I would really like to avoid publishing this post but I don t know how to check Debian Planet s aggregation otherwise, so forgive me.
I sponsored the upload of new version of radiotray package.

I would really like to avoid publishing this post but I don t know how to check Debian Planet s aggregation otherwise, so forgive me.
I sponsored the upload of new version of radiotray package.

(original post) > If Ubuntu 12.04 if a LTS release, and Ruby 1.8.7 goes out of support in June of
> 2013, then why is the default still 1.8.7?
>
> Ruby 1.9.2 was released in 2010. Ruby 1.9.3 was released in October of this year. First, there s almost nobody in the Ubuntu development community doing any Ruby work. Packages are just imported from Debian, and Ubuntu follows what is done on the Debian side. In the Debian/Ruby team, we are currently transitioning to a new packaging helper (gem2deb) that makes it much
easier to support several Ruby versions. Once this will be done, switching to 1.9.3 by default will be very easy. We already provide a way for the sysadmin to change the default on a system. Now, doing that transition takes time, and we could have used *your* help (and could still use it). We are still quite on time to do it for Debian wheezy, but it sounds very hard to do it for Ubuntu 12.04 unless someone from Ubuntu steps
up to help.

• Ukrainian, Sinhala complete level 1
• Ukrainian now fully complete
• Kazakh fully complete
• Icelandic completes sublevels 1 and 2
• Italian now nearly fully complete, only missing two strings in grub debconf translations
• Many languages complete again for level 3 because of a massive unfuzzy action by me for win32-loader

Status for D-I level 1 (core D-I files):

• 23 languages 100%: bg cs de eo fa fr gu hi it ja kk ko mr nb nl pl pt ru si sk th uk zh_CN
• 4 languages 99%: bs es ta te
• 2 languages 98%: eu sv
• 1 language 96%: eu sr sv
• 6 languages 95%: ar be bn dz he tr
• 3 languages 94%: ast ga ro
• 5 languages 93%: el hu is km lo
• 2 languages 92%: id sl
• 4 languages 91%: et pa vi zh_TW
• others are 90% or below

Status for D-I level 2 (packages that have localized material that may appear during default installs, such as iso-codes, tasksel, etc.):

• 12 languages 100%: cs de es fa fr kk nl pt ru si sk zh_CN
• 11 languages 99%: be bg da eo id it ja sl sv th uk
• 4 languages 98%: ca eu pt_BR ro
• 1 language 97%: is
• 1 language 96%: nb
• 3 langauges 95%: el fi he
• 7 languages 94%: ar ast dz gl hr vi zh_TW
• 8 languages 92%: bn bs hu ko ne pl sr tr
• 9 languages 91%: ga gu ka km lt mk mr ta te
• others are 90% or below

Status for D-I level 3 (packages that have localized material that may appear during non-default installs, such as win32-loader)

• 26 languages 100%: be bg bs ca cs de el eo es fa fi fr ga gl is it ja kk nb nl pt ru sk sv th tr
• 4 languages 98%: he hu uk zh_CN
• others are 90% or below

So, full 100% completeness (hall of fame) for: Czech, German, Persian, French, Kazakh, Dutch, Portuguese, Russian, Slovak, Ukrainian

It s this time of the year again: a new X release approaches. The upstream schedule has been delayed a tiny bit so that the multitouch changes could land in master during this merge window. Which is what happened, a few days before Christmas. The other components involved in XI2.2 (aka. multitouch ) were packaged in experimental while the server side was getting prepared:

• inputproto
• libXi

Given we reached the 1.12 RC1 stage, it s a good idea to start building drivers against the new server to make it possible for users to perform some tests. And as usual, a new server means bumped input and video ABI, meaning a rebuild for the drivers to pick new dependencies. Some of them also needed a few fixes to make them build against the new server. Nothing that can t be fixed with a few merges from upstream master branches. The usual set of major drivers was uploaded to experimental:

• xserver-xorg-input-evdev
• xserver-xorg-input-keyboard
• xserver-xorg-input-mouse
• xserver-xorg-input-synaptics
• xserver-xorg-input-void
• xserver-xorg-video-ati
• xserver-xorg-video-dummy
• xserver-xorg-video-nouveau
• xserver-xorg-video-fbdev
• xserver-xorg-video-intel
• xserver-xorg-video-vesa

Significant change on the intel side: a snapshot of the current master branch was created, and packaged with SNA support enabled. SandyBridge's New Acceleration has apparently reached a point where it can be published to the masses, so here we go. Some details about it can be found in the initial commit. Also, for those wondering about the xorg-server FTBFS on some architectures, fixes are pending. Happy new year.

