The last five days I've spent at the combined Debian Edu, FAI and CDD meeting in M rida in Extremadura, together with 17 others. The Debian Edu / Skolelinux crowd was the biggest, followed by FAI, followed by CDD people, though many were part of more than one project. "As usual" it was great to meet many known faces and some unknown ones and to be able to discuss stuff in RL.

Besides various small different things, I worked on the Debian Edu etch r1 release, our lenny roadmap (see the bottom of our roadmap page which also covers etch r1) and the (technical side of the) german translation of the Debian Edu documentation. Non edu related the new setupharddisk2 for FAI took most of my brain activity. And I've signed all keys allready :-)

We stayed at a very nice hotel in the even much nicer city of Merida, which features a lot of roman ruins and history. For example, we walked over the biggest roman bridge in the world! The only thing that was bigger was the amount of good food we were forced to eat every day... Incredible. This was my second visit to Merida and this time I finally managed to visit the amphitheatre (with seats for 15000 people) and the Roman theatre. (Unfortunatly the english page about Emerita Augusta is a stub.) If you happen to come around that area make sure to spend some time sight seeing, it is really worth it! People living in Merida literally fear to rebuild their houses, because as soon as they start to dig, they find something historical and have to turn their property into a museum :-)

In case you have not seen it yet, you should watch this small movie from euro news about the free software efforts in Extremadura. Insightful and very good promotion, also to show around.

Many thanks to C sar, Jos Luis and the Junta de Extremdura for hosting such a great meeting! You rock!

On a unrelated note, spam has gone crazy yesterday while traveling back, 15000 mails were not catched by my so far well working setup. ARG. I still used to have a catchall setting, which was useful to give out addresses like $company@mydomain, but now I will explicitly list those addresses and disable catchall. And luckily for you I will not blog about every spam mail I got... :) Generally I dont consider spam (the source of) evil, it's money: as long as money rules the world, there will be spam. So since it's a social problem, it is hardly solvable by technology. (That is, as long as you want to receive mails from strangers, which I do.) IMO what's worse than spammers are autoresponders to spam. Most of those 15000 mails were auto-replies to spam. OMFSM.

apt-xapian-index: performing a simple query I've recently posted an introduction of apt-xapian-index. Today I'll show how to make simple queries to apt-xapian-index. If you feel like reimplementing my examples in another language, let me know and I'll include it to the post. What I'm going to build is a replacement for apt-cache search that:

• is much faster than apt-cache search
• scores results by relevance, so you get the best matches first
• does stemming of search terms, so it matches 'edit' when you type 'editing'
• understands debtags tags.

This is just a beginning: in future blog posts I'll show how to enhance a search with interesting advanced features. First thing, we need to import the Xapian module, found in the package python-xapian. Documentation on the Python Xapian API can be found in /usr/share/doc/python-xapian. Then we open the apt-xapian-index database: Now we build a query from the command line arguments. We'll assume that if an argument is in the form foo::bar, then it's a Debtags tag instead of a normal keyword. For normal keywords, we also search for the stemmed version, so that we can, for example, find "editing" when the user searches for "edit". Now we have the terms for the query, and we can create a query that ORs them together. One may ask, why OR and not AND? The reason is that, contrarily to apt-cache, Xapian scores results according to how well they matched. Matches that match all the terms will score higher than the others, so if we build an OR query what we really have is an AND query that gracefully degenerates to closer matches when they run out of perfect results. This allows stemmed searches to work nicely: if you look for 'editing', then the query will be 'editing OR Zedit'. Packages with the word 'editing' will match both and score higher, and packages with the word 'edited' will still match 'Zedit' and get included in the results. We then run the query. Queries are run through a xapian.Enquire object: The Enquire object returns results as an mset. An mset represents a view of the result set, and can be iterated to access the resulting documents. Here we iterate the mset and output the result of the query, looking up short descriptions with apt: This is it. You can use the wsvn interface to get to the full source code. You can run the code passing keywords and Debtags tags. Try running it as:

    ./axi-query-simple.py role::program image edit
    ./axi-query-simple.py role::program game::arcade
    ./axi-query-simple.py kernel image

You can search Debtags tags using debtags tagsearch. In a later blog post, I'll show how to use apt-xapian-index to implement a better-than-you-would-ever-have-thought-possible tag search. Next in the series: adding simple result filters to the query.

