Search Results: "will"

7 December 2007

Erich Schubert: Spammers and DNS WTF.

My domains DNS is still hosted with the company I registered it at. I'm planning to move it to a different company early next year. So when a friend asked me for secondary nameserver exchange, I already set up the new DNS.So my current setup is like this:Primary and secondary nameserver are at my old provider, serving their copy of the DNS zone (which obviously lists their nameservers as NS)The A and MX records point to my server, which will sometime also be the new master NS. This host has an own copy of the zone file, which agrees on the 'regular' entries, but lists my server as well as the friends two servers as NS. This is the only link from the domain to the friends servers. Let me emphasize this: neither my server nor my friends servers are currently listed in the .tld database. Their NS entries still point to the old providers server. I'm planning to change that in January.Now my friend told me, that he had about 10 email delivery attempts to my domain in his logs, obviously coming from some spammers.WTF? In order to link my domain to his server, you'd need to What is the reason to jump through all those hoops? Do many admins configure a secondary NS to be an unlisted, unprotected relay for incoming email?Is it common for secondary NS to receive random emails from spammers?

Chris Lamb: Maintainership of SWI-Prolog

As of today I am the new maintainer of the SWI-Prolog package in Debian:
swi-prolog (5.6.47-1) unstable; urgency=low
  * New upstream version (Closes: #295209, #308325, #425580)
  * New maintainer (Closes: #422576)
  * Bump Debhelper compatibility to 5
  * debian/rules:
     * Update config.sub and config.guess from autotools-dev
         (Closes: #408076, #414181)
     * Desist from blindly ignoring "clean" target
  * debian/control:
     * Use $ binary:Version  instead of $ Source-Version 
     * Add new Homepage: field
     * Add XS-Vcs-* fields
  * Change ".menu" sections from
       "Apps/Programming" -> "Applications/Programming"
  * Documentation:
     * Remove some SGML documentation now missing from upstream
     * Add Sicstus and SWI-Prolog v4.8 -related XPCE documentation
  -- Chris Lamb < _ @chris-lamb.co.uk>  Sun, 02 Dec 2007 23:26:00 +0000
There are still a few issues with the package, but I felt that getting the new upstream release and fixing the RC bugs was the primary goal. It will be of a superior quality to the current one anyway (which was removed from Etch). UPDATE: Oh, I forgot to mention #423322. Too many bugs!

Jan Wagner: Package updates and others

Since some weeks I’m really busy, private and at work. It’s going into the end of the year and everybody is in hurry. There seems also coming some changes for our family down the road in the future, but more maybe later. Additionally one months ago Santiago Ruano Rinc n did surprisingly turn up as my AM. We started fast, but I got stuck at P&P part 1 with the License comparisons, cause actually I’m so busy at work and with my family, that I can’t concentrate enough late at night, when trying to work on the papers. For example the graphviz license is completely overwhelming me. My hope in the last time was some bigger timeslots at the weekends, but they got smashed by my family and/or work issues. I hope Santiago is not getting annoyed by me and I can find hopefully some free time on holidays or in the first weeks next year. Anyways … Christian Perrier started a review and translation process of ipplans debconf templates by the debian-i18n contributors. The templates was in really bad conditions, most of it was copied over from gallery2 and I did know that they wasn’t so good. Thanks for all your work, when the process is over I’m proud to include your really nice work. Two other packages got updates. php-suhosin got new upstream release after months which fixes the broken perdir/.htaccess support. Unfortunatly I missed the release (cause there is no announcement list and there was no watch file) unless Raphael Geissert did leave a note. I integrated the new VCS and homepage stuff also and formorer did fix some minor issues. So we can hopefully upload now (when it arrives testing) the first package to backport.org and sleep little bit better, when using PHP on stable.
nagios-plugins also got updated. Since Seanius seems really busy (like allways), nobody did really took care of the package. In October it got two CVE which was solved via NMU by the testing-security team, also two new upstream releases where available. So I droped the obsolete patches, integrated new once, did make the new shiny lintian a bit more happy, some minor fixes and queued the package to Seanius. ;)
You can expect both packages on backport.org soon. My other (comaintained) packages will get updated to latest policy and VCS/homepage guidelines in the near future. Actually I’ve to prioritize what to do with the left time slots. :/

