Debian GNU/Linux Debian 7.0 (aka Wheezy) will be a general hardened distribution in my eyes. Not only that it now enabled hardened building of packages (see http://wiki.debian.org/Hardening), the Kernel team also backported with 3.2.20-1 the IMO very interesting hidepid option (already available in Wheezy since some weeks)! What is the job of hidepid ? hidepid is an new mount option for the procfs (/proc), with that you can hide processes and its information to other users, like other shell users and to web scripts. hidepid accepts three different values:

• hidepid=0 (default): This is the default setting and gives you the default behaviour.
• hidepid=1: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc
• hidepid=2: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc!

Additionaly you can specifiy an user/group ID which is still able to look up the processes with the gid option. So if you want to hide all processes to other users, except root (uid=0) and in this example gid=1001 (some semi administrative user in this example) your /etc/fstab has to look like this: proc /proc proc defaults,hidepid=2,gid=1001 0 0 It was a good descision to backport this feature IMO, but also be careful, it *may* break programs. I did not found any server related application which will break with hidepid=2, but we had to adjust our Nagios monitoring to execute some process checks with another UID, since the nagios user itself could not see anymore, if process A and B is still running. UPDATE 1:
Since a few people asked (thanks for it) with hidepid=2 the process IDs are not invisible, they are unavailable:
$ ls /proc/1
ls: cannot access /proc/1: No such file or directory
$

Dear lazy web, The electronic devices are much cheaper in US than in Poland and I ve got an opportunity to get one without duty/taxes and all that crap. I wonder if Kindle Fire HD is the right choice for someone outside of US/UK?
We don t have access to all Amazon services but still this tablet specification looks interesting. Any other hints? I m looking for something under 300 bucks, so no fruits please

Continuing the ZFS evaluation journey (which I will summarize here with the things that I learned), I was able to fit about 2.5TB of data on a single 2TB drive, with deduplication enabled. Unfortunately, even moving files around in ZFS (which you would think would be a cheap operation) takes ages. Removing files also takes ages. In a completely unloaded Phenom II X4 910 system running Linux 3.5.2 (actually, from Debian's experimental), and zfsonlinux version 0.6.0.71-0ubuntu1~precise1 (recompiled from source to work with my Debian system), I tried to remove a subdirectory that had about 4000 files. According to time, it took:

real    42m51.487s
user    0m0.188s
sys     0m16.769s

Which is a bit too slow. I just (read: "yesterday") upgraded this machine from 4GB to 6GB of RAM (well, I would have updated it to 8GB of RAM as that is what I ordered, but it one of the RAM chips arrived dead here and I simply took one of the new 4GB card and one of the older 2GB card). But, honestly, I don't see change in upgrading the RAM from 4GB to 6GB and, unless something magic happens with 2GB more, I wouldn't expect a whole different story with 8GB of RAM. Oh, no swap is being used (well, it is an unloaded machine after all), and the Linux kernel swappiness knob is at its default of 60. What I do see, though, is that even for a single file removal, the disk is thrashing a lot. I mean like crazy and that is, of course, the prime suspect of the bad performance (of course, of course). So, there must be some really crazy metadata churning going on here and I guess that the people from the LLNL would like to know of their modules producing this behavior. Keep tuned for some future impressions.

This morning version 0.2.8 of RInside arrived on the CRAN sites. RInside provides a set of convenience classes which facilitate embedding of R inside of C++ applications and programs, using the classes and functions provided by the Rcpp R and C++ integration package. This release adds no new features but improves the build process a little and should make use on Windows a little easier. All changes since the last release are summarized below in the NEWS file entry:

Changes in RInside version 0.2.8 (2012-09-07)

• Added CMake build support for armadillo and eigen examples, once again kindly contributed by Peter Aberline
• Corrected Windows package build to always generate a 64 bit static library too
• Updated package build to no longer require configire and configure.win to update the two header file supplying compile-time information; tightened build dependencies on headers in Makevars / Makevars.win
• Improved examples/standard/Makefile.win by detecting architecture

CRANberries also provides a short report with changes from the previous release. More information is on the RInside page. Questions, comments etc should go to the rcpp-devel mailing list off the Rcpp R-Forge page.

