Separating out keyring and rootfs support

 emdebian-archive-keyring - GnuPG archive keys for the emdebian repository

 emdebian-rootfs - emdebian root filesystem support

 emdebian-tools - emdebian crossbuilding tool set

 libemdebian-tools-perl - emdebian support library

Finally got to test a request from some months ago to create a separate archive keyring for those people who just want to use the toolchains.
I also took the chance to split out the scripts to build root filesystems from the scripts that build the packages for the repository. The Emdebian::Tools module was best split out too, it's needed for emdebian-rootfs and emdebian-tools.
Not sure when this is going to happen for real, it's only a test branch right now.
(browse SVN). It tests OK, so far and if other things check out, this could be 0.8.4 (in Emdebian), then whilst the same code badged as 0.9.0 spends time in the NEW queue so that I can upload 0.8.5 etc. to Emdebian, followed by 0.9.1 with the changes from 0.8.5 onwards.
TDeb changes from Fosdem
In the main trunk (0.8.3), I've updated a few parts of em_installtdeb but I haven't made much progress on whether TDebs should be Architecture: all or Architecture: any.

1. A big endian .mo file from powerpc works fine on little endian amd64.


2. msgfmt --alignment does not seem to do what I expected (but then I'm not entirely sure what I did expect).


3. I can't find anyone cross-building .mo files - maybe it's my Google skills but if it was essential, I find it hard to think that all those cross-built systems are doing something different to just msgfmt -o $@ $.

I’m starting all over again. New domain, new blog. I will try to dig up and repost all of the great things I wrote earlier. Posts about code, debian and pink ponies. I can also say that I’m back on planet.debian.org and on planet.samfundet.no. The link to my blog on women.debian.org should also be fixed soon.

In 1996 Peter Gutmann wrote a paper titled “Secure Deletion of Data from Magnetic and Solid-State Memory” [1]. In that paper he mentions the fact that the contents of RAM last longer at lower temperatures and suggests that data could be retained for weeks at a temperature of -60C or lower (while 140C causes rapid data loss). The paper also addresses issues of data recovery from hard drives, but given that adequate CPU power for encryption is available recovering data from a disk shouldn’t be an issue unless thee attacker can get the key to decrypt it or crack the algorithm - so disk recovery is not a hot issue at the moment. Recently some researchers at Princeton University have published a paper describing in detail how to chill RAM to make it keep its data after a power cycle and even after being installed in a different computer [2]. This attracted a lot of attention, while Peter’s paper described the theoretical concept (in great detail) the Princeton group showed how to implement the attack using materials that are commonly available. Most of the analysis of this misses some fundamental points. Any suggestion that you can wipe the RAM on power failure or on boot misses the point entirely. If an attacker can chill a DIMM and then remove it from the system then there is no chance for it to be wiped. Maybe if you had security on the PC case to detect case opening (some servers have a basic version of this) such things would do a little good, but it shouldn’t be difficult to bypass in most cases. Another common flawed analysis is to suggest that this is no big deal because sniffing the memory bus has been possible for years. While it has always been possible for government agencies and companies who design motherboards to sniff the bus, for most potential attackers it has been overly difficult. When considering the effectiveness of a security system you should first consider what your threat model is. Who is going to attack you and what resources will they be willing and able to devote to the attack? An organisation that is prepared to use expensive equipment and highly trained people to break your encryption probably has other methods of gaining access to your secret data that are easier and cheaper. The research from Princeton suggests that I could perform such attacks with my spare time and with equipment that is very cheap. I’ve been idly considering doing this to an old PC just for fun! Therefore I have to assume that everyone who has the same amount of skill and money as me can potentially compromise my data if they capture one of my machines. It is still most likely that if anyone steals my laptop they will want to sell it and use the money to buy drugs. I don’t think that I have any data that is anywhere near valuable enough to justify a targeted mugging. But my procedures (in terms of changing passwords etc) in the case of my laptop being stolen now need to be scaled up due to the ease in which data might be compromised. The best way of dealing with this would be to have the decryption keys locked inside the CPU (stored in registers or memory that’s locked in the CPU cache). The possibility of getting a modern CPU to operate at any temperature approaching -60C is laughable, and the CPU is a well contained package that can operate on its own and is difficult to attack. This would make things significantly more difficult for an attacker while requiring little effort (in fact it might be possible to lock data in the CPU cache already in which case a software change is all that is required). Update: A comment by Mike made a good point about CPU cooling. Toms Hardware performed an overclocking experiment (from 3.2GHz to 5.25GHz) and used liquid nitrogen cooling [3]. It might be possible to cool a CPU core to -60C in a reasonably small amount of time. But I still believe that it would raise the bar enough to make it worth doing. Update2: Thanks Jaime for the spelling advice.