I have just had a lot of trouble with Thumbnails on one of my blogs. It turned out that I had to install the package php5-gd and restart Apache before thumbnails would even be generated. The package php5-gd (or php4-gd) is “suggested” by the Debian Wordpress package and it’s not a dependency, so the result of apt-get install wordpress will be that thumbnails won’t work. I’ve filed Debian bug report 447492 [1] requesting that php5-gd be a dependency. Another slightly controversial issue is the fact that the MySQL server is not a dependency. I believe that it’s correct to suggest MySQL as the database server is commonly run on a different host and Wordpress will clearly inform you if it can’t access the database. An alternate way of solving this bug report would be to have Wordpress give a warning such as “Thumbnails disabled due to lack of php-gd support” which would allow users to make requests of their sys-admins that can be easily granted.

• [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447492

Share This

That does not mean I'm dead yet, of course - It just means I've been too tied up with real life. Yes, I do feel to be close-to-MIA in Debian as in most other projects I work in out of personal interest... It's that bureaucratic point in year where we have to get all of the paperwork sorted out in order to enjoy another year working in the University. And, of course, it's a huge PITA - but all in all, it's worth it.That point by itself is not the only reason why I was drawn away from my usual posting, mind you - My blog was broken for some time because of a b0rken table in MySQL... And it has been at least three weeks since I noticed, but I only got around to fix it today. And, BTW, how come did I fixed it? Because I'm working on a migration tool. Migration? What? Why?Back in 2004, when I started this blog, I chose JAWS as the software to run it on. It was started by a group of good friends of mine, and they keep developing it. It is a very nice piece of work... But I've had several problems with it (and yes, I have not bothered to submit bug reports - shame on me. Anyway, I think they are related to how I made some mistakes while upgrading), and I do miss some bits of functionality... So, yes, I'm migrating away to Drupal. After all, I'll be setting up several sub-sites at my real-life work with Drupal, so I'd better get familiar with it... And, of course, as migrating a three-year-old blog is not easy (and even less migrating four sites I have lying around), so today I've been working on a nice migration script covering the components I use (blog, comments and photos). I expect it to be ready for prime-time after one more session (which I don't know when will happen). Anyway, Jaws guys: You do rock. Thanks a lot for all the fish!

This week-end, i decided to copy a collection of CD-R back to my hard drive, to make new copies. Everyone knows, that a CD-R only live for 10 years. After this date, the data on it are more difficult to read. So it's the time to know what brand of CD-R has the greatest lifetime. I begin to write CD-R sometimes around 1997. From this date, i keep using the same scheme to do this task: use high-end CD recorder (Plextor), good quality disc, always write at the minimum speed (ranging from 4x to 16x for the latest CD-R -- because sometime you cannot go under a defined speed), keep data on a separate partition to prevent buffer underun (10 years ago this was mandatory). The way i do this has almost not changed, expect maybe for the buffer underun, which doesn't happen anymore on modern hardware. They have been in the same place at the same date. They have always been kept out of direct sunlight exposure, in 18-25 C environment (i.e. near my computer). I didn't often use them. None have "scratches" on theirs surface. I have written the name of the CD with a permanent marker (Stabilo). For reading back the data I use a DVD-Recorder (Plextor PX-716UF) that can lower its speed if there are too many errors during the read. The result is somehow what you should think:

• Verbatim CD-R DataLifePlus metalAzo (blue surface): lost something like 5 files on 50 CD-R
• Kodak DS (gold surface): 0 lost on 2 CD-R
• Memorex CD-R (gold surface): 20 files lost on 2 CD-R

The Verbatim and Kodak can be read at full speed. I think the data on this two media are really well conservated. Even, if i have lost some data from the Verbatim medium, i think it is a really good rate for a 10 year old CD-R. The Kodak medium seems also good, but i don't have enough of them to be sure that i won't have the same error rate as Verbatim. Memorex CD-R is by far the worst media. I think all the data i have on these CD-R are lost. It takes me something like 1 hour to conclude that the first disc i try was totally destroyed. At the time i have bought Verbatim medium, it was the best medium around. I gave a try to the Memorex medium to reduce the price per unit. Conclusion: i have lost 15 CD-R with their content because 10 years ago i was thinking that i will save 2-3F (0,5 ) by replacing Verbatim with Memorex...