According to my Amazon purchase history, it was Sunday, October 11, 2009, that we were lazing around with our friends Dan and Sue and we decided we'd just hang out and watch the first season of Dollhouse. I bought the whole thing on Amazon's Video on Demand, and we started watching episodes. It got close to dinner time, and Dan was going through a home made pizza phase at the time, and we thought about making some pizzas. I wasn't sure if we had all the ingredients in the house, but it went something like this:

Dan: Got flour? Me: Yes Dan: Yeast? Me: Yes Me: Oh, and we've got a big bag of grated mozzarella from Costco. And we have a pizza stone and a peel, and a bunch of random stuff we can throw on a pizza.

So we totally ninja-ed up some pizzas from stuff we had lying around the house. It was awesome because it was totally spontaneous. You couldn't have planned it better, and we pulled it off brilliantly without having the leave the house. Anyway, Dan had to calculate the ratios of water, flour, salt and sugar, and he wrote them all down on the magnetic whiteboard we kept on our fridge. Fast forward almost 3 years later, and we've moved to our new home, and have a stainless steel fridge that we haven't been able to put this whiteboard on, so it got stashed away in a cupboard. The pizza dough recipe is still written on it, though. So with Sarah away, Bill and Victoria are coming around for dinner tonight to hang out, and I thought trying to make pizza again might be a fun experiment. So I dug out the whiteboard with the trusty recipe, and Zoe and I made some dough this morning, and it's currently proofing in the oven. Unfortunately the whiteboard only had the quantities and not the method on it, and from perusing other recipes on the Internet, I may not have mixed things properly (I just kind of threw things together and made it into a ball), so this first batch might be a total disaster. I might go and make a second batch while Zoe's napping. Here's the contents of the whiteboard, for posterity (I'm hoping it says 10g of salt and not 18g, not that I think it'll affect the outcome too much):

Lessons learned from trying to do some simple non-linear video editing on Linux: Kdenlive has reached a point where it's usable. Not good by any means there are glaring problems such as the color management support being very rudimentary, almost no multicore support, general lack of optimization, frequent near-crashes, and so on but usable to the point where you can actually create a video from start to end. I'd say it's very roughly comparable to Premiere 5 was, circa 1998, but it's not something I'd recommend to my mother. slowmoVideo, on the other hand, was not very useful to me for framerate up-conversions; the end results were simply too poor given the general complexity in my scenes. It can seemingly do an okay (but not perfect) job for down-conversion if you're willing to hack it a bit and live with general slowness and demand for disk space. So, well, behold the end result, I guess. If you like frisbee, that is.

Thanks to Corey Goldberg, one of my colleagues @ Canonical, the page performance report can now be used on regular Apache log files, rather than just the zserver trace log files that Launchpad s middle tier generates. We use this report to identify poorly performing pages and get insight into the timing patterns of bad pages. The code lives in the Launchpad dev-utils project instructions for checking it out and configuring it are on the wiki. If you don t have aggregate data for your web application, I highly recommend grabbing PPR and checking it out its very lightweight, and data is extremely useful.

On the 3rd of September, I applied to Google's AdSense program, as I told in my previous post. Well, that was a short-lived experience. On the 5th of September, I received the following e-mail, which, sincerely, is as uninformative as it could get:

Date: Wed, 05 Sep 2012 16:52:22 -0000
From: adsense-noreply@google.com
To: rbrito@gmail.com
Subject: Google AdSense Support
Hello,
As mentioned in our welcome email, we conduct a second review of your
AdSense application once AdSense code is placed on your site(s). As a
result of this review, we have disapproved your account for the following
violation(s):
Issues:
- Site does not comply with Google policies
---------------------
Further detail:
Site does not comply with Google policies: We're unable to approve your
AdSense application at this time because we feel that your site does not
comply with Google AdSense policies or webmaster quality guidelines. It's
our goal to provide our advertisers sites that offer rich and meaningful
content, receive organic traffic, and allow us to serve well-targeted ads
to users. We believe that currently your site does not fulfill this
criteria. 
For more details, please read the webmaster quality guidelines at
http://www.google.com/support/webmasters/bin/answer.py?answer=35769 and
the AdSense program policies at
http://support.google.com/adsense/bin/answer.py?answer=48182,
https://support.google.com/adsense/bin/topic.py?topic=1271507
(...)