I've been informed by a couple of people that the Debian Administration site is down. Sadly it is; at the moment the host isn't showing anything on the serial console and remotely power-cycling it isn't showing any signs of life. At this time of year I don't want to drag anybody in to take care of it, so ETA on recovery/replacement hardware is Monday/Tuesday. In other news I've made it to year five of the KVM hosting sub-project/thing. Originally started as a Xen host its been running happily for quite some time. I suspect next year, or the year after that the price/specification ratio will end up losing out and we'll cancel the whole thing - but there are no immediate reasons to make any change. Finally I knocked up a simple tool to validate my TinyDNS records prior to uploading them. It is simplistic, but adequate to catch the kind of mistakes I make:

• http://tinydns-lint.repository.steve.org.uk/file

Honestly it probably wants to be rationalised a little more - and check records more carefully. e.g. Ensure that the host a CNAME refers to itself exists, and making sure that the nameservers specified are valid. I just wanted to make something quick after accidentally uploading a zonefile where I'd managed to fat-finger several important records. le sigh. Oddly enough asking on serverfault.com showed no real suggestions - other than actually running tinydns locally and doing a zone-xfer to validate records. Overkill and harder than I'd like. Happy New year if you care about such things.. "I finished growing up, L on. I just get older. " - Leon

I started this blog over a decade ago. Over time, my priorities have changed family, work, home, etc. Many other avenues for online self-expression have also developed in the interim. I m done for now. Old entries remain online, but do not necessarily reflect any of my current views, and certainly do not reflect any views of any of my employers.

I got a beer bread kit from Mum for Christmas this year. It seems pretty easy, so for a pre-new-year treat, I gave it a go. Of course, for the beer I'm using one of my first batch of home brewed beer that I made just before the holidays. Chuck it in Mix it for around 30 seconds. Discover there is no bread tin here, so use cake tins instead. Flatter than it should be, but otherwise YUM YUM YUM

I've been at the cabin, on solar power, for a year now. I have a year of data! Everything went pretty well until last month. There was an April rainy spell where power felt slightly tight. Then over the summer, plenty of power, no need to conserve. The last month though had what seemed like weeks of continual grey clouds, where I never saw the sun.

high noon today

Of course, even on a sunny day in winter, it does not get far above the hills, and the peak production window is only a few hours. This bad combination had my battery power dipping below the 10 volts that I consider low, down to 9, and even to 8 volts. I use kerosine lamps in the winter. (I prefer the light anway.) I've also started unplugging my Thecus server at night to conserve power, meaning no internet late or early. For four or so nights, I had no power to run even my laptop after sunset. On one notable day, there was no power even in the daytime. Even when it turned sunny again, I found that the batteries would seem to charge to 12 volts during the day, but then precipitously drop to 10 and 9 volts at night. I think the problem was not damaged batteries, but that these Nicads charge most efficiently above 12 volts (14 volts is best), and there was never enough power saved up to get them full enough that they could charge really efficiently. So, I reluctantly spent three days away this week, to let the batteries soak up sun and recover. It seems to have worked; they've been holding a 12 volt charge overnight again.

Barry Ritholtz wrote an insightful post quoting Federal Reserve Bank of Kansas City President Thomas Hoenig, who warns that the nation s biggest banks are putting the U.S. capitalist society at risk [1]. Big banks oppose capitalism. Glenn Greenwald has written an insightful article for Salon about the modern definition of American excellence being the killing of supposedly bad people without any due process [2]. Mazuma Mobile buys used mobile phones [3]. They can send a post-pack to ship your old mobile to them. This is good for the environment and also saves some money. Sam Varghese has written an informative article about the Trans Pacific Partnership Agreement that will probably end up benefiting US corporations at the expense of Australian citizens [4]. Cory Doctorow has written an informative article for The Guardian about the BBC DRM plans[5]. He received information that was denied in a FOI request which shows how poor the BBC case is and how bad the Ofcom oversight is. Sam Harris has written an insightful blog post about self-defense [6]. He also has many other posts that are worth reading. Aparna Roa gave an interesting TED presentation about her robotic art [7].

