A percussionist myself, this made my day [via Boing Boing]. And I too have some recordings by the Marimba Ponies already and didn't know jack about who they were.

Yesterday, someone accidentally sent a private message to an internal mailing list, using Microsoft Outlook. Realising what she had done, she sighs and hits the "Recall" button. This causes another message to be sent, which states:

content-class: urn:content-classes:recallmessage
Subject: Recall: <the subject>
The sender would like to recall the message, "<the subject>".

The message contains no In-Reply-To or References headers. How does Microsoft expect email to work? Of course, to them, it's only supposed to work between Outlook/Outlook Express/Hotmail clients and <gulp>Exchange. And reportedly, recalling messages with the above "technique" works in pure-Microsoft email infrastructures (but none of the other readers of said internal mailing list use Microsoft). I do still wonder how the exchange server (or the Outlook client) match the recall request with the message to be recalled? Is it always the latest with a given subject sent by the person initiating the recall? So I have definitely learnt my lesson when it comes to thinking twice before you send (c.f. some of my messages in the Debian list archives), and I have learnt it the direct way. Because Microsoft seems to foster the na vite of its users with "technologies" like the aforementioned recall procedure, those poor users have to learn the indirect way, as the unfortunate sender of the private message had to when everyone had read the message and she still couldn't believe it:

"But I immediately recalled it; you cannot have read it."

Thanks, once again, Microsoft. If you were to make cars with built-in obstacle avoidance, you'd encourage your users never to use the brake on public streets because "there are no other cars, so nothing can happen." PS: This semi-negative rant about Microsoft is explicitly not dedicated to helix. My last post should have been, but it was too late so I forgot. I'll do it on the next one. NP: Mice Parade, Bem-Vinda Vontade

Today (okay, it's past midnight, but tomorrow starts when I get up), my day was made not once, but twice by percussionists (and Boing Boing).

Daniel pointed us to maltloaf, which brings up painful memories from my US College times -- you know, ghost milk and 100% fat free butter and stuff like that.

• Soreen quote 2 g/100 g fat under typical values, so 2%. Someone tell them their PR that they can write 100-2 => 98% fat free for better effect! (yes, I know fat isn't a linear scale). Or do they mean 2 g being about 3% of the suggested daily intake, which means you have 97% "left to spend"?
• Second, "Soreen Original fruity malt loaf is suprisingly nutritious and low in fat." Aha. Do 97% fat freeness somehow cancel out the 688 kcal per bar? Or are they not trying to appeal to people watching their weight?

To whom are they trying to appeal? If it's really sports persons, then the sheer amount of carbohydrates would call for an average such person (75 kg, 178 cm):

• to drink about 9 litres of water for each bar (two of which should be isotonic, one with extra electrolytes),
• to eat just a little less than two bananas for the potassium, and
• to consume one boiled egg with about one tea spoon of table salt for proteins and sodium

for a moderately balanced diet. Given average fitness and BMI, this person would have to keep the pulse between 140 and 150 for two hours straight (for each bar), and not eat more than 1.8 of those maltloafs. These values are according to a rather reasonable book on sports nutrition I bought in preparation of our Kilimanjaro hike, btw. I really wonder how many sports persons have a balanced diet. Those who don't will not be able to digest the carbohydrates and excrete more than half of them while adding body weight in the long run -- but hey, at 97% fat freeness, that can't be fat, it must be muscular tissue, right? :) These bars do have an impressive amount of carbohydrates, I must say. I am never sure about importing food products from the UK, but maybe I'll have to pick up a few. PS: oh, and does their math square? According to the nutritional facts, 100 g of loaf has 310 kcal while 1/8 of a loaf as 86 kcal, so a bar is 222 g (wow). But 222 g of bar are supposed to have 8*0.6 g = 4.8 g of fat if you approach it bottom-up, and 222*2.0 g/100 = 4.4 g of fat if you come at it from that angle. Daniel, do these things really weigh 222 g per bar?

A percussionist myself, this made my day [via Boing Boing]. And I too have some recordings by the Marimba Ponies already and didn't know jack about who they were.