OK, I went on and read all the documentation on program policies etc. I investigate each point here:

• Invalid clicks and impressions: No violation here.
• Encouraging clicks: No violation here.
• Content guidelines: No violation here.
• Copyrighted material: No violation here.
• Webmaster guidelines: No violation here.
• Traffic sources: No violation here.
• Ad behavior: No violation here.
• Ad placement: No violation here.
• Site behavior: No violation here.
• Competitive ads and services: No violation here.
• Google advertising cookies: No violation here.

To cut a long story short, I RTFM and did everything correctly. So, dear lazyweb, what would my options be to fund a tiny bit of my software contributions?

My first morning in India I woke up very late in the house of Pavithrans parents. Pavithran was out organizing events for us, his father was at work, leaving me with his mother. She spoke little english - unsure if it was lack of skills or she was humble, or perhaps she just felt as shy as me in the situation. How to, ahem, do your thing at a restroom when there is no toilet paper but instead a bucket of water? I decided to not yell for help but use my imagination. How to eat breakfast local style? I knew from dinner previous night with Pavithran that local custom was to eat with my hands and that it (lucky for me) was tolerated in India to use left hand, so turned down the kind offer for a spoon. But were I supposed to mix rice with all the curries? Or one at a time? In which order? What if a curry was too hot to dip my fingers into? Was the liquid stuff to drink or to mix with the rice or eat afterwards? I asked for help, and first she just smiled at my alien useless language and then when I persisted, she patiently demonstrated with her hands in my food how to do. The only natural thing to do, really, and I dearly appreciate her help and patiency. But wauw, it was mind-blowing to me! Since early childhood, fingers in food is a forbidden thing: "Don't play with the food!". On top of that, having someone else handle my dish while at the table is something I associate with being very old and needing to be spoon-fed. In the afternoon we went for a small hike to an old stone fortress in the middle of Khammam - with a great view of the sun setting. Next day we went to Sarada Institute of Technology & Science where I gave my first talk to about 100 students. I had intended to provide concrete facts on Debian generally and on my pet project, Debian Pure Blends, but then the night before decided to radically shift focus to their situation in the early twenties - as best as I could imagine it. Pavithran had clearly expected a different style talk, but I liked it and believe it was received well by the audience as well. The teacher responsible for the event, Bhukya Jabber, afterwards asked for hints on running Debian at their computer lab. I suggested to not lock down access but instead make it easy to reinstall, and he explained how he was quite interested in a larger degree of learning-by-doing (which I had also promoted in my talk) but was constrained by curriculum dictated higher up in the educational system. Late that day Pavithrans father introduced me to CPM Khammam - the local offices and community center of the Communist Party - and to a colleague of his at the place, N. N. Rao. I instantly fell in love with the place and its atmosphere, and now have an open invitation to come back to spend 1-2 months to study and to collaborate with other users of the place (including some kids hosted there) on Free Software. Next morning we headed back by train to Hyderabad I am still amazed how radical it feels sticking my fingers into food. Not the physical feeling (I am not that disconnected from my body) but similar to a discovery I had as a teenager: After 7 years of piano lessons (and numerous other instruments less patiently) I gave up because I felt it was too difficult expressing personality through the instrument. After that I exclusively sang - as I had always done, but only now did I recognize my voice as a serious musical instrument. Similarly I now realized that eating with the fingers is not just yet another eating style like fork+knife or sticks - it is the natural one. Obviously, in hinsight. This text is part of my Asia 2011 scriblings.

A couple of months ago I was experimenting with adding no-new-privileges to various systems I run. Unfortunately I was surprised a few weeks later at unintended breakge. My personal server has several "real users", and several "webserver users". Each webserver user runs a single copy of thttpd under its own UID, listening on 127.0.0.1:xxxx, where xxxx is the userid:

steve@steve:~$ id -u s-steve
1019
steve@steve:~$ sudo lsof -i :1019
COMMAND  PID    USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
thttpd  9993 s-steve    0u  IPv4 7183548      0t0  TCP localhost:1019 (LISTEN)

Facing the world I have an IPv4 & IPv6 proxy server that routes incoming connections to these local thttpd instances. Wouldn't it be wonderful to restrict these instances, and prevent them from acquiring new privileges? Yes, I thought. Unfortunately I stumbled across a down-side: Some of the servers send email, and they do that by shelling out to /usr/sbin/sendmail which is setuid (and thus fails). D'oh! The end result was choosing between:

• Leaving "no-new-privileges" in place, and rewriting all my mail-sending CGI scripts.
• Removing the protection such that setuid files can be executed.