• [1] http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html


• [2] http://citp.princeton.edu/memory/


• [3] http://www.tomshardware.com/2003/12/30/5_ghz_project/index.html

Share This

It’s done, we have new releases of grml, the Debian-based Linux Live-CD for sysadmins and texttool users:

grml 1.1 (32bit) - Codename Skunk

grml64 0.2 (64bit) - Codename Schwammerlklauber

grml-medium 0.1 (32bit) / grml64-medium (64bit) - Codename Pfuh

It’s the first stable release being based on our new build-framework grml-live which itself is based on FAI (Fully Automatic Installation). Thanks to grml-live we can provide you a new grml flavour grml-medium which tries to close the gap between grml-small and grml. As usual you’ll get software and kernel updates, many new packages and features plus additional hardware support. We are using LZMA compression for squashfs and provide several additional kernel modules like atl2, iscsitarget, madwifi and (for the first time) loop-aes. Oh and the grml release is known to work fine on the Asus Eee PC - LAN, WLAN and webcam working out-of-the-box! Find all the glory details about the new releases in above mentioned release notes or just visit grml.org. For german readers there’s an article about the new release at pro-linux.de. BTW: On the next weekend (1st and 2nd of march) we - the grml team) - will present the new release on Chemnitzer Linuxdays at the grml booth. grml-CDs, grml-shirts und (new!) “ready to go grml-usb-pens” will be available as well as the chance to talk to us in reallife. So, we wish you a fast download and hope you enjoy the new release!

Is XFS that bad? Well, at least with default settings, XFS on Debian seems to be blown away by ext3 completely in terms of speed. I don't mind 1.5x slowdown, maybe even 2x, but 20x is a show stopper. I am already using ext3 for any pbuilder builds, because it's a difference to wait for 30s with XFS, compared to 3s with ext3 to extract the base image. And I'll probably switch to ext3 completely, unless someone finds a way how to fix this.

I recently got burned by this when running Sage on my computer, because it compiles a lot of Python files when started for the first time. Normally it should take roughly 15s, but instead it took 6 minutes on my comp and then it triggered a so far undiscovered bug in Sage, that I reported.

Michael Abshoff, the release manager of Sage, suggested that something is FUBAR (Fucked Up Beyond Any Recognition) on my shiny Debian amd64 sid system running on Intel Core Quad, so I said no way, because I really care about this machine, as I use it for larger finite elements calculations and other stuff (like compiling huge deb packages in parallel, like paraview).

So I offered a bet, that I give him an access to this compter, he finds the problem and if it's a problem in my Debian configuration, I'll write to this blog that I am lame, while if it's a problem in Sage, he will write to his blog that he is lame. And I was smiling to myself, how good I am and that I will have some fun too reading planet.sagemath.org with the top post from Michael saying that he is lame.

But then I remembered my old struggle with cowbuilder and XFS and I stopped smiling. See e.g. this wiki I created half a year ago. Something is FUBAR with XFS and Debian. I also asked on the Czech server Root, that is famous for having a lot of experts willing to share their knowledge, and it was quickly revealed, that the problem is with the "nobarrier" option of XFS (my post is here, but it's in Czech).