Mario Iseli: QA Extremadura 2007, my Health, new Job

Sunday afternoon I came back from the QA meeting in M rida (Spain). I host some of the pictures on my machine: http://www.marioiseli.com/stuff/qa-extremadura-2007/ (thanks to Cyril Brulebois for the pics) As I have written to debian-devel-announce yesterday, I was mostly working on MIA stuff, it was also great to have some personal discussions with several DDs. I hope that there will be such a great meeting again, maybe next year. :-) Monday in the evening I got a phonecall from the company where I had a personal interview last tuesday. They can adopt my apprenticeship. Yay… There are several reasons why I want to leave my current workplace (Stadt Grenchen): I have almost nothing to do, I learn nothing anymore, some people in my team were an interpersonal catastrophe, noone knows what the work “responsibility” means. I don’t want to go into the detail, but at least they reached that I got several nervous breakdowns, ending at the doctor wednesday afternoon. As I told, my nerves are down, I can’t sleep during the night here, motivation for life was down in the cave. This week I don’t need to work at all (medical certificate) and the next 2 weeks only 50%, so enough time to relax and get healthy again. Also thanks to my girlfriend Lisa for always being there for me… Tomorrow we will be a pair for already 4 months, Tempus fugit…
01.02.2008 I will start then my new job as a Systems Administrator and Networking-Dude for an ISP, more details will follow :-) Regards,

Brandon Holtsclaw: Baby Steps

Well the last few days I have updated many things in a lot of different areas, the most noticeable right away is I have updated my website theme, I’m still not 100% happy with it, link colors are a bit off and such but its “good enough” to go live, if your reading this via an RSS feed go check out my main page and drop me some feedback. ( if your really interested in the theme and want it for your own website you can grab it at http://www.imbrandon.com/misc/human_0.5.tar.gz
I’ve released it under GPLv2 , its not perfect but its exactly what I’m running as of this writing. ) The next thing is I changed ISP from Comcast Cable ( ugh ) to Yahoo! Branded AT&T 6M/768k DSL, not only is this faster and cheaper than my old connection, it has the nice side effect of giving me a flickr Pro account free* ( *included in the connection price somehow I’m sure ), that brings us to the next change … I’ve started using my flickr pro account and am loving it, with things like the fuse filesystem FlickrFS and kFlickr makes using flickr easy and painless. Along with that there is this awesome GPL wordpress plugin FAlbum that lets me integrate my Flickr sets into a photoalbum on wordpress very simply and looks great too. Visit my new web album here http://www.imbrandon.com/images/ ( I’ve uploaded just over 100 photos to get it started, I still need to tag and sort most of them ) And last but not least on top of my Ubuntu Core Developer Status, I’ve finally got in contact with a “full-time” sponsor for my contributions in Debian, this will make my application for NM alot smoother with an Advocate ( when I get around to filling out the NM form, LOL ), wish me luck.

Erich Schubert: Intel wireless (ipw3945) still broken

It's now far over a year that the ipw3945 driver doesn't work reliably for me on stock Debian kernels. From other blogs I figured it only occurs in SMP situation, and even then not on all systems.On my laptop, I can reproduce it rather reliably: connect to the WPA2 encrypted network at my parents and transfer a file to one of the other computers on the network. An IO rate of a couple hundred kb/s will make the wireless card disconnect frequently. Often I end up having to flip the kill switch twice to get it working again.I have however found a workaround: use a kernel with preemption enabled.So it seems that there is something in that driver which will in certain situations trigger a big lock. Actually you can even hear that - sound will also be interrupted shortly when the wireless dies. Without preemption enabled, this will make the wireless card run into a timeout and reset itself.I don't know yet if this completely fixes it. But other comments in the bug report at bughost suggest that it's at least much more stable. bug 1085 seems another instance of this bug and is open since june 2006. As good as their OSS record is, it seems that Intel has given up on fixing this bug.There are other drivers causing similar problems. For example the dcdbas driver for the Dell Bios used to check for the wireless kill switch, display brightness and such functionality. When I load that driver, hal or NetworkManager will interrupt my sound every few seconds when polling the kill switch. Maybe they would just need to get hold of a system affected so they can diagnose it properly themselves. There have been at least 20 people reporting this bug by now, most of them on Dell systems.