I went with the latter for now, but will probably revisit this in the future. In more interesting news recently I tried to recreate the feel of a painting, as an image which was successful. I think. I've been doing a lot more shooting recently, even outdoors, which has been fun. ObQuote: "You know, all the cheerleaders in the world wouldn't help our football team." - Bring it On

Sarah is back in Australia attending the graduation ceremony for her Bachelor of Business degree, at the University of Southern Queensland, an Australia University that specialises in distance education. To say I'm immensely proud of her achievement is putting it lightly. Consider for a moment all of the challenges she has had to face in the past 6 years since she started it:

• studying remotely
• working full time (for a bit)
• losing a baby
• having major heart surgery (with a staph infection complication)
• getting her sternal wires removed (with another staph infection complication)
• having a baby
• looking after a baby at home while continuing to study

Me, I'd fail at "studying remotely". Heck, I've had two stabs at a Bachelor of Information Technology on campus, and what do I have to show for it? No, I'm so very very proud of her for sticking at it, and doing so very well (she twice received the Dean's Award for having a high GPA for the semester). She decided to embark on a business degree after having a really hard time finding meaningful work when we moved to the US. She had been working in business project management for the Australian Federal Government (and really enjoying the work) before we moved, and couldn't find any project management that wasn't high-tech, which wasn't really her thing, and everything wanted a degree. She briefly contracted at VMWare, in a marketing position, and Google, in a Security Vulnerability Management role, but neither of these were really up her alley, so to speak. So she went "bugger it" and enrolled in the degree. Ironically, mid-way through the course, she decided that nursing was more what she wanted to do, so she has also gone out and done short courses in health care. She has been licensed as a Certified Nurse Assistant and also a Phlebotomist, but never worked as either. She's just started an Emergency Medical Technician course at Mission College, and is keen to try and work in that field for a little while before starting on a post-graduate Nursing degree in Australia. Sarah had indicated to me that she'd really love to go back for the on-campus graduation ceremony, since she's barely set foot on campus in the six years she's been studying at the university. I thought that was an excellent idea, so I sprang for a Business Class flight back for just her, and am staying behind to look after Zoe. It's only a flying visit. She departed Wednesday night, returns on Monday. As I write, she's probably at the ceremony right now. Normally it would take 6 years to complete a degree externally, assuming two subjects a semester for 12 semesters. She's obviously had to take a few semesters off here and there because of some of the aforementioned challenges. To still finish the degree in 6 years, she's had to plow through the "summer" break (I say "summer" because it's during the Northern Hemisphere winter) and use the accelerated "summer semester", also known as "semester 3" to do an additional subject. That's meant that summers over here have been her shorter winter break. This summer has been the first summer where she hasn't had to worry about studying, and it's been really wonderful to be a whole family again for an extended period of time, and we've had a jam packed summer as a result. We bought a tent and did a small amount of camping. We've had weekends away with friends. We've been to Raging Waters. We've been to Disneyland (granted that was in between final exams). It's been go go go. So now that summer is almost over, I'm looking forward to the pace slowing down a bit more and things returning to "normal" (well the new "normal" is Sarah doing her EMT class a couple of nights a week until December). She's only just started, but she's really loving the on-campus aspect of it. I'm also looking forward to getting a bit more "me" time. Since Zoe was born, I have sacrificed my personal time to facilitate Sarah's study. I haven't had much time to tinker and I've barely had time for Debian. I'm looking forward to trying to carve out a few hours a week for some of both, plus a bit of reading.

As I mentioned this summer, I have created a Computer Science song book a few years ago, and today I finally found time to create a public Gitorious repository for the project. If you want to help out, please clone the source and submit patches to the HTML version. To generate the PDF and PostScript version, please use prince XML, or let me know about a useful free software processor capable of creating a good looking PDF from the HTML. Want to sing? You can still find the song book in HTML, PDF and PostScript formats at Petter's Computer Science Songbook.

In writing a note to someone today, I realized that I had never put up on my web site the slides for my presentation to the 2011 AFS and Kerberos Best Practices workshop. Those are now available from my Kerberos notes page. Entitled "The Murky Tangle of Web Authentication," they're about what we've done recently with our site-wide web authentication system. Both of the major efforts discussed there (multifactor and proactive user account abuse detection) are deployed in production, although the latter is only deployed in a fairly light-weight and minimal way pending further time to refine and improve it. The multifactor support in WebAuth has been available since version 4.0.0, but it currently relies on a user information service, which right now you have to write. I want to polish and release ours as open source, but it's going to require some dedicated hours that I've not yet been able to find. Similarly, I hope to release as open source the proactive account abuse detection system, but there haven't been enough hours yet. I also noticed that my 2010 Debconf slides on using Debian in the enterprise weren't up on my web site (although they've been available from the Debconf site), so those have been added to my Debian notes page.

