This Saturday, 17.00, Nederland 1. preview (flash)

Michal iha asks about a mobile phone usable in Japan. When I went to Japan this spring, I've researched some options. Renting such a phone in The Netherlands was about 50/day (!). However, when you rent it upon arrival in Japan, it was only 500/day, ~ 3. It worked perfectly and is very affordable for shorter trips. See NTT DoCoMo for details. Apropos phones, I've got a new mobile phone: the Nokia 6300 to replace my previous 6310i. Transferring the data on it worked great with the help of gnokii. The only question was how to get rid of my old phone responsibly. Stiching AAP, a sanctuary for monkeys, offers the possibility to send the phone to them for free. It will be recycled and AAP gets a bit of money for it. A real "win-win" situation.

Erich Schubert reports about a Serendipity issue he found. Thanks Erich for researching that and thanks upstream fox quickly fixing it. I'm glad to report that I've just uploaded the fixed version to unstable, and that Sarge and Etch are not vulnerable.

Today I tried to cancel my phone line from KPN, the national phone company. First, their website has this text:

Misschien ben je teleurgesteld of vind je een dienst te duur. Dat vindt KPN erg jammer, maar vooral vervelend voor jouw.

Apart from the blatant spelling error, it says that "KPN regrets this, but especially feels sorry for you." The pretense that their services are so great, they need to feel sorry for me canceling... Next up I call the mentioned number. After selecting the right option, the voice tells me: "An error has occurred." (in English!) and the connection is terminated. This is a reproducible problem. As a telephone company, they cannot make their own voice response system work. I'm not sure who they should be feeling sorry for...

At some point in the past, Steve Yegge had his "drunken blog rants", now sanitized to "Random whining and stuff", so I guess after one beer I ought to be allowed to rant a bit about what is, according to him, the "Next Big Language". He comes right out and says it in this video: http://blip.tv/file/319044/ (skip to the end if you want to hear it from the horse's mouth). What he gets right in his talk is that Javascript does not have a good brand due to inconsistent and troublesome implementations in browsers. Actually he gets a lot of things right - more geeks should pay attention to having a basic knowledge of marketing, because it's a reality that isn't going to go away just because you don't like it. Leaving that discussion for another time, though, what brought this to mind was this cleverly worded error message in an application I'm trying to stich together:

Object cannot be created in this context" code: "9

To borrow a line, "Note the consistent user interface and error reportage. EdJavascript is generous enough to flag errors, yet prudent enough not to overwhelm the novice with verbosity." Indeed, I don't have a clue as to what it's complaining about. Naturally, I had a look on Google with the error message, and found a few other individuals suffering from the same symptoms, and checked, and rechecked that I was indeed including prototype.js prior to including the file causing the error, but all to no avail. After an hour or so of googling and fiddling with firebug, and reloading, the problem seems to have "just gone away" (I wouldn't believe me either, but there it is...). Let's hope that if Javascript does become 'the next big thing', that even more effort is put into making it a pleasant experience for developers.

I voted for further discussion rather than accepting the Debian Maintainers proposal. My opposition is that it's a new procedure while I think the existing structures should be able to handle the people that want to contribute to Debian. The proponents intend to solve the following problems.

NM takes too long

Agreed that it takes too long (useless waiting is a waste of time) but creating a new procedure does not fix it. Apparently there's a group of people that want to develop software for maintaining a keyring group-wise, and want to do the work actually maintaining such a keyring. Great. My suggestion would be to apply their technology and time to the existing DAM position so the work can be shared and we can reduce the waiting time.

Some people do not want to go through NM

NM is not as complicated as it is sometimes regarded, and a large part of it can consist of actually contributing to Debian rather than answering boring questions. I do not see it as a bad thing that uploading on your own requires some commitment.
There has been talk about people only interested in a small set of packages. There are already many specialised teams which those people would be welcome to join. I've also yet to see a significant number of people having trouble to find a sponsor. Sponsoring is a bit less convenient, sure, but not unbearable. Extra checking also has added value for Debian.

Some people do not want to associate themselves with Debian

Fine with me, but I don't think we need to facilitate an entire procedure for the less than a handful of people that chose to resign as DD but still want to upload. Sponsoring works for them.

I support sponsoring, and I think Rapha l Hertzog was right to introduce it. It works. With sponsoring on the one hand and being a DD on the other, we have two avenues of contribution that complement each other quite nicely.

"It is unlikely that X_oce is larger than X_atm , because the ocean initially exists below the atmosphere". From Enhanced atmospheric loss on protoplanets at the giant impact phase in the presence of oceans, Genda et. al, Nature, 2005. Tags astronomy, quotes

Although a small puddle formed uphill of our house, it soon soaked away, so I thought we'd got away without any problems from the unexpected Summer Rain [niq's soapbox] around here, but it seems I was wrong... Walking along Kewstoke Road yesterday, I was surprised to see sandbags outside one house. When I mentioned it in the greengrocer's, Nicky (excuse any misspelling) said they'd been sweeping the water flowing down the hill away from the shop door, as it would kill the wood floor and the electrics beneath if they didn't. It seems the other side of the hill also had some flash floods, reported in The Weston Mercury - News: The day the rains came down. Even so, it was much less than up-river in Gloucestershire and across in Oxfordshire, where Midcounties Co-op has mobilised its resources to combat flood chaos [coop news] by distributing essentials like water. It seems finding out whether you're in a flood risk area is unnecessarily difficult because the Environment Agency gives its reasons for stopping flood data being used [Free Our Data] - in short, they want to sell us our data a second time! In the longer term, it looks like things may change drastically around here if an entrepreneur from Burnham-on-Sea succeeds in his plan to wall in Weston-super-Mare with Severn Lake. (tip WWN ) What would that do to floods?

Both local papers are reporting that the council's investigations found nothing wrong but there's still nothing on North Somerset Council's web site. WWN: Reports that recyclable waste is being dumped in landfill sites have been rubbished by the council. The Weston Mercury - News: Recycling gets clean bill of health

Today we've released DOMjudge 2.0 after nine months of hard work. We've named it 2.0 because we think this is a major jump in the development of DOMjudge. There are many smaller changes, but the most notable improvements are the vastly enhanced jury interface, much more and better documentation and a dropped requirement on a shared filesystem between judgehosts. DOMjudge is a programming contest jury system for use in contests such as the ACM ICPC. We are using it for the upcoming Northwestern European Programming contest, and it has been used at several other universities aswell. It's nice to hear that someone is also using it as a base for their Google Summer of Code project to develop an automated assignment grading system.

For part of Stage 11, I watched the new Tour live coverage on Sat.1 who bought the German rights. When Sat.1 is busy, Pro7 will cover it. The two stations are owned by the same company, along with Kabel1, N24 and 9Live. The coverage was OK - the same French pictures as everyone else, but fewer extra features than ARD/ZDF. Commentary was a bit pedestrian, but that's like ZDF. I like Eurosport's commentary much more. International Herald Tribune reports that Eurosport's ratings tripled for stage 10 which is unsurprising. Eurosport and Sat.1 both seem to be on the same ~30% of German DVB-T as well as DVB-S. In comments on my last post about this, Thomas asked:

"You don't read German papers, do you?"

No. I've not even tried to buy one since moving to this village.

"I do, and I'm neither outraged nor surprised. It is a fairly logical step in light of the debate and the public reception of the tour, cycling pros, and Team T-Mobile in particular."

Is it public reception? Around 50% of those polled by ZDF disagreed with the decision (according to the IHT link above). Given all the ZDF spin on this, that's shockingly low. Is this driven by the silly debate of Bundestag members, rather than public opinion? (I've still not forgiven them for booting Eurosport off of ZDFvision. CDU seem to like messing ARD/ZDF about.) Are German papers in a feeding frenzy? In some days, they'll move onto football or boxing or something else. Get this in context: it's not like the old scandals where we had pro teams or wives being caught with car boots full of drug kits.

"I'd also bet that T-Mobile will quit as a sponsor."

It didn't seem like that from TV interviews, but I guess they wouldn't say yet. I think if they were going to jump ship, they would have done it after last year's worse problems. AIUI, their contract expires 2010 anyway and I wonder whether all the good publicity from their tour outing in England will help them stay until then.

"Some things belong in pharmacology textbooks and not on TV screens."

Does this mean drugs or incomplete drug tests? ;-)

"If I paid German TV fees, I'd be outraged that this comes that late. But then, I know better and don't have a TV in the first place."

Oh, well! Then I guess nothing would convince you to watch the tour! Philipp Kern commented:

"they did not threaten for a year actually. After the big doping scandal some months ago they explicitly announced that they will drop the Tour de France if a new doping case pops up. Granted, the person in question did dope before the Tour."

We don't know that yet - only one sample has been tested so far and even then, this test is controversial and has been successfully appealed against before. It's only a case. Also, maybe it wasn't the TdF, but here's a comment about ARD in 2006 threatening to drop cycling (scroll to 25.10.).

"The argumentation is that the Tour should not be a contest of the best doping substances like it could have been the last years. But I am probably biased because I don't watch the Tour, or sports in general."

No more biased than ARD/ZDF's producers, it seems. In an interview on itv4, a ZDF producer said they