6 December 2007

Gunnar Wolf: Triple negations

I'm packaging Ruby's PDF::Writer module for Debian - It is a simple module and (almost) ready for upload. But anyway, it carries some issues I had to bring to debian-legal's attention, mainly, five files licensed under Creative Commons licenses (specially two of them, which are under its NonCommercial variant - clearly non-free), so I'm repackaging the .orig.tar.gz into a +dfsg version. But I know I'm a lazy and sometimes stupid bum. Even more, the package will be group-maintained by the pkg-ruby-extras team, so we must be as careful as possible not to forget to remove the non-free material - To remove two scripts, and to replace three images with free equivalents I just made. But hey, tell me if this does not feel ugly to you. At least to the bits of you who learnt human grammar:
clean::
	# Make sure we strip out non-DFSG demo files from the orig.tar.gz
	[ ! -f demo/qr-library.rb -a ! -f demo/qr-language.rb ]   false 
	[ $$(md5sum images/bluesmoke.jpg   cut -f 1 -d ' ') == 0586eca5af7523ab871609eceb44724a ]   false
	[ $$(md5sum images/chunkybacon.jpg   cut -f 1 -d ' ') == a000b1917142ce332fd3474f0722cd6f ]   false
	[ $$(md5sum images/chunkybacon.png   cut -f 1 -d ' ') == 927feec1cbbf23c4d89a4a5ad88e6d0f ]   false
Triple negations. How nice.

Martin F. Krafft: Pay us, we might actually do as promised

On Saturday, we sent an express letter to Ireland, using the courier service provider of the German Postal Service: DHL. The lady at the counter alerted us that the letter was unlikely to arrive on Monday, but Tuesday would be fine for our purposes, so off it went. What an amazingly crap choice. The letter has not arrived in Ireland today (Thursday) even, who knows whether it will make it tomorrow. Or next week. Or ever? When we handed over a fair bit of money to aforementioned lady for their express services, we entered a contract with the courier. A sensible assumption would be that the contract requires the courier to deliver the letter as soon as possible, which is my understanding of "express". But in this world, nothing is sensible any longer. Somewhat related to the asymmetry of e-shops I previously identified, the terms and conditions of the courier make sure that they cannot be held liable for failure to fulfill their side of the contract. The next time you walk up to the Deutsche Post/DHL counter, keep in mind that when you hand them money, you are purchasing a lower bound on delivery time: they assure you that they won't deliver the express letter before the next business day. That's it, nothing more, please move on. They don't even ensure that any such letter will arrive. Ever. But you cannot hold them liable. Maybe there is a reason why e.g. UPS charges almost three times the sum for express delivery of letters to Ireland: they actually get there in time. But then I check their conditions and see that they also interpret their delivery times as estimates of best effort, but no guarantees. Since when does "consumer" mean "get ready to be screwed?" Why are we putting up with this? I am now filing a complaint. I hope others in similar positions do the same. I am also going to try an experiement: post another express letter and ask to see their terms and conditions before forking over the money. I have a vague feeling that they'll fail to present them in an orderly fashion. Then I'll call up a lawyer friend and sum up my belligerence, time available, and plausibility. And the likely outcome is that I'll go to court against the Deutsche Post. You can count on me. NP: The Pineapple Thief: Variations on a Dream

Russell Coker: Planet Debian Piracy

The site http://maxfeed.ath.cx/ is copying the entire Planet Debian feed for the purpose of splogging. I’ve sent one DMCA take-down notice for one of my pages (hopefully they will go through and remove all pages that were illegally copied from my feed). Other people who have non-commercial use licenses for their blog feeds may want to do the same. Would it be possible to have the entire Debian feed licensed in such a way such that one person could request that the Planet Debian feed not be used for such things?

