There are many resources for network automation with Ansible. Most
of them only expose the first steps or limit themselves to a
narrow scope. They give no clue on how to expand from that. Real
network environments may be large, versatile, heterogeneous, and filled
with exceptions. The lack of real-world examples for Ansible
deployments, unlike Puppet and SaltStack, leads many teams to
build brittle and incomplete automation solutions.
We have released under an open-source license our attempt
to tackle this problem:
Jerikan, a tool to build configuration files from a single
source of truth and Jinja2 templates, along with its
integration into the GitLab CI system;
an Ansible playbook to deploy these configuration files on
network devices; and
the configuration data and the templates for our, now defunct,
datacenters in San Francisco and South Korea, covering many vendors
(Facebook Wedge 100, Dell S4048 and S6010, Juniper QFX 5110,
Juniper QFX 10002, Cisco ASR 9001, Cisco Catalyst 2960, Opengear
console servers, and Linux), and many functionalities
(provisioning, BGP-to-the-host routing, edge routing, out-of-band
network, DNS configuration, integration with NetBox and IRRs).
Here is a quick demo to configure a new peering:
This work is the collective effort of C dric Hasco t,
Jean-Christophe Legatte, Lo c Pailhas, S bastien Hurtel,
Tchadel Icard, and Vincent Bernat. We are the network team of
Blade, a French company operating Shadow, a cloud-computing
product. In May 2021, our company was bought by Octave Klaba and
the infrastructure is being transferred to OVHcloud, saving
Shadow as a product, but making our team redundant.
Our network was around 800 devices, spanning over 10 datacenters with
more than 2.5 Tbps of available egress bandwidth. The released
material is therefore a substantial example of managing a medium-scale
network using Ansible. We have left out the handling of our legacy
datacenters to make the final result more readable while keeping
enough material to not turn it into a trivial example.
Jerikan
The first component is Jerikan. As input, it takes a list of
devices, configuration data, templates, and validation scripts. It
generates a set of configuration files for each device. Ansible
could cover this task, but it has the following limitations:
Jerikan inputs and outputs
If you want to follow the examples, you only need to have Docker and
Docker Compose installed. Clone the repository and you
are ready!
Source of truth
We use YAML files, versioned with Git, as the single source of
truth instead of using a database, like NetBox, or a mix of a
database and text files. This provides many advantages:
anyone can use their preferred text editor;
the team prepares changes in branches;
the team reviews changes using merge requests;
the merge requests expose the changes to the generated configuration files;
rollback to a previous state is easy; and
it is fast.
The first file is devices.yaml. It contains the
device list. The second file is classifier.yaml.
It defines a scope for each device. A scope is a set of keys and
values. It is used in templates and to look up data associated with a
device.
The device name is matched against a list of regular expressions and
the scope is extended by the result of each match. For
to1-p1.sk1.blade-group.net, the following subset of
classifier.yaml defines its scope:
The third file is searchpaths.py. It describes
which directories to search for a variable. A Python function provides
a list of paths to look up in data/ for a given scope. Here
is a simplified version:2
Variables are scoped using a namespace that should be specified when
doing a lookup. We use the following ones:
system for accounts, DNS, syslog servers,
topology for ports, interfaces, IP addresses, subnets,
bgp for BGP configuration
build for templates and validation scripts
apps for application variables
When looking up for a variable in a given namespace, Jerikan looks
for a YAML file named after the namespace in each directory in the
search paths. For example, if we look up a variable for
to1-p1.sk1.blade-group.net in the bgp namespace, the following
YAML files are processed: host/sk1/to1-p1/bgp.yaml,
location/sk1/bgp.yaml, os/cumulus-dell-s4048/bgp.yaml,
os/cumulus/bgp.yaml, and common/bgp.yaml. The search stops at the
first match.
The schema.yaml file allows us to override this
behavior by asking to merge dictionaries and arrays across all
matching files. Here is an excerpt of this file for the topology
namespace:
The last feature of the source of truth is the ability to use Jinja2
templates for keys and values by prefixing them with ~ :
# In data/os/junos/system.yamlnetbox:manufacturer:Junipermodel:"~ model upper "# In data/groups/tor-bgp-compute/system.yamlnetbox:role:net_tor_gpu_switch
Looking up for netbox in the system namespace for
to1-p2.ussfo03.blade-group.net yields the following result:
# In groups/adm-gateway/topology.yamlinterface-rescue:address:"~ lookup('topology','addresses').rescue "up:-"~iprouteadddefaultvialookup('topology','addresses').rescue ipaddr('first_usable')tablerescue"-"~ipruleaddfromlookup('topology','addresses').rescue ipaddr('address')tablerescuepriority10"# In groups/adm-gateway-sk1/topology.yamlinterfaces:ens1f0:"~ lookup('topology','interface-rescue') "
This yields the following result:
$ ./run-jerikan lookup gateway1.sk1.blade-group.net topology interfaces
[ ]ens1f0: address: 121.78.242.10/29 up: - ip route add default via 121.78.242.9 table rescue - ip rule add from 121.78.242.10 table rescue priority 10
When putting data in the source of truth, we use the following rules:
Don t repeat yourself.
Put the data in the most specific place without breaking the first rule.
Use templates with parsimony, mostly to help with the previous rules.
Restrict the data model to what is needed for your use case.
The first rule is important. For example, when specifying IP addresses
for a point-to-point link, only specify one side and deduce the other
value in the templates. The last rule means you do not need to mimic a
BGP YANG model to specify BGP peers and policies:
Templates are using Jinja2. This is the same engine used in
Ansible. Jerikan ships some custom filters but also reuse some of
the useful filters from Ansible, notably
ipaddr. Here is an excerpt of
templates/junos/base.j2 to configure DNS
and NTP servers on Juniper devices:
system ntp %forntpinlookup("system","ntp")% server ntp; %endfor% name-server %fordnsinlookup("system","dns")% dns; %endfor%
devices() returns the list of devices matching a set of
conditions on the scope. For example, devices("location==ussfo03",
"groups==tor-bgp") returns the list of devices in San Francisco in
the tor-bgp group. You can also omit the operator if you want the
specified value to be equal to the one in the local scope. For
example, devices("location") returns devices in the current
location.
lookup() does a key lookup. It takes the namespace, the key, and
optionally, a device name. If not provided, the current device
is assumed.
scope() returns the scope of the provided device.
Here is how you would define iBGP sessions between edge devices in the
same location:
%forneighborindevices("location","groups==edge")ifneighbor!=device% %foraddressinlookup("topology","addresses",neighbor).loopbacktolist% protocols bgp group IPVaddressipv-EDGES-IBGP neighbor address description "IPvaddressipv: iBGP to neighbor"; %endfor% %endfor%
We also have a global key-value store to save information to be
reused in another template or device. This is quite useful to
automatically build DNS records. First, capture the IP address
inserted into a template with store() as a filter:
Templates are compiled locally with ./run-jerikan build. The
--limit argument restricts the devices to generate configuration
files for. Build is not done in parallel because a template may depend
on the data collected by another template. Currently, it takes 1
minute to compile around 3000 files spanning over 800 devices.
Output of Jerikan after building configuration files for six devices
When an error occurs, a detailed traceback is displayed, including the
template name, the line number and the value of all visible variables.
This is a major time-saver compared to Ansible!
templates/opengear/config.j2:15: in top-level template code
config.interfaces. interface .netmask adddress ipaddr("netmask")
continent = 'us'
device = 'con1-ag2.ussfo03.blade-group.net'
environment = 'prod'
host = 'con1-ag2.ussfo03'
infos = 'address': '172.30.24.19/21'
interface = 'wan'
location = 'ussfo03'
loop = <LoopContext 1/2>
member = '2'
model = 'cm7132-2-dac'
os = 'opengear'
shorthost = 'con1-ag2'
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
value = JerkianUndefined, query = 'netmask', version = False, alias = 'ipaddr'
[ ]
# Check if value is a list and parse each element
if isinstance(value, (list, tuple, types.GeneratorType)):
_ret = [ipaddr(element, str(query), version) for element in value]
return [item for item in _ret if item]
> elif not value or value is True:
E jinja2.exceptions.UndefinedError: 'dict object' has no attribute 'adddress'
We don t have general-purpose rules when writing templates. Like for
the source of truth, there is no need to create generic templates able
to produce any BGP configuration. There is a balance to be found
between readability and avoiding duplication. Templates can become
scary and complex: sometimes, it s better to write a filter or a
function in jerikan/jinja.py. Mastering
Jinja2 is a good investment. Take time to browse through our
templates as some of them show interesting features.
Checks
Optionally, each configuration file can be validated by a script in
the checks/ directory. Jerikan looks up the key checks
in the build namespace to know which checks to run:
In the above example, checks/junoser is executed if there is a
change to the generated config.txt file. It also outputs a
transformed version of the configuration file which is easier to
understand when using diff. Junoser checks a Junos configuration
file using Juniper s XML schema definition for Netconf.5 On
error, Jerikan displays:
jerikan/build.py:127: RuntimeError
-------------- Captured syntax check with Junoser call --------------
P: checks/junoser edge2.ussfo03.blade-group.net
C: /app/jerikan
O:
E: Invalid syntax: set system syslog archive size 10m files 10 word-readable
S: 1
Integration into GitLab CI
The next step is to compile the templates using a CI. As we are using
GitLab, Jerikan ships with a .gitlab-ci.yml
file. When we need to make a change, we create a dedicated branch and
a merge request. GitLab compiles the templates using the same
environment we use on our laptops and store them as an artifact.
Merge request to add a new port in USSFO03. The templates were compiled successfully but approval from another team member is still required to merge.
Before approving the merge request, another team member looks at the
changes in data and templates but also the differences for the
generated configuration files:
The change configures a port on the Juniper device, adds records to DNS, and updates NetBox with the new IP addresses (not shown).
Ansible
After Jerikan has built the configuration files, Ansible takes
over. It is also packaged as a Docker image to avoid the trouble to
maintain the right Python virtual environment and ensure everyone is
using the same versions.
InventoryJerikan has generated an inventory file. It contains all the managed
devices, the variables defined for each of them and the groups
converted to Ansible groups:
in-sync is a special group for devices which configuration should
match the golden configuration. Daily and unattended, Ansible should
be able to push configurations to this group. The mid-term goal is to
cover all devices.
none is a special device for tasks not related to a specific host.
This includes synchronizing NetBox, IRR objects, and the DNS,
updating the RPKI, and building the geofeed files.
Playbook
We use a single playbook for all devices. It is described in the
ansible/playbooks/site.yaml file.
Here is a shortened version:
A host executes only one of the play. For example, a Junos device
executes the blade.junos role. Once a play has been executed, the
device is added to the done group and the other plays are skipped.
The playbook can be executed with the configuration files generated by
the GitLab CI using the ./run-ansible-gitlab command. This is a
wrapper around Docker and the ansible-playbook command and it
accepts the same arguments. To deploy the configuration on the edge
devices for the SK1 datacenter in check mode, we use:
We avoid using collections from Ansible Galaxy, the exception
being collections to connect and interact with vendor devices, like
cisco.iosxr collection. The quality of Ansible
Galaxy collections is quite random and it is an additional
maintenance burden. It seems better to write roles tailored to our
needs. The collections we use are in
ci/ansible/ansible-galaxy.yaml. We use
Mitogen to get a 10 speedup on Ansible executions on Linux
hosts.