After long periods of indecisiveness and insecurities about the trip after Debconf6, I am now finally booked to Mexico (and back). In case you care, here's my itinerary:

Sa 13 May 2006: ZRH -> FRA on LH5055, leaving 12:20
Sa 13 May 2006: FRA -> MEX on LH498, arriving 18:55
So 28 May 2006: MEX -> FRA on LH499, leaving 20:50
Mo 29 May 2006: FRA -> ZRH on LH3732, arriving 16:55

Best of all: I have a lot of Lufthansa miles set to expire soon, so I can likely upgrade to business class. :) Now I hope that my sponsorship request gets honoured one of these days. Lufthansa was the cheapest I could get from Zurich, but my definition of cheap is something else...

< Sesse> madduck: you'll have to counter-blog :-)
< madduck> mh.
< Sesse> madduck: my degree isn't in computing, it's in signal processing
< Sesse> so I don't have all the programming and db books
< madduck> mine is in procrastination.

Sesse, I see your list and raise you:

• Computer architecture: "Structured computer organization" by Tanenbaum
• C++: "The C++ Programming Language" by Stroustrup, and I also include "Modern C++ Design" by Alexandrescu, an excellent book and companion to the Gamma et al. "GoF" book you quote for design patterns.
• Compilers: Aho et al. Compilers: principles, techniques, and tools. Great book.
• Database management systems: Elmasri and Navathe
• Operating systems: Tanenbaum, but I also liked Silberschatz and Galvin's "Operating System Concepts"
• Unix programming: the Stevens books
• Programming in general: Abelson & Sussman's "Structure and Interpretation of Computer Programs" -- possibly the book that had the most influence on me.

Also, for crytography, I would put "Contemporary Cryptography" by Oppliger in there, despite its price. I have worked with Oppliger so I may be biased, but I found his book to be very in-depth and yet understandable, possibly more so than Schneier's. And it's more up to date. Update: Now I am really curious what the classic for UML would be. Seems like all the UML books are either too spec-like, or too lofty.

I am following Wouter's example and returning to Fluxbox. I certainly thought ion3 was an interesting approach and it seemed like it would be exactly what I needed when I saw Erinn show it off to me in Helsinki. However, over time I developed too many gripes:

• I am a great fan of Enrico's software, buffy in particular. I would like to have buffy stick to ever workspace, ideally along the right edge. This seemed not trivially possible in ion3, where I would have had to create a single static workspace with two panes, then put all my other workspaces into the pane next to the one reserved for buffy. Certainly possible, but a major pain to configure and protect against resizing and accidental closing.
• Applications like Firefox, dia, and especially The Gimp (to name but a few) were just a major pain to use, especially since I never got the hang of the floating workspace model. My favourite example (which is in line with Wouter's experience): try to crop an image in The Gimp; by the time you set the first click, you'll have the crop dialog in your face, which you have to first move out of the way before you can restart. * Certain transients would be locked to a size that made it impossible to fill in all fields, first requiring you to attach the window to a proper frame.
• The inability to display dock and status bar on the same head.

There were probably a couple of other minor issues that don't pop to mind right now. All that said, there are certain things I now miss in Fluxbox, which had been my window manager of choice before Helsinki, that I know what ion3 can do:

• The ability to use your keyboard to switch to a bordering window; I had it set up so that Mod5-<arrow key> (Mod5 I tied to Caps_Lock) would transfer focus to the window on the left/right/top/bottom. My xinerama-switcher module (part of ion3-scripts now) would allow that to work across multiple heads and workspaces.
• Tagging and attaching a window to another pane, or using the attach command directly to summon a window from somewhere else to the current pane.
• While grun is a worthy replacement for ion3's F3, I have not found something to replace F4, a prompt with autocompletion for SSH targets; I've really grown used to that.
• The concise and extensible status reporting done by the various modules in the statusbar, like ACPI status (incl. temperature and CPU frequency), current IP address, WLAN status, and the three CPU load values. Dockapps just take way too much screen estate, and I don't need no graphic frills when I want information.

... and possibly more. Maybe it's time to look around again for a lightweight, keyboard-friendly window manager (and only that) that's not WindowMaker?

If you design your website so that it requires cookies, you ought to be punched (c.f. Sesse). When I surf the web, I usually choose to deny cookies for this reason; should I find out that cookies are actually needed, the excellent Cookie Button Firefox extension allows me to rethink my choice. If you implement redirect chains like ticketcorner.ch to www.ticketcorner.ch to www.ticketcorner.com to www2.ticketcorner.com, you ought to be kicked and battered, especially if those are implemented with meta refresh instead of HTTP redirect. If you set a cookie from www.ticketcorner.com with cookie domain .ticketcorner.com and require that on www2.ticketcorner.com, you should be slaughtered. And Firefox should certainly have a better means to edit cookie restrictions outside of the current domain than to require me to go to the preferences and click a hundred times until I can browse a huge list of cookie exceptions (no search) for a the entry, remove it, reload the page, and cast another vote. I have not found an extension to do this...