A new major released of Armadillo came out earlier today. I prepared the corresponding RcppArmadillo package 0.3.4.0 which also arrived on CRAN earlier today. This released contains a few performance improvements, the beginnings of support of sparse matrices and more, see below. We also post the NEWS entry for the beta release which was prepared, but not uploaded to CRAN to minimise the upload frequency there. On the RcppArmadillo side, two enhancements were made for the fastLm() function for faster linear model fits.

Changes in RcppArmadillo version 0.3.4.0 (2012-09-06)

• Upgraded to Armadillo release 3.4.0 (Ku De Ta)
  • added economical QR decomposition: qr_econ()
  • added .each_col() & .each_row() for vector operations repeated on each column or row
  • added preliminary support for sparse matrices, contributed by Ryan Curtin et al. (Georgia Institute of Technology)
  • faster singular value decomposition via divide-and-conquer algorithm
  • faster .randn()
• NEWS file converted to Rd format

Changes in RcppArmadillo version 0.3.3.91 (2012-08-30)

• Upgraded to Armadillo release 3.3.91
  • faster singular value decomposition via "divide and conquer" algorithm
  • added economical QR decomposition: qr_econ()
  • added .each_col() & .each_row() for vector operations repeated on each column or row
  • added preliminary support for sparse matrices, contributed by Ryan Curtin, James Cline and Matthew Amidon (Georgia Institute of Technology)
• Corrected summary method to deal with the no intercept case when using a formula; also display residual summary() statistics
• Expanded unit tests for fastLm

Courtesy of CRANberries, there is also a diffstat report for 0.3.4.0 relative to 0.3.2.4 As always, more detailed information is on the RcppArmadillo page. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page.

This is not the kind of place I live, though I don't mind a visit. I'm not bothered by a more rural life, I thrive on peace and quiet, and am not bothered by needing to haul my water, split firewood, or spend an hour just mowing my driveway. I bought a GPS the other day, and it doesn't know where my driveway is..
or where the road leading to my driveway is..
or even about the highway leading to that road!
The only thing that really bothers me about living here off the map is that I'm in the middle of a food desert too. The nearest semi-decent grocery store and produce market are 40 minutes away. There's one restaurant worth eating at, and while a very congenial place to eat rustic food while watching the river flow by, it serves almost no vegetables. Adding to the problem, my fridge is a rather expensive propane model, which is about half a normal size, and has no freezer. Managing a healthy meal plan is a constant struggle, though I do have time to cook, at least, thanks to not having the kind of commute that is typical around here. Well, the food desert was my only real problem. Now I can add to that the UPS emergency. A week ago, a package left Shenzen China for here. It quickly passed through Anchorage Alaska, and with a few days had arrived an hour and a half from here. Getting it here has taken the whole rest of the week.
I only knew UPS attempted delivery because a neighbor told me. Seems they took one look at my driveway and turned around. They never tried again, and they didn't bother to leave a note on the mailbox, or anything. Now, the US postal service is happy to drive up this driveway; they drive a sensible 4x4 around here. I think DHL and Fedex have been here too. (Contrary to John Goerzen's experiences) My compact car is not bothered by my driveway either... But UPS's brand involves large brown trucks, even where inappropriate, and damage to them from such things as low-hanging branches apparently comes out of the driver's paycheck. And while normally UPS leaves small things in my mailbox, or with a neighbor, this was an important package from China, and it needed a signature. But really, a post card? "emergency"?! So, I bought the GPS to find UPS, because my package was in an industrial park in some town I've never been to. And on Tuesday I was within an hour of there and swung by. And it was closed. UPS's website had not mentioned this; other businesses are open the day after Memorial day. That turned out to be a really annoying day all around. When I got home, after a night away, I found my fridge's fire had blown out, and nearly all my food was only fit for the dog. Today I went out to try again (and buy groceries). When I reached the UPS depot.. it was closed! Until 3 pm. At this point I felt this story was reaching full-on farce. After cooling my heels in a library for three hours, I was finally able to open the most over-packed package I've probably ever seen. My kickstarter reward sample looks good.. I'll be ordering a lot more, but not to this address. As a coda to the UPS farce, arriving home today I checked my mailbox, and found the UPS postcard had finally arrived. It included mention of the 3 pm opening time, and noted that I had until tomorrow before they'd return my package to China. The coda to the coda is that on my way home from this second annoying day delivered courtesy of UPS, I stumbled on a restaurant overlooking a waterfall, just outside the town where I get my groceries. It serves food that satisfies both my Cajun and healthy cravings. Now I just need a larger fridge..

