Search Results: "ed"

9 October 2012

David Welton: Fast, Light and Asynchronous

I am a big fan of Ruby on Rails: it does a lot of things, and it does most of them pretty well. When starting a new web project, it's the first thing I would reach for: most of the time, your problem is going to be figuring out a good product/market fit, or whipping up some internal tool without wasting a lot of programmer time. Once you've got a firm grasp of the problem, then maybe you can consider optimizing. Who cares if you do something that no one wants really really fast? However, Ruby on Rails is not beautiful in terms of being particularly fast or lightweight. No complaints from me: most of the time, I'm happy to have something that does so much for me, leaving me to work on the actual problem at hand. Once in a while, though, you do need fast and relatively lightweight, and that space has been getting more interesting over the past few years, at least in terms of the web. First of all, technologies like "Comet", utilizing web sockets or some other always-on connection are becoming more common, where a socket with the server remains open in order to quickly exchange data from the server to the client - and back. That seems to be a poor fit for something like Rails, where it can tie up a lot of resources if one isn't careful. And while computing costs continue to decline, no one minds getting more for less in terms of what their server can do. Furthermore, with frameworks like Backbone.js, pushing more and more code to the client, the server can afford to be a bit simpler and do less, so it may as well be snappy to boot. Java has long been fairly popular for "heavy lifting" types of applications, partially because it does end up being reasonably fast. But it's not something I've ever had much fun using and is usually kind of wordy, and makes you feel like you need a crew of people in Palo Alto, one in Bangalore, and one in Stockholm just to churn out all the code. And it certainly is no lightweight in terms of memory either. So... while it can certainly do pretty much anything you need, I don't see it as being the strongest player when someone needs "real time web" code, and needs it to be reasonably light weight. Ruby, outside of standard Rails stuff like Passenger, seems to offer some interesting possibilities for this kind of work, like Reel but they don't seem to have the traction other solutions do. Python is in a similar situation: the Twisted framework has been around for a while, and while it has some success stories, never seems to have really 'caught fire'. Neither of these languages was built for "concurrency" from the ground up, and that seems to have, to date, inhibited people from using them extensively for this kind of job. My gut feeling is that the need for speed and "concurrency" (or at least handling a lot of concurrent users) will drive adoption of languages heretofore not so popular on the server. Let's have a look at them. Erlang: This is by no means a new language, having been developed in Ericsson in the late 1980ies; and it implements several interesting concepts. First and foremost, concurrency is handled in the form of many small "processes", which are not actually Unix processes at all, but processes internal to the Erlang VM. The Erlang system contains a scheduler that allocates resources to all of these processes, so even if one of them dies or behaves badly, it's not a problem: the system as a whole can continue to function well. The way Erlang is built, the scheduler is preemptive: the internal "processes" don't need to yield to let other processes run. Beyond the scheduler and simple processes, Erlang gives you the tools to create elaborate trees of supervisors and workers that are quite robust to failures in any one portion of the system, as well as giving you the tools to set up a system to run on multiple, distributed computers. This kind of thinking is necessary when you write applications, such as phone switches, where downtime is really, really not ok. Erlang processes comunicate almost exclusively via message passing, meaning that state is not shared. Altogether, this makes for a fast, rock solid system that can easily handle thousands of concurrent connections without breaking a sweat. The computing world being what it is though, Erlang is likely to be more of a Lisp or Smalltalk: it's a trailblazer that did many things years before their time in other languages, but I don't see it as ever quite catching on amongst 'the masses'. It has a wonky syntax, it's a functional programming language, and because it is used in environments where too much experimentation is not good, it does not have a lot of room to break with its own past and innovate in terms of the language itself: it's slow to change and improve, even where the need to is clearly perceived. Node.js: is the opposite, in some ways: being based on Javascript, it draws on a huge number of potential programmers - orders of magnitude more than Erlang. And thanks to design decisions enforcing the use of asynchronous code and callbacks for anything that could block, it deals quite well with concurrent connections, even if the language and libraries don't really give you much in terms of "true" concurrency. This is a simple model that works pretty well, even if, theoretically, all it would take is one "while (1)" loop in a callback to block the entire system. In practice, this doesn't seem to be a big problem, though. More of a problem is writing maintainable code, when everything is a callback. Keeping the network of callbacks straight can be a bit of a chore, and is probably not an optimal model in terms of programmer productivity. That said, people seem to do make due with it, although Node is young enough that we haven't seem projects that are 5 or 6 years old and maintained by people who didn't write them. One of the advantages of being such a popular language is that lots of people have a strong interest in seeing Javascript being very, very performant. That need begat the V8 Javascript engine, from Google, which they were kind enough to release as free software. So one of the advantages that Node has is that the underlying implementation is extremely fast for a dynamic language. For many people who know Javascript, picking up Node.js is also an easy choice, even though people used to browser side programming with Javascript will have to adjust their way of thinking to succesfully tackle server projects. Go language: this is an interesting one, written by some luminaries who work at Google. It can best be described as something akin to C with some updated features, such as garbage collection, that make it more suitable for working on large projects, where things like memory leaks are going to make life very frustrating. It has the feel of a "real language, for real programmers" in that it doesn't stray far too far from what people are used to - it's not going to cause the "what the hell is this?!" reactions that Erlang might in more close-minded circles. Between the big company backing it, and the approachable syntax and concepts, Go looks like it has a good shot at the mainstream. Where it gets interesting is their concurrency model, which is apparently based on something called "communicating sequential processes" which, superficially at least, looks like it has some things in common with Erlang's "actor model" of concurrency. Under the hood, Go apparently hives off its "goroutines" to different OS level threads, but does not have a preemptive scheduler like Erlang: http://code.google.com/p/go/issues/detail?id=543 - although according to this, they may change that in the future. I'm not enough of a computer science guy to comment much on the details of CSP vs Actors, but both seem like valid models with strengths compared to trying to keep threads straight, which always seems to be a source of problems for programmers. Conclusions So, what's actually going to happen? I see Node.js as the clear front runner. It takes a worse-is-better approach that seems to work well enough as people get started. If they encounter difficulties later, they can always rewrite in something else, if needs be, but by "luring people in", Node.js has gathered a large group of users who continue, in turn, to churn out more code for use with the system, making it more attractive to new users. Programming languages are not winner-take-all markets though, so perhaps there is room for a few more languages to have decent followings in this space. Hopefully the competition will lead to ever better tools for those of us utilizing them! What do you think?