I have just read an interesting post speculating about the possibility of open source hardware [1]. To some extent things have been following a trend in that direction. Back in the bad old days every computer manufacturer wanted to totally control their market segment and prevent anyone else from “stealing their business”. Anti-competitive practices were standard in the computer industry, when you bought a mainframe you were effectively making a commitment to buy all peripherals and parts from the same company. The problems were alleviated by government action, but the real change came from the popularity of PC clones. White-box clones where every part came from a different company truly opened up the hardware development, and it wasn’t all good. When running a simple single-tasking OS such as MS-DOS the problems were largely hidden. But when running a reliable multi-tasking OS such as Linux hardware problems became apparent. The PCI bus (which autoconfigured most things) reduced the scope of the problem but there are still ways that white-box machines can fail you. Now when I get a white-box machine I give it away to members of my local LUG. My time is too valuable to waste on debugging white-box hardware, I would rather stick to machines from IBM and HP which tend to just work. Nowadays I buy only name-brand machines, all the parts were designed and tested to work together - this doesn’t guarantee that the machine will be reliable but it does significantly improve the probability. Fortunately modern hardware is much faster than I require for the work I do, so buying second-hand name-brand machines (for less money than a new white-box machine) is a viable option. The PCI bus [2] standard from Intel can be compared to some of the “Open Source” licenses from companies where anyone can use the software but only one company can really be involved in developing it. One significant impediment to open hardware development is the proprietary nature of CPU manufacture. Currently there are only a few companies that have the ability to fabricate high-end CPUs so projects such as OpenRISC [3] which develop free CPU designs will be limited to having their CPUs implemented with older technology (which means lower clock speeds). However this doesn’t mean that they aren’t useful, tailoring factors such as the number of registers, the bus width of the CPU, and the cache size to match the target application has the potential to offset the performance loss from a lower clock speed. But this doesn’t mean that an OpenRISC or similar open core would be ideal for your typical desktop machine. If companies such as Intel and AMD were compelled to fabricate any competing CPU design at a reasonable cost (legislation in this regard is a possibility as the two companies collectively dominate the world computer industry and it would be easy for them to form a cartel) then designs such as OpenRISC could be used to implement new CPUs for general purpose servers. Another issue is the quality of support for some optional extra features which are essential for some operations. For example Linux software RAID is quite good for what it does (basic mirroring, striping, RAID-5 and RAID-6), but it doesn’t compare well with some hardware RAID implementations (which actually are implemented in software with a CPU on the RAID controller). For example with a HP hardware RAID device you can start with two disks in a RAID-1 and then add a third disk to make it a RAID-5 (I’ve done it). Adding further disks to make it a larger RAID-5 is possible too. Linux software RAID does not support such things (and I’m not aware of any free software RAID implementation which does). It would certainly be possible to write such code but no-one has done so - and HP seem happy to make heaps of money selling their servers with the RAID features as a selling point. Finally there’s the issue of demand. When hardware without free software support (such as some video cards which need binary-only drivers for best performance) is discussed there is always a significant group of people who want it. The binary-only drivers in question are of low quality, often don’t support the latest kernels, and have such a history of causing crashes that kernel developers won’t accept bug reports from people who use them, but still people use them. In the short-term at least I expect that an open hardware design would deliver less performance and in spite of the fact that it would have the potential to offer better reliability the majority of the market would not accept it. The production volume of electronics gear is the major factor determining the price so it would cost more. I think that both IBM and HP provide hardware that is open enough for my requirements, they both have engineers working on their Linux support and the interfaces are well enough documented that we generally don’t have any problems with them. Both Intel and AMD and the major system vendors are all working on making things more open, so I expect some small bug significant improvements in the near future.