Sam Hocevar: Bits from India

Incredible !ndia As Christian already stated, we are currently in this lovely city with friendly people whom we French people have great trouble understanding, totally insane traffic and colourful taxis you find nowhere else, and dangerously spicy food. And no, it s not Mexico City. My first talk at FOSS.IN/2007 in Bangalore, India (Giving back to the community: how does Debian perform?) was an attempt at explaining to upstream developers what Debian did with their software, and where to proactively find information about the changes we do, the bugs that are reported, etc. I did this talk because Bangalore has this incredible ratio of software developers per square kilometer, while at the same time we have so few Indian DDs despite the 1.12 billion inhabitants. So I expected to find people doing much development but not necessarily familiar with Debian. With Christian s two other talks about translation works in Debian and how to contribute to Debian, we did quite a thorough coverage of Debian for a novice audience. My second talk, in the main conference track, will be on Saturday and will be an even more general presentation of Debian. Of course, my slides are not ready yet, what did you expect? Debian business cards There has been great interest in my Debian business cards, so I m providing their SVG source (to be loaded and printed in Inkscape, for they make extensive use of the blur effect which is an Inkscape extension) for anyone interested. They use the Sexsmith and Sans Condensed Uralic fonts, available in Debian packages ttf-larabie-straight and ttf-uralic. Sam s Debian business card Sam s Debian business card (back) Sam s Debian business card (sample) I don t know enough about SVG scripting and object cloning, so to do the text shadow you will have to edit the same object twice. Sorry about that. Here are the files: background image (PNG), generic DD front (SVG), custom DPL front (SVG), back (SVG). The background image was cropped from Ayo s Debian Expo wallpaper. The rest of the design should be considered public domain. Just a note about the different languages I ve been using at the back: I know I could have used more fancy languages with beautiful glyphs to show how truly universal our system is, but I did not know which to choose. So I just put the languages I personally vaguely understood.

Steve Kemp: You can't hide the knives

After recently intending to drop the Planet Debian search and recieving complaints that it was/is still useful it looks like there is a good solution. The code will be made live and official upon the planet debian in the near future. The DSA team promptly installed the SQLite3 package for me, and I've ported the code to work with it. Once Apache us updated to allow me to execute CGI scripts it'll be moved over, and I'll export the current data to the new database. In other news I'm going to file an ITP bug against asql as I find myself using it more and more...

Philipp Kern: Travelling in 2008

So I just booked train tickets to Z rich to attend the Debian Bug Squashing Party on January 12-13, 2008. This will be my first BSP and yay, I will meet fellow DDs (and NMs). The only occasion where that happened by now was LinuxTag 2005, when I attended the Debian Day as a freshly accepted Developer (and got an exemption from school for it). I also attended CeBIT back then but felt strange when visiting the booth, although my AM was present, so I quickly left again. I hope to change this the coming year: so I will go to FOSDEM in Bruxelles on February 23-24, thanks to Sven Krohlas, an Amarok fellow, for organising the trip. Maybe I could also attend DebConf 8 if there are some travel funds available for me. We will see, I really look forward to it. Perfect occasions to get more involved, to boost my English and to meet some people I only know from IRC and mail.

Christian Perrier: I'm Indian-da

I think that all Debian developers (including the brand new ones) will be delighted to learn that we not only have 4 indian DD's now, but we have an Indian DPL, at least according to his own words after a few beers. The first two days at FOSS.in have been quite busy. Sam's first talk ("Giving back to the community, how does Debian perform") was really interesting with ideas about a possible place where various distributions' patches to software could be collected and made available to upstream authors. I then had two talks in a row, which I feared a little but went pretty well. The first one was a brand new for me ("Contributing to Debian for dummies"). I tried to enforce the idea that contributing to Debian might be fun and opened to everybody, not only deep hard-core hackers (I funnily took my friend Andrew McMillan as example for hard-core hackers....). To make the talk less boring, I did choose to illustrate the various ideas I was explaining with photos taken from the various Debian-related events I attended last years. So, many of my Debian friends will recognize themselves on my talk slides. I hope you people won't mind being taken as examples (I should maybe have asked your authorization before....in case some of you want to sue me for using your public image). The other talk I has was a quite standard i18n talk. As I don't like doing the same talk over and over, I changed that one slightly to make it more suitable for the local audience, putting focus on localization for languages of India (even doing some of the "famous" bubulle-style maps especially for India). In case you aren't bored with that one, here's the link to slides. The next day features some other projects days. I will put focus on talks from the Indlinux project day. Indlinux is indeed an amazingly active project and the small room was entrely packed with people attending quite technical talks about Indic computing, Text-to-Speech, Indic languages spellchecking and such really specific topics. I also attended a very promozing talk by Dimitri Glezios, in the Fedora project day room, talking about Transifex, a very promising localisation material collecting platform with the interesting ability to be able to push translations back to thei respective upstreams, avoiding one of the major drawbacks of tools such as Rosetta. I'll have to come back on that one. Now for the Main Confeence days....that will be busy, too, for sure ! And I didn't even mention the awful Mozilla party we had yesterday night. Some people will remember that one.