Stefano Zacchiroli: bits from the DPL for September 2012

Just posted to d-d-a, bits from the DPL for Septemer 2012.
Heya,
here is the periodic report of DPL activities, this time related to September 2012 (posted here with some delay, as I've been traveling oversea on behalf of Debian for the past few days). Help needed: Google Code-In The Google Code-In (GCI) initiative is about to start again. We don't have a great track record of participating into it, and that's a pity. The initiative revolves around small tasks that other Free Software projects have come to call "easy hacks", showing how effective they're in attracting new volunteers. To participate, we need both mentors and admins. If you're interested see Ana's call for help and please volunteer on the soc-coordination list. Related to this, you've probably seen the report of our participation in GSoC 2012. I'd like to thank all students, mentors, and admins for a very well organized edition. Logo relicensing & other assets The DFSG-relicensing of the Debian logo, which I've mentioned in recent updates, has now happened. The so called Debian "Open Use" logo, in both variants (with and without "Debian") is now dually licensed under LGPL3+ / CC-BY-SA 3.0. The change has been made effective with a resolution of the SPI Board of Directors. Note that the so called "official" logo, which we seem to use very little, is still released under the terms of a non-free license. Discussion is ongoing on -project to stop promoting it. If you're using it or if you've arguments in favor of against that, please participate in the discussion. I've got from SFLC an updated draft of the new proposed trademark policy, implementing most of the changes requested during related August discussions on -project. I'll post it for review there shortly. The Japanese Trademark Office (JPO) has sent us the final confirmation that trademark transfer request (from individuals Debian contributors in the area to SPI) has happened. We've paid the needed fee of 457 CHF to conclude the transaction. We finally settled a domain transfer agreement with the current owner of the debian.eu. Technically, the domain will be transferred to FFIS in the coming weeks. Core teams (non-)news Quite some core teams are in the process of changing their formations these weeks, but most are still pending proper delegation (or equivalent). So here are just a few "teasers": I hope to finalize all the pending tasks above this month. Future events I've spent quite some time to plan my participation in events I'll be attending during October on behalf of Debian, such as the ACM Reflections conference in Urbana-Champaign (at the time of writing, this has already happened), the Ubuntu Developer Summit in Copenhagen, and the LinuxDay event in Turin. Cheers.
PS the day-to-day activity log for September 2012 is available at the usual place master:/srv/leader/news/bits-from-the-DPL.txt.201209