• [1] http://www.raiden.net/?cat=2&aid=315


• [2] http://en.wikipedia.org/wiki/Peripheral_Component_Interconnect


• [3] http://en.wikipedia.org/wiki/OpenRISC

Share This

By request of Russell Coker (he wanted to download the scripts) I just created an open repository.

---

I must admit I wanted to create it since before (I prefer to develop using a VCS) but because of the lack of time I just had forgotten :D.

Anyways, the repository is available at https://neo.yahostme.com/svn/DeBaBaReTools/ with read-only access.

This will be the home of DeBaBaReTools until the Alioth admins create the project account.

The main reason why I want it to be hosted there is because Alioth already provides the facilities for Debian and Debian-related projects.

Notes about the code: I'm currently redesigning it so it works on any computes. The original scripts were designed to do very basic tasks and were meant only to run for my repository so they might not work out of the box (they are actually broken right now :S).

OK, I'm taking the risk of being ridiculous and have all my English friends laugh loudly in 3 hours. So, my bet is South Africa winning over England, 25-16 (3 tries, 2 transformed and 2 penalty kicks while England scores one trandformed try and 3 penalty kicks). The weather is *perfect* over Paris tonight. That will be a great final.

Some day, this thing stopped to work for me. I was not aware of doing anything what could break it, even any related package was not updated. Time went on and I still did not find time to learn how to debug this udev/hal/dbus/gnome-volume-manager machinery. Today, after some googling I found short debugging guide on Ubuntu wiki, which quickly revealed me that "volume.ignore set to true on /org/freedesktop/Hal/devices/volume_uuid_4717_5407, not mounting". Well I didn't configure anything to be ignored, so let's dig deeper in this. As I had no idea where this thing could be set, I again started to google and /etc/hal and /usr/share/hal seem to be the right place where to start grep. Nothing related in /etc, but too much entries in /usr. However most of them were selective for some special USB disks or partitions. But there was one which did this unconditionally - it was file /usr/share/hal/fdi/policy/gparted-disable-automount.fdi, what crap from gparted. Now I remember that I used this for formatting and partitioning something on USB and after doing all job, it crashed. So it left this piece of HAL hack inside /usr/share/hal and it was cause of anything not mounting. Seems to be worth of reporting as a bug... Wait a moment, it's already known and some patch for it exists. Hopefully we will see this soon in unstable.

flickr page

Original post can be found here. Interview: Today we are interviewing Andrea Veri, fresh MOTU and eager Ubuntu volunteer. Age: 18
Location: Udine, Italy
IRC Nick: bluekuja How long have you used Linux and what was your first distro?
I started using Linux at the end of 2005 using Red Hat and Fedora distros, contributing on writing several pages for Fedora documentation (mostly server docs) but mainly working on some packaging-related activities (introducing ctorrent, gtorrent-viewer and v2strip packages inside Fedora) for more than 3 months until the beginning of March 2006 when I decided to move definitely to Ubuntu after discovering it at a friend s party. Was love at first sight that made me leaving every Fedora plan and project creating my first personal wiki page on wiki.ubuntu.com some days later. How long have you been using Ubuntu?
In fact, I started using Ubuntu at the beginning of 2006, firstly getting involved inside the Edubuntu family making real the possibility to have an Edubuntu Italian support and website area inside the current Italian LoCo Team. When did you get involved with the MOTU team and how?
Right after joining the Ubuntu brigade I started checking out MOTU documentation, mainly packaging guide plus debian new maintainer s guide, trying to understand every single new word and applying directly to a source package every lesson learned during developer s world travel . After getting introduced and fascinated from an active community, I had to left the project for a while for some small problems, restarting everything on May 2007 with my first sponsored upload inside the archive. My packaging passion increased right after meeting Alexander Sack inside #ubuntu-mozillateam irc channel some days later, deciding to work directly with him as my mentor for both Debian and Ubuntu distributions. What helped you learning packaging and learning how the Ubuntu teams work?
I started with Debian New Maintainer s guide and Ubuntu s packaging guide moving then to package my first applications learning from already-packaged software and asking if needed to Alexander improving and learning every time from him or from other developers a new Ubuntu Team lesson. Favorite part of working with MOTU?
Introducing a fix making tons of users happy is one of the best things I appreciate of being a MOTU. Mentoring, sponsoring, helping out new contributors or students is something special as well. Any advice for people wanting to help with MOTU?
I always suggest to start with a package a new contributor cares about personally, that s useful to improve/fix the package itself during its maintenance.
Reading MOTU and Debian documentation is a great starting point as well to avoid any strange question on our MOTU irc channel. What packages/areas of Universe are you most interested in?
I m currently working on a vast area of packages, but I ll try to focus on p2p (Peer-2-Peer) applications both for Universe and Main. I planned to create a MOTU-p2p team really soon including it inside the existing motu-torrent team, but it will take some months to organize everything up; contributors (testers/packagers) are currently missing. Any Plans for Hardy Heron?
I ll keep working on a large number of packages but as I said before I would like to focus on having an updated situation of p2p applications, introducing libtorrent-rasterbar and its related clients like btg or linkage. Creating a working team with interested contributors and developers will be the first step to work on. Favorite quote?