First, on that amd64 machine, the above problem was fixed after issuing this command:

mount -o remount,rw,nobarrier /dev/sda3 /home/

(notice the "nobarrier" option). You can read some background behind this on the lkml list. Unfortunately, I also have my laptop, and there I already use this "nobarrier" option, and it doesn't help at all. I just created a new ext3 partition and verified that on my laptop, ext3 is around 10x faster than XFS with nobarrier (that was supposed to fix this). I use the latest 2.6.24 kernel from unstable on both.

Time to move from XFS to ext3 on my laptop? Seems like that. I'll leave XFS on the other machine, because I know some other peole have good experience with XFS and the "nobarrier" option seems to fix the problem there.

But as to the bet, yeah, I am lame and I should still learn a lot from Michael. :)

After 10 days of nice holidays, I'm back. I was totally offline, so I had to read some hundred of mails first, which is done now. For a good restart, I've fixed a bunch of bugs in awesome and released 2.2-rc2 version. I've also migrated apt-build repository on Alioth from Subversion to git. I've uploaded a new version of this one with some patches, and a also put in the archive a new version of the mp32ogg package. Next step will be to move my packages repositories which are in my global home Subversion repository, to my own git repositories on Alioth.

Today I've noticed that my last post was on August and I've decided that I'm going to try to keep this blog alive. Since this summer I've left the University and now I only have two jobs... my daily work and my son; I believe that things are going better at a personal level, but the truth is that lately I have near zero time to devote to Debian and Free Software in general. As I don't want to leave the FLOSS world and I'm still able to do some sysadmin related tasks at work and at home I've decided that I'll try to reserve some time for blogging about them. I'm also thinking about starting a blog and a wiki in Spanish, mainly to be able to publish some of the documents I write at work about our installations, the advantage for me is that I can publish them with a little revision and that is much faster than translating them into English. Anyway, before creating new blogs my first task is to finish my home server migration; I'm moving all the services that were running on my old PowerBook (PowerPC @ 400Mhz, 378MB of RAM, 10 GB HD) to my other PowerBook (PowerPC @ 1Ghz, 768MB of RAM, 60GB HD), as I haven't used it for ages and I still use a lot the old machine. On the move I plan to change a lot of things, the machine is going to run multiple vservers and I plan to change a lot of the software I was using, always trying to simplify the maintenance and/or get more performance from the new machine:

• The internal network will use dnsmasq for DNS and DHCP (replacing bind9 and the dhcp3-server).
• My authoritative nameservers are going to be served by powerdns using the named backend for the primary servers and sqlite3 for the secondary domains.
• I'm going to move all my webservers from apache2 to nginx and fast-cgi (the speed and memory gains are huge at work).
• I plan to move all my repositories from Subversion to git, including this ikiwiki installation.

I'll try to blog about this new installation once it is done.

The next two days I'm going to be at the "embedded world", presenting all the stuff we developed over the last year. There are still four hours to go until we're leaving, so I'm probably going to get a bit of sleep, it will be needed as the next opportunity will in about 22 hours.

As you probably know (well, in case you read d-d-a (hello man-di)), we got two new people as FTP Assistants. While I disagree with the way it went, it’s a good thing to not have NEW, removals and override changes a (pretty much) one man show. OTOH I am also pretty reluctant to having others do NEW, as the long time I am now doing it makes me feel about it like - well “it’s my baby”, or something like that. It’s just that I processed a lot of packages, rejected even more and (mostly) had fun doing it. (And I hate to share fun, HA :) ). But I understand the need of having more people doing it, so today I gave an introduction to Thomas and Kalle. Now they at least know where to start. And while that took somewhere around 2 hours - its still only an introduction. I bet there will be many more questions when they do more than just reading the large amounts of text I flooded into the ftp teams IRC channel. :) But that should work fine, I am online most of the day - and then there are the other ftpteam-members and ftpmasters in the channel, someone should be able to respond sooner or later. :) And now some real content. The ultimate way to get a totally bug free Debian:

for i in $(dak control-overrides -t dsc -l awk ' print $1 '); do
 dak rm -m "Cleanup" -C package $i
done

Don’t try this at home, kids. (Yes, a nice DELETE FROM $correct_table in projectb also works, but isnt as much fun! The above gets you nice and pretty logs in the removals.txt and also nice and pretty mails to the package address!)