Christian Perrier: Long overdue 2012 update 30 for Debian Installer localization

It's quite some time since I didn't report about Debian Installer localization. Indeed, thanks to the tireless activity of Cyril Brulebois, we focused on releasing D-I and I indeed stopped harassing translators for updates around July 2012. Why July? Well, you probably know we have "something" to release as soon as we can and most, if not all, Debian energies should be focused on this! Or, more precisely speaking, I only focused on getting the newly introduced material translated: we had several changes recently in D-I, mostly focused on important features, such as IPv6 support (thanks to Phil Kern who worked on this), better wireless networking support (thanks to Sorina Sandu) and EFI boot support (thanks to Steve McIntyre). And, of course, when people change code in D-I, they want to add questions to users, display error and informative messages, etc, etc. And these need translations..:-) Most translators coped with all this (sometimes with /me hitting them hard on the head to get updates) and D-I beta2 was released with 37 complete translations out of 73 supported languages. Yesterday, I just resumed the activity of trying to get more updates not only for those recent changes, but also for other older changes...or for languages that never got completed in the past. As a result, we bumped from 37 compelte languages up to 45 this morning: look for level 1 here (level 2 has been hit by a change in iso-codes, but that change doesn't really affect D-I). If you language is not 100% in the leftmost column on the stats page, you can probably help. Just get in touch with me and we'll check if somebody is already working on this or not.

Christian Perrier: Bug #690000

(doh, I nearly had it. I just got #690019, #690020 and #690022 for l10n stuff) Bartek Krawczyk reported Debian bug #690000 on Monday October 8th, against guake. And my friend Sylvestre Ledru, the package maintainer, now has to fix it instead of trying to promote the use of Scilab over proprietary alternatives in the French aerospace research organizations..:-) Bug #680000 was reported as of July 2nd: 3 months and 8 days for 10,000 bugs. This is a VERY significant drop in the bug reporting rate in Debian. Last time, I wrote: "How will the wheezy freeze affect this? We'll see in two months!". We have the answer: the wheezy freeze triggerred an important drop in bug reporting rate in Debian. My general feeling is somehow different: for whatever reason, I feel like the *overall* activity in the project has dropped significantly. I seem to have less mails to read, less bugs reported against my packages, even less heated discussions here and there, as well as several very quiet channels on IRC. Am I pessimistic when feeling that the overall momentum is sliding out of Debian? Maybe I am, so, folks, please make me optimistic and move you fingers out of the place where they are and help releasing that damn penguin. Apart from that, our next milestone (apart from the wheezy release!) will be bug #700000. Remember the bet?. It looks like the probability of Kartik Mistry winning it is now away (he bet for Now 8th 2012) and the best position is hel by David Pr vot (he bet for December 12th). On the other hand, my own chances are increasing if the bug rate drop is confirmed and if bug #700000 is reported in more than 3 months (I bet for February 14th 2013, guess why?). We'll see that in a few weeks!

8 October 2012

Eddy Petrișor: HOWTO fix git-buildpackage signs with wrong signature

If you have two or more available gpg keys that can be used for the same identity (e.g.: 'John Doe <john@doe.com>') that you might use to add entries to changelogs of packages, you might end up in situations where git-buildpackage or other similar tool might want to sign packages with the wrong key.

It seems debsign (the tool that actually does the signing) just picks up the first key that is still valid (I also have a revoked key) and matches the used identity.

There are many ways to fix this, but the one that will work for most cases is to run this command:

echo 'DEBSIGN_KEYID=0x0123ABCD' >> ~/.devscripts

Of course, you should replace 0x0123ABCD with the keyid which you prefer.

This will create a ~/.devscripts file (if it didn't exist) which will contain the DEBSIGN_KEY variable with the desired value. This file will be sourced by debsign before doing its actual work, so it will do the right thing when ran.