• [1] http://www.ritholtz.com/blog/2011/06/hoenig-capitalism-at-risk/
• [2] http://www.salon.com/2011/10/22/a_remaining_realm_of_american_excellence/singleton/
• [3] http://www.mazumamobile.com.au/
• [4] http://wildcard.gnubies.com/?p=1433
• [5] http://www.guardian.co.uk/technology/2011/nov/14/bbc-hd-drm
• [6] http://www.samharris.org/blog/item/the-truth-about-violence/
• [7] http://www.ted.com/talks/aparna_rao_high_tech_art_with_a_sense_of_humor.html

I ve recently been reading the Sociological Images blog [1]. That site has lots of pictures and videos that are relevant to the study of Sociology (most of which have a major WTF factor) and it s run by people who have Ph.Ds in Sociology so the commentary is insightful. Since reading that I ve started photographing relevant things. I can t work out the logic behind the above advert for Energy Watch which was on a billboard near Ringwood Station in Melbourne, Australia. The only thing that it clear is that it spreads bad ideas about mental illness and psychiatric treatment. It doesn t make me want to do business with them. The above picture is a shop-front for the Antons clothing store (I m not sure if they are a tailor or if they sell ready to wear). It was taken on Lonsdale St, Melbourne where the store apparently used to be, now they are in Melbourne Central. The above pictures show more detail. Unfortunately the combination of lighting and my camera (Xperia X10 phone camera) wasn t adequate to show the apparent ethnic differences between the two men. It seems that the most likely Australian interpretation of the ethnic groups that are represented are African (maybe Afro-American), Southern-European or maybe American Hispanic, North-Western European, and Japanese. It s good to have mannequins representing the fact that not everyone in Australia is white, but different facial expressions for different races seems a strange choice (admittedly it might be a choice made by mannequin manufacturers). Also the Japanese woman with fan idea is rather outdated. I ve just started reading You May Ask Yourself: An Introduction to Thinking Like a Sociologist (Second Edition) by Dalton Conley. I ve only read the first chapter, but that was good enough that the entire book has to be good enough to recommend.

• [1] http://thesocietypages.org/socimages

On the 1st of August I noticed that the server which runs my blog among other things was having an occasional SEGV from a sshd process. Unfortunately I was busy and didn t pay much attention to this, which turned out to be a big mistake. On the 12th of September I started investigating this properly and noticed that when someone tried to connect to ssh with password authentication sshd would SEGV after it was denied access to a shared memory region or a semaphore which had a SE Linux type of unconfined_t. I added some SE Linux auditallow rules and discovered that the memory region in question was created by the ssh client. Shortly after that I came to the conclusion that this wasn t some strange feature of ssh (or one of the many shared objects it uses) but hostile activity. The ssh client appeared to be storing passwords that it used in a shared memory region and sshd was also collecting passwords in the same region and presumably offering them to a ssh client which uses some extension to the ssh protocol. The sshd process was crashing because it couldn t handle EPERM on access to shared memory or semaphores. Presumably if the system in question wasn t running SE Linux then the exploit would have remained undetected for a lot longer. At this stage we don t know how the attacker got in. Presumably one of the people with root access ran a ssh client on a compromised system and had their password sniffed. One such client system was mysteriously reinstalled at about that time, the sysadmin of the system in question claimed to have no backups which made it impossible to determine if that system had been compromised. I believe that the sysadmin of the client system knew that their system was compromised, kept that information secret, and allowed other systems to become and remain compromised. The attacker made no good effort to conceal their presence, they replaced ssh, sshd, and ssh-add and didn t bother changing the Debian checksums so the debsums program flagged the files as modified. Note that I have kept copies of the files in question and am willing to share them with anyone who wants to analyse them. Steinar H. Gunderson has named this trojan Ebury [1]. Recovery By the evening of the 13th of September I had the system mostly working again. Jabber still isn t working because ejabberd is difficult to get working at the best of times, I am now investigating whether there is a better Jabber server to use, but as I don t use Jabber often this hasn t been a priority for me. Some of the WordPress plugins I use and all of the WordPress themes that are installed were outside the Debian packaging system, as I couldn t be sure that they hadn t been altered (because the people who wrote WordPress plugins don t keep old versions online) I had to upgrade to the newer versions. Of course the newer versions weren t entirely compatible so I had to use a different theme and I couldn t get all plugins working. Link Within no longer works, not that it ever worked properly [2], I wanted to try Outbrain again but their web site won t let me login (and they haven t responded to my support request). Does anyone know of a good WordPress plugin to provide links to related content? Either related content on my blog or on the Internet in general will be OK. Some people have asked me about the change in appearance of my blog. It was simply impossible (for someone with my PHP skills) to get my blog looking the same way as it did before the server was cracked. I think that the new look is OK and don t mind if people think it looks likw a VW advert VW make great cars, I was very satisfied with the VW Passat I used to drive. Future Plans I had bought some Yubikeys (USB devices that generate one-time passwords) [3] to control access to that server, if I had configured the software to use them then this might not have happened. The use of one-time password devices can prevent passive password-sniffing attacks. It would still allow active attacks (such as using ControlPath/ControlMaster options on the ssh client to allow a hostile party to connect later (EG the -M, -S, and -o ControlPersist options for the ssh client). It s a pity that there doesn t seem to be a way to configure the ssh server to disable ControlMaster. Conclusion It would be good to have some changes to sshd to allow more restrictions on what a client can request, as ControlMaster functionality isn t needed by most users it should be possible to disable it. SE Linux doesn t protect against a compromised client system or any other way of stealing passwords. It did do a good job of stopping Ebury from doing all the things it wanted to do and thus making me aware of the problem. So I count this as a win for SE Linux. Yubikeys are the cheapest and easiest way of managine one-time passwords. I had already bought some for use on the system in question but hadn t got around to configuring them. I have to make that a priority.