Philipp, thanks for the note. I was at the talk and it was then (though not due to Joey's talk) that I decided we need to do something about security in Debian. It just so happened that LinuxTag 2005 coincided with the bad media coverage we got on security. I don't want to speak of (as of yet) unreal things, but one of the goals we want to achieve as soon as possible is take some of the burden away from Joey and expand the work of the secure testing team to cover unembargoed security issues in stable as well. And among the prime needs we identified was lack of a formal procedure and documentation, so this is stuff I want to work on, also in preparation of my upcoming FOSDEM talk.

I need a UML editor capable of state diagrams to formalise the current and future workflow related to security updates for the stable and testing releases. Most UML software in Debian's archive only knows about class diagrams, with a few notable exceptions:

• tcm: the user interface is a nightmare and despite at least half an hour of reading the docs and trying hard, I had not managed to create a .xmi file describing a simple publication workflow. Reason enough to move away from this horrid application.

• umbrello: 50 Mb of downloads later, I finally had the KDE-based umbrello installed and within five minutes, I understood how to accomplish what I want with the more or less intuitive user interface, although I have still not found out how to associate actions with transitions. Anyway, while I am happily clicking away, umbrello suddenly disappears without a warning, message, or output to the console. Thanks, KDE, for making intuitive software that looks good; whether it's usable and/or stable is an issue with which you need not concern yourself.

ArgoUML, a Java-based application (see how desperate I am?) doesn't even want to start with the 1.5 JRE. Lacking any usable editors, I might just implement the whole security update process in Python. At least then it's formally described. If only there was a tool that turned some sort of state description files into valid UML...

If I set a password for a resource, it's good to be able to enter it twice and have the system verify that the two passwords equal each other, or else a typo may bring some unpleasant surprises. If, on the other hand, I let a system know the password for an existing resource (such as a WPA-PSK for a WLAN), there is no need in entering it twice! If it doesn't work, you probably entered the password wrongly. It's amazing how little many software vendors think when coding. "Password?" -- "Ah yes, two input fields, it's safer that way." The problem is especially annoying when the software needing the password is buggy, such as the Windows XP SP2 WLAN configuration: it cannot properly process WEP passphrases with special characters, so you have to enter the 13 bytes in hex. That's 26 keystrokes, and just to be sure you don't enter the password wrongly, make that 52. Some will say that Windows users are so stupid that requiring them to enter the password twice to guard against typos and subsequent hotline calls because it doesn't work. Let them say that. PS: Erinn, this Windows-related post I dedicate specifically to you.