We also have a few playbooks for operational purpose: upgrading the OS
version, isolate an edge router, etc. We were also planning on how to
add operational checks in roles: are all the BGP sessions up? They
could have been used to validate a deployment and rollback if there is
an issue.
Currently, our playbooks are run from our laptops. To keep tabs, we
are using ARA. A weekly dry-run on devices in the in-sync group
also provides a dashboard on which devices we need to run Ansible
on.
Configuration data and templatesJerikan ships with pre-populated data and templates matching the
configuration of our USSFO03 and SK1 datacenters. They do not exist
anymore but, we promise, all this was used in production back in the
days!
The latest iteration of our network infrastructure for SK1, USSFO03, and future data centers. The production network is using BGPttH using a spine-leaf fabric. The out-of-band network is using a simple L2 design, using the spanning tree protocol, as well as a set of console servers.
Notably, you can find the configuration for:
our edge routers
Some are running on Junos, like edge2.ussfo03, the others on
IOS-XR, like edge1.sk1. The implemented functionalities are
similar in both cases and we could swap one for the other. It
includes the BGP configuration for transits, peerings, and IX as
well as the associated BGP policies. PeeringDB is queried to get
the maximum number of prefixes to accept for peerings. bgpq3 and a
containerized IRRd help to filter received routes. A firewall is
added to protect the routing engine. Both IPv4 and IPv6 are
configured.
our BGP-based fabric
BGP is used inside the datacenter8 and is extended on
bare-metal hosts. The configuration is automatically derived from
the device location and the port number.9 Top-of-the-rack
devices are using passive BGP sessions for ports towards servers.
They are also serving a provisioning network to let them boot using
DHCP and PXE. They also act as a DHCP server. The design is
multivendor. Some devices are running Cumulus Linux, like
to1-p1.ussfo03, while some others are running Junos, like
to1-p2.ussfo03.
our out-of-band fabric
We are using Cisco Catalyst 2960 switches to build an L2 out-of-band
network. To provide redundancy and saving a few bucks on wiring, we
build small loops and run the spanning-tree protocol. See
ob1-p1.ussfo03. It is redundantly connected to our gateway
servers. We also use OpenGear devices for console access. See
con1-n1.ussfo03
our administrative gateways
These Linux servers have multiple purposes: SSH jump boxes, rescue
connection, direct access to the out-of-band network, zero-touch
provisioning of network devices,10 Internet access for management
flows, centralization of the console servers using Conserver,
and API for autoconfiguration of BGP sessions for bare-metal
servers. They are the first servers installed in a new datacenter
and are used to provision everything else. Check both the generated
files and the associated Ansible tasks.
Ansible does not even provide a line number when there is an
error in a template. You may need to find the problem by
bisecting.
$ ansible --version
ansible 2.10.8[ ]$ cat test.j2
Hello name !$ ansible all -i localhost, \> --connection=local\> -m template \> -a "src=test.j2 dest=test.txt"localhost FAILED! => "changed": false, "msg": "AnsibleUndefinedVariable: 'name' is undefined"
You may recognize the same concepts as in Hiera, the
hierarchical key-value store from Puppet. At first, we were
using Jerakia, a similar independent store exposing an HTTP
REST interface. However, the lookup overhead is too large for our
use. Jerikan implements the same functionality within a Python
function.
The list of available filters is mangled inside
jerikan/jinja.py. This is a remain of the
fact we do not maintain Jerikan as a standalone software.
This is a bit confusing: we have a store() filter and a
store() function. With Jinja2, filters and functions live in
two different namespaces.
We are using a fork with some modifications to be able to
validate our configurations and exposing an HTTP service to
reduce the time spent on each configuration check.
There is a trend in network automation to automate a
configuration subset, for example by having a playbook to create a
new BGP session. We believe this is wrong: with time, your
configuration will get out-of-sync with its expected state,
notably hand-made changes will be left undetected.
We also have some datacenters using BGP EVPN VXLAN at
medium-scale using Juniper devices. As they are still in
production today, we didn t include this feature but we may
publish it in the future.
In retrospect, this may not be a good idea unless you are
pretty sure everything is uniform (number of switches for each
layer, number of ports). This was not our case. We now think it is
a better idea to assign a prefix to each device and write it in
the source of truth.
Non-linux based devices are upgraded and configured
unattended. Cumulus Linux devices are automatically upgraded on
install but the final configuration has to be pushed using
Ansible: we didn t want to duplicate the configuration process
using another tool.
Pandemic Situation in India.
I don t know from where I should start. This is probably a good start. I actually would recommend Indiacable as they do attempt to share some things happening in India from day to day but still there is a lot thatt they just can t cover, nobody can cover. There were two reports which kind of shook me all inside. One which sadly came from the UK publication Independent, probably as no Indian publication would dare publish it. The other from Rural India. I have been privileged in many ways, including friends who have asked me if I need any financial help. But seeing reports like above, these people need more help, guidance and help than I.
While I m never one to say give to Foundations. If some people do want to help people from Maharashtra, then moneylifefoundation could be a good place where they could donate. FWIW, they usually use the foundation to help savers and investors be safe and help in getting money when taken by companies with dubious intentions. That is their drive. Two articles show their bent. The first one is about the Algo scam which I have written previously about the same in this blog. Interestingly, when I talk about this scam, all Modi supporters are silent. The other one does give some idea as to why the Govt. is indifferent. That is going to a heavy cross for all relatives to bear. There has been a lot that has been happening. Now instead of being limited to cities, Covid has now gone hinterland in a big way. One could ask also Praveen as he probably knows what would be good for Kerala and surrounding areas.
The biggest change, however, has been that India is now battling not just the pandemic but also Mucormycosis also known as black fungus and its deadlier cousin the white fungus. Mucormycosis came largely due to an ill-advise given that applying cow dung gives protection to Corona. And many applied it due to faith. And people who know science do know that in fact it has that bacteria.
Sadly, those of us who are and were more interested in law, computer science etc. has now also have to keep on top of what is happening in the medical field. It isn t that I hate it, but it has a lot of costs. From what I could gather on various social media and elsewhere, a single injection of anti-fungal for the above costs INR 3k/- and that needs to be 5 times in a day and that course has to be for three weeks. So even the relatively wealthy people can and will become poor in no time. No wonder thousands of those went to UK, US, Dubai or wherever they could find safe-harbor from the pandemic with no plans of arriving back soon.
There was also the whole bit about FBS or Fetal Bovin Serum. India ordered millions of blood serum products from abroad and continues to. This was quickly shut down as news on Social Media. Apparently, it is only the Indian cow which is worthy of reverence. All other cows and their children are fair game according to those in power. Of course, that discussion was quickly shut down as was the discussion about IGP (Indian Genome Project). People over the years had asked me why India never participated for the HGP (Human Gnome Project). I actually had no answer for that. Then in 2020, there was idea of IGP which was put up and then it was quickly shot down as the results could damage a political party s image. In fact, a note to people who want to join Indian civil services tells the reason exactly. While many countries in the world are hypocrites, including the U.S. none can take the place that India has made for itself in that field.
The Online experience
The vaccination process has been made online and has led to severe heartburn and trouble for many including many memes. For e.g.
Daily work, get up, have a bath, see if you got a slot on the app, sleep. People trying desperately to get a slot, taken from Hindi Movie Dilwale Dulhania Le Jaygenge.
Just to explain what is happening, one has to go to the website of cowin. Sharing a screenshot of the same.
Cowin app. sceeenshot
I have deliberately taken a screenshot of the cowin app. in U.P. which is one of the areas where the ruling party, BJP has. I haven t taken my state for the simple reason, even if a slot is open, it is of no use as there are no vaccines. As have been shared in India Cable as well as in many newspapers, it is the Central Govt. which holds the strings for the vaccines. Maharashtra did put up an international tender but to no effect. All vaccine manufacturers want only Central Govt. for purchases for multiple reasons. And GOI is saying it has no money even though recently it got loans as well as a dividend from RBI to the tune of 99k crore. For what all that money is, we have no clue.
Coming back though, to the issue at hand. the cowin app. is made an open api. While normally, people like us should and are happy when an API is open, it has made those who understand how to use git, compile, etc. better than others. A copy of the public repo. of how you can do the same can be found on Github. Now, obviously, for people like me and many others it has ethical issues.
Kiran s Interview in Times of India (TOI)
There isn t much to say apart from I haven t used it. I just didn t want to. It just is unethical. Hopefully, in the coming days GOI does something better. That is the only thing we are surviving on, hope.
The Toolkit saga
A few days before, GOI shared a toolkit apparently made by Congress to defame the party in power. That toolkit was shared before the press and Altnews did the investigation and promptly shredded the claims. Congress promptly made an FIR in Chhattisgarh where it is in power. The gentleman who made the claims Mr. Sambit Patra refused to appear against the police without evidence citing personal reasons and asking 1 week to appear before them. Apart from Altnews which did a great job, sadly many people didn t even know that there is something called WYSIWYG. I had to explain that so many Industries, whether it is politics, creative industries, legal, ad industries, medical transcription, and imaging all use this, and all the participants use the same version of the software. The reason being that in most Industries, there is a huge loss and issue of legal liabilities if something untoward happens. For e.g. if medical transcription is done in India is wrong (although his or her work will be checked by a superior in the West), but for whatever reason is not, and a wrong diagnosis is put (due to wrong color or something) then a patient could die and the firm who does that work could face heavy penalties which could be the death of them.
There is another myth that Congress has unlimited wealth or huge wealth. I asked if that was the case, why didn t they shift to Mac. Of course, none have answers on this one.
There is another reason why they didn t want to appear. The Rona Wilson investigation by Arsenal Experts also has made them cautious. Previously, they had a free run. Nowadays, software forensic tools are available to one and all. For e.g. Debian itself has a good variety of tools for the same. I remember Vipin s sharing few years back. For those who want to start, just install the apps. and try figuring out. Expertise on using the tools takes years though, as you use the tool day in night.
Update 25/05/2021 Apparently because Twitter made and showcased few tweets as Manipulated Media , those in Govt. are and were dead against it. So they conducted a raid against Twitter India headquarters, knowing fully well that there would be nobody except security. The moment I read this, my mind went to the whole Fruit of the poisonous tree legal doctrine. Sadly though, India doesn t recognize it and in fact, still believes in the pre-colonial era that evidence however collected is good. A good explanation of the same can be found here. There are some exceptions to the rule, but they are done so fine that more often than not, they can t be used in the court of law in India. Although a good RTI was shared by Mr. Saket Gokhale on the same issue, which does raise some interesting points
Twitter India Raid, Saket Gokhale RTI 1 Saket Gokhale RTI query , Twitter India Raid 2
FWIW, Saket has been successful in getting his prayers heard either as answers to RTI queries or then following it up in the various High Courts of India. Of course, those who are in the ruling party ridicule him but are unable to find faults in his application of logic. And quite a few times, I have learned from his applications as well as nuances or whatever is there in law, a judgment or a guideline which he invokes in his prayer. For e.g. the Lalitha Kumari Guidelines which the gentleman has shared in his prayer can be found here. Hence now, it would be upto the Delhi Police Cell to prove their case in response to RTI. He has also trapped them as he has shared they can t give excuses/exemptions which they have tried before.