• [1] http://be-geek.com/linux/2011/11/15/steinar-h-gunderson-ebury-a-new-ssh-trojan
• [2] http://etbe.coker.com.au/2010/04/30/link-within/
• [3] http://www.yubico.com/

A minor new release of the RcppExamples package is now on CRAN. RcppExamples contains a few illustrations of how to use Rcpp. It grew out of documentation for the classic API (now in its own package RcppClassic), and while we added a few more functions documenting how to do the same with the new API, the package is still nowhere near completion. The two ChangeLog entries since the last release are below. One new example was added, and some things were changed in order to make R CMD check (and the CRAN gate keepers) happy.

2011-12-28  Dirk Eddelbuettel  <edd>
        * DESCRIPTION: Release 0.1.3
        * src/newRcppDateExample.cpp: switch from std::cout to the new
        Rcpp::Rcout device available since Rcpp 0.9.8
        * src/classicRcppDateExample.cpp: idem
        * DESCRIPTION: Depends on Rcpp (>= 0.9.9) for Rcpp::Rcout
2011-04-08  Dirk Eddelbuettel  <edd>
        * R/RcppDataFrame.R: Added new example for Rcpp::DataFrame
        * src/RcppDataFrame.cpp: C++ source for new example
        * man/RcppDataFrame.Rd: Documentation
        * man/RcppParams.Rd: Small change to suppres a warning

Thanks to CRANberries, you can also look at a diff to the previous release 0.1.2. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page

The bug webinterface of the Ultimate Debian Database currently knows about the following release critical bugs:

In Total:	1586
Affecting Wheezy:	960
Wheezy only:	163
Remaining to be fixed in Wheezy:	797

Of these 797 bugs, the following tags are set:

Pending in Wheezy:	49
Patched in Wheezy:	117
Duplicates in Wheezy:	50
Can be fixed in a security Update:	26
Contrib or non-free in Wheezy:	9
Claimed in Wheezy:	0
Delayed in Wheezy:	8
Otherwise fixed in Wheezy:	49

Ignoring all the above (multiple tags possible) 552 bugs need to be fixed by Debian Contributors to get Debian 7.0 Wheezy released. However, with the view of the Release Managers, 862 need to be dealt with for the release to happen. Please see Interpreting the release critical bug statistics for an explanation of the different numbers.

* Some months back, we (Mark Hills is main culprit here) decided to fork xosview codebase and released new version 1.9.0. I had no luck contacting main authors and there were 23 Debian patches pending. Mark did amazing job here and we ve one major and one minor releases in two months. Kudos to him again. You can always grab latest Debian packages from unstable and code from Mark s Github xosview project page. Temporary homepage until we take over SF.net project is here. Feel free to send patches! (This post is bought to you by myself that this blog exists )

Backups are something I don't do well. I hope to write a more thorough article about them at some point. For now, here are some tips. Like most home users, I don't have access to a tape drive or jukebox for backups. I'm therefore looking for a solution that backs up to a local block device. I haven't ruled out a solution that backs up to DVD-Rs, but I haven't found a suitable one. I first tried rsnapshot, which uses hard link trees to represent increments. I found that this resulted in enormous filesystem metadata, sufficient to cause the machine I was running it on (an embedded ARM system) to slow to a crawl. I'd recommend to avoid anything using this technique. I more recently have been using rdiff-backup. This has appeared to work quite well for a number of years. However, it does not gracefully handle the backup volume being full, spewing python backtraces. This is compounded with some confusing use of temporary directies and not honouring $TMPDIR. This has been known about for years (1, 2). I've just independently discovered these problems for the second time. Aside from that, because it does not de-duplicate files, it is sensitive to large files being moved around in the source being backed up. It also cannot do a dry-run estimate of the disk space required for the next increment. So: time to move on. Back in 2010 I discovered bup, an intriguing backup tool that used a git-style backing store. It's interesting enough that I packaged it and use it in a few situations, but I wouldn't rely on it for my main backups, for two reasons: one, it's not tried-and-tested enough yet (but that is rapidly being resolved), two: you can't get rid of old increments, so your backup volume will always increase in size over time, and never throw away old data. So, for now: move on. Next on my list to try is Lars Wirzenius' obnam.