There are also git-buildpackage specific fixes like defining builder in the [DEFAULT] section of ~/.gbp.conf and passing '-k0x0123ABCD' to debuild something like:

[DEFAULT]
builder = debuild -i -I -k1234ABCD
...

But that probably gets ugly if you use a custom builder.


P.S.: I have just deleted my old key 0xDD1F1F9F since I won't be using it anymore. I don't remember where I put the revocation certificate, but I'll revoke the key, once and if I find the revocation certificate. Otherwise, it will expire in July, next year.

From now on, I am going to use only the key 0xE3E083A1 to which I even added a photo and some newer identities and updated with a few signatures I got during DebConf 9.

Luke Faraone: Where I've gone off to

For those of you back at my university, you may have noticed I'm not there this semester.

Google's 2012 FEP team

I spent this past summer at Google, Inc, developing internal tools for the AdSense team, specifically Google Programmable Ads. Being at Google was great; I loved my team and my intern cohort, the rest of the interns in the Freshman Engineering Practicum.

I'm not currently at Google; my internship ended at the beginning of August. Although it was a blast, all good things must come to an end.

I'm not at Mason, either. I was super excited to return to university, and was just about to buy my books and get ready to move in when I got an email from a former coworker at Ksplice, a startup Oracle acquired while I interned there last year. He was starting a new company which would focus on business communications. I'd be working with a bunch of my former coworkers, and based on what I had heard of the company's plans I was confident in their ability to make an awesome product.

Needless to say, when they decided to offer me a position working there full time, I jumped on it.

From an academic point of view, Mason didn't really have much of a mechanism to support this. Co-ops are uncommon there, and not really supported for more than one semester; a full year away had never been done, according to our career services. My department was fully supportive, however, so we managed to find a way to make it work. This involved filling out some oddly-named forms, such as Special Registration for Graduation Request, which the registrar asserted was the right form, trust us on this one.

Myself and Obey Arthur Liu
at a SIPB hackathon
But that's all neither here nor there. I'm now up in Cambridge, MA, working with awesome people (including but not limited to tabbott, wdaher, jesstess, and keegan), and exploring the city. I'm hanging out with MIT SIPB, helping with the maintenance of Sugar Labs' servers in E15 and spending more time working on various open source projects.

To my friends at Mason: I miss you all. I know regardless of how the next year+ turns out, it'll be one one hell of a ride.

Rudy Godoy: MySQL data enconding conversion latin1 utf8

I was about to post a different story but things turned out differently, for good. Now I ll post tips that may save the day in the event of encoding issues when dealing with MySQL table data. Hopefully you find it useful. Say you have a MySQL table that has collation set to latin1 but you have utf8-encoded data stored. This happened when importing a dump, or because of Murphy s law. When querying the data from your application or from mysql s tools you get awful results for non-ascii characters such tildes. Changing the table s collation definition will only work for new columns and records. Altering the collation for the said column would make things worse. So what to do? Fortunately MySQL offers a nice way to save the day. You can use a transition conversion and then set the table encoding back to utf8, so it pairs accordingly with the encoding type for the data it has stored. ALTER TABLE table_name CHANGE column_name column_name BLOB; Issuing the previous command will make the table change it s type to BLOB. Why? Because by doing it the stored data is kept untouched. This is important. If you use the CONVERT or MODIFY commands the data will be converted by MySQL. We don t want that since the data is already in the encoding type we want. You can note that column_name is repeated twice, this is because the CHANGE command copies the data and we want the resulting column to have the same name. Now, we have to put the data back on the encoding we want, so everything is under control again. This is done by issuing the following command. ALTER TABLE table_name CHANGE column_name column_name COLUMN_TYPE CHARACTER SET utf8; COLUMN_TYPE depends on the content s column type. For instance, for a TEXT column it should be. ALTER TABLE table_name CHANGE column_name column_name TEXT CHARACTER SET utf8; It works for VARCHAR, LONGTEXT and other data types that are used to store characters.