If there s one thing that I ve had missing in my life for way too long, it s hacking on small silly stupid amusing little things. When I was young I used to write dozens of little pointless programs a week and forget about them, only to found them a few months later and be incredibly amused by them. This afternoon I noticed that one of my machines didn t have my default .bashrc loaded, which colourises (or colorizes for Americans or colourizes for Canadians) my shell so that I know on which machine I am so that I don t accidentally do something silly like reboot the wrong host. One problem I ve had with this is that there are limited colours available that makes sense to use for a shell prompt. Right as I was thinking this, I was looking at my Byobu screen sessions and thinking Hmm! I like those logos, maybe I could use them in my shell! . So in just a few minutes I had a little script to help you configure those for your shell. Here is a screenshot of the shell logos in action. On my laptop I use a red background when I have a root shell: This is what the shello script looks like that sets it up: I might get bored by seeing it soon and get rid of it, but at least I had a little fun with it. If you d like to try it out, then you can get the script right here: https://github.com/highvoltage/shello It doesn t do anything like validating input yet, I d also like to add something that creates some kind of a checksum of your hostname and choose a unicode character based on that. Maybe I ll finish it up this weekend, or maybe I ll have new things to write about!

This is my monthly summary of my Debian related activities. If you re among the people who made a donation to support my work (88.41 , thanks everybody!), then you can learn how I spent your money. Otherwise it s just an interesting status update on my various projects. This month has again been a short one since I have mostly been in vacation during the last 2 weeks. Dpkg Things are relatively quiet during the freeze. I only took care of fixing 3 bugs: a regression of 3.0 (quilt) (#683547), a segfault of dpkg-query -W -f (commit) and a bad auto-completion for French users (#685863). Testing the upgrade to wheezy We got several reports of wheezy upgrade that failed because dpkg ran the trigger while the dependencies of the package with pending triggers are not satisfied. Unfortunately fixing this in dpkg is not without problems (see #671711 for details) so Guillem decided to defer this fix for Jessie. My suggestion of an intermediary solution has fallen in limbo. Instead we now have to find solutions for each case where this can fail (example of failure: 680626). Another way to avoid those errors is to ensure that triggers are run as late as possible. We can improve this in multiple ways. The first way is to modify most triggers so that they use the interest-noawait directive. In that case, the packages activating the trigger will be immediately marked as configured (instead of triggers-awaited ) and the trigger will thus not need to be run as part of further dependency solving logic. But as of today, there s no package using this new feature yet despite a nudge on debian-devel-announce. The second way is to modify APT to use dpkg no-triggers, and to let the trigger processing for the end (with a last dpkg configure -a call). I requested this early in the wheezy timeframe but for various reasons, the APT maintainers did not act on it. I pinged them again in #626599 but it s now too late for wheezy. I find this a bit sad because I have been using those options for the entire wheezy cycle and it worked fine for me (and I used them for a dist-upgrade on my wife s laptop too). It would have been good to have all this in place for wheezy so that we don t have to suffer from the same problems during the jessie upgrade, but unless someone steps up to steer those changes, it seems unlikely to happen. Instead, we re back to finding klumsy work-arounds in individual packages. Packaging I prepared security updates for python-django (1.4.1 for unstable,
1.2.3-3+squeeze3 for stable). I packaged a new upstream version for cpputest (3.2-1). I reviewed ledgersmb 1.3.21-1 prepared by Robert James Clay and asked him to prepare another version with further fixes. I released nautilus-dropbox 1.4.0-2 with supplementary changes of my own to support https_proxy and to display better diagnostic information when the download fails. With the help of Paul van der Vlis and Michael Ziegler, we did what was required to be able to migrate python-django-registration 0.8 to Wheezy even though it s a new upstream version with backwards incompatible changes. Thanks to Adam D. Barratt who unblocked the package, we now have the right version in Wheezy despite the fact that I missed the freeze deadline. Debian France Julien Cristau reminded the board of Debian France that we have to elect officers (President, Secretary, Treasurer) as the current officers have withdrawn. I was somewhat afraid that nobody would take over so I pinged each member to try to get new volunteers. We now have volunteers (me, Julien Danjou and Sylvestre Ledru) and we re waiting until Julien finds some time to run the election. Misc With the help of DSA, I setup antispam rules for the owner@packages.qa.debian.org alias because I was getting tired by the amount of spam. In the process, they asked me to write a wiki page for dsa.debian.org to document everything so that they can refer to it for future queries. I did it but it looks like that they did not apply my patch yet. I also tested an upstream patch for gnome-keyring (see bugzilla #681081) that reintroduces the support of forgetting GPG passphrases after a specified amount of time. Thanks See you next month for a new summary of my activities.