Hello, World! Today s hacks come remotely, on the first day of my long trek to Cleveland. As many debian readers know, debian URLs are usually transmitted over IRC or email with some snappy abbreviations. Usually, you ll see something like:

Feel free to check out information about frob at wiki.d.o/Frob

or something like:

I have uploaded package bar onto mentors.d.n for review

What bugs me most about this is that I have to expand URLs by hand. Which is lame. Enter libolla (a fitting name as well as a graceful nod to my alma mater John Carroll University s crest). When LD_PRELOAD d, it ll intercept and expand calls to getaddrinfo transparently. It seems to work fine on SSH, and chrome (but I can t test well, since I m not on a real line). This was all hacked up in a few hours I had to spare, and without any sort of internet love, so I m willing to bet there are some bits that can be cleaned up (after all, the name of the blog is Peace, Love and C++ , not Peace, Love and C - I don t clam to be a c expert ;) ) So, feel free to fork the project on github (or as I can now do - http://g.c/paultag/libolla) Now, I just need to find a way to globally pre-load this for apps that I start in my DE. Should be easy enough fiddling with some env-var files.

So there are two servers; let's call them srv1 and srv2. Srv1 contains a bunch of subversion repositories, but these are to be migrated to srv2. Since the repositories are not (just) used for ascii-only files, they're fairly big (several tens of gigabytes, altogether), so copying them from one server to the other would take a while. In order to make sure this would happen quickly, we had already copied them over to the new server, so that on the final switch would be quick (an rsync that would copy over just the new done transactions). That final switch was today. Only I didn't know that instead of just testing, the customer had already started using one of the repositories (and they'd forgotten to remind me), so the subversion repository suddenly jumped backwards in time. In addition, the new server wasn't being backed up yet (at least not for the subversion bits), so restoring from backups wasn't an option. Oops. Luckily the solution is fairly simple. You see, fsfs stores each revision in a unique file; that means that as long as nobody has committed to the repository yet (which they couldn't, since system users aren't the same on both servers, so the webserver didn't have write permissions on the repository after the rsync), nothing is lost. One only needs to manually change the repository so that whatever subversion thinks is the latest commit, actually is the latest commit. That information is stored in a file called db/current inside the repository. What's in that file depends on the repository version, which is stored in a file called db/format in the repository. For versions 1 and 2, the format is a single line with three space-separated values, of which the first is the last revision number used in the repository. The other two are counters that are used to give transactions unique names; and they, too, need to be up-to-date. For version 3 and above, the file contains only the revision number; there, the other two are derived from that instead of having their own unique number. Figuring out the last used revision number in an fsfs repository is ridiculously easy:

ls -v db/revs tail -n1

So if you've got a repository of fsfs version 3 or above, just change the revision number in the db/current file (after taking backups and making sure nobody can access the repository while you're doing this, of course), and you're all set. Unfortunately, in my case, the repository was still in fsfs version 2, which meant I could not change just the revision number and not expect trouble. I suppose it should've been possible to figure out what the last transaction numbers are, somehow, so that I could fix the current file completely, but I reasoned that upgrading to a newer repository format might have other advantages too, so I just dumped the repository and reloaded it, and everything worked at that point.

I have recently switched my http server from Apache to nginx. The switch was mostly painless thanks to the good documentation available on the nginx wiki. I have been able to move all my public virtual hosts, and have already noticed the improvement on how fast the pages load. Here is a sample graph of the disk I/O rates of my linode showing before/after the switch to nginx: I only had an issue with StatusNet due to the default behavior of spawn-cgi to not spawn any PHP child except if told otherwise. I also had to fix the OpenID plugin for WordPress, as per this commit. For now, I keep apache running for the DSPAM Web UI, which requires suexec. I know I can easily run the CGI through a different user, but still have to polish my setup for FastCGI.

A recent trip to Switzerland made me dig out my prepaid card for UMTS usage again. This resulted in some minor enhancements for Prepaid Manager. The new release handles disabled and missing modems more reliably. It also has some visual feedback if we know the length of the top up code: This blog is flattr enabled.