Craig Small: NTP control messages

I have had an opportunity to rework some code to query NTP servers directly in python rather than running ntpq -pn and scraping the result. The over-the-wire protocol format is reasonably straight forward and my little module is now passing all of its nosetests which is wonderful. While its only a single table, ntpq actually does multiple requests to get its results. NTP control messages are all mode 6 which tells the client and server its not time sort of things, but more about queries. A control packet has a sequence number which the server responds with so you can line up your requests with responses. For large responses, the more, offset and count fields work together to knit up a large block of data. The first packet of the response will have the offset field of 0. The count is the size of the data payload in bytes. If the response is too big, the more bit will be set to 1 to say there is more coming. The second packet will have an offset that is the same value as the previous packets count value, so you can stitch them together. The first query is a READSTAT which uses opcode 1. This returns a list of 4 byte responses with the association ID taking the first two bytes and the peer status taking the second. If you look at the output of ntpq you will notice a character in the first column which is the peer selection. The important one for us is asterix, which equates to 110 in the lower 3 bits of the first status byte. This is the system peer which is the main one. There may be others, up to 2, (usually symbol +) which are compared to the system peer. ntpq doesn t really care about the different peers and just displays the status but I want to know what peer the server is synchronised to. Next we need more details about the system peer (or all peers in ntpq). To do this a READVAR or opcode 2 is sent to the server. The association ID is set to the association or peer we are interested in. The response for my setup is sent over two packets which need to be reassembled and it is all in plain ascii which is a comma-separated list with a key=value pair. I use the following python line to split it up.
self.assoc_data.update(dict([tuple(ad.strip().split("=")) for ad in data[header_len:].split(",") if ad.find("=") &gt; -1]))
I m sure people that know python better than I will say I am doing it wrong (it looks a bit klunky to me too) but it does work. From that I can query the various values that are returned by the server about its peers, including the source of its clock.

Jonathan McDowell: KVM + usbmon + Wireshark == win

(This is something I did a few months ago, and I really should have noted down all the details then so I covered everything. However hopefully these notes will remind me enough next time.) When I first wanted to reverse engineer a USB device that only had Windows drivers the "easy" option was to take a Windows machine, install usbsnoop on it and capture the traffic as a bunch of verbose text files. It was a cumbersome procedure. Recently I wanted to do a firmware upgrade of a ZTE 3G modem dongle, partly to provider unlock it and partly to try and enable some voice functionality. I was also hoping to sniff the traffic to see how to drive the voice side of things. These days I don't have a dedicated Windows box, but I do have a Windows 7 KVM virtual machine. I hadn't yet used the USB support in this, but I thought I'd see what it was capable of. Firstly I had to explicitly enable USB2 - the device wasn't happy with the default USB1 only stack that KVM enabled. That involved passing -usb -device usb-ehci,id=ehci to KVM. I also told KVM to grab all the ZTE devices with -device usb-host,bus=ehci.0,vendorid=0x19d2. I dropped a udev rules file into /etc/udev/rules.d to ensure any device nodes created belonged to my normal user. This gave me a Windows setup that could see the USB dongle and install the appropriate drivers. It was also happy to do the firmware update (along with various device resets on the way as it changed USB ID - this is why I needed the udev rule, to ensure every time the device re-appeared it would be seen by the KVM instance without manual intervention). After that was complete I investigated usbmon. modprobe usbmon created the appropriate /dev/usbmon<n> files and I chowned the appropriate bus to my normal user. Once this was done I was able to start Wireshark which rather nicely has full USB decoding support. Firing up the custom app in the Windows KVM guest I could see the traffic going back and forth to each of the device endpoints and work out what was going on. All of this was much more flexible than using a standalone Windows box. Once I figured out that I needed to explicitly enable USB2 I was quite pleased with how simple USB access under KVM was. I also used lvm to create a snapshot of the Windows guest so at the end I could roll back all of the drivers I'd installed for the dongle. And being able to use Wireshark instead of trawling through dense text files helped a lot in seeing the command stream.

7 October 2012

Junichi Uekawa: parsers.

parsers. From a reader (Hi Diggory) I received a mail that biscuit might be interesting. The syntax is using templates extensively. Not sure if it's something I would touch because it doesn't look very well maintained, and I suspect code would go through significant simplification adapting to c++11.