As for me, all I know is that I know nothing. Socrates

What do you do in your other spare time?
I love going around with my motorbike, listening good music, playing basketball and meeting up with friends around the city centre. Pic of you, your work area, and/or your screen?

Yesterday night, a taxi driver was killed in Madrid. The rest decided to go on strike. No taxis are available in the whole city. I had to get my plane to Lyon at half past seven, the check-in finished at 07:00. Metro starts at 6:00, and the airport is quite far from here. Thus, I got to the airport some minutes after seven. Only some minutes, 4 or 5 maybe, but enough for the check-in to be closed. Damn computers, when they decide something, it seems that all the humans can do is obbey. who is the tool and who the user then? I couldn’t get my plane. It doesn’t matter who I got to ask for help, no one seemed to be able to do anything. Computers rule. Check-in is already closed. I’m not the oly one who missed the plane anyway. I’d really love to be able to be in Lyon now. Next time, I just won’t trust public transport at all, I won’t try to get a plane that early and I will do the check-in through the Internet. Have a lot of fun all of you joining JDLL.

So we will move back from Sweden to Germany after 7.5 years. Besides swedish nature and working culture we will surely also miss swedish broadband. On the other hand we survived swedish health care without serious repercussions and look forward to the german alternative.
So after having found a really nice house in L beck's historic center we now look for an swedish Au-Pair. One of the main goals with that would be to help our children to keep their swedish language skills. If anyone reading this knows someone interested in working as an Au-Pair during 2008 please have them contact me.

This years first Extremadura work meeting with people from Debian Edu, FAI, Debian-Science and Debian-Med takes place at time of writing. The group is 20 people (with some locals included). There is a rich supply of good spanish food so I skipped dinner yesterday in order to let my digestive system recuperate and get work done at the same time. I feel tempted to do that again today. Having stared and poked at FAIs new partition framework makes me consider partman as an alternative.

Introducing apt-xapian-index apt-xapian-index has just been approved into experimental, and in the next days I'm going to blog more about it. The package contains a tool called update-apt-xapian-index that indexes Debian package metadata into a Xapian index located at /var/lib/apt-xapian-index/index. The index is read-only, except for update-apt-xapian-index; however, it is world-readable: every user can query it, all the time, at the same time, even during index updates. The index can contain more than package descriptions. update-apt-xapian-index indexes data using plugins located in /usr/share/apt-xapian-index/plugins, and any package can add their own. For example, debtags will provide a plugin to index tags. Since Xapian can index numeric values as well, if anyone makes a popcon package that downloads popcon information, they can provide a plugin to index popcon values. If anyone makes an iterating package that downloads ratings, they can provide a plugin to index ratings. Another plugin could be a specialised Debian stemmer that generates token such as foo out of libfoo-dev. I think you get the idea: it's very extensible. You can have a look at the initial set of plugins in subversion. The index is also self-documenting, so that one can keep track of all the intresting things that can be found in it. update-apt-xapian-index does not only maintain the index, but also the file /var/lib/apt-xapian-index/README that aggregates documentation provided by the plugins. To query the index, you just use Xapian. Debian contains Xapian bindings for various languages:

• libxapian-dev for C++
• libsearch-xapian-perl for Perl
• libxapian-ruby1.8 for Ruby
• python-xapian for Python
• tclxapian for Tcl
• php5-xapian for PHP

In the next days I am going to post various example queries and interesting tricks that the index allows you to do. It's going to be fun.

France sank against Argentina tonight. Last time France played in Parc des Princes, they were crushed by South-Africa, 10 years ago. The same happened tonight with an impressive victory by Argentina against France. France dominated the first 20 minutes but Argentina's defense was heroic and strong. Certainly the best defense play of this entire world cup, in this match, with a great organization around mauls, an impressive scrum and explosive tackles. After being dominated 26 minutes long and anyway scoring a try an, Argentina had to resist 10 minutes before half time when France unsuccessfully attempted to score a try (which would probably have changed the match). I think I will have to review these 10 minutes again as this was a demonstration of defensive play. It is indeed not a surprise that Ibanez lost his nerves and got expelled at the very end of 1st half time. Sad end of career...very similar to Zidane's one, indeed. In second half time, seeing France being crushed so hard was sometimes saddening but Argentina played so wonderfully that we could just be admirative of that play. Again, their solidarity and defensive play made the difference and, 5 tries later, they finally logically beat France. The Argentinian team is really a great satisfaction of the world cup. Playing only with 18 players, they only half-missed one match: their semi-final against South-Africa. I think they now really deserve to play in the Tri-Nations tournament along with New Zealand, Australia and South-Africa: if that doesn't happen, I will really think that other southern hemisphere nations are just cowards..:-) What about France? Well, this is a really sad ending for that world cup. Finishing with two very bad matches is really worrying for the future of that team. There are many promising players in that team (such as Dusautoir, Szarzewski...) and they can probably rebuild something and we still be enthusiast about that sport in this country.

In my previous post about Advice for Speakers [1] I referred to the common problem of going through presentation materiel too quickly due to being nervous. In extreme cases (which tend to happen when giving a presentation for an unusually large audience) the materiel for an hour long presentation may be covered in 10 minutes or less. This is a problem that most speakers have at least once in their career. I recently heard an interesting (and in retrospect obvious) way of dealing with this problem. That is to label each note card with the estimated time through the presentation when it should be presented. If you are reading from the 10 minute card at 2 minutes into the presentation then you need to slow down. Of course this doesn’t work as well if you follow the “strict powerpoint” method of presenting where the only notes are the slides. It would be good if a presentation program supported having windows on two displays so you could have one full-screen window on an external video device for the audience to see and one window that’s not full-screen on the built-in display in the laptop for the speaker. The built-in display could have speaker notes, a time clock, and other useful things. I have just filed Debian bug report 447207 [2] requesting that this feature be added to Open Office. It was closed before this post was even published due to Unstable apparently having some degree of support for this and the rest being already on the planned feature list (see the bug report for details). I found the complaint about a feature request being against Etch interesting as Debian doesn’t have bugs tracked against different releases, so it’s not as if a bug reported against Etch will get any different treatment than a bug reported against Unstable.

• [1] http://etbe.coker.com.au/2006/09/07/advice-for-speakers/


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447207

Share This

Thanks to Alexander, the next upload of GNU Smalltalk will include the Gtk Blox Browser. To run it, I used:

st> PackageLoader fileInPackage: 'BloxGTK'!
st> PackageLoader fileInPackage: 'Browser'!
st> BLOX.BLOXBrowser.BrowserMain new initialize!