5 December 2007

David Welton: Hecl Java Integration

Yesterday, I took the Java integration I'd been building into the Hecl Android port, and moved it into its own directory, so now it's built in to the command line/j2se (non JavaME) version of Hecl for people to experiment with. Here's a slightly modified version of my posting on the subject: I created a java/ subdirectory with an org.hecl.java package that does a few things. The core of the system is in JavaCmd and Reflection. The first creates commands out of Java classes. It utilizes, obviously, the reflection stuff in Reflection. Both are, at the moment, sort of hacky and tentative, but work. For instance, I checked in this bit of test suite today:
test java-2  
   java java.util.Hashtable ht
   set hasht [ht -new  ]
   $hasht put foo "bar"
   $hasht get foo
   bar 
The 'java' command takes a class, and string, and creates a new Hecl command 'ht' that is tied to the Hashtable class. ht -new (could have been -new [list]) is how we call the constructor. After this, $hasht points to a Hashtable, and we can utilize its methods. Up to a point, at least - there have to be mappings in Reflection to deal correctly with types. For instance, there isn't a mapping for Enumeration right now, so calling the .keys() method wouldn't do the right thing. There are some more bits and pieces of magic: There are some open issues with the ongoing work:

Michal &#268;iha&#345;: Downtime 15 hours

Finally happened the thing which I expected to happen since I left to Japan. My server (currently being few thousands kilometers away) crashed and exactly followed Murphy's law to break in time when it would caused largest possible downtime. Anyway it's now back and I hope all services are correctly running. And no, I have no idea what caused power led to blink and make the computer unresponsive for anything except plugging it out of power and then pugging it back. Hopefully it will not repeat, at least not until I'll be back in Prague :-).

Biella Coleman: Rethinking Blogs: The importance of fewer posts and preaching to the choir