Sune Vuorela: Playing with webstuff

So, the other day, I wrote a blog post asking people to make sure their private hacks become published somehow. So in the sprit of that, I should also publish my recent hacks. I have been toying around as a web dude and created two nice pieces of oldschool webby software. So. Time to introductions: Dodoma is a simple online note taking application. I have created a boring homepage for it on http://sune.vuorela.dk/dodoma and I have a screenshot here:
Screenshot of webapp Kadaka is a simple rss reader showing the five newest items from various rss feeds. Has special support for youtube channels.
I have created a boring homepage for it on http://sune.vuorela.dk/kadaka and I have a screenshot here:
Screenshot of kadaka Have fun with those two apps. Patches always welcome. Some of you might wonder where does he get those crazy names from . Well. One of them I found on a map. Thats actually a way I name quite many of my projects. Even those that don t even leave my harddrive. And the other one actually also is on a map, but I saw it on a frequently used bus in Tallin, Estonia. And. I am considering naming my next fancy projects after some of the cool words found on the join the game member page. If you want to be part of that, feel free to Join the game!

Matthew Garrett: Handling UEFI Secure Boot in smaller distributions

The plan for supporting UEFI Secure Boot in Fedora is still pretty much as originally planned, but it's dependent upon building a binary which has the Fedora key embedded, and then getting that binary signed by Microsoft. Easy enough for us to do, but not necessarily practical for smaller distributions. There's a few possible solutions for them.


I've taken Suse's code for key management and merged it into my own shim tree with a few changes. The significant difference is a second stage bootloader signed with an untrusted key will cause a UI to appear, rather than simply refusing to boot. This will permit the user to then navigate the available filesystems, choose a key and indicate that they want to enrol it. From then on, the bootloader will trust binaries signed with that key.

Distributions are then able to take an existing signed copy of shim and put it on their install media, along with a file containing their key. If a user attempts to boot then the boot will fail because the second stage bootloader isn't signed with a trusted key, but the user can then use the navigator and select the distribution's key file. After providing confirmation and rebooting, the second stage bootloader's signature will now be recognised and the installer will boot.

This has the advantage over the first two options that the UI is consistent, making it easier to document the install process. The primary disadvantage is that the distribution won't be able to rebuild shim and will have to ship a pre-compiled binary. This may well be unacceptable to distributions like Debian, but should still provide a viable approach for other distributions who are either unwilling or unable to deal with Microsoft themselves.

comment count unavailable comments

Gregor Herrmann: RC bugs 2012/40

this week I focussed mostly on bugs where conffiles are modified in maintainer scripts. thanks to the recipe in debconf-devel(7) many cases are not so hard to solve.

Charles Plessy: Gathering metadata with Umegaya.

A Debian package contains some metadata about the packaged program. For instance, its homepage URL is stored in the source package control file (debian/control) and propagated through the Debian source control file (.dsc). The problem with this approach is that to update the metadata, one has to update the whole package. Today, thousands of Debian source packages are developed in a version control system, most often Subversion or Git. The repository's URL is also propagated through the control files mentioned above. It is then possible to monitor the main branch to detect and propagate changes without needing to upload to the Debian archive. In 2009, I proposed to centralise metadata about Upstream in a YAML-formatted file, debian/upstream. We are now using it in the Debian Med project to propagate bibliographic references about the manuscripts describing the packaged programs. The references can be seen on our web sentinels for our metapackages. The data transits through the Ultimate Debian Database (UDD). Let's imagine that the concept gains success and that thousands of packages provide a debian/upstream file. How can we avoid thousands of daily requests on Alioth to keep the database up to date ? I am developing a system called Umegaya, for Umegaya is a MEtadata GAtherer using YAml. Umegaya provides a web interface with a simple URL structure to retrieve data. For instance, http://upstream-metadata.debian.net/emboss/reference-year returns 2000, the year where the first scientific article describing EMBOSS was published. If at the time of retrieval, the previous update was older than one hour, the system will read the package's debian/upstream file again. It is therefore by reading the data that it is kept up to date. Conversely, to update the database after modifying debian/upstream, one just has to access it. Umegaya is still a draft, and many things may change. But the service is already up for more than a year at the address upstream-metadata.debian.net. It is used to fill the Subversion repository called packages-metadata, with gathers the debian/upstream, debian/control and debian/copyright files from recently uploaded packages (since a few months). One can see there that among the 3,646 copyright files, 1,218 declare themselves conformant to the machine-readable format 1.0. Because I like a lot the principle package what you use, use what you package, umegaya entered the Debian archive a few days ago.