As I had shared earlier, High Courts in India have woken up, whether it is Delhi, Mumbai, Aurangabad, Madhya Pradesh, Uttar Pradesh, Odisha or Kerala. Just today i.e. on 25th May 2021, Justices Bela Trivedi and Justice Kalra had asked how come all the hospitals don t have NOC from the Fire De[partment. They also questioned the ASG (Assistant Solicitor General) as how BU (Building Use Certificate) has been granted as almost all the 400 hospitals are in residential area. To which the ASG replies, it is the same state in almost 4000 schools as well as 6000 odd factories in Ahemdabad alone, leave the rest of the district and state alone. And this is when last year strict instuctions were passed. They chose to do nothing sadly. I will share a link on this when bar and bench gives me
The Hindu also shared the whole raid on twitter saga.
Conclusion
In conclusion, I sincerely do not where we are headed. The only thing I know is that we cannot expect things to be better before year-end and maybe even after that. It all depends on the vaccines and their availability.
After that ruralindia article, I had to see quite a few movies and whatnot just to get that out of my head. And this is apart from the 1600 odd teachers and workers who have died in the U.P. poll duty. Now, what a loss, not just to the family members of the victims, but a whole generation of school children who would not be able to get quality teaching and be deprived of education. What will be their future, God only knows.
The only good Bollywood movie which I saw was Ramprasad ki Teravi . The movie was an accurate representation of most families in and around me. There was a movie called Sansar (1987) which showed the breakup of the joint family and into a nuclear family. This movie could very well have been a continuation of the same. Even Marathi movies which at one time were very progressive have gone back to the same boy, girl love story routine. Sameer, though released in late 2020, was able to see it only recently. Vakeel Saab was an ok copy of Pink . I loved Sameer as, unlike Salman Khan films, it showed pretty much an authentic human struggle of a person who goes to the Middle East without any qualifications and works as a laborer and the trials he goes through. Somehow, Malayalam movies have a knack for showing truth without much of budget. Most of the Indian web series didn t make an impact. I think many of them were just going through the motions, it seems as everybody is concerned with the well-being of their near and dear ones. There was also this (Trigger Warning: This story discusses organized campaigns glorifying and advocating sexual violence against Muslim women.) Hoping people somehow make it to the other side of the pandemic.
The freenode IRC network has been hijacked.
TL;DR: move to libera.chat or OFTC.net, as did countless
free software projects including Gentoo, CentOS, KDE, Wikipedia,
FOSDEM, and more. Debian and the Tor project were already on OFTC and
are not affected by this.
What is freenode and why should I care?
freenode is the largest remaining IRC network. Before this
incident, it had close to 80,000 users, which is small in terms of
modern internet history -- even small social networks are larger by
multiple orders of magnitude -- but is large in IRC history. The IRC
network is also extensively used by the free software community, being
the default IRC network on many programs, and used by hundreds if not
thousands of free software projects.
I have been using freenode since at least 2006.
This matters if you care about IRC, the internet, open protocols,
decentralisation, and, to a certain extent, federation as well. It
also touches on who has the right on network resources: the people who
"own" it (through money) or the people who make it work (through their
labor). I am biased towards open protocols, the internet, federation,
and worker power, and this might taint this analysis.
What happened?
It's a long story, but basically:
back in 2017, the former head of staff sold the freenode.net
domain (and its related company) to Andrew Lee, "American
entrepreneur, software developer and writer", and, rather weirdly,
supposedly "crown prince of Korea" although that part is kind of
complex (see House of Yi, Yi Won, and Yi Seok). It
should be noted the Korean Empire hasn't existed for over a
century at this point (even though its flag, also weirdly,
remains)
back then, this was only known to the public as this strange PIA
and freenode joining forces gimmick. it was suspicious at
first, but since the network kept running, no one paid much
attention to it. opers of the network were similarly reassured
that Lee would have no say in the management of the network
this all changed recently when Lee asserted ownership of the
freenode.net domain and started meddling in the operations of the
network, according to this summary. this part is disputed,
but it is corroborated by almost a dozen former staff which
collectively resigned from the network in protest, after legal
threats, when it was obvious freenode was lost.
the departing freenode staff founded a new network,
irc.libera.chat, based on the new ircd they were working on
with OFTC, solanum
meanwhile, bot armies started attacking all IRC networks: both
libera and freenode, but also OFTC and unrelated networks like a
small one I help operate. those attacks have mostly stopped as of
this writing (2021-05-24 17:30UTC)
on freenode, however, things are going for the worse: Lee has been
accused of taking over a channel, in a grotesque abuse of
power; then changing freenode policy to not only justify the
abuse, but also remove rules against hateful speech, effectively
allowing nazis on the network (update: the change was
reverted, but not by Lee)
Update: even though the policy change was reverted, the actual
conversations allowed on freenode have already degenerated into toxic
garbage. There are also massive channel takeovers (presumably
over 700), mostly on channels that were redirecting to libera,
but also channels that were still live. Channels that were taken
over include #fosdem, #wikipedia, #haskell...
Instead of working on the network, the new "so-called freenode" staff
is spending effort writing bots and patches to basically automate
taking over channels. I run an IRC network and this bot is
obviously not standard "services" stuff... This is just grotesque.
At this point I agree with this HN comment:
We should stop implicitly legitimizing Andrew Lee's power grab by
referring to his dominion as "Freenode". Freenode is a
quarter-century-old community that has changed its name to
libera.chat; the thing being referred to here as "Freenode" is
something else that has illegitimately acquired control of
Freenode's old servers and user database, causing enormous
inconvenience to the real Freenode.
I don't agree with the suggested name there, let's instead call it "so
called freenode" as suggested later in the thread.
What now?
I recommend people and organisations move away from freenode as soon
as possible. This is a major change: documentation needs to be fixed,
and the migration needs to be coordinated. But I do not believe we can
trust the new freenode "owners" to operate the network reliably and in
good faith.
It's also important to use the current momentum to build a critical
mass elsewhere so that people don't end up on freenode again by
default and find an even more toxic community than your typical
run-of-the-mill free software project (which is already not a high bar
to meet).
Update: people are moving to libera in droves. It's now reaching
18,000 users, which is bigger than OFTC and getting close to the
largest, traditionnal, IRC networks (EFnet, Undernet, IRCnet are in
the 10-20k users range). so-called freenode is still larger, currently
clocking 68,000 users, but that's a huge drop from the previous count
which was 78,000 before the exodus began. We're even starting to see
the effects of the migration on netsplit.de.
Update 2: the isfreenodedeadyet.com site is updated more
frequently than netsplit and shows tons more information. It shows 25k
online users for libera and 61k for so-called freenode (down from
~78k), and the trend doesn't seem to be stopping for so-called
freenode. There's also a list of 400+ channels that have moved
out. Keep in mind that such migrations take effect over long
periods of time.
Where do I move to?
The first thing you should do is to figure out which tool to use for
interactive user support. There are multiple alternatives, of course
-- this is the internet after all -- but here is a short list of
suggestions, in preferred priority order:
Matrix.org, which bridges with OFTC and (hopefully soon) with
libera as well, modern IRC alternative
XMPP/Jabber also still exists, if you're into that kind of
stuff, but I don't think the "chat room" story is great there, at
least not as good as Matrix
Basically, the decision tree is this:
if you want to stay on IRC:
if you are already on many OFTC channels and few freenode
channels: move to OFTC
if you are more inclined to support the previous freenode staff:
move to libera
if you care about matrix users (in the short term): move to
OFTC
if you are ready to leave IRC:
if you want the latest and greatest: move to Matrix
if you like XML and already use XMPP: move to XMPP
Frankly, at this point, everyone should seriously consider moving to
Matrix. The user story is great, the web is a first class user, it
supports E2EE (although XMPP as well), and has a lot of momentum
behind it. It even bridges with IRC well (which is not the case for
XMPP) so if you're worried about problems like this happening again.
(Indeed, I wouldn't be surprised if similar drama happens on OFTC or
libera in the future. The history of IRC is full of such epic
controversies, takeovers, sabotage, attacks, technical flamewars, and
other silly things. I am not sure, but I suspect a federated model
like Matrix might be more resilient to conflicts like this one.)
Changing protocols might mean losing a bunch of users however: not
everyone is ready to move to Matrix, for example. Graybeards like me
have been using irssi for years, if not decades, and would take quite
a bit of convincing to move elsewhere.
I have mostly kept my channels on IRC, and moved either to OFTC or
libera. In retrospect, I think I might have moved everything to OFTC
if I would have thought about it more, because almost all of my
channels are there. But I kind of expect a lot of the freenode
community to move to libera, so I am keeping a socket open there
anyways.
How do I move?
The first thing you should do is to update documentation, websites,
and source code to stop pointing at freenode altogether. This is what
I did for feed2exec, for example. You need to let people know in
the current channel as well, and possibly shutdown the channel on
freenode.
Since my channels are either small or empty, I took the radical
approach of:
redirecting the channel to ##unavailable which is historically
the way we show channels have moved to another network
make the channel invite-only (which effectively enforces the
redirection)
kicking everyone out of the channel
kickban people who rejoin
set the topic to announce the change
In IRC speak, the following commands should do all this:
/msg ChanServ set #anarcat mlock +if ##unavailable
/msg ChanServ clear #anarcat users moving to irc.libera.chat
/msg ChanServ set #anarcat restricted on
/topic #anarcat this channel has moved to irc.libera.chat
If the channel is not registered, the following might work
/mode #anarcat +if ##unavailable
Then you can leave freenode altogether:
/disconnect Freenode unacceptable hijack, policy changes and takeovers. so long and thanks for all the fish.
Keep in mind that some people have been unable to setup such
redirections, because the new freenode staff have taken over their
channel, in which case you're out of luck...
Some people have expressed concern about their private data hosted at
freenode as well. If you care about this, you can always talk to
NickServ and DROP your nick. Be warned, however, that this assumes
good faith of the network operators, which, at this point, is kind of
futile. I would assume any data you have registered on there
(typically: your NickServ password and email address) to be
compromised and leaked. If your password is used elsewhere (tsk, tsk),
change it everywhere.
Update: there's also another procedure, similar to the above, but
with a different approach. Keep in mind that so-called freenode staff
are actively hijacking channels for the mere act of mentioning libera
in the channel topic, so thread carefully there.
Last words
This is a sad time for IRC in general, and freenode in
particular. It's a real shame that the previous freenode staff have
been kicked out, and it's especially horrible that if the new policies of
the network are basically making the network open to nazis. I wish
things would have gone out differently: now we have yet another fork
in the IRC history. While it's not the first time freenode changes
name (it was called OPN before), now the old freenode is still around
and this will bring much confusion to the world, especially since the
new freenode staff is still claiming to support FOSS.
I understand there are many sides to this story, and some people were
deeply hurt by all this. But for me, it's completely unacceptable
to keep pushing your staff so hard that they basically all (except
one?) resign in protest. For me, that's leadership failure at the
utmost, and a complete disgrace. And of course, I can't in good
conscience support or join a network that allows hate speech.
Regardless of the fate of whatever we'll call what's left of freenode,
maybe it's time for this old IRC thing to die already. It's still a
sad day in internet history, but then again, maybe IRC will never
die...