It is hard to believe that I have been blogging for over five years. And what is clear is that being an assistant professor is not all that conducive for blogging and this is materially evident in my sparse posting pattern over the last few months. It has been particularly bad in the last month thanks to a week long international trip, back-to-back sickness over Thanksgiving week, and finally going to Washington D.C. for the AAAs. But this retreat from blogging as well as teaching on so-called Web 2.0 software, like blogs, has made me rethink the value and limits of the craft of blogging and so I am going to take some time (that I feel like I don t really have, but oh-well..) to write them down as I am preparing a short piece for on the politics of Web 2.0 and I hope I can transfer some of these ideas there. So as I have already mentioned, I am an now infrequent blogger. Prior to the era of RSS, this could have meant the death of my blog because if people went to visit my page and there was no new post and then this happened a few more times, they would just stop visiting. The magic of RSS is that it brings the blog post to you and this alters the landscape of possibilities within the context of what has been nothing short of a seismic explosion of blogs. What I am finding and this will be no surprise to anyone is that it is just too difficult to keep up too many of a certain class of blogger the prolific poster who posts medium to long posts and worse, nearly everyday! To make a point about the effects of this, allow me to tell a story: Two blogs I really like are Joe Reagle’s blog on Open Communities as well as Tenured Radical. Both provide captivating posts but I recently unsubscribed to Radical Tenure and not Joe Reagle s. Why? My decision was purely pragmatic. Because she posts way too much, I just can t keep up. If I stop reading her blog for 2 weeks, and then pay a visit via bloglines, I am faced with a blogolanche and I am trying to avoid, at all costs, overwhelming situations. On the other hand, if I stop reading Joe s blog for 2 weeks, there may be one or two posts so I feel like I can spare the time to continue reading. Ironically, I will now visit Tenured Radical every month, much as I did prior to the RSS era, just to take a quick scan and see if there is anything I must read. There is another class of blogs, such as Sivacracy, that update their site frequently but the posts are tidy and short and so I can usually keep up and they provide important news for my projects. But the type of blog that provides longer ruminations has proliferated (and I really like reading those) but I suspect that as the blogosphere has expanded, less people can commit to those types of blogs. In other words, today, you may hang on to more readers, if you only blog 1 to 2 times a week instead of 3-5 weekly posts that are medium to long in length. Now I may be completely OFF the mark with this by generalizing my own experience so I would be interested in hearing people s experiences or better, if anyone could point me to someone who studies these types of pattern, I would really appreciate it. On a related note, last week I taught a now famous piece by Cass Sunstein on political balkanization on the Internet that is in part secured by blogging. His core argument, which I think stands to some degree, is that the blogosphere is less an arena where people with different inclinations and views meet to debate, and thus change their views, but is an arena where your pre-existing ideas are reinforced because you are simply reading and debating with people who hold your worldview. As I mentioned, I think this is true in so far as you don t see people on the left and right engaging in some debate that substantially transforms their ideas. But the argument is faulty or missing something crucial about the nature of politics, in so far as that the so called left or right or so called liberal and conservative positions are truly not unitary so that if different types of liberals/lefties are engaging with each other to change positions and ideas within that group, well then, the critical function of blogging is in fact well and alive. To state using an example, there are plenty of liberals who, in my opinion, could use a little radicalization and perhaps this is happening in the blogosphere because people come across a spectrum of ideas and positions from within their political pole. Finally and this point really is not mine but I am poaching it from Jeff Juris who made it last weekend at the AAA meeting during his presentation on activist videos. One of his findings was that activists were the only ones watching video s documenting protests when hosted on radical political sites like Indymedia. When they were placed on Youtube, the audience expanded considerably: conservatives were also watching them, but they effect was not to make their more sympathetic toward the left and their political points, but simply to reinforce their position, which is evident in the archived comments expressing their great distaste of the left. This is a perfect example of the Balkanization that Sunstein talks about but with an important reversal: it comes from confronting difference not avoiding it! But Jeff made the excellent point that there is a critical function in preaching to the choir: it ensures that the choir will not stop singing! That is, your political passions are not simply ensured, they must be renewed and given the massive amounts of apathy peppering our population, renewal by confronting what you believe in, is vital. So my advice is keep producing posts, keep reading even if it tends to be stuff you already believe in BUT please, post less. Less, I think, is really becoming the new more….

Russell Coker: The Meaning of Godwin s Law

A widely cited unofficial rule on the Internet is known as Godwin’s Law [1]. In it’s original form this rule states that “As an online discussion grows longer, the probability of a comparison involving Nazis or Hitler approaches one“. Mike Godwin noted that “overuse of Nazi and Hitler comparisons should be avoided, because it robs the valid comparisons of their impact“. The purpose of noting and publicising this is to reduce such false comparisons. It’s often used as a rule for conduct in various fora where it’s regarded that if you compare your opponent in a debate to Hitler or unjustly call them a Nazi then the debate is over and you have lost. In more recent times due to successful application of Godwin’s Rule the frequency of inappropriate comparisons has dramatically decreased. This combined with the small number of people on the net who are interested in discussing historical events that happened ~60 years ago (and the even smaller number of people who are interested in learning about them) means that the possibility of robbing valid comparisons of their impact is small. Now a large part of the use of Godwin’s rule is because it’s regarded as an ad-hominem attack that distracts everyone from serious discussion more than most such attacks. To see examples of this you merely have to do a Google search for “Bill Gates” and “Hitler” (currently 597,000 web pages have both those terms). Note that the original reason for avoiding such false comparisons is given to sustain the impact of legitimate comparisons. It is quite legitimate to use the term Nazi when describing anyone who wants to implement mass-murder and slavery on a national scale (or any of the other awful things that the Nazis did), or the propaganda and other mechanisms that the NSDAP used to gain power. It is also legitimate to make historical comparisons, comparing Stalin to Hitler is historically valid (both were awful tyrants that committed a similar range of crimes) - I’m not going to compare them in this post but I merely note that such a comparison is valid (and is the subject of much debate by people who are interested in history). I’ve just had a religious zealot named Elder Dave accuse me of breaching some new version of Godwin’s Law. I believe that my mention of the fact that his religious group (which wants to deny homosexuals the same legal rights as all other people) has some beliefs in common with the Westboro Baptist Church [2] is valid. The Westboro Baptist Church seems to be the leading organisation in the English-speaking world for demanding legislation to discriminate against homosexuals. Anyone else who demands such legislation IS trying to achieve similar aims and should expect this to be noted by everyone who has any knowledge of what is happening in the world. Religious groups are given a lot of freedom to discriminate internally (EG “Priest” is one of the few jobs that can be denied to a qualified woman without any legal recourse). Also I think that most people will agree that it’s acceptable for them to advocate self-repression (EG the book What Some of You Were [3]). But when they try and get legislation enacted to institutionalise such discrimination I believe that they are going too far. As for why the 95% of us who aren’t gay should be bothered about this issue, there’s the famous poem by Martin Niem ller which is known by the line “First they came for the Jews” [4] (actually there are a few versions of the poem some of which don’t mention Jews - check the link for details). Here’s another Wikipedia link for the same poem [5].

