sunday, other than doing a few bits of work from 1100 till about 2100 I read the rest of Blackout, it's kinda addictive. It ends a bit abruptly, but well. If you've not read this series - pick up Feed - if you like it, you'll love the series... also, if you don't cry at at least 2 points in Feed, you're obviously a heartless bastard!

10 June 2012

Gregor Herrmann: RC bugs 2012/23

here's the list of RC bugs I've worked on during the last week:

~~#666373~~ src:scribus: "scribus: FTBFS: dh_testroot: You must run this as root (or use fakeroot)."
fix build* targets in debian/rules, upload to DELAYED/2
~~#673864~~ searchandrescue: "searchandrescue: FTBFS in sid: install: cannot stat SearchAndRescue': No such file or directory"
fix build* target dependencies in debian/rules, upload to DELAYED/2, then moved to 0-day on maintainer's request
~~#674212~~ libalkimia: "libalkimia: ftbs missing dependency on pkg-config"
add missing build dependency, upload to DELAYED/2
~~#674353~~ src:libcss-perl: "libcss-perl: FTBFS: tests failed"
recompile grammar at build time, upload to DELAYED/2
~~#674356~~ src:kalzium: "kalzium: FTBFS: make[4]: *** No rule to make target /usr/lib/libQtOpenGL.so', needed by lib/libcompoundviewer.so.4.7.0'. Stop."
manual close
~~#674369~~ src:libtuxcap: "libtuxcap: FTBFS: Could NOT find ImageMagick"
add patch to work with newer cmake ImageMagick module, upload to DELAYED/2
~~#674370~~ src:aolserver4-nsmysql: "aolserver4-nsmysql: FTBFS: ld: cannot find -lssl"
manual close
~~#674376~~ src:sysbench: "sysbench: FTBFS: ld: cannot find -lssl"
manual close
~~#674377~~ src:korundum: "korundum: FTBFS: make[3]: *** No rule to make target /usr/lib/libQtCore.so', needed by lib/korundum4.so'. Stop."
manual close
~~#676051~~ src:biber: "biber: FTBFS: tests failed"
add missing build dependencies (pkg-perl)
~~#676072~~ src:libgeo-osm-tiles-perl: "libgeo-osm-tiles-perl: FTBFS: tests failed"
add patch to skip test that needs internet access (pkg-perl)

Gregor Herrmann: DebConf12

finally I managed to book a flight to MGA. here's my itinerary, in case someone shares a flight:

Munich        Madrid        IB3537   Jul  1   07:30   10:30
Madrid        San Jose      IB6313   Jul  1   12:05   15:05
San Jose      Managua       LR679    Jul  1   18:24   19:24



Managua       Panama City   CM105    Jul 21   14:49   17:24
Panama City   Madrid        IB6346   Jul 21   18:55   12:10+1
Madrid        Munich        IB3564   Jul 22   16:10   18:55

C.J. Adams-Collier: Spinning up a telco with Asterisk

Back in 2010 our family moved to an island in an archipelago in the very top left of the US s continental 48. Before moving, we did some research regarding high speed network access. There are a number of ISPs in the county, and even one headquartered on our particular island. But we found that the location where we were moving was in a location that was only serviced by 1.5Mbit DSL. We had been spoiled in our previous two locations and had seen bittorrent swarms reach over 1 megabyte (8Mbit) per second. Our bill said 12 down and 2 up and I wouldn t be surprised if we achieved that. At any rate, we were disappointed by the speeds available and I wanted to do something to increase the availability of higher speed network access. Some of my friends from the North American Network Operators Group (NANOG) told me that one way to improve the infrastructure would be to get involved with telecommunications provisioning as a Competitive Local Exchange Carrier (CLEC). With the above in mind, I did some research and found that in my state, the authority which certifies and regulates telecommunication companies is the Washington Utilities and Transportation Commission (UTC). I found the application forms on their web site, filled them in, filed the appropriate documents with the appropriate departments and received a certificate in the mail shortly thereafter. We have since filed annual reports as required by regulations. And with the regulatory bits out of the way, we re now left with only the technical details. We have established collocation of some equipment near our state s central telecommunications facility at the Westin Building. Technically speaking, the equipment is not in the Westin, but at a facility connected to the Westin by multiple 10Gbit links. Close enough for me. On this equipment, we re running a Debian Squeeze Xen virtual machine and Digium s Asterisk packages:

cjac@sip0:/etc/asterisk$ grep -B1 -A3 Digium /etc/apt/sources.list
#
#  Digium asterisk packages
#
deb http://packages.asterisk.org/deb squeeze main
deb-src http://packages.asterisk.org/deb squeeze main
cjac@sip0:/etc/asterisk$ dpkg -l   grep digium
ii  asterisk                           1:1.8.11.1-1digium1~squeeze  Open Source Private Branch Exchange (PBX)
ii  asterisk-config                    1:1.8.11.1-1digium1~squeeze  Configuration files for Asterisk
ii  asterisk-core-sounds-en-gsm        1.4.21-1digium1~squeeze      asterisk PBX sound files - English/gsm
ii  asterisk-voicemail                 1:1.8.11.1-1digium1~squeeze  simple voicemail support for the Asterisk PBX

We saved up our nickles and dimes to purchase a 24-port analog telephony adapter (ATA). At the recommendation of one of the denizens of the #asterisk IRC channel on Freenode, we decided on the GrandStream GXW4024. It is pretty simple to configure them to register with the Asterisk server using SIP. The only problem we had was getting the RTP streams, and specifically their dynamically negotiated service ports, to traverse the NATting routers. We currently have no public IPv4 address space at the facility which hosts the ATA and so the rest of the internet sees all traffic originating from this facility as sourced from a single IP address. In order for this to work, the edge NAT/router device (in our case, BIG-IP LTM) needs to map its external L4 ports (TCP and UDP) to the ports of internal hosts so that traffic can flow correctly. This works fine for traffic which originates from internal hosts and is destined to hosts on the outside, but does not work so well when hosts on the outside wish to establish connections to hosts on the inside. Call management sessions established with the SIP protocol fall in the former category, but call media (voice, video, txt) sessions established with the RTP protocol fall into the latter; the host and port used to carry the media data are negotiated during the SIP session and the media socket is established out of band. The problem occurs when the call server (on the outside) attempts to establish an RTP stream with the caller (on the inside). The call server attempts to connect to the caller using the IP address from which it connected. The problem is that this address belongs to the NATting router, not the caller, and the router is not expecting the incoming request. To get around the NAT problem, we temporarily configured an OpenVPN tunnel to extend our L2 network segment. Our long-term solution will be to provision an Asterisk server in the same facility as the ATA and then register with it instead of the server in the exterior facility. Calls will then be switched at the local facility and the upstream link will be established using the IAX2 protocol, which does not suffer from the same NAT problems. All of the above provides us with the ability to make voice calls between the 24 channels of the ATA and any other SIP client which happens to be registered with our call server. This is all well and good, but we want to allow our customers to call the rest of the world. Enter our upstream provider, Threshold Communications, Inc. These folks are experienced and professional and have helped us successfully establish both outbound and inbound calling for very reasonable monthly costs. The call quality is indistinguishable from the lines provisioned by the local bell company, and inter-operates flawlessly with the Asterisk call server stack. Because calls transit our Asterisk server, we can add additional features such voicemail, speech to text, DTMF-driven menus, or call forwarding, for instance. We could even theoretically set up autopatch service using amateur frequencies or launch perl scripts to automate arbitrary fancyness. Our next step is to finish configuration of our 12-channel ZyXEL AAM1212 DSLAM modules so that we can deliver ADSL service over the same copper pairs as we deliver voice.

Next.

Previous.