First time ever I have been at a conference and attending so few talks. Needed to talk to sooo many people. But anyways, it was quite interesting to put some faces of the people I kind of work with. Especially my favourite kde upstream people. So many keys to sign, but I guess I am finally thru it. If you are expecting a signature from me and haven’t got one yet, please check your spam filters and/or try poke me. I guess I will keep my paper notes a couple of days before ditching them. Beer event was bigger this year, but still too crowded. Fosdem is also quite crowded - so crowded that I missed some talks because of it. But anyway, see you next year - probably.

Since 4 hours, the planet of ocamlcore.org is online. This is the first service provided by ocamlcore.org to the OCaml community. In fact, ocamlcore.org team has decided to release it today, because Erik Castro de Lopo ask a question about another OCaml planet in China. The one in China seems to be gathered through google search... Putting online the planet is also the occasion to test a little application to manage feed subscription: ocaml-planet. This script is quite trivial but it was a good first experiment of managing CGI/sqlite through OCaml. The application should help us to control subscription of feeds. I think this is a better way to subscribe than letting people commit changed planet.conf in some kind of SCM (like we do for planet debian). Once the forge of ocamlcore.org will be online, we will publish the source code of this application. I hope that this planet will be of some help for the OCaml community... http://planet.ocamlcore.org

I have spent one day and a half this week-end at FOSDEM. This was not as great as expected, but mostly because i don't have the time to stay the whole sunday. Next year, I will stay the whole week-end in order to have time to attend all the speak i should be interested in. The beer event was overcrowded, but all the beer i found there was great (in particular the Floris Pear). It was also a great time to have a demonstration of the XO OLPC laptop. This little thing is funny, but i don't get the way the UI should be used. Another bad point, is that the first console allow to login as root by pressing "Enter" (at least on the one i try). I suppose this kind of device is not intended to be secured. I also have time to talk with some Debian people and some other people -- in particular one who was thinking that Windows 2000 is the best ever OS. At least, it means that there were people from different horizons -- and this is a good thing. During Saturday, i spend half of the day in the big amphitheater (Janson). The talk about Tux with Shades (Linux in Hollywood) was impressive, regarding the trailer they show us... The talk about FreeBSD was interesting -- but not impressive as a trailer. I spend Saturday afternoon in the Debian devroom, following all the different talks. I miss the one from MadCoder about managing packages with git... That's a shame because i really want to see this one. Since my train was at 12am on Sunday, i choose to only pay a visit to the different booths. I have the pleasure to have a demonstration of the EeePC on the Debian booth that really please me. I found the UI more easy to understand than the one from XO. Speaking with the person demonstrating the laptop, she explained me that EeePC is more "standard desktop" and XO more "creative desktop". Conclusion: i am not creative ;-) Also talking about everything around talks and the meeting, i think Bruxelles is a really nice city for this kind of events. ULB is not near the center of Bruxelles but there are enough transportation. There was really a lot of people attending FOSDEM, and this is a good thing. I also have the pleasure to find some people from the OCaml Meeting.