No comment Liked this article? Click here. My blog is Flattr-enabled.

La Quadrature du Net is a European advocacy group that has been created to defend our rights and freedoms on the Internet against the continuous political threats driven by major corporations, such as the recent ACTA. After the recent citizen victories against these monsters, it is time to take the initiative and advocate for a reform of the copyright system which has become inappropriate with the omnipresence of copy-based systems. To this end, la Quadrature will give each Member of the European Parliament a customized USB drive, preloaded with a set of elements for a copyright reform, and with an anthology of free cultural works. To fund that campaign, la Quadrature is asking for everyone's help, by the means of an Ulule campaign (Ulule is a crowd-funding platform similar to Kickstarter). This initiative is noteworthy by at least two aspects:

• after years of being in a defensive position, I think this is the first offensive initiative from the citizen group in the copyright wars;
• the crowd funding will strongly indicate that it is supported by citizens.

If, like me, you are tired of the continuous attacks from the major corporations of mass entertainment, in addition to not helping them by buying their crap, you can now participate in this first counter-attack. This will probably not end the war, so I hope there will be more offensive actions from the citizen group!

There's been good progress in Fedora's implementation of UEFI Secure Boot, so time for a quick update.
Boot process signingThe infrastructure for signing the bootloader binaries is now implemented. pesign is in the archive and being used to sign shim, grub2 and the kernel. At the moment they're all being signed by test keys, and the private key is actually in the pesign package. This is, obviously, not intended for production use - it's just to ensure that we can build correctly signed images. We've proof-of-concepted signing via cryptographic hardware and will shortly be deploying new build systems dedicated to building the signed binaries. These won't be general access systems and will have a lightly modified mock configuration to ensure that the crypto hardware is available to the build chroots, but otherwise there's nothing special about them.

As far as signing with the Microsoft keys goes, we're in the final round of legal review of the appropriate agreements and will be migrating to a version of shim signed with their key in the near future.
Kernel modificationsThere's two main sets of patches for the kernel. The first is to automatically enable the locking down of various bits of functionality when secure boot is enabled, in order to prevent users (including root) from being able to modify the kernel at runtime. They've just been posted upstream and haven't been dreadfully received, though we'll probably be changing the name of the capability. The main thing that users will notice is that any X drivers that still need direct hardware access (which, on secure boot systems, should be zero - we've implemented native kernel drivers for all the hardware we expect to see there) will fail to work, as will setpci. The plan is for kexec to require that kernel images be signed, but that's requiring rather more reworking of kexec than expected so for now kexec will just be disabled.

The other lump of kernel functionality is the support for module signatures. That had been somewhat blocked based on a lack of consensus between patch authors and upstream, but an agreement got hammered out at Kernel Summit last week and so we should see progress there shortly. Right now we're still looking at modules being signed with a throwaway key, but the plan is still for keys in db (and MOK, if using the Suse approach) to be imported into the kernel keyring and used. That's dependent upon that code being written in time, though. It's definitely still a goal for F18.
Key managementWe're planning on using Suse's approach of permitting local key management at the shim level, and I spent some time discussing this with Vojtech last week. In combination with the above, this should provide a workable mechanism for permitting the end-user to install module signing keys.
General UEFI support improvementsWe've added support to grub to use the kernel's built-in UEFI setup functionality, although there's still some discussion with upstream to ensure that it's implemented in an acceptable way. This approach also makes it easy for us to obtain PCI ROMs via UEFI, which improves radeon support on a bunch of Macs. Finally, we've been hammering on some remaining UEFI bugs and are definitely at the point where the machines that don't work are surprising and the ones that do are the tedious expectation. This is far better than any previous release.
DocumentationStill has to be written, and that's probably where much of the my next month is going.
SummaryFedora 18 is still on track to have full UEFI Secure Boot support out of the box, and the Beta should be fully signed although perhaps still with our test keys.