A couple of weeks ago I stumbled across a Template Haskell question on the
Haskell sub-reddit. This was quite exciting
because I rarely see TH questions, and this one was by someone working
on something which was quite similar to what I had done: they were writing
a code generator, and had pure functions of type Exp -> Exp -> Exp, but
wanted to leverage TH's quasi-quotation syntax (e.g. [ \p -> p + 1 ])
as a syntactic short-hand. Alas these quasi-quotes are of type Q Exp, so
the question becomes, how to escape Q?
I had to do exactly this, so I knew an answer: use unsafePerformIO. Another
commenter pointed at this Overloaded Quotation Brackets GHC
Proposal which I was
not aware of and is a much more elegant solution, available since GHC 9.0.1.
There was something odd about the question, though.
Sometime later on, I checked back to find that the thread had been deleted.
It turns out it was one of a set of duplicate posts with exactly the same
question. Spammers are copying old questions and reposting them, presumably
in an attempt to harvest "Reddit karma".
When I learned that, my sense of oddness about the question remained, so I went
to find the original thread, to discover I wrote the original question a year
ago
and had therefore literally answered my own question a year
later.
Back to the more elegant solution. In GHC versions 9 onwards, quasi-quotation
returns a different type that is not bound up in the Q Monad:
GHC 8.8.4:
> :t [ 42 ]
[ 42 ] :: Language.Haskell.TH.Lib.Internal.ExpQ
> [ 42 ]
<interactive>:5:1: error:
No instance for (Show Language.Haskell.TH.Lib.Internal.ExpQ)
arising from a use of print
In a stmt of an interactive GHCi command: print it
GHC 9.0.1:
> :t [ 42 ]
[ 42 ]
:: Language.Haskell.TH.Syntax.Quote m =>
m Language.Haskell.TH.Syntax.Exp
> [ 42 ]
LitE (IntegerL 42)
My newsletter Le Courrier du hacker (3,800 subscribers, 176 issues) is 3 years old and Mailchimp costs were becoming unbearable for a small project ($50 a month, $600 a year), with still limited revenues nowadays. Switching to the Open Source Mailtrain plugged to the AWS Simple Email Service (SES) will dramatically reduce the associated costs.
First things first, thanks a lot to Pierre-Gilles Leymarie for his own article about switching to Mailtrain/SES. I owe him (and soon you too) so much. This article will be a step-by-step about how to set up Mailtrain/SES on a dedicated server running Linux.
What s the purpose of this article?
Mailchimp is more and more expensive following the growth of your newsletter subscribers and you need to leave it. You can use Mailtrain, a web app running on your own server and use the AWS SES service to send emails in an efficient way, avoiding to be flagged as a spammer by the other SMTP servers (very very common, you can try but you have been warned against
Prerequisites
You will need the following prerequisites :
An AWS account with admin rights
Full control over the domain name you use to send your newsletter
A baremetal or virtual Linux Debian server you have the root access to
NodeJS installed (8x and 10x are ok with Mailtrain)
A MySQL/MariaDB instance with the root access to
Redis 3x (not 5) if you want to use Redis (not mandatory)
Steps
This is a fairly straightforward setup if you know what you re doing. In the other case, you may need the help of a professional sysadmin.
You will need to complete the following steps in order to complete your setup:
Configure AWS SES
Configure your server by:
configuring your database
install Mailtrain
configuring your web server
Configure your Mailtrain setup
Configure AWS SES
Verify your domain
You need to configure the DKIM to certify that the emails sent are indeed from your own domain. DKIM is mandatory, it s the de-facto standard in the mail industry.
Ask to verify your domain
Ask AWS SES to verify a domain
Generate the DKIM settings
Generate the DKIM settings
Use the DKIM settings
Now you have your DKIM settings and Amazon AWS is waiting for finding the TXT field in your DNS zone.
Configure your DNS zone to include DKIM settings
I can t be too specific for this section because it varies A LOT depending on your DNS provider. The keys is: as indicated by the previous image you have to create one TXT record and two CNAME records in your DNS zone. The names, the types and the values are indicated by AWS SES.
If you don t understand what s going here, there is a high probabiliy you ll need a system administrator to apply these modifications and the next ones in this article.
Am I okay for AWS SES ?
As long as the word verified does not appear for your domain, as shown in the image below, something is wrong. Don t wait too long, you have a misconfiguration somewhere.
AWS SES pending verification
When your domain is verified, you ll also receive an email to inform you about the successful verification.
SMTP settings
The last step is generating your credentials to use the AWS SES SMTP server. IT is really straightforward, providing the STMP address to use, the port, and a pair of username/password credentials.
AWS SES SMTP settings and credentials
Just click on Create My SMTP Credentials and follow the instructions. Write the SMTP server address somewhere and store the file with credentials on your computer, we ll need them below.
Configure your server
As we said before, we need a baremetal server or a virtual machine running a recent Linux.
Configure your MySQL/MariaDB database
We create a user mailtrain having all rights on a new database mailtrain.
MariaDB [(none)]> create database mailtrain;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> CREATE USER 'mailtrain' IDENTIFIED BY 'V3rYD1fF1cUlTP4sSW0rd!';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON mailtrain.* TO 'mailtrain'@localhost IDENTIFIED BY 'V3rYD1fF1cUlTP4sSW0rd!';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> show databases;
+--------------------+
Database
+--------------------+
information_schema
mailtrain
mysql
performance_schema
+--------------------+
6 rows in set (0.00 sec)
MariaDB [(none)]> Bye
Configure your web server
I use Nginx and I ll give you the complete setup for it, including generating Let s Encrypt.
Configure Let s Encrypt
You need to stop Nginx as root:
systemctl stop nginx
Then get the certificate only, I ll give the Nginx Vhost configuration:
certbot certonly -d mailtrain.toto.com
Install Mailtrain
On your server create the following directory:
mkdir -p /var/www/ cd /var/www wget https://github.com/Mailtrain-org/mailtrain/archive/refs/tags/v1.24.1.tar.gz tar zxvf v1.24.1.tar.gz
Modify the file /var/www/mailtrain/config/production.toml to use the MySQL settings:
Now Mailtrain is launched and should be running. Yeah I know it s ugly to launch like this (root process in a screen, etc) you can improve security with the following commands:
To register the following systemd unit and to launch the new Mailtrain daemon, use the following commands (do not forget to kill your screen session if you used it before):
Now Mailtrain is running under the classic user mailtrain of the mailtrain system group.
Configure the Nginx Vhost configuration for your domain
Here is my configuration for the Mailtrain Nginx Vhost:
This Nginx vhost will redirect all http requests coming to the Mailtrain process running on the 3000 port. Now it s time to setup Mailtrain!
Setup Mailtrain
You should be able to access your Mailtrain at https://mailtrain.toto.com
Mailtrain is quite simple to configure, Here is my mailer setup. Mailtrain just forwards emails to AWS SES. We only have to plug Mailtrain to AWS SES.
Mailtrain mailer setup
The hostname is provided by AWS SES in the STMP Settings section. Use the 465 port and USE TLS option. Next is providing your AWS SES username and password you generated above and stored somewhere on your computer.
One of the issues I encountered is the AWS SES rate limit. Send too many emails too fast will get you flagged as a spammer.
So I had to throttle Mailtrain. Because I m a lazy man, I asked Pierre-Gilles Leymarie his setup. Quite easier than determining myself the good one. Here is my setup. Works fine for my soon-to-be 4k subscribers. The idea is: if your AWS SES lets you know you send too fast then just slow down.
Mailtrain to throttle sending emails to AWS SES
Conclusion
That s it! You re ready! Almost. You need an HTML template for your newsletter and a list of subscribers. Buf if you re not new in the newsletter field, fleeing Mailchimp because of their expensive prices, you should have them both already.
After sending almost ten issues with this setup, I m really happy with it. Open/click rates are the same.
When leaving Mailchimp, do not leave any list of subscribers because they ll charge you $8 for a 0 to 500 contacts, that s crazy expensive!
About the author
I recently bought a Pinebook Pro. This was mainly out of general interest,
but also because I wanted to have a spare portable computer. When I was
recently having some difficulty with my laptop not charging, I realised that I
am dependent on having access to Emacs, notmuch.el and my usual git
repositories in the way that most people are dependent on their smartphones
all the info I need to get things done is in there, and it s very disabling
not to have it. So, good to have a spare.
I decided to get the machine running the hard way, and have been working to
add a facility to install the device-specific bootloader to
Consfigurator. It has been good to learn about
how ARM machines boot. The only really hard part turned out to be coming up
with the right abstractions within Consfigurator, thanks to the hard work of
the Debian U-Boot maintainers. This left me with a chroot and a corresponding
disk image, properly partitioned and with the bootloader installed. It was
only then that the difficulties began: getting a kernel and initrd combination
which can output to the Pinebook Pro s screen and take input from its keyboard
is not really straightforward yet, but that s required for inputting disk
encryption passwords, which are required on portable devices. I don t have
the right hardware to make a serial connection to the machine, so all this
took a lot of trial and error. I ve ended up using Manjaro s patched upstream
kernel build for now, because that compiles in the right drivers, and
debugging an initrd without a serial connection is far too inefficient.
What I keep having to remind myself is that this device isn t really a laptop
in the usual sense it s a single board computer that s powering several
pieces of hardware which together roughly constitute a laptop. I think
something which epitomises this is how the power light doesn t come on when
you hit the power button, but only when the bootloader or operating system
kernel thinks to turn on the LED. You start up this SBC and it loads up some
software and then once it has got itself going several seconds later
that software starts turning on the screen, keyboard, power LEDs etc. Whereas
on an ordinary laptop it s more than you turn on the keyboard, screen, power
LEDs etc. all at once, and then /they/ go off and load some software. Of
course this description is nothing like what s actually going on, but it s my
attempt to capture how it feels as a user, who is installing operating
systems, but otherwise treating the laptop s hardware, including things like
boot ROMs, as a black box. There are tangible differences between what it is
like to do that with an ordinary laptop and with the Pinebook Pro.
Thanks to Vagrant Cascadian for all the work on U-Boot in Debian and for help
on IRC, Cyril Brulebois for help with crossbuilding, and Birger Schacht for a
useful blog
post.
The Population Issue and its many facets
Another couple of weeks passed. A Lot of things happening, lots of anger and depression in folks due to handling in pandemic, but instead of blaming they are willing to blame everybody else including the population. Many of them want forced sterilization like what Sanjay Gandhi did during the Emergency (1975). I had to share So Long, My son . A very moving tale of two families of what happened to them during the one-child policy in China. I was so moved by it and couldn t believe that the Chinese censors allowed it to be produced, shot, edited, and then shared worldwide. It also won a couple of awards at the 69th Berlin Film Festival, silver bear for the best actor and the actress in that category. But more than the award, the theme, and the concept as well as the length of the movie which was astonishing. Over a 3 hr. something it paints a moving picture of love, loss, shame, relief, anger, and asking for forgiveness. All of which can be identified by any rational person with feelings worldwide.
Girl child
What was also interesting though was what it couldn t or wasn t able to talk about and that is the Chinese leftover men. In fact, a similar situation exists here in India, only it has been suppressed. This has been more pronounced more in Asia than in other places. One big thing in this is human trafficking and mostly women trafficking. For the Chinese male, that was happening on a large scale from all neighboring countries including India. This has been shared in media and everybody knows about it and yet people are silent. But this is not limited to just the Chinese, even Indians have been doing it. Even yesteryear actress Rupa Ganguly was caught red-handed but then later let off after formal questioning as she is from the ruling party. So much for justice.