I'm going to be traveling and giving talks quite a bit this spring. Here's what my schedule looks like now. I don't think much will be added to it:

• February 29-March 1 - Houston, Texas - Matt Lee's Wedding
• March 12 - Amherst, Massachusetts - Hampshire College
• March 15-16 - Cambridge, Massachusetts - FSF Members Meeting
• March 27-28 - New York City, New York - Fordham IP Conference
• April 7 - Florence, Italy - Renaissance Panel: The Roles of Creative Synthesis in Innovation at CHI
• April 11-13 - San Fransisco, California - Lugradio Live USA
• April 17-20 - Detroit, Michigan - Penguicon
• April 25-27 - Cambridge, Massachusetts - ROFLCon
• May 5 - San Fransisco, California - Sun's Community One

I'll be giving at least one talk at the FSF Members Meeting, the Renaissance Panel, Lugradio Live, Penguicon, and Community One. Matt's wedding is private. To join the FSF members meeting you must become an FSF Associate Member if you are not already. All of the other conferences require some sort of registration. Penguicon, Lugradio Live, and ROFLCon are each cheap and each promises to be a lot of fun. The talk at Hampshire should be free and open to the public. I'll be posting more about each of these as things get closer including details about what is that I'll be talking about. If you'd like me to talk to another group or at another event while I'm town for any of the events above, now would be a good time to ask. If you just want to meet up for a beverage of your choice, that's good too. In either case, get in contact.

I was asked for advice from a non-technical person about buying a laptop for their 15yo daughter. They were looking to spend $200 or $300. I suggested that stretching their budget to $500 for a new EeePC would be a better option than the risks associated with a second-hand laptop (laptops are all different in their hardware). I also suggested that waiting a few months to see what happens with the new EeePCs might be a good idea. There are rumours about the development of new EeePC models with bigger screens, this would be a benefit for those who can afford it, and for those who can’t the current model may drop in price. They took that suggestion very well and I suspect that they weren’t planning to purchase in the near future anyway. I asked for advice on the LUV mailing list [1] for further suggestions that I could offer. One suggestion was that larger laptops of a more traditional design have been driven down in price recently and might be worth considering. I will have to mention it, but suggesting that someone who wants to spend $200 should spend $500 seemed enough of a stretch, suggesting that they spend $700 or more might not be taken well. Of course there is the weight issue that Matt raised in a blog post [2]. The last thing I want to do is to convince people not to buy computers for their children! A complaint was raised about the size of the keyboard in the EeePC (personally I wouldn’t want to use anything smaller than the T series Thinkpad I’m using now). In a quick google search the best information I could find about average finger sizes was the Danforth Diamond blog [3] which says that in the US women average a ring size of 6 while men average 10. According to the ring sizing page on the same site [4] that means ring finger diameter of 16.5 and 19.8mm respectively. So it seems likely that given the same level of typing skill an average woman could happily use a keyboard that’s 83% the size of the keyboard that an average man uses. Of course there’s a lot of variation between individuals, for example my fingers are thinner than average and I prefer a full-sized keyboard. One thing I recommend when considering a keyboard (or a laptop) is to type your name a few times quickly. Typing something about a quick brown fox will take some thought, but typing your own name requires no thought so you can concentrate on the feel of the keyboard. Using this method it is very easy to go to a store and determine whether a laptop is likely to suit you. The screen resolution and size is a significant issue, one EeePC owner described it as “too small to do anything useful“. Rumour has it that the next version will have a screen that’s a significant increase in size and resolution. A final interesting comment was about the social aspect of owning a laptop. The suggestion was made that a teenager who owned the smallest (and possibly cheapest) laptop in class might have other kids tease them about it. I will be interested to see comments on this issue, it had never occurred to me that the laptop use in schools would be high enough for the ownership of any type of laptop to be a cause for harassment. Also I’m not sure which would be considered as being of lower status, an old second-hand laptop or a new low-end laptop. I’m pretty sure that owning either would be considered to have higher status than having no laptop. A quick scan of the GraysOnline.com.au auction site suggests that a second-hand Pentium-M laptop (a few years old) could be purchased for about $550 and a Core 2 Duo based laptop might go for about $700. So it seems unlikely that for less than $500 you could buy something suitable for a novice user (something that will just work with recent software). I’m not planning on offering the full IT support package that I offer to my relatives so I can only recommend things that can be self-supported. Of course as the people doing the buying seem to have no definite plans for the use of the computer then anything they buy will fail in some way to meet the requirements that they discover. :-# Update: fixed a bad link.