For those of you who get sent to surprisingly expensive conferences, I'll be discussing some of this as part of a presentation on improving Linux support for UEFI at the Intel Developer Forum in San Francisco next Tuesday morning. Feel free to say hi if you're in the area.

comments

I've been slowly noticing, over a number of years now, a place where I don't react to other people the way that I want to. I've been stumbling over defensive reactions that I didn't realize I had. These are a few rules of thumb that I'm formulating for myself to try to improve that, and I thought it might help to write them down. And maybe they'll be meaningful for someone else.

1. Things people are excited about are probably exciting. If I don't find them exciting, that's probably because I don't know enough about them to understand why they're exciting. Or perhaps I have a different mindset, and therefore the exciting parts don't connect with me. Both of those are okay! There are way more things to learn about than I will ever possibly have time to learn, and I don't have to get excited about everything other people are excited about. But, equally, just because I'm not excited doesn't mean that the thing is not exciting.
2. My misplaced sense of obligation should not be someone else's buzzkill. This requires a bit of unpacking, since I only intermittantly realize that I'm doing this. But (partly for cultural reasons, partly due to natural inclinations) I've always felt a strong sense of obligation to "keep up" with things. To know a lot about a lot of topics. And one of the things I've realized is that my brain occasionally twists an interest in knowing lots about the world into a sense of obligation to "stay current" and know something about everything important, at least within my vague field of expertise. And usually that part of my brain has a very expansive notion of field of expertise; all of software development, for example, which is, when I pull it out into the light, ridiculously broad. This then sparks one of the standard failure modes of human cognition. I have an unrealistic expectation of myself. I fail to meet that expectation. This makes me feel guilty and stressed. At that point, my brain starts trying to find targets for me to displace negative feelings onto, and that generally ends up being the next person who is excited about something new that I don't know anything about but feel like I should. This is all very interesting psychologically, in the abstract. However, the concrete result is that I sometimes get all snarky and negative about something that someone else is excited about because it happens to be the moment I hit overload, or because I didn't want to hear about another thing that I feel like I should know more about. And that, in turn, can be either confrontational or discouraging to someone who is legitimately excited (and may rarely get the chance to be excited). And that's not the person I want to be.
3. It's okay not to have an opinion. Seriously, it's okay. The world is full of stuff, far more stuff than any one person can know anything about. It's okay not to go read about everything people say is exciting. It's okay not to know about something new. It's okay to focus on the things I'm already doing. Really. What's not okay is to make up an opinion about something I know nothing about just so that I can feel better about myself by having an opinion. Particularly since that opinion formed under those circumstances tends to be negative, despite the fact that I have no actual basis for having any opinion at all. I need to practice just quietly not having an opinion. No one else needs to know about my lack of opinion.
4. Before bristling at imposition, be sure someone is actually imposing. I frequently leap to the conclusion that, when someone raises a topic, they want me to do something about it. It's a gut emotional reaction, I think in part because the emotional part of my brain likes to make everything about me. Intellectually, if I can engage that part of my brain, it's often obvious that it's not about me, or that they're not asking me to do anything. Often, when someone brings something up, they just want to tell someone else about it, or make me aware of it. If I've listened to, or read, all the sentences and understood then, then congratulations! I've done everything that I needed to do and was expected to do and need not feel any further obligation. Even if something further needs to be done, it doesn't necessarily need to be done by me. I'm very protective of my time and available resources because I almost always feel overwhelmed by all the things that I want to work on. This does not entitle me to snap at random people who are being excited around me on the grounds that they're trying to put more obligations on me. They're probably not. If it becomes clear that they really want me to do something I don't have time to do, I can politely decline, but if I just shut up and listen for longer, usually that's not the case at all.

(Please note that this is not prompted by any current discussion happening anywhere, and paticularly not by anything in Debian. Insofar as it was prompted by anything, it was by a throwaway comment in an unrelated private discussion. It's just something that gelled enough to write down while I was walking home from work.)