Dominique Dumont: Dpkg source editor/checker is going native

Hello As Config::Model was becoming too big with too many dependencies, I ve moved all Debian stuff from Config::Model repository into a separate Debian repository. If you install only libconfig-model-perl 2.026-1 (from experimental), the command cme check dpkg will not work. You must also install libconfig-model-dpkg-perl to get it back. libconfig-model-dpkg-perl is currently in experimental. libconfig-model-dpkg-perl repository is hosted on Alioth in debian perl-packaging team and is a Debian native package. Nevertheless, it will be uploaded to CPAN. (just like dh-make-perl).
All people involved in packaging are welcome to hack it or suggest improvements I ll upload both packages into unstable once the dust settles. All the best
Tagged: config-model, debian, dpkg, Perl

6 October 2012

Matthew Garrett: The importance of trustworthy power structures

Direct harassment and overt sexism are certainly a significant part of why the gender ratios in the Linux community[1] are so skewed, but they're not the whole story. Part of feeling comfortable with a community is the knowledge that those in positions of power can be relied upon to engage in appropriate action when undesirable situations arise - no matter how compelling your code of conduct, no matter how detailed your diversity policy, if someone contravenes them and nothing happens, those documents are worthless and your community is unwelcoming. You can't rely on enforcement unless the community can trust its leadership.

Setting a good example in terms of behaviour is obviously vital, but it's not sufficient. Leaders who engage in sexist behaviour or who harass community members are clearly untrustworthy and undermine any attempts the rest of the community may be making. Failing to step in when they see examples of unacceptable behaviour is as bad. But less obvious is that it's possible to destroy that community trust without clearly contravening those community standards.

An example of this is Todd Akin, a candidate for the upcoming US Senate elections. In August he justified his support for making abortion illegal even in cases of rape, on the basis that women can't become pregnant through being victims of "legitimate rape". Of course, this had little to do with his fiscal or wider social policies, positions that are more directly relevant to most of his potential constituents, and in an election year that's primarily about the economy and healthcare it might be expected that a single issue would have little effect on the election standings. Instead, there was a huge uproar and a previously safe victory has now turned into a real chance of a loss.

Why? A significant part of it is because many people now have difficulty believing that they can trust him to represent them. If he understands women so little that he's willing to make entirely spurious justifications for his positions, how could any woman trust him to consider any other problems they may face? If he's willing to use fake science to back himself up, how could anyone trust him to consider any issue involving science? Through a single statement to a journalist he demonstrated to many that he was unsuited to be their representative in government. Many people who would otherwise have voted for him simply don't feel that they can rely on him to be there for them. Whether he wins his election or not, that distrust is going to remain and it's going to compromise his ability to work with his constituents.

It's the same in technical communities. If a member of a project's technical leadership frequently and loudly expresses their disdain for Python coders, anyone advocating for increased use of Python in that project is unlikely to feel that they can get unbiased opinions from that leader. If the project as a whole is uninterested in adopting Python then that's probably for the best, but if the rest of the project is open to using Python then there's a problem. People working with Python are less likely to join the project, and perhaps the project will lose out as a result.

But it's worth remembering that technical communities are still communities. If a member of a project's technical leadership vociferously argues that slavery benefited minority groups in the long run, members of those minority groups are going to feel that they're not going to be well represented by that leader. If they blog about how homosexuality is a lifestyle choice then homosexuals are unlikely to flock to the project. Likewise, if they downplay the prevalence or impact of rape, women are going to feel marginalised and find something better to do with their time.

It's impossible to separate these things. No matter how technically competent a community leader is, no matter how much code review they perform or how much mentorship they provide, if they're expressing unacceptable social opinions then they're diminishing the community. People I know and respect have left technical communities simply because people in positions of responsibility have engaged in this kind of behaviour without it causing them any problems.

We shouldn't be willing to give people a pass simply because they aren't actually groping anyone or because they're not members of the KKK. Those who drive people away from the community on the basis of race, gender or sexual orientation deserve vocal condemnation, and if they're unwilling to change their behaviour then the community should instead act to drive them away.