• [1] http://lists.luv.asn.au/wws/arc/luv-main/2008-02/msg00670.html


• [2] http://matt.bottrell.com.au/item/167/


• [3] http://danforthdiamond.wordpress.com/2005/12/16/guessing-your-girlfriends-ring-size/

Share This

A few days ago I got myself an Asus EEEPC to experiment with it being in a role of a small server and a tiny internet kiosk. I installed Debian on it, but the process was not for the feint of heart, that’s for sure. First of all the d-i font was messed up and all the menus overflowed the screen making it very hard to select anything. Additionally it seems very strange to me that there was a special d-i image made for EEEPC, but that image did not include built-in support for the computers wired or wireless network interfaces. That made my day highly problematic as I do not have an easy way to get to the Internet via a wired connection and the provided d-i image did not have enough files on it to finish the base install without networking.
This again made me think that the approach Ubuntu took is more favorable in most situations - have the install image boot a mostly functional system (it does not have to be X even) and then install from there. It actually feels more flexible than using the highly restricted d-i environment.
I will be looking to make a Debian rescue image designed for the EEEPC that you could dd onto a USB key, boot from and have a minimal Debian system with working ethernet, wifi and some basic rescue tools and a way to install a basic Debian system as well. That should make it much easier for people to get Debian onto their EEE PCs. I do hope that the Debian EEEPC project will improve as well.

For the last few years I have been actively seeking free hardware to give to members of my local LUG. Whenever a friend or business associate mentions that they are upgrading or replacing computers I enquire what they plan to do with the old ones and request that the old gear be given to me if there are no other plans for it. There is a moderate amount of hardware that I use for my own purposes, but the free hardware that is available is often in excess of my requirements and also sometimes just unsuitable for my use (I am happy to install a second-hand IBM or HP machine for a client but I won’t install a white-box machine). One organisation that I sometimes give computers to is Computerbank [1]. The purpose of Computerbank is to take donations of old machines, fix them and install Linux, and then sell them for extremely low prices to people who can’t afford new machines. It’s been a while since I gave them any computers because for a long time the minimum specs on machines that they were willing to accept were higher than the machines that I obtained. Generally I offer my old hardware to the mailing list of Linux Users of Victoria [2]. I offer not only working systems but also broken systems and other things that might be useless to most people - but are greatly desired by the small minority who can use them. One member of that list wants PC power supplies for repairing other electronic devices, so I collect batches of machines that are broken but appear to have working PSUs and give them to him. I once received a box of free two-button mice. I offered them to LUV members expecting that many people would want one or two for test machines. No-one wanted them for use as mice but one guy wanted all of them to use their sensors in robotics projects. One thing that impresses me is the community spirit demonstrated. Often I will offer some free machines and the first response will be something like “I’d like to take that machine apart for the bits, but if someone wants a complete system please give it to them instead”. There aren’t many occasions when you see someone suggesting that they may not be the most deserving recipient for something that is free! My aims in this effort are to help random Linux users in my area, and to help the environment by reducing the amount of land-fill. My efforts aren’t going to make a significant impact on the environmental situation, but they do make a significant impact on the availability of hardware for members of the Linux community - which seems to be of particular interest to people who want cheap machines for their children or grand-children. I encourage other people to do similar things. One thing that impressed me was the organisation of used hardware gifts at LCA. Near the start of the conference hardware was given away to anyone who put their hand up. At the end of the conference more hardware was given away (I expect it was mostly by delegates who lived locally). It would be good if this idea (which worked so well) was spread to other conferences.

• [1] http://vic.computerbank.org.au/


• [2] http://www.luv.asn.au/

Share This