In one of his many well written and thought provoking essays (Ideas for Startups), Paul Graham has this to say:

Actually, startup ideas are not million dollar ideas, and here's an experiment you can try to prove it: just try to sell one. Nothing evolves faster than markets. The fact that there's no market for startup ideas suggests there's no demand. Which means, in the narrow sense of the word, that startup ideas are worthless.

While I agree with his main point that execution counts, his affermation bugs me a little bit because it clashes with my understanding of economics. To wit, that ideas are "Non-excludable goods". As the linked page says,

Non-excludable goods are defined in economics as goods or service whereby it is impossible to prevent an individual who does not pay for that thing from enjoying the benefits of it. Market allocation of such goods is not feasible.

How would a market for ideas work, in any case? How could you prevent someone from listening to a bunch of ideas and just walking away with the ones they like? Perhaps with lots of lawyering and monitoring schemes, something could be kludged together, but at that point, since the ideas alone most likely aren't worth that much compared to well executed ideas, putting together that market would probably be more trouble than it's worth. So Paul Graham is right, for practical purposes, but his economics don't seem correct to me.

I was trying to make a credit-card purchase on the web. The site I was trying to give money to prefers not to directly handle such messy details, and outsource their credit card application to Google. So far, so good - I got redirected to Google Checkout. Ok, I start filling in my personal data, until...

WTF? and yes, I do mean it. WTF?
I live, as many of you know, in a little country called Mexico. No, it does not appear on many world atlases. It's so very small, only slightly below two million square kilometers, that it's easily overlookable. Also, only a hundred million people live there - Not much. No, the 25,000,000 people that live together with me in Mexico City won't feel left out at all - We are used to it. But come on - In the listing I see our alphabetically neighouring countries (Malta, Mauritius, Moldova, Monaco)... Why did they get listed and we didn't? Of course, I tried editing the form data and substituting Moldova's MD for our dear MX, to no avail - We are not only off the map in their lists, but also in the database - and there are some integrity checks. Does somebody know which way should I whine in order to get the Google folks to fix this? :(

Thanks to Romain Francoise, I found and watched Martin Michlmayr's Release Management in Large Free Software Projects talk on Google Video's Open Source Speaker series. Martin: Thanks a lot, great talk. I've been following your presentations lately, as I've given some talks on this topic - Quality Assurance on Free Software Projects (Spanish only) - However hard I try to remain faithful to the subject, I end up giving a talk on what Free Software is and how its processes are naturally more prone to yielding better quality than propietary projects.
Anyhow, with this post I want to do basically three things:

• To cheer Martin for writing and presenting the topic. I've been refering to your work for a long time, and although my presentations are not formally papers and thus have no quotation value (in fact, they often don't have the references as anything more than comments in the source files, it at all), I should thank you frontally and publicly.
• To get some more attention to the topics presented. Your point is very interesting and important to be taken into account specifically for Debian: I'm not 100% with you regarding that time-based releases is the way to go, but the point you make when discussing GCC (IMHO) is an important one: A project can shift to time-based releases even if it does not release on time, and its general inner processes can become quite cleaner. I do think we witnessed this with Etch in Debian - The process was much more believable and peaceful (even with all the release-related mudfights) than with Sarge. I think it partly stems from what you point out: We aimed to release in December, and we failed to precisely meet the target - but having the date helped set the release goals to something believable, and not let Sid's unstability drift too far away. During Sarge's testing cycle, for a long time, few of us even cared to use testing at all, as it was... Something completely undefined.
• To get some insight on some points. Martin, in several of the projects you analyzed, there is a tendency to get to a six months release cycle. Many other projects also follow that cycle - There is a time-based project you didn't mention that is to me one of the inspirations of such model, and has proven to work for over a decade: OpenBSD. Yes, it lacks in many areas, and definitively not everybody can aspire to become an OBSD developer, but they have done high-quality six-month releases since they exist. However, speaking specifically for Debian: Would you like our project to follow such a schedule? For many reasons (including one you mentioned, the difficulty to support several concurrent versions, or just having oldstable versions be left too early with no support) I think we should aim for a 18 month cycle, 12 at the very least. Either I lacked attention when you went over that part or you didn't mention it - but why do you think such a short cycle is good for so many projects? What would you like Debian to do? (Of course, for answering this, you might be Martin, or somebody else entirely ;-) )