What is and has been surprising at least for me is Rwanda which is in the top 10 of some of the best places in equal gender. It, along with other African countries have also been in news for putting quite a significant amount of percentage of GDP into public healthcare (between 20-10%), but that is a story for a bit later. People forget or want to forget that it was in Satara, a city in my own state where 220 girls changed their name from nakusha or unwanted to something else and that had become a piece of global news. One would think that after so many years, things would have changed, the only change that has happened is that now we have two ministries, The Ministry of Women and Child Development (MoWCD) and The Ministry of Health and Welfare (MoHFW). Sadly, in both cases, the ministries have been found wanting, Whether it was the high-profile Hathras case or even the routine cries of help which given by women on the twitter helpline. Sadly, neither of these ministries talks about POSH guidelines which came up after the 2012 gangrape case. For both these ministries, it should have been a pinned tweet. There is also the 1994 PCPNDT Act which although made in 1994, actually functioned in 2006, although what happens underground even today nobody knows .
On the global stage, about a decade ago, Stephen J. Dubner and Steven Levitt argued in their book Freakonomics how legalized abortion both made the coming population explosion as well as expected crime rates to be reduced. There was a huge pushback on the same from the conservatives and has become a matter of debate, perhaps something that the Conservatives wanted. Interestingly, it hasn t made them go back but go forward as can be seen from the Freakonomics site.
Climate Change
Another topic that came up for discussion was repeatedly climate change, but when I share Shell s own 1998 Confidential report titled Greenhouse effect all become strangely silent. The silence here is of two parts, there probably is a large swathe of Indians who haven t read the report and there may be a minority who have read it and know what already has been shared with U.S. Congress. The Conservative s argument has been for it is jobs and a weak we need to research more . There was a partial debunk of it on the TBD podcast by Matt Farell and his brother Sean Farell as to how quickly the energy companies are taking to the coming change.
Health Budget
Before going to Covid stories. I first wanted to talk about Health Budgets. From the last 7 years the Center s allocation for health has been between 0.34 to 0.8% per year. That amount barely covers the salaries to the staff, let alone any money for equipment or anything else. And here by allocation I mean, what is actually spent, not the one that is shared by GOI as part of budget proposal. In fact, an article on Wire gives a good breakdown of the numbers. Even those who are on the path of free markets describe India s health business model as a flawed one. See the Bloomberg Quint story on that. Now let me come to Rwanda. Why did I chose Rwanda, I could have chosen South Africa where I went for Debconf 2016, I chose because Rwanda s story is that much more inspiring. In many ways much more inspiring than that South Africa in many ways. Here is a country which for decades had one war or the other, culminating into the Rwanda Civil War which ended in 1994. And coincidentally, they gained independence on a similar timeline as South Africa ending Apartheid in 1994. What does the country do, when it gains its independence, it first puts most of its resources in the healthcare sector. The first few years at 20% of GDP, later than at 10% of GDP till everybody has universal medical coverage.
Coming back to the Bloomberg article I shared, the story does not go into the depth of beyond-expiry date medicines, spurious medicines and whatnot. Sadly, most media in India does not cover the deaths happening in rural areas and this I am talking about normal times. Today what is happening in rural areas is just pure madness. For last couple of days have been talking with people who are and have been covering rural areas. In many of those communities, there is vaccine hesitancy and why, because there have been whatsapp forwards sharing that if you go to a hospital you will die and your kidney or some other part of the body will be taken by the doctor. This does two things, it scares people into not going and getting vaccinated, at the same time they are prejudiced against science. This is politics of the lowest kind. And they do it so that they will be forced to go to temples or babas and what not and ask for solutions. And whether they work or not is immaterial, they get fixed and property and money is seized. Sadly, there are not many Indian movies of North which have tried to show it except for oh my god but even here it doesn t go the distance. A much more honest approach was done in Trance . I have never understood how the South Indian movies are able to do a more honest job of story-telling than what is done in Bollywood even though they do in 1/10th the budget that is needed in Bollywood. Although, have to say with OTT, some baggage has been shed but with the whole film certification rearing its ugly head through MEITY orders, it seems two steps backward instead of forward. The idea being simply to infantilize the citizens even more. That is a whole different ball-game which probably will require its own space.
Vaccine issues
One good news though is that Vaccination has started. But it has been a long story full of greed by none other than GOI (Government of India) or the ruling party BJP. Where should I start with. I probably should start with this excellent article done by Priyanka Pulla. It is interesting and fascinating to know how vaccines are made, at least one way which she shared. She also shared about the Cutter Incident which happened in the late 50 s. The response was on expected lines, character assassination of her and the newspaper they published but could not critique any of the points made by her. Not a single point that she didn t think about x or y. Interestingly enough, in January 2021 Bharati Biotech was supposed to be share phase 3 trial data but hasn t been put up in public domain till May 2021. In fact, there have been a few threads raised by both well-meaning Indians as well as others globally especially on twitter to which GOI/ICMR (Indian Council of Medical Research) is silent. Another interesting point to note is that Russia did say in its press release that it is possible that their vaccine may not be standard (read inactivation on their vaccines and another way is possible but would take time, again Brazil has objected, but India hasn t till date.)
What also has been interesting is the homegrown B.1.617 lineage or known as double mutant . This was first discovered from my own state, Maharashtra and then transported around the world. There is also B.1.618 which was found in West Bengal and is same or supposed to be similar to the one found in South Africa. This one is known as Triple mutant . About B.1.618 we don t know much other than knowing that it is much more easily transferable, much more infectious. Most countries have banned flights from India and I cannot fault them anyway. Hell, when even our diplomats do not care for procedures to be followed during the pandemic then how a common man is supposed to do. Of course, now for next month, Mr. Modi was supposed to go and now will not attend the G7 meeting. Whether, it is because he would have to face the press (the only Prime Minister and the only Indian Prime Minister who never has faced free press.) or because the Indian delegation has been disinvited, we would never know.
A good article which shares lots of lows with how things have been done in India has been an article by Arundhati Roy. And while the article in itself is excellent and shares a bit of the bitter truth but is still incomplete as so much has been happening. The problem is that the issue manifests in so many ways, it is difficult to hold on. As Arundhati shared, should we just look at figures and numbers and hold on, or should we look at individual ones, for e.g. the one shared in Outlook India. Or the one shared by Dr. Dipshika Ghosh who works in Covid ICU in some hospital
Dr. Dipika Ghosh sharing an incident in Covid Ward
Interestingly as well, while in the vaccine issue, Brazil Anvisa doesn t know what they are doing or the regulator just isn t knowledgeable etc. (statements by various people in GOI, when it comes to testing kits, the same is an approver.)
ICMR/DGCI approving internationally validated kits, Press release.
Twitter
In the midst of all this, one thing that many people have forgotten and seem to have forgotten that Twitter and other tools are used by only the elite. The reason why the whole thing has become serious now than in the first phase is because the elite of India have also fallen sick and dying which was not the case so much in the first phase. The population on Twitter is estimated to be around 30-34 million and people who are everyday around 20 odd million or so, which is what 2% of the Indian population which is estimated to be around 1.34 billion. The other 98% don t even know that there is something like twitter on which you can ask help. Twitter itself is exclusionary in many ways, with both the emoticons, the language and all sorts of things. There is a small subset who does use Twitter in regional languages, but they are too small to write anything about. The main language is English which does become a hindrance to lot of people.
Censorship
Censorship of Indians critical of Govt. mishandling has been non-stop. Even U.S. which usually doesn t interfere into India s internal politics was forced to make an exception. But of course, this has been on deaf ears. There is and was a good thread on Twitter by Gaurav Sabnis, a friend, fellow Puneite now settled in U.S. as a professor.
Gaurav on Trump-Biden on vaccination of their own citizens
Now just to surmise what has been happened in India and what has been happening in most of the countries around the world. Most of the countries have done centralization purchasing of the vaccine and then is distributed by the States, this is what we understand as co-operative federalism. While last year, GOI took a lot of money under the shady PM Cares fund for vaccine purchase, donations from well-meaning Indians as well as Industries and trade bodies. Then later, GOI said it would leave the states hanging and it is they who would have to buy vaccines from the manufacturers. This is again cheap politics. The idea behind it is simple, GOI knows that almost all the states are strapped for cash. This is not new news, this I have shared a couple of months back. The problem has been that for the last 6-8 months no GST meeting has taken place as shared by Punjab s Finance Minister Amarinder Singh. What will happen is that all the states will fight in-between themselves for the vaccine and most of them are now non-BJP Governments. The idea is let the states fight and somehow be on top. So, the pandemic, instead of being a public health issue has become something of on which politics has to played. The news on whatsapp by RW media is it s ok even if a million or two also die, as it is India is heavily populated. Although that argument vanishes for those who lose their dear and near ones. But that just isn t the issue, the issue goes much more deeper than that
Oxygen:12% Remedisivir:12% Sanitiser:12% Ventilator:12% PPE:18% Ambulances 28%
Now all the products above are essential medical equipment and should be declared as essential medical equipment and should have price controls on which GST is levied. In times of pandemic, should the center be profiting on those. States want to let go and even want the center to let go so that some relief is there to the public, while at the same time make them as essential medical equipment with price controls. But GOI doesn t want to. Leaders of opposition parties wrote open letters but no effect. What is sad to me is how Ambulances are being taxed at 28%. Are they luxury items or sin goods ? This also reminds of the recent discovery shared by Mr. Pappu Yadav in Bihar. You can see the color of ambulances as shared by Mr. Yadav, and the same news being shared by India TV news showing other ambulances. Also, the weak argument being made of not having enough drivers. Ideally, you should have 2-3 people, both 9-1-1 and Chicago Fire show 2 people in ambulance but a few times they have also shown to be flipped over. European seems to have three people in ambulance, also they are also much more disciplined as drivers, at least an opinion shared by an American expat.
Pappu Yadav, President Jan Adhikar Party, Bihar May 11, 2021
What is also interesting to note is GOI plays this game of Health is State subject and health is Central subject depending on its convenience. Last year, when it invoked the Epidemic and DMA Act it was a Central subject, now when bodies are flowing down the Ganges and pyres being lit everywhere, it becomes a State subject. But when and where money is involved, it again becomes a Central subject. The States are also understanding it, but they are fighting on too many fronts.
Snippets from Karnataka High Court hearing today, 13th March 2021
One of the good things is most of the High Courts have woken up. Many of the people on the RW think that the Courts are doing Judicial activism . And while there may be an iota of truth in it, the bitter truth is that many judges or relatives or their helpers have diagnosed and some have even died due to Covid. In face of the inevitable, what can they do. They are hauling up local Governments to make sure they are accountable while at the same time making sure that they get access to medical facilities. And I as a citizen don t see any wrong in that even if they are doing it for selfish reasons. Because, even if justice is being done for selfish reasons, if it does improve medical delivery systems for the masses, it is cool. If it means that the poor and everybody else are able to get vaccinations, oxygen and whatever they need, it is cool. Of course, we are still seeing reports of patients spending in the region of INR 50k and more for each day spent in hospital. But as there are no price controls, judges cannot do anything unless they want to make an enemy of the medical lobby in the country. A good story on medicines and what happens in rural areas, see no further than Laakhon mein ek.