Wouter Verhelst: Dear Lazyweb,

I'm looking for a scanner, with the following requirements:
  1. Must work perfectly with Linux. I don't even care about Windows or MacOS.
  2. Will be used for documents, not pictures. As such, resolution does not matter, but ADF would be nice.
  3. I have a pretty good printer, and we have a system running mgetty for faxes, so I'm not looking for a multifunctional thing. I just need to be able to scan from time to time.
  4. Not too expensive.
The problem is that I know splat about scanners in Linux, except that there is this thing called SANE which sometimes seems to help there. I even used it once or twice, but that's about it. Any suggestions?

Josselin Mouette: Won t people ever learn?

Introducing biometric authentication in our systems is a very good idea. It is the key to two-factor authentication which, while not solving all security issues, can bring a giant leap in terms of security when done correctly.

Everything is in the correctly.

And I can t say I m impressed with the way people are developing fingerprint authentication systems. Let s look at the currently emerging standard, fprint, and its security notes:
In it's current state, fprint is not a very secure system: this data is stored on disk in unencrypted form. This data is not readable by other users, however it is possible that the super-user can access it, and also someone with local access could move the disk to another system in order to gain access to the whole disk.
This statement is followed by considerations on how to protect this data from being read, much like passwords are protected by MD5 hashes.

Wait Yes, they are treating biometrical data like a password. Password-based security relies on the fact it isn t easy to obtain your password without spying on you or torturing you. But obtaining your fingerprint? Unless you ve been wearing gloves for years, this is absolutely trivial. And this is how people focus on the wrong issues.

Biometric data is not a password, and it requires a radically different approach to authentication. You can t just expect the person in front of the computer to provide some data corresponding to the fingerprint. You have to ensure that the person in front of the computer is the one with the correct fingerprint. Biometric devices manufacturers have made impressive efforts to ensure fake fingers or cut fingers can t be used, but there is still a giant hole in the security model. While you can now be reasonably sure that the device will only return data corresponding to the person in front of it, you also need to ensure the data processed by the computer comes from the device.

Guess what? These devices are USB-based. And given how USB works, there is nothing that prevents an attacker to plug a custom device in the USB port and send the data he wants to the authentication system. Good job, guys. While you re busy hiding easily available data, the house s door is still wide open.

Jonathan McDowell: A year passes

Katherine and I celebrated our first wedding anniversary over the weekend. We still don't think marriage has changed us or our relationship that much; having lived together for many years beforehand was really a much bigger step. A number of fairly major other events have happened to me in the past year, which I don't think either of us could have predicated. All in all I think I'm in a better place than I was last year. 5:30 starts are painful (it's 2 hours door to door with trains at 6am or 8am and nothing in between), but at least I get to come home to Katherine rather than an empty house, and it's nice to be working in an office again rather than on my own. We will eventually get the Castlerock house sorted (there are still lots of things in boxes, the TV isn't even hooked up, the wireless coverage is patchy in the study, the kitchen isn't quite finished yet, the living room is barely started yet, need I go on?). And I'm sure it'll stop raining for at least one day during the year. Please?

Next.

Previous.