In the upcoming holidays I’ll be working with Daniel Baumann on a graphical user interface to Debian Live thanks to the Google Summer of Code (I posted my full proposal to debian-live-devel if you want to read more). Thanks to Daniel for agreeing to be my mentor. This is my first post to Planet Debian, by the way. A few people might have met me at certain events, but if you haven’t I’m a kinda average hacker-type with a short attention span, long hair, broken sleeping patterns and above-average caffeine requirements. I’m currently a student at the University of Warwick and first started using Debian with “Slink”. If I’m missing anything, or you just want to say hi, please post a comment.

Martin Michlmayr: "Yes, deadlines are real, targets can be met, and the project can release on time."

In the company I work for, most documentation is maintained in Word format. Except mine. I have a dokuwiki and am thankfully allowed this exception as I am the only Linuxer in the company. Since Windows systems need external documentation (being hindered by the absence of commentable text configuration files), there is a policy that all configuration data needs to be explicitly documented. I hate that idea, since documentation is always outdated, and documenting configuration changes doubles the work that needs to be done. After finding out that dokuwiki has a command line interface, I implemented a mechanism that can run from cron and keeps wiki pages of configuration files up to date on an automated basis. On the target systems (the ones that need to have their configuration documented), I installed a script which generates a tarball containing the relevant configuration files on standard output. For more sensitive data, the script could do some basic sanitazion such as removing passwords from the configuration files before putting them into the tarball. On the system running the cron job, the following script runs:

#!/bin/bash
set -e
set -C
set -u
JOBNAME=“update-wiki-firewall-config”
DWPAGE=“php4 /usr/share/dokuwiki/bin/dwpage.php”
TMPBASE=“/tmp”
SSHID=“$HOME/.ssh/$USER-passphraseless-$(hostname)”
REMOTEHOST=“remote.fqdn.example”
REMOTEJOB=“pull-netfilter-init-config-tar”
SHAREDIR=“$HOME/share/$JOBNAME”
WIKINAMESPACE=“pointer:to:namespace”
start=’/*BEGIN generated firewall rules */’
end=’/*END generated firewall rules */’
insert=’/*INSERT generated firewall rules */’
umask 077
if ! TMPDIR=“$(mktemp -d $TMPBASE/fwconfig.XXXXXXXXXX)”; then
        echo >&2 “ERR: cannot create temp dir in $TMPBASE”
        exit 1
fi
cd $TMPDIR
mkdir remote
ssh -i $SSHID root@$REMOTEHOST $REMOTEJOB   \
 tar --extract --gzip --file - --directory remote
mkdir workdir
touch workdir/rulelistfile
echo “$start” >> workdir/rulelistfile
for fwfile in $(find $TMPDIR/remote/rules/up -type f   sort); do
  MTIME=“$(stat --format=”%y“ $fwfile)”
  PROSEEXPLANATION="$( $fwfile sed -n '/^#::#/ s/^#::#[[:space:]]*//;p;q; ')"
  if [ -z "$PROSEEXPLANATION" ]; then
    PROSEEXPLANATION="netfilter-init internal code"
  fi
  rm -f workdir/newwikipage
   $SHAREDIR/wikipagetemplate \
    sed \
        -e "s PLHfilenamePLH $(basename $fwfile) " \
        -e "s PLHproseexplanationPLH $PROSEEXPLANATION " \
        -e "s PLHmtimePLH $MTIME " \
        -e "/PLHcontentsPLH/r$fwfile" \
        -e "s/PLHcontentsPLH//" \
  > workdir/newwikipage
  WIKIPAGENAME=“$WIKINAMESPACE:regeln:$(basename $fwfile .rul)”
  $DWPAGE checkout $WIKIPAGENAME workdir/wikipage
  if ! cmp --quiet workdir/wikipage workdir/newwikipage; then
    cp workdir/newwikipage workdir/wikipage
    $DWPAGE -m “new contents imported from $fwfile” commit workdir/wikipage $WIKIPAGENAME
  fi
  echo “  * [[$WIKIPAGENAME $(basename $fwfile)]] - $PROSEEXPLANATION” >> workdir/rulelistfile
done
echo “$end” >> workdir/rulelistfile
$DWPAGE checkout $WIKINAMESPACE workdir/contentspage.txt
 workdir/contentspage.txt \
  sed -e "\ ^$ start//\\*/\\* \$ ,\ ^$ end//\\*/\\* \$ d; "   \
  sed -e "\ ^$ insert//\\*/\\* \$ rworkdir/rulelistfile" \
  > workdir/newcontentspage.txt
if ! cmp --quiet workdir/contentspage.txt workdir/newcontentspage.txt; then
  cp workdir/newcontentspage.txt workdir/contentspage.txt
  $DWPAGE -m “new contents page” commit workdir/contentspage.txt $WIKINAMESPACE
fi
cd /
rm -rf “$TMPDIR”

Yes, this needs some more documentation and generalization. But it’s just a proof of concept that needs some polishing before being put into real life use. Here are the two template files for wiki page and contents page:

====== Firewallregeln PLHfilenamePLH ======
Last changed on target system: PLHmtimePLH
PLHproseexplanationPLH
<code>
PLHcontentsPLH
</code>

===== Dump of firewall rules =====
/*INSERT generated firewall rules */
/*BEGIN generated firewall rules */
/*END generated firewall rules */

The index page template relys on the HiddenComment dokuwiki plugin to be installed, or the placeholders show up in the rendered wiki page. The code uses the first comment line marked with #::# to generate a short explanation of the file being pulled into the wiki. dwpage.php is a fully-fledged command line interface to dokuwiki, committed new pages are fulled versioned as if entered through the wiki web front end. This way, the documentation in the wiki is guaranteed to be current and to fit the configuration found on the live system - it is directly pulled from the live system. Yes, rendering of the code is currently suboptimal. Working on it.

At work, I’ve got two screens on my Sarge workstation “snitch”. Since I want to switch virtual desktops independently on both screens, I don’t have a Xinerama setup but a Dual Screen setup. So my left and right screen do have different $DISPLAY (“:0.0” and “:0.1”) set. This is neither a problem for FVWM nor xlock nor XScreenSaver. But it is a problem for nearly every modern web browser available which checks, if there’s already an instance of it running. So if you try to start a new instance of a web browser on the other screen, most graphical web browsers make more or less problems:

• Galeon 1.3 and Epiphany always opens new tabs or windows on the display where its first instance is running, i.e. ignores $DISPLAY completely except on the first call.
• Kazehakase (0.3.7) just opens a new tab in the running instance.
• Firefox 2.0 thinks it crashed and asks if it should restore tabs and windows. Haven’t tried any further.
• Opera 9.20 pops up a dialog, says, there seems already a copy of Opera running and asks if it should continue with startup. If you say yes, only the bookmarks of one of the two instances get saved, probably those of the one with the last added bookmark or the one which exited last.

The only graphical web browsers which simply just work on a Dual Screen setup are Konqueror, Links2 (called with the -g option for a GUI), Chimera 2, Amaya and of course Dillo. Unfortunately I’m neither a fan of KDE nor of Konqueror and I do want a web browser with CSS and tab support… And Amaya is, well, only a reference implementation… (Chimera 2 from Sarge btw. segfaulted on two of the four pages I tested it with. Seems to have problems with PNG images.) So my current setup is to have Kazehakase as my main work web browser (with all the local web applications I need) on the right screen while I have Opera on the left screen for surfing, looking up documentation, testing web pages and other things. BTW: I don’t use Gecko based browsers for surfing on that box at the moment, since there are some web pages (the spammer vandalised Kazehakase wiki for example, at least a few months ago) which manage to be rendered in such an ugly way by Gecko so that XFree86 with the binary Nvidia (at least the last five or six versions I tried) just crashes away — either at once or when you try to switch to a text console by pressing e.g. Ctrl-Alt-F1 while such a page is displayed.

I just finished reading Jessica Livingston's Founders at Work, which I found very interesting, and valuable in terms of information on startups. Unlike a lot of businessy books, since the whole thing is interviews, there isn't really any "filler". One thing I think might have been more interesting in some ways is to have some more information on failed startups and what went wrong, but it's probably more difficult to research that. My question to the world, though, is this: Who (or what startup?) would you have liked to see interviewed? It would have been interesting to see Dave Sifry, both because I know him from my time at Linuxcare, but also because he went through a couple companies before the stars aligned with Technorati, which seems to be doing pretty well.

Last week I started the final round of Debian upgrades for the servers I maintain here and there, which is mostly complete today. I haven't been so lucky with upgrades this time, for a long list of different reasons. In the end, the smoothest upgrades were those boxes I upgraded when etch froze or so. natura.oskuro.net is the box serving these pages. It's an old, extremely noisy Pentium 150 which I've been intending to replace for a while now. I started the upgrade early on Thursday, knowing it'd take a while (natura takes its time only to read the Dpkg database), and it had apparently finished when I was ready to leave the office. Three issues:

• apache2's enabled modules were forgotten and I had to reenable them again, plus IIRC the default "It works!" site got reenabled, hiding the blog for a little while.
• bind didn't like some change in one of the default configs and I failed to noticed it had not started. After the reboot, the box was unreachable remotely, but that was OK as I had to go visit my dad that night for his birthday, so it was fixed after one hour or so.
• Last, my blog stopped working, and while I thought it'd have something to do with apache2.2, I had no time to have a close look as I had to leave to Lleida this weekend. Yesterday I discovered that for some reason, the old tar.gz PyBlosxom install wasn't liking the new python2.4, so I decided it was about time to move to PyBlosxom 1.3, from the Debian package. Not without the mandatory "It works!" post published in the gazillion Planets, natura was ready to go.

The very same night of last Thursday, I decided to dist-upgrade the box which serves the Spanish Debian website mirror. That's the only purpose on the box, so you can imagine the upgrade should have been pretty straight-forward. And so it seemed, until, in the middle of unpacking, dpkg died with a horrible I/O error, and I dropped into an unusable remote terminal with no working commands. Fortunately, apache2 was still up and running, and the web service has been working without interruption since the hard drive crash, albeit with no syncs from www-master. Today, Sergio visited the campus and had a look. It was a XFS crash, which got cleanly repaired using an install CD. We have an empty partition in the box, and will probably move the system to it temporarily, and back to the RAID, but on ext3. When the box was back online, I just had to resume the upgrade process, make mdadm happy and update lilo.conf before rebooting into the new kernel. This box uses LILO for some obscure reason I can't remember too clearly anymore. The box has just one partition on a md array, on two SCSI disks on a aic7xxx-based controller. Can anyone hint me why GRUB would have failed on us back in sarge, and if any fixes in the etch version would work any better? Using LILO here is error prone, and basically feels like a step back. Anyway, www.es.debian.org is now back up and running with updated content. Sindominio.net had its bi-annual upgrading party last monday, but unfortunately I wasn't able to help much as when I tried to log into the server, I must have caught the system in the middle of some key lib upgrade or something, and again I was locked in a unusable shell which would only segfault. Given my previous experience, I assumed that something had gone wrong and the box would need to be fixed at the console, and after 20 minutes I gave up helping on that front. Until I noticed, quite a long while later that I was still getting mail from the server. I managed to log in to discover the upgrade was done, with just a few bits remaining to be done. The major issues were encountered with our pam and ldap setup, plus nscd kept dying causing quite a lot of mayhem all over the place. Great work from Seajob, Syvic, nogates, apardo and the rest of the people who handled it! With etch, we can finally move back to an official Debian kernel, something we've been longing to do for a long time. The only pending upgrade issue is that we need to move from our old jabber server to either the traditional jabberd 1.x or ejabberd; our current implementation is no longer supported in Debian. The last of the etch upgrades stories involves Sofcatal 's servers. The box was running on a CentOS 4.4, which was moved away into a subdir just after booting Debian-Installer, and then lobotomised so it would run as a Linux-VServer under a new Debian etch install. I'll probably write more details about it soon though, as it could be a maybe less scary alternative to Guillem's debtakeover. Yay for etch!

Since Linux kernel 2.6.21 entered higher release candidates, more people started to report that Gammu has problem on that with connecting over USB cable. First I thought it is some misconfiguration of kernel, but when several same reports appeared, I decided to take a look at it. As great side effect of this, I found out that I can use snapshots of Debian kernel, where current version (2.6.21-rc7) is available as Debian package. This saved me lot of time, thanks guys! After installing and booting new kernel, I quickly found out that the problem is not SIGSEGV as many people reported, but SIGIO. After quick look at code, it was obvious that setting file to asynchronous I/O causes this. Well this is how asynchronous I/O is supposed to work and kernel people implemented it now for (some?) serial drivers. I have no idea why there was attempt to use it in Gammu. The code is not at all ready for this and makes no use of asynchronous I/O. So the fix was quite easy - just to remove this flag from file. Fix now sits in SVN, impatient users who run kernel 2.6.21 can get SVN snapshot :-). Testing release will follow during next week.

Since some days I’m trying to install windows into a domU just for fun. All went fine until accessing discs. Sometime partition is not formatable, sometimes files could not read from cdrom. To be sure, it’s not the disc image, I used a fresh one from a MSDN Subscription, but it didn’t help. Searching around on web, I found that I’m not the only one, with this issue. The common(s) seems to be etch (and AMD CPU). I found traces of the issue at SP Team Blog, xen-users and xen-forum (german). Maybe anybody can enlighten me? Debian, opensource, planet, xen

A month or two ago, I installed Etch/amd64 on a HP system which uses the ATI SB400 chipset. It worked great mostly, but sound was choppy from the start.
I decided this week to investigate and quickly discovered that oss emulation on this chipset is giving most people issues. It turns out the solution, for a GNOME desktop, is really simple: remove the libesd0 package and install libesd-alsa0 instead, so that esd does not use OSS emulation.

Which begs the question, could the Debian installation system be made smarter so that systems using ALSA drivers wouldn't use OSS unless for applications that only support the latter?

I have been living at home for the past few weeks, and as such have been reading the paper after breakfast. I can do this in Durham too, its just a bit more of a fight to get the paper. After a couple of weeks, I commented to my mother than the columnists seemed to be a bit dire. She pointed out that they all started well, and steadily when't downhill. One would assume that they just ran out of interesting things to say. I was looking at the Daily WTF today, now renamed to Worse than Failure, and I was reminded of this observation. When I found the site, I did look at the entries and go "WTF?", now I just look and go "meh". I'm guessing that its running out of spectacular material, and that each new posting pushes the boundary of what it takes to be a good posting, or in the case of the Daily WTF, a bad one. At the same time, the number of readers is getting bigger, so the numbers of comments are getting bigger, so there are more silly comments. Add in the bigger readership means more demand for material, and the site's operator starts accepting lesser quality stories and the comments go down hill. Slashdot is the worst example of this, with both dire stories and comments. OSNews has also fallen over this problem. All in all, this means that as a good blogger / news site, you have to accept the fact that you aren't going to post that often, and accept the fact that you aren't going to get lots of hits and have a steady readership. A few folk, such as Steve Yegge and Joel Spolsky, seem to do this. Of course, writing without readers means writing for yourself, which is the normal advice writers offer on how to get started. So the best way to start is the best way to continue, writing about stuff that interests you and not really caring about having readers.Oh, and incase you are wondering, I don't care about folks reading my blog, and sometimes wish they didn't. They tell me I'm wrong. They get me in the coffee shop and start arguing about stuff I wrote while drunk two weeks ago. anyway... Getting back to where I started, both newpaper columnists and sites going downhill doesn't really bother me. After a while, they slip into the crap threshold and I stop reading them. Its just sad that they slip away. PS: Edwin Brady tells the Daily WTF was always quite bad. Maybe its just me who takes ages to pick up on bad sites.

Scott Lamb commented:

"Measuring police on the absence of crime is even easier to game, with horrible consequences."

In more detail, Baruch wrote:

"The result of measuring absence of crime will be that reports of crime will be rejected if the cops will think that they won't be able to catch the criminals. You will have to seperate the group that takes the reports and the group that handles them to make it work and even then I'm not sure someone won't find a way to go around that with another trick."

Well, if you read any cycling online forum, you'll have seen some reports of police rejecting reports of 'too hard' crimes like harassing cyclists. I think I've had one report accepted in the last year, about a moped user riding along a cycle track near a playground where I had noted the number plate, and two pretty certainly discarded. So, police discarding or discouraging reports of no-obvious-solution crimes seems to be happening already. andy r wrote:

"Hi there, Don't talk to me about tragedy of targets... As a teacher the word 'target' fills me with both fear and laughter. Last year my year 6 class and I worked our butts off and achieved the highest set of grades for any school in North Somerset, thereby rescuing the school from a very sticky situation with Ofsted. Within days of these results being known the senior LEA advisor suggested to me that the targets had, perhaps, in hindsight been too low. My reply was curt and Anglo-Saxon. Hindsight! Looking out of her hind? The LEA love targets. If you hit them you have not pushed the kids enough. If you exceed them you should have pitched them higher. Woe betide anyone who fails to meet their targets (I will this year, different cohort and those % from last year have been INCREASED!)... My kids have targets (though they have so many that they actually fail to remember them all). Teachers have targets for the numbers of children who are 'supposed' to achieve certain grades but the idiots who set them frequently have only a rudimentary grasp of mathematics. In my current school there are 45 children in a year group, so each one represents a little over 2%. In schools with small classes (perhaps 10 per year in some rural schools) 1 child can equate to 10%. If he's sick on exam day or is just not bright enough, that's 10% gone. And with the government expecting 75-80% of children to achieve a level 4 in their KS2 SATS, it's all too easy to drop blow your 'targets' through illness alone. But here's an even worse tragedy of targets in primary schools... a couple of years ago I had to disapply 2 children from SATS, simply because they have profound special needs and could not take the tests. In addition, the school had an Autistim Unit (now called something PC, but I forget what) which that year had 4 children in year 6. Therefore we had 6 children who could not take the exams. We filled in the paper work but were horrified when the results came in to discover that these children (who all had official exemption on disability grounds) were counted as having taken the test, even though they couldn't. For 'statistical' purposes these kids were classified as having scored zero! Out of a cohort of 36 children, 6 were classified as not having done a thing! The department of education acknowledged that this didn't help our statistics, but stated that it was their policy. In a school with a lot of very deprived kids this 16% scoring zero, added to a significant quanitity of under-achievers was enough to push us down to the bottom 100 primary schools nationally. You can only imagine how damaging that was for the school's reputation - parents took kids out, we were slated in the local press and had to fight like mad to justify our continued existence... Targets... bah! Hey, talking of which. The Health Trust has recently done a survey of local primary school children's weights and heights. In our day this sort of thing was compulsory. Not any more. Parents had to 'opt in' to the survey... And guess what? The parents of the largest kids refused to take part - as did the ignorant b*strds, but that's another story. So the WAHT will now be collating a totally skewed data set. I'm just waiting for the press release highlighting our slim North Somerset children... And of course, someone will be complemented on achieving targets for reducing childhood obesity, whilst infact the problem has probably - as it were- grown. I used to like the way that 'on time targets' were displayed in Didcot railway station. There was a board in foyer which highilighed punctuality. The impressive looking bar chart had these words written on it: "% of trains on time, compared to last month." And the brightly coloured chart was always up around 95%, ish. I was always suprised that nobody commented on that. 0.95*0.95*0.95...... month on month those trains were getting less and less punctual! But nobody bothered to point this out because 95% looks impressive! On many occasions I took the time to read, and re-read, the wording of those graphs so I know with 100% confidence that this was what they quoted. We never had a month with more than 100% punctuality compared to the previous month. Shame. That's enough. I'm off to the dog house."

Instead of the boring “package” queries, rng used to support ’till now, rng now supports all the queries our BTS supports:

package

Returns all the bugs belonging to the PACKAGE

bugnumber

Returns the bug with BUGNUMBER and loads it into the built in browser immediately

maintainer@foo.bar

Returns all the bugs assigned to MAINTAINER

src:package

Returns all the bugs belonging to the SOURCEPACKAGE

from:submitter@foo.bar

Returns all the bugs filed by SUBMITTER

severity:foo

Returns all the bugs of SEVERITY. Warning this list is probably very long. Recognized are the values: critical, grave, serious, important, normal, minor and wishlist

tag:bar

Returns all the bugs marked with TAG

Those queries are available on the command line too and behave exacly as if entered in the program: The syntax is: rng [QUERY], where query is one of the above (and rng a convenient shortcut to reportbug-ng). An example: if you start rng from:venthur@debian.org, you’ll get the full list of all bugreports I’ve ever reported. Now you can filter the list to find all bugreports I’ve filed against, say: qgo… voila. It doesn’t get any easier than that, does it? Those new queries and a few changes under the hood required quite a lot of refactoring in the code and I’m somewhat scared that I’ve introduced some new bugs. So I guess I should stop releasing so often (or for at least 10 days so rng can finally enter testing) and use the time to start writing some unit tests.

Does anyone have a (partial?) policy for Tomcat on SELinux "strict"? It's definitely something I'd like to confine, however Java needs tons of permissions. Multiple ports, execmem, log files, fifos, on-demand extracted webapps and so on. :-(Has anyone started on writing a policy for this beast? If there is any way to confine it actually, given that it's pretty much a system on it's own.[Update: I'd like to point out that running tomcat on a SELinux 'targeted' system works fine by running tomcat in an 'unconfined' domain. Since tomcat usually isn't run with root privileges anyway, it's not that risky]

If you are trying to setup SELinux, a must-know command for you is "sestatus".Example output:

SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          permissive
Policy version:                 20
Policy from config file:        refpolicy-strict

If it doesn't say "enabled", there is no way it will work. :-)If it says "Current mode: permissive", SELinux will not block any access (that's why it's called "permissive"). So if you still get an "access denied" error from your web server, your unix permissions are blocking the access.When asking for help, please include which policy you are running (most likely you'll be running 'refpolicy-targeted', since that is the most usable out of the box). Writing e.g. "sestatus says enabled/permissive/refpolicy-strict" is really helpful, and not much to type, is it?

In a previous post, I claimed that SELinux uses a kind of object-oriented approach, and that this has several advantages over path name based access.Since SELinux policy isn't actually a 'program', the term is somewhat surprising. It's just one fragement of "object oriented programming" that is available in SELinux, and actually a rather simple fragment. Also it's not how it's evaluated; but the OOP 'design pattern' of 'classes' is somewhat present in the SELinux reference policy. The syntax is kind of twisted, too.Let me give you a simple example policy fragment:

type mylog_t;
logging_log_file(mylog_t)

This fragment defines a new type, and 'inherits' from the 'log_file' class. (you can think of "logging_log_file" as com.tresys.oss.refpolicy.system.logging.log_file if you are a Java freak)The logging_log_file 'class' (which technically is a M4 macro, and maps to the SELinux 'typeattribute' 'logfile' - this would be called an abstract class in other programming languages) in turn will make mylog_t also be a "file_type" type attribute.So above line means that the new mylog_t type will 'inherit' certain access rules. Namely those defined via the logfile type attribute or file_type.This means that I can write policy to grant access on "any file" (e.g. for security scanners such as 'samhain' or the SELinux relabeling utilities, backup application, etc.) or just to any log files (e.g. for logrotate). Independend of where they live or who wrote the policy for them.So if I write policy for a custom application, add mylog_t for files living somewhere in /home/myapp/logs, I don't need to modify the logrotate policy, because that policy contains:

logging_manage_all_logs(logrotate_t)

(You can again think of this as logrotate being derived from a "log file manager" class, though it's implemented differently this time. Also note that multiple inheritance is no problem in SELinux policy)Macro names in the reference policy usually start with a namespace prefix. In this example, it's logging_. Since it uses M4 for processing the files, the syntax is largely determined by what is easy to use in M4.

Today I started to prepare the Parted 1.8 to be uploaded to Debian. Parted 1.8 has many improvements against 1.7 release current on Debian and also makes the work easier since it’s the current maintained version by Parted team. On the next days Parted 1.8.7 is going to be release and with this an upload to Debian should happen…

I hadn't even thought of Earth Day when I was talking to my dad last night, and we got onto the subject of Electric bills bills. His is apparently ~$15/month. I think ours is just over 5 times that. *ouch* We moved here in December, and the previous owner hadn't lived here for several months, so I don't think much was done in the way of winterisation. Add daily diaper washes, drying, etc., and it's understandable (if not actually excusable).

But now we've got a nice target to aim for! =) Kyoto FTW