Here is a screenshot: The package still needs some polishing.

No "debian" on ubuntu.com: undoubtfully a bug! The mention that the word "Debian" does not appear in the recent announce about Gutsy on the ubuntu.com website by Lucas reminded me something. Indeed, though I'm yet another DD that so far has never played the ubuntu bashing game, I remember having in the past tried to find the word "debian" on the ubuntu website. At the time of writing, using the site search on ubuntu.com, results in just a few hits, all of them are marginal: OpenOffice.org maintenance, the fact that Canonical employees are part of Debian, and an announcement as old as Ubuntu 5.04. What I want to see there is just a tiny teeny sentence that explain where a huge deal of Ubuntu packages come from and a mention of all the wonderful collaborative maintenance projects in which DDs and Canonical employees (or even MOTUs) work together to build great packages. So I wondered that it was probably a fault of mine: I wasn't looking in the right place of the website. Let's try with http://www.ubuntu.com/debian, since the ubuntu website is CMS/Wiki based it seems like a good attempt, doesn't it? But no luck: "Sorry, the page you are looking for was not found". But then, down in the page, I saw the root of the problem: "please consider reporting this problem as a bug". It is obvious now: it's simply a bug in the website! Let's point the maintainers to it ... As a careful bug reporter I first searched to check whether the bug was already reported, according to this search it hasn't (though now that you're clicking on it you're probably seeing something, when I did I got "No results for search debian"). So let's report the bug, the result is bug #154274 on launchpad. Let's see what will happen to it. Update: the reply on launchpad was really fast. I've followed up with what I think should be mentioned on the ubuntu website regarding Debian. Feel free to help out with your comments in the launchpad entry.

Bruce Schneier summarised a series of articles about banking security [1]. He mentioned the fact that banks don’t seem to care about small losses and would rather just deal with the problem (presumably by increasing their fees to account for losses). There are some other interesting bits in the article, for example banks are planning a strategy of securing transactions with an infected computer [2]! Now there are some possible solutions to this, for example if the bank issued a hardware device that allowed the customer to enter the account number, amount to transfer, destination account, and PIN number and then produced a cryptographically secure hash (based in part on a rolling code) that the user could type in. The only way that you are going to do anything securely with an infected host is if everything is offloaded into an external device. In which case why not just do the Internet banking on the external device? It’s not difficult to make a hardware device that is small enough to carry everywhere, has a display, an input device, net access, and which is reasonably difficult to crack externally. Consider for example a typical mobile phone which has more RAM, CPU power, and storage than a low-end machine that was used for web browsing in 1996. Mobile phones have a good history of not being hacked remotely and are difficult for the owner to “unlock”. A locked-down mobile phone would be a good platform for Internet banking, it has wireless net access in most places (and with a Java application on the phone it could do banking by encrypted SMS). Being locked down to prevent the user from reconfiguring the software (or installing new software) will solve most of the security problems that plague Windows. If when signing up for a new phone contract I was offered the possibility of getting a phone with secure banking software installed for a small extra fee then I would be very interested. Of course we would want some external auditing of the software development to make sure that it’s not like some of the stupid ideas that banks have implemented. Here is a classic example of banking stupidity [3]. They display a selected word and picture for the user when they login to try and prevent phishing (of course a proxy or a key-logger on the local machine will defeat that). They also ask for an extra password (of the simple challenge phrase variety) if you use a different IP address, of course as the typical broadband user doesn’t know when their IP address changes they wouldn’t know if their data was being proxied and dial-up users will enter it every time. A google search for “internet banking” picture password turns up a bunch of banks that implement such ideas.

• [1] http://www.schneier.com/blog/archives/2007/10/future_of_malwa.html


• [2] http://www.cio.com/article/135551/Hacker_Economics_MPACK_and_the_Next_Wave_of_Malware/2


• [3] http://www.ufcu.org/accounts/member/online/index.php

Share This

W00t, my pet package is so clean! Ah, looking closer, there's a Ubuntu thing in a corner. I'll integrate that patch when Debian will be mentioned in their release announcements.