Allahabad High Court hauling Uttar Pradesh Govt. for lack of Oxygen is equal to genocide, May 11, 2021
The censorship is not just related to takedown requests on twitter but nowadays also any articles which are critical of the GOI s handling. I have been seeing many articles which have shared facts and have been critical of GOI being taken down. Previously, we used to see 404 errors happen 7-10 years down the line and that was reasonable. Now we see that happen, days weeks or months. India seems to be turning more into China and North Korea and become more anti-science day-by-day
Fake websites
Before going into fake websites, let me start with a fake newspaper which was started by none other than the Gujarat CM Mr. Modi in 2005 .
Gujarat Satya Samachar 2005 launched by Mr. Modi.
And if this wasn t enough than on Feb 8, 2005, he had invoked Official Secrets Act
Mr. Modi invoking Official Secrets Act, Feb 8 2005 Gujarat Samachar
The headlines were In Modi s regime press freedom is in peril-Down with Modi s dictatorship. So this was a tried and tested technique. The above information was shared by Mr. Urvish Kothari, who incidentally also has his own youtube channel.
Now cut to 2021, and we have a slew of fake websites being done by the same party. In fact, it seems they started this right from 2011. A good article on BBC itself tells the story. Hell, Disinfo.eu which basically combats disinformation in EU has a whole pdf chronicling how BJP has been doing it. Some of the sites it shared are
Times of New York Manchester Times Times of Los Angeles Manhattan Post Washington Herald and many more.
The idea being take any site name which sounds similar to a brand name recognized by Indians and make fool of them. Of course, those of who use whois and other such tools can easily know what is happening. Two more were added to the list yesterday, Daily Guardian and Australia Today. There are of course, many features which tell them apart from genuine websites. Most of these are on shared hosting rather than dedicated hosting, most of these are bought either from Godaddy and Bluehost. While Bluehost used to be a class act once upon a time, both the above will do anything as long as they get money. Don t care whether it s a fake website or true. Capitalism at its finest or worst depending upon how you look at it. But most of these details are lost on people who do not know web servers, at all and instead think see it is from an exotic site, a foreign site and it chooses to have same ideas as me. Those who are corrupt or see politics as a tool to win at any cost will not see it as evil. And as a gentleman Raghav shared with me, it is so easy to fool us. An example he shared which I had forgotten. Peter England which used to be an Irish brand was bought by Aditya Birla group way back in 2000. But even today, when you go for Peter England, the way the packaging is done, the way the prices are, more often than not, people believe they are buying the Irish brand. While sharing this, there is so much of Naom Chomsky which comes to my mind again and again
Caste Issues
I had written about caste issues a few times on this blog. This again came to the fore as news came that a Hindu sect used forced labor from Dalit community to make a temple. This was also shared by the hill. In both, Mr. Joshi doesn t tell that if they were volunteers then why their passports have been taken forcibly, also I looked at both minimum wage prevailing in New Jersey as a state as well as wage given to those who are in the construction Industry. Even in minimum wage, they were giving $1 when the prevailing minimum wage for unskilled work is $12.00 and as Mr. Joshi shared that they are specialized artisans, then they should be paid between $23 $30 per hour. If this isn t exploitation, then I don t know what is.
And this is not the first instance, the first instance was perhaps the case against Cisco which was done by John Doe. While I had been busy with other things, it seems Cisco had put up both a demurrer petition and a petition to strike which the Court stayed. This seemed to all over again a type of apartheid practice, only this time applied to caste. The good thing is that the court stayed the petition.
Dr. Ambedkar s statement if Hindus migrate to other regions on earth, Indian caste would become a world problem given at Columbia University in 1916, seems to be proven right in today s time and sadly has aged well. But this is not just something which is there only in U.S. this is there in India even today, just couple of days back, a popular actress Munmun Dutta used a casteist slur and then later apologized giving the excuse that she didn t know Hindi. And this is patently false as she has been in the Bollywood industry for almost now 16-17 years. This again, was not an isolated incident. Seema Singh, a lecturer in IIT-Kharagpur abused students from SC, ST backgrounds and was later suspended. There is an SC/ST Atrocities Act but that has been diluted by this Govt. A bit on the background of Dr. Ambedkar can be found at a blog on Columbia website. As I have shared and asked before, how do we think, for what reason the Age of Englightenment or the Age of Reason happened. If I were a fat monk or a priest who was privileges, would I have let Age of Enlightenment happen. It broke religion or rather Church which was most powerful to not so powerful and that power was more distributed among all sort of thinkers, philosophers, tinkers, inventors and so on and so forth.
Situation going forward
I believe things are going to be far more complex and deadly before they get better. I had to share another term called Comorbidities which fortunately or unfortunately has also become part of twitter lexicon. While I have shared what it means, it simply means when you have an existing ailment or condition and then Coronavirus attacks you. The Virus will weaken you. The Vaccine in the best case just stops the damage, but the damage already done can t be reversed. There are people who advise and people who are taking steroids but that again has its own side-effects. And this is now, when we are in summer. I am afraid for those who have recovered, what will happen to them during the Monsoons. We know that the Virus attacks most the lungs and their quality of life will be affected. Even the immune system may have issues. We also know about the inflammation. And the grant that has been given to University of Dundee also has signs of worry, both for people like me (obese) as well as those who have heart issues already. In other news, my city which has been under partial lockdown since a month, has been extended for another couple of weeks. There are rumors that the same may continue till the year-end even if it means economics goes out of the window.There is possibility that in the next few months something like 2 million odd Indians could die
The above is a conversation between Karan Thapar and an Oxford Mathematician Dr. Murad Banaji who has shared that the under-counting of cases in India is huge. Even BBC shared an article on the scope of under-counting. Of course, those on the RW call of the evidence including the deaths and obituaries in newspapers as a narrative . And when asked that when deaths used to be in the 20 s or 30 s which has jumped to 200-300 deaths and this is just the middle class and above. The poor don t have the money to get wood and that is the reason you are seeing the bodies in Ganges whether in Buxar Bihar or Gajipur, Uttar Pradesh. The sights and visuals makes for sorry reading Pandit Ranjan Mishra son on his father s death due to unavailability of oxygen, Varanasi, Uttar Pradesh, 11th May 2021.
For those who don t know Pandit Ranjan Mishra was a renowned classical singer. More importantly, he was the first person to suggest Mr. Modi s name as a Prime Ministerial Candidate. If they couldn t fulfil his oxygen needs, then what can be expected for the normal public.
Conclusion
Sadly, this time I have no humorous piece to share, I can however share a documentary which was shared on Feluda . I have shared about Feluda or Prodosh Chandra Mitter a few times on this blog. He has been the answer of James Bond from India. I have shared previously about The Golden Fortress . An amazing piece of art by Satyajit Ray. I watched that documentary two-three times. I thought, mistakenly that I am the only fool or fan of Feluda in Pune to find out that there are people who are even more than me. There were so many facets both about Feluda and master craftsman Satyajit Ray that I was unaware about. I was just simply amazed. I even shared few of the tidbits with mum as well, although now she has been truly hooked to Korean dramas. The only solace from all the surrounding madness. So, if you have nothing to do, you can look up his books, read them and then see the movies. And my first recommendation would be the Golden Fortress. The only thing I would say, do not have high hopes. The movie is beautiful. It starts slow and then picks up speed, just like a train. So, till later.
Update The Mass surveillance part I could not do justice do hence removed it at the last moment. It actually needs its whole space, article. There is so much that the Govt. is doing under the guise of the pandemic that it is difficult to share it all in one article. As it is, the article is big
In April I was assigned 16 hours of work by Freexian's Debian LTS
initiative and carried over 2.5 hours from earlier months. I worked
14 hours and will carry over the remainder.
I spent a long time trying to verify that the futex issue in was now
properly fixed in Linux 4.9, and reviewing the merge of these
changes with the real-time (PREEMPT_RT) kernel patchset.
Unfortunately this work is not complete and I did not make another
upload this month.
If you read my last blog. You
might know that I moved my email away from thunderbird to mutt. I thought I will
miss thunderbird, nope, not even for a bit. This transition was very smooth.
Only things left in thunderbird was my calendar and RSS reader.
Couple of weeks ago I switched to calcurse for handling my calendar
and To-do list. Like its name, it has a curses TUI. They have its own to-do list
and native support for syncing with caldav servers. The to-do list seems buggy
when sync between OpenTask Android app. And
newsboat is my RSS reader.
Wrote a pomodoro timer in elisp.
Why? Because I try to keep my workflow simple, and to keep the simplicity I sometimes need to re-implement stuff.
No this is a lame excuse.
I have been living in emacs for the past week and felt like it.
However writing elisp has been challenging, maybe because I haven't done it for a while.
I noticed there's lexical-binding, but I didn't quite get it, my lambda isn't getting the function parameter in scope.
Like many I use pass for storing usernames and passwords. This gives me easy access to credentials in a secure manner.
I don't like the way that the metadata (i.e. filenames) are public, but that aside it is a robust tool I've been using for several years.
The last time I talked about pass was when I talked about showing the age of my credentials, via the integrated git support.
That then became a pass-plugin:
frodo ~ $ pass age
6 years ago GPG/root@localhost.gpg
6 years ago GPG/steve@steve.org.uk.OLD.gpg
..
4 years, 8 months ago Domains/Domain.fi.gpg
4 years, 7 months ago Mobile/dna.fi.gpg
..
1 year, 3 months ago Websites/netlify.com.gpg
1 year ago Financial/ukko.fi.gpg
1 year ago Mobile/KiK.gpg
4 days ago Enfuce/sre.tst.gpg
..
Anyway today's work involved writing another plugin, named env. I store my data in pass in a consistent form, each entry looks like this:
username: steve
password: secrit
site: http://example.com/login/blah/
# Extra data
The keys vary, sometimes I use "login", sometimes "username", other times "email", but I always label the fields in some way.
Recently I was working with some CLI tooling that wants to have a username/password specified and I patched it to read from the environment instead. Now I can run this:
That's ideal, because now I can source that from within a shell:
$ source <(pass env internal/cli/tool-name)
$ echo username
steve
Or I could directly execute the tool I want:
$ pass env --exec=$HOME/ldap/ldap.py internal/cli/tool-name
you are steve
..
TLDR: If you store your password entries in "key: value" form you can process them to export $KEY=$value, and that allows them to be used without copying and pasting into command-line arguments (e.g. "~/ldap/ldap.py --username=steve --password=secrit")
Like many I use pass for storing usernames and passwords. This gives me easy access to credentials in a secure manner.
I don't like the way that the metadata (i.e. filenames) are public, but that aside it is a robust tool I've been using for several years.
The last time I talked about pass was when I talked about showing the age of my credentials, via the integrated git support.
That then became a pass-plugin:
frodo ~ $ pass age
6 years ago GPG/root@localhost.gpg
6 years ago GPG/steve@steve.org.uk.OLD.gpg
..
4 years, 8 months ago Domains/Domain.fi.gpg
4 years, 7 months ago Mobile/dna.fi.gpg
..
1 year, 3 months ago Websites/netlify.com.gpg
1 year ago Financial/ukko.fi.gpg
1 year ago Mobile/KiK.gpg
4 days ago Enfuce/sre.tst.gpg
..
Anyway today's work involved writing another plugin, named env. I store my data in pass in a consistent form, each entry looks like this:
username: steve
password: secrit
site: http://example.com/login/blah/
# Extra data
The keys vary, sometimes I use "login", sometimes "username", other times "email", but I always label the fields in some way.