I got myself the Draytek Vigor 2900VG, as announced, to handle my home office connection needs. I've been playing with the device all morning and am somewhat undecided as to whether I should keep it, or replace it with a tiny computer without moveable parts that runs Debian, simply for the benefit of greater control. But first, let me review the device. Don't get me wrong when I say that I am not sure whether I should keep it: the router seems solid and has a lot of functionality, and with few glitches, it mostly seems to work. Go read the specs yourself if you care, in the following I want to give my view on some of the pros and cons of the device after a few hours: The device is an all-in-one, combining WAN access (DHCP, PPPoE, PPTP) with NAT (with support for a DMZ), DHCP, VPN (PPTP, L2CAP, IPsec), a stateful packet filter, a 802.11g access point with support for WPA2 and 802.1x, VoIP gateway, a 4-port switch with VLAN and rate control, static routing and RIP, QoS, UPNP, dynamic DNS updates (e.g. no-ip.com), syslog or SMTP-based logging, and a printer server for USB printers. Basic HTTP URL and content filtering is provided, though most of it comes through the interface to SurfControl (no subscription included). Content control includes the most popular IM and P2P protocols. For all that functionality, the price is quite reasonable, if you ask me. Interaction is through a web interface that can be restricted to a couple of clients only, and is password protected (though in the clear). In any case, the device also comes with a telnet console that has a larger feature set than the web interface, but lacks documentation. Several forums exist, however, to fill this hole. The router also sports SNMP! The packet filter seems limited in what it can do: TCP, UDP, ICMP, IGMP, and only the basics for each (e.g. sockets for TCP). There are 12 filter sets with 7 rules each, and if/then logic can be implemented by branching to other filter sets. However, I can well imagine that the limit can be quickly reached. For QoS, you can define three classes, and to each assign services based on sockets and diffserv. That's it, but it should be enough for most basic use cases. VPN can be achieved with L2CAP, PPTP, or IPsec, but only pre-shared secrets are supported. Users can dial-in, up to 16 "Road Warrior" profiles can be created, and 32 LAN-to-LAN tunnels can coexist. A nice feature are the 16 schedules you can define and use throughout. For instance, certain filters can be restricted to only apply during working hours, some users may only be allowed to use the VPN to dial in during specific times, WLAN can be turned off at dusk, and VoIP devices can be routed based on the time of the day. NTP ensures this all happens accurately. I am really missing a RADIUS server on the device. As it stands, I am left to run a separate RADIUS server on the LAN, or resort to WPA2-PSK, which is a little less desirable but quite okay for my case. The device can separate LAN and WLAN clients and block any traffic between the two. I have not found a way to put LAN and WLAN into their own subnets and allow traffic inbetween. The DHCP server seems okay, it does not remember leases and will simply time out leases and use them for new requests. It is not possible to lock a MAC address to a specific IP through the web interface, one has to resort to the telnet prompt, and the limit is on 10 static leases. The device has no support for DNS updates for DHCP clients, nor is there any integration with a DNS server whatsoever. This means that for 10+ clients, you'll need ZeroConf stuff or you cannot use DNS between clients on the LAN/WLAN. All of the above are minor annoyances. I have also already found a bug (which has been known for more than a year now but remains unfixed in the latest firmware from December 2005): the device has a DNS relay without a cache (ugh!). If you request an A record, it all works. If you request an AAAA or MX record, it forgets to translate the source IP of the answer and feeds the upstream forwarder's packet straight throught. Thus, it is not possible to resolve AAAA or MX records without hard-coding the DNS servers to use in the DHCP server configuration to bypass the DNS relay. That's all for now. I have not gotten around to play with VoIP stuff yet, but one of these days...

Mozilla Firefox has done some good to the Web as a whole. I still wonder why, for $DEITY's sake, it does everything different from a normal application. To be precise, Firefox sucks just a little too much for my taste. Today's gripe: I have two machines here, my laptop and my workstation. The workstation is headless due to a broken monitor, but it's connected to the stereo. My music collection is served by libapache2-mod-musicindex over HTTP, and I have not yet figured out how to configure mocp to actually play remote playlists (any ideas?). Thus, these days I X-forward Firefox to my laptop to surf the list and select the songs. But try this: start Firefox locally, then start an instance through an X-enabled SSH session: it will open a new window of the running local session, which is really not what I want nor expect. It seems like the requirement to surf from somewhere else is an out of bounds concept for the Firefox developers. Thanks for trying (and failing) to be smart, Mr. Firefox. Why don't you rather concentrate on processing clicks and keystrokes when you should, rather than ignoring them from time to time? Update: Matt Brubeck tells me that MOZ_NO_REMOTE=1 in the environment does what I want. Future versions will have a -no-remote command-line argument. I think it should become default. Please see #352809 if you have an opinion on this. PS: Firefox and OpenOffice.org seem to be two flagship products of the F/OSS world. At the same time, they are probably the two best examples of programmes orthogonal to the Unix philosophy. Does that mean that the Unix philosophy is the wrong way? Holy Shit!

Amaya claims that it's easier to put it all under SSL if the list management interface should be protected. I use the following options in /etc/mailman/mm_cfg.py to use SSL for list management, but plain HTTP for the archives:

DEFAULT_URL_PATTERN = 'https://%s/mailman/'
PUBLIC_ARCHIVE_URL = 'http://lists.madduck.net/pipermail/%(listname)s'
PRIVATE_ARCHIVE_URL = 'https://lists.madduck.net/mailman/private/%(listname)s'

Add to that some apache2 RewriteRule directives, and it's enforced.

I finally got around to switch my parents from T-Offline to MaxiDSL. The switch worked flawlessly, our internal phone system continues to work, and switching the DSL was painless. So no more random disconnects (if I am to believe what people say about MaxiDSL), a responsive service hotline with people that have a clue, and all that for about 60% of the price we used to pay to T-Offline. Heartily recommended for residents of Munich. If you are interested, link up with me so we can both benefit from a referral bonus.