We're pretty bad at that in the Linux world at the moment. Too many people have behaved in this way and are left with positions of power or responsibility. There's no easy solution to the problem, but the Ada Initiative is continuing to work to improve awareness and work with communities to reduce the alienation that results from this kind of behaviour. If you want this to be anything other than a straight white male dominated community, you should give them money.

[1] (and computing in general, though to a lesser extent)

comment count unavailable comments

Lars Wirzenius: Obnam 1.2 (backup software)

I've just made release 1.2 of Obnam, my backup program. The NEWS file entry: Bug fixes: This release has been uploaded to my own apt repository on code.liw.fi, for squeeze and unstable. Due to the Debian freeze, I am not uploading this to Debian at this time, though some changes may eventually be uploaded there.

Tim Retout: Wedding

Today, Kate and I got married! Thank you to everyone who sent best wishes. A big wedding party will follow in the next 18 months or so (when we've saved some money!), to which many more people will be invited. This was the minimum viable subset of wedding - we got the product to market early, and both stakeholders are very satisfied. We had dinner at the Caribbean restaurant in town which is always busy - turns out there's a reason for that. They do these one-pot meals in enamel dishes, which tasted amazing. It is a strange new feeling to be a husband. :)

MJ Ray: Elected as @theCooperative member delegate

Thank you to the co-operative group Cambridge and East Anglia area for electing me as their member delegate to the national half-yearly meeting and annual general meeting. Please tell me what you d like me to do (such as comment here or there s a private contact form on my website), else I ll do what seems best at the time. Thanks also to our co-op for allowing me the time to do this and for helping with the process. Co-ops do different. :-)

Christian Perrier: [life] Running update

It's been some time since I didn't write in this blog about my running activities. So let's make an update for my international friends. If you don't care about running, you can move to the next post in your feed reader..:-) After a quite busy running activity during DebConf 12 in Nicaragua, as well as during the touristic trip we did afterwards, I went back to my "regular" schedule. Main objectives in September-December are roughly the following: During August, I broke my monthly distance record by running nearly 300km in one month, even achieving 100km in only 5 days, around 24th. That was one of my goals: improve my overall resistance to run repetitions, which is one of the keys for ultra-running. These were achieved with many runs to/back work, with up to 13km in the morning and the same in the evening. Yes, running 26km at about 11km/h (and with some ups and downs in the woods to make it even worse) on a day where one has a normal work activity is quite a challenge. September has been more focused on marathon preparation. This time, no complicated plan with interval running as the month was also a very busy work month, where fitting training sessions during the day would be hard. So, I made an easy plan : run a half-marathon every Sunday and run part of my work-home commute every day (So, 3km run to the train station, 30mn train ride, then 4km run to my work place, then shower....and the same back after work). Out of the 5 half-marathons I ran during these 5 Sundays, two of them were official ones. On the first one, I finally managed to break my personal best on half, with 1h37'14". Only a 14 seconds improvement, but that one is certainly one of my best among personal bests....even better than 3h38'45" on marathon.. All other half-marathons were run at marathon speed, so targeting 5'06"/km, which will be my planned pace on October 21st. The one I ran on Sept. 16th, which was the other official race I ran was finally done quite significantly faster than this. First of all, because I had hard times to run "only" at 5'06"/km because of other runners emulation. And also, because I ran the last 3 kilometers up to nearly 14km/h (so, down to 4'15"/km), just for fun, because I could do it..:-) With all this preparation, I think that I now manage to very well manage my marathon speed. I'll probably do a final test tomorrow by trying to keep running at this speed for 3 rounds of my favourite "Maurepas Marathon" circuit, which is just exactly 1/4 of a marathon. More "funnily", I also did something I never did before during this really crazy month : simply said, I came back from work by running. All the way long. Through woods, forests, along some lakes and finally in the country. 42 kilometers (yes, a marathon). After a work day. Starting at 5:45pm and arriving home after 4h50 minutes. With 2 hours of heavy rain. With 2.5 hours running in the dark (with my headlamp of course). All alone. That was a crazy bet to do....but really great fun achieving this : the GPS trace is here. Really something I have to do again..:-) So, well, now I'm more or less prepared and having fun is just a matter for time..:-). I'll keep you guys posted with those and, guess what? I'm already picking my target races for next year..:-)

Next.

Previous.