Recently I was working with some CLI tooling that wants to have a username/password specified and I patched it to read from the environment instead. Now I can run this:
That's ideal, because now I can source that from within a shell:
$ source <(pass env internal/cli/tool-name)
$ echo username
steve
Or I could directly execute the tool I want:
$ pass env --exec=$HOME/ldap/ldap.py internal/cli/tool-name
you are steve
..
TLDR: If you store your password entries in "key: value" form you can process them to export $KEY=$value, and that allows them to be used without copying and pasting into command-line arguments (e.g. "~/ldap/ldap.py --username=steve --password=secrit")
Review: The Voyage of the Dawn Treader, by C.S. Lewis
Illustrator:
Pauline Baynes
Series:
Chronicles of Narnia #3
Publisher:
Collier Books
Copyright:
1952
Printing:
1978
ISBN:
0-02-044260-2
Format:
Mass market
Pages:
216
There was a boy named Eustace Clarence Scrubb and he almost deserved
it.
The Voyage of the Dawn Treader is the third Narnia book in original
publication order (see my review of The
Lion, the Witch and the Wardrobe for more about reading order). You
could arguably start reading here; there are a lot of references to the
previous books, but mostly as background material, and I don't think any
of it is vital. If you wanted to sample a single Narnia book to see if
you'd get along with the series, this is the one I'd recommend.
Since I was a kid, The Voyage of the Dawn Treader has held the spot
of my favorite of the series. I'm happy to report that it still holds up.
Apart from one bit that didn't age well (more on that below), this is the
book where the story and the world-building come together, in part because
Lewis picks a plot shape that works with what he wants to write about.
The younger two Pevensie children, Edmund and Lucy, are spending the
summer with Uncle Harold and Aunt Alberta because their parents are in
America. That means spending the summer with their cousin Eustace.
C.S. Lewis had strong opinions about child-raising that crop up here and
there in his books, and Harold and Alberta are his example of everything
he dislikes: caricatured progressive, "scientific" parents who don't
believe in fiction or mess or vices. Eustace therefore starts the book as
a terror, a whiny bully who has only read boring practical books and is
constantly scoffing at the Pevensies and making fun of their stories of
Narnia. He is therefore entirely unprepared when the painting of a ship
in the guest bedroom turns into a portal to the Narnia and dumps the three
children into the middle of the ocean.
Thankfully, they're in the middle of the ocean near the ship in the
painting. That ship is the Dawn Treader, and onboard is Caspian
from the previous book, now king of Narnia. He has (improbably) sorted
things out in his kingdom and is now on a sea voyage to find seven
honorable Telmarine lords who left Narnia while his uncle was usurping the
throne. They're already days away from land, headed towards the Lone
Islands and, beyond that, into uncharted seas.
MAJOR SPOILERS BELOW.
Obviously, Eustace gets a redemption arc, which is roughly the first half
of this book. It's not a bad arc, but I am always happy when it's over.
Lewis tries so hard to make Eustace insufferable that it becomes tedious.
As an indoor kid who would not consider being dumped on a primitive
sailing ship to be a grand adventure, I wanted to have more sympathy for
him than the book would allow.
The other problem with Eustace's initial character is that Lewis wants it
to stem from "modern" parenting and not reading the right sort of books,
but I don't buy it. I've known kids whose parents didn't believe in
fiction, and they didn't act anything like this (and kids pick up a lot
more via osmosis regardless of parenting than Lewis seems to realize).
What Eustace acts like instead is an entitled, arrogant rich kid who is
used to the world revolving around him, and it's fascinating to me how
Lewis ignores class to focus on educational philosophy.
The best part of Eustace's story is Reepicheep, which is just setup for
Reepicheep becoming the best part of The Voyage of the Dawn
Treader.
Reepicheep, the leader of Narnia's talking mice, first appears in
Prince Caspian, but there he's mostly
played for laughs: the absurdly brave and dashing mouse who rushes into
every fight he sees. In this book, he comes into his own as the courage
and occasionally the moral conscience of the party. Caspian wants to
explore and to find the lords of his past, the Pevensie kids want to have
a sea adventure, and Eustace is in this book to have a redemption arc, but
Reepicheep is the driving force at the heart of the voyage. He's going to
Aslan's country beyond the sea, armed with a nursemaid's song about his
destiny and a determination to be his best and most honorable self every
step of the way, and nothing is going to stop him.
Eustace, of course, takes an immediate dislike to a talking rodent.
Reepicheep, in return, is the least interested of anyone on the ship in
tolerating Eustace's obnoxious behavior and would be quite happy to duel
him. But when Eustace is turned into a dragon, Reepicheep is the one who
spends hours with him, telling him stories and ensuring he's not alone.
It's beautifully handled, and my only complaint is that Lewis doesn't do
enough with the Eustace and Reepicheep friendship (or indeed with Eustace
at all) for the rest of the book.
After Eustace's restoration and a few other relatively short incidents
comes the second long section of the book and the part that didn't age
well: the island of the Dufflepuds. It's a shame because the setup is
wonderful: a cultivated island in the middle of nowhere with no one in
sight, mysterious pounding sounds and voices, the fun of trying to figure
out just what these invisible creatures could possibly be, and of course
Lucy's foray into the second floor of a house, braving the lair of a
magician to find and read one of the best books of magic in fantasy.
Everything about how Lewis sets this scene is so well done. The kids are
coming from an encounter with a sea serpent and a horrifically dangerous
magic island and land on this scene of eerily normal domesticity. The
most dangerous excursion is Lucy going upstairs in a brightly lit house
with soft carpet in the middle of the day. And yet it's incredibly tense
because Lewis knows exactly how to put you in Lucy's head, right down to
having to stand with her back to an open door to read the book.
And that book! The pages only turn forward, the spells are beautifully
illustrated, and the sense of temptation is palpable. Lucy reading the
eavesdropping spell is one of the more memorable bits in this series, at
least for me, and makes a surprisingly subtle moral point about the
practical reasons why invading other people's privacy is unwise and can
just make you miserable. And then, when Lucy reads the visibility spell
that was her goal, there's this exchange, which is pure C.S. Lewis:
"Oh Aslan," said she, "it was kind of you to come."
"I have been here all the time," said he, "but you have just made me
visible."
"Aslan!" said Lucy almost a little reproachfully. "Don't make fun of
me. As if anything I could do would make you visible!"
"It did," said Aslan. "Did you think I wouldn't obey my own rules?"
I love the subtlety of what's happening here: the way that Lucy is much
more powerful than she thinks she is, but only because Aslan decided to
make the rules that way and chooses to follow his own rules, making
himself vulnerable in a fascinating way. The best part is that Lewis
never belabors points like this; the characters immediately move on to
talk about other things, and no one feels obligated to explain.
But, unfortunately, along with the explanation of the thumping and the
magician, we learn that the Dufflepuds are (remarkably dim-witted)
dwarfs, the magician is their guardian (put there by Aslan, no less!), he
transformed them into rather absurd shapes that they hate, and all of this
is played for laughs. Once you notice that these are sentient creatures
being treated essentially like pets (and physically transformed against
their will), the level of paternalistic colonialism going on here is very
off-putting. It's even worse that the Dufflepuds are memorably funny
(washing dishes before dinner to save time afterwards!) and are arguably
too dim to manage on their own, because Lewis made the authorial choice to
write them that way. The "white man's burden" feeling is very strong.
And Lewis could have made other choices! Coriakin the magician is a
fascinating and somewhat morally ambiguous character. We learn later in
the book that he's a star and his presence on the island is a punishment
of sorts, leading to one of my other favorite bits of theology in this
book:
"My son," said Ramandu, "it is not for you, a son of Adam, to know
what faults a star can commit."
Lewis could have kept most of the setup, kept the delightfully silly
things the Dufflepuds believe, changed who was responsible for their
transformation, and given Coriakin a less authoritarian role, and the
story would have been so much stronger for it.
After this, the story gets stranger and wilder, and it's in the last part
that I think the true magic of this book lies. The entirety of The
Voyage of the Dawn Treader is a progression from a relatively mundane sea
voyage to something more awe-inspiring. The last few chapters are a tour
de force of wonder: rejuvenating stars, sunbirds, the Witch's stone knife,
undersea kingdoms, a sea of lilies, a wall of water, the cliffs of Aslan's
country, and the literal end of the world. Lewis does it without much
conflict, with sparse description in a very few pages, and with
beautifully memorable touches like the quality of the light and the hush
that falls over the ship.
This is the part of Narnia that I point to and wonder why I don't see more
emulation (although I should note that it is arguably an
immram). Tolkien-style
fantasy, with dwarfs and elves and magic rings and great battles, is
everywhere, but I can't think of many examples of this sense of awe and
discovery without great battles and detailed explanations. Or of
characters like Reepicheep, who gets one of the best lines of the series:
"My own plans are made. While I can, I sail east in the Dawn
Treader. When she fails me, I paddle east in my coracle. When she
sinks, I shall swim east with my four paws. And when I can swim no
longer, if I have not reached Aslan's country, or shot over the edge
of the world in some vast cataract, I shall sink with my nose to the
sunrise and Peepiceek shall be the head of the talking mice in
Narnia."
The last section of The Voyage of the Dawn Treader is one of my
favorite endings of any book precisely because it's so different than the
typical ending of a novel. The final return to England is always a bit
disappointing in this series, but it's very short and is preceded by so
much wonder that I don't mind. Aslan does appear to the kids as a lamb at
the very end of the world, making Lewis's intended Christian context a bit
more obvious, but even that isn't belabored, just left there for those who
recognize the symbolism to notice.
I was curious during this re-read to understand why The Voyage of
the Dawn Treader is so much better than the first two books in the
series. I think it's primarily due to two things: pacing, and a story
structure that's better aligned with what Lewis wants to write about.
For pacing, both The Lion, the Witch and the Wardrobe and
Prince Caspian have surprisingly long
setups for short books. In The Voyage of the Dawn Treader, by
contrast, it takes only 35 pages to get the kids in Narnia, introduce all
the characters, tour the ship, learn why Caspian is off on a sea voyage,
establish where this book fits in the Narnian timeline, and have the kids
be captured by slavers. None of the Narnia books are exactly slow, but
Dawn Treader is the first book of the series that feels like it
knows exactly where it's going and isn't wasting time getting there.
The other structural success of this book is that it's a semi-episodic
adventure, which means Lewis can stop trying to write about battles and
political changes whose details he's clearly not interested in and instead
focus wholeheartedly on sense-of-wonder exploration. The island-hopping
structure lets Lewis play with ideas and drop them before they wear out
their welcome. And the lack of major historical events also means that
Aslan doesn't have to come in to resolve everything and instead can play
the role of guardian angel.
I think The Voyage of the Dawn Treader has the most compelling
portrayal of Aslan in the series. He doesn't make decisions for the kids
or tell them directly what to do the way he did in the previous two books.
Instead, he shows up whenever they're about to make a dreadful mistake and
does just enough to get them to make a better decision. Some readers may
find this takes too much of the tension out of the book, but I have always
appreciated it. It lets nervous child readers enjoy the adventures while
knowing that Aslan will keep anything too bad from happening. He plays
the role of a protective but non-interfering parent in a genre that
usually doesn't have parents because they would intervene to prevent
adventures.
I enjoyed this book just as much as I remembered enjoying it during my
childhood re-reads. Still the best book of the series.
This, as with both The Lion, the Witch and the Wardrobe and
Prince Caspian, was originally intended to be the last book of the
series. That, of course, turned out to not be the case, and The
Voyage of the Dawn Treader is followed (in both chronological and
original publication order) by The Silver Chair.
Rating: 9 out of 10
First email from my new machine.
I didn't have my desktop Debian machine for a long time and now I have one set up.
I rewrote my procmail/formail recipe, especially the part where I wrote complex shell script to generate my folder rules.
I rewrote that 4 lines of shell script in 200 lines of Go, with unit tests.
The part that took the longest time was finding out how to write unit tests in Go, and
how to properly use go.mod to be able to import packages from subdirectories.
I guess that's part of the fun.
Yesterday morning I got a warning call from the Debian quality
control system that
the VLC
bittorrent plugin was due to be removed because of a release
critical bug in one of its dependencies. As you might remember, this
plugin make VLC able to stream videos directly from a bittorrent
source using both torrent files and magnet links, similar to using a
HTTP source. I believe such protocol support is a vital feature in
VLC, allowing efficient streaming from sources such at the almost 7
million movies in the Internet
Archive.
The dependency was the unmaintained
libtorrent-rasterbar
package, and the bug in
question blocked its python library from working properly. As I
did not want Bullseye to release without bittorrent support in VLC, I
set out to check out the status, and track down a fix for the problem.
Luckily the issue had already been identified and fixed upstream,
providing everything needed. All I needed to do was to fetch the
Debian git repository, extract and trim the patch from upstream and
apply it to the Debian package for upload.
The fixed library was uploaded yesterday evening. But that is not
enough to get it into Bullseye, as Debian is currently in package
freeze to prepare for a new next stable release. Only non-critical
packages with
autopkgtest
setup included, in other words able to validate automatically that
the package is working, are allowed to migrate automatically into the
next release at this stage. And the unmaintained libtorrent-rasterbar
lack such testing, and thus needed a manual override. I am happy to
report that such manual override was approved a few minutes ago, thus
increasing significantly the chance of VLC bittorrent streaming being
available out of the box also for Debian/Buster users. A bit too
close shave for my liking, as the Bullseye release is most likely just
a few days away, and this did feel like the package was saved by the
bell. I am so glad the warning email showed up in time for me to
handle the issue, and a big thanks go to the Debian Release team for
the quick feedback on
#debian-release
and their swift
unblocking.
As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.
Here is my monthly update covering what I have been doing in the free software world during April 2021 (previous month):
Reviewed and merged two pull request from Michael K. to my django-slack library which provides a convenient wrapper between projects using the Django web development framework and the Slack chat platform. Michael's pull requests made Python 3.6+ a hard requirement (#102) and to run the tests against Python 3.9 (#103).
Filed a pull request against libsass-python (a Python implementation of the Sass CSS preprocessor) in order to make the build reproducible. (#319)
Reproducible Builds
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
The project is proud to be a member project of the Software Freedom Conservancy. Conservancy acts as a corporate umbrella allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
This month, I:
Issued DLA 2620-1 to address a cross-site scripting (XSS) vulnerability in python-bleach, a whitelist-based HTML sanitisation library.
Issued DLA 2622-1 and ELA 402-1 as it was discovered that there was a potential directory traversal issue in Django, the popular Python-based web development framework. The vulnerability could have been exploited by maliciously crafted filenames. However, the upload handlers built into Django itself were not affected. (#986447)
Jan-Niklas Sohn discovered that there was an input validation failure in the X.Org display server. Insufficient checks on the lengths of the XInput extension's ChangeFeedbackControl request could have lead to out of bounds memory accesses in the X server. These issues could have led to privilege escalation for authorised clients, particularly on systems where the X server is running as a privileged user. I, therefore, issued both DLA 2627-1 and ELA 405-1 to address this problem.
Frontdesk duties, reviewing others' packages, participating in mailing list discussions, etc., as well as attending our monthly meeting.
You can find out more about the project via the following video:
Like each month, have a look at the work funded by Freexian s Debian LTS offering.
Debian project funding
In March, we put aside 3225 EUR to fund Debian projects but sadly nobody picked up anything, so this one of the many reasons Raphael posted as series of blog posts titled Challenging times for Freexian , posted in 4 parts on the last two days of March and the first two of April. [Part one, two, three and four]
So we re still looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article!
Debian LTS contributors
In March, 11 contributors have been paid to work on Debian LTS, their reports are available:
Abhijith PA did 9.0h (out of 9h assigned and 12h from February), thus carrying over 12h to April.
Evolution of the situation
In March we released 28 DLAs and held our second LTS team meeting for 2021 on IRC, with the next public IRC meeting coming up at the end of May.
At that meeting Holger announced that after 2.5 years he wanted to step back from his role helping Rapha l in coordinating/managing the LTS team. We would like to thank Holger for his continuous work on Debian LTS (which goes back to 2014) and are happy to report that we already found a successor which we will introduce in the upcoming April report from Freexian.
Finally, we would like to remark once again that we are constantly looking for new contributors. For a last time, please contact Holger if you are interested!
The security tracker currently lists 42 packages with a known CVE and the dla-needed.txt file has 28 packages needing an update.
We are also pleased to report that we got 4 new sponsors over the last 2 months : thanks to sipgate GmbH, OVH US LLC, Tilburg University and Observatoire des Sciences de l Univers de Grenoble !
Thanks to our sponsors
Sponsors that joined recently are in bold.
Surrounding a region with Emacs lisp.
I wanted to surround a region with HTML tags and here's what I learnt today.
Specifying "r" in interactive gives two numbers, begin and end.
When I want to obtain multiple kinds of values in interactive, I can use newlines to delimit.
set-marker is an api to keep a marker at relative position even after edits,
API needs making make-marker to create an empty marker first, and seems like the number of markers affects editing speed so the API is made to allow reuse of markers.
After I got these going I could now write.
I wrote previously about my DeskPi Pro + 8GB Pi 4 setup. My main complaint at the time was the fact one of the forward facing USB ports broke off early on in my testing. For day to day use that hasn t been a problem, but it did mar the whole experience. Last week I received an unexpected email telling me The new updated PCB Board for your DeskPi order was shipped. . Apparently this was due to problems with identifying SSDs and WiFi/HDMI issues. I wasn t quite sure how much of the internals they d be replacing, so I was pleasantly surprised when it turned out to be most of them; including the PCB with the broken USB port on my device.
They also provided a set of feet allowing for vertical mounting of the device, which was a nice touch.
The USB/SATA bridge chip in use has changed; the original was:
usb 2-1: New USB device found, idVendor=152d, idProduct=0562, bcdDevice= 1.09
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: RPi_SSD
usb 2-1: Manufacturer: 52Pi
usb 2-1: SerialNumber: DD5641988389F
and the new one is:
usb 2-1: New USB device found, idVendor=174c, idProduct=1153, bcdDevice= 0.01
usb 2-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1
usb 2-1: Product: AS2115
usb 2-1: Manufacturer: ASMedia
usb 2-1: SerialNumber: 00000000000000000000
That s a move from a JMicron 6Gb/s bridge to an ASMedia 3Gb/s bridge. It seems there are compatibility issues with the JMicron that mean the downgrade is the preferred choice. I haven t retried the original SSD I wanted to use (that wasn t detected), but I did wonder if this might have resolved that issue too.
Replacing the PCB was easier than the original install; everything was provided pre-assembled and I just had to unscrew the Pi4 and slot it out, then screw it into the new PCB assembly. Everything booted fine without the need for any configuration tweaks. Nice and dull. I ve tried plugging things into the new USB ports and they seem ok so far as well.
However I also then ended up pulling in a new backports kernel from Debian (upgrading from 5.9 to 5.10) which resulted in a failure to boot. The kernel and initramfs were loaded fine, but no login prompt ever appeared. Some digging led to the discovery that a change in boot ordering meant USB was not being enabled. The solution is to add reset_raspberrypi to the /etc/initramfs-tools/modules file - that way this module is available in the initramfs, the appropriate pre-USB reset can happen and everything works just fine again.
The other niggle with the new kernel was a regular set of errors in the kernel log:
and a set of registers afterwards, roughly every 10s or so. This seems to be fallout from an increase in the core clock due to the VC4 driver now being enabled, the fact I have no SD card in the device and a lack of working card-detect line for the MicroSD slot. There s a GitHub issue but I solved it by removing the sdhci_iproc for now - I m not using the wifi so loss of MMC isn t a problem.
Credit to DeskPi for how they handled this. I didn t have to do anything and didn t even realise anything was happening until I got the email with my tracking number and a description of what they were sending out in it. Delivery took less than a week. This is a great example of how to handle a product issue - no effort required on the part of the customer.
Jerikan inputs and outputs
Output of Jerikan after building configuration files for six devices
Merge request to add a new port in USSFO03. The templates were compiled successfully but approval from another team member is still required to merge.
The change configures a port on the Juniper device, adds records to DNS, and updates NetBox with the new IP addresses (not shown).
The latest iteration of our network infrastructure for SK1, USSFO03, and future data centers. The production network is using BGPttH using a spine-leaf fabric. The out-of-band network is using a simple L2 design, using the spanning tree protocol, as well as a set of console servers.
The Hindu also 
A couple of weeks ago I stumbled across a Template Haskell question on the
Prerequisites
You will need the following prerequisites :
Ask AWS SES to verify a domain
Generate the DKIM settings
AWS SES pending verification
AWS SES SMTP settings and credentials
Mailtrain mailer setup
Mailtrain to throttle sending emails to AWS SES
I recently bought a Pinebook Pro. This was mainly out of general interest,
but also because I wanted to have a spare portable computer. When I was
recently having some difficulty with my laptop not charging, I realised that I
am dependent on having access to Emacs, notmuch.el and my usual git
repositories in the way that most people are dependent on their smartphones
all the info I need to get things done is in there, and it s very disabling
not to have it. So, good to have a spare.
I decided to get the machine running the hard way, and have been working to
add a facility to install the device-specific bootloader to
The following contributors got their Debian Developer accounts in the last two months:
.
On the global stage, about a decade ago, Stephen J. Dubner and Steven Levitt argued in their book 
Pappu Yadav, President Jan Adhikar Party, Bihar May 11, 2021
In April I was assigned 16 hours of work by Freexian's Debian LTS
initiative and carried over 2.5 hours from earlier months. I worked
14 hours and will carry over the remainder.
I spent a long time trying to verify that the futex issue in was now
properly fixed in Linux 4.9, and reviewing the merge of these
changes with the real-time (PREEMPT_RT) kernel patchset.
Unfortunately this work is not complete and I did not make another
upload this month.
Wrote a pomodoro timer in elisp.
Why? Because I try to keep my workflow simple, and to keep the simplicity I sometimes need to re-implement stuff.
No this is a lame excuse.
I have been living in emacs for the past week and felt like it.
However writing elisp has been challenging, maybe because I haven't done it for a while.
I noticed there's lexical-binding, but I didn't quite get it, my lambda isn't getting the function parameter in scope.
Like many I use 
Here is my monthly update covering what I have been doing in the free software world during April 2021 (
I wrote previously about my 
They also provided a set of feet allowing for vertical mounting of the device, which was a nice touch.
The USB/SATA bridge chip in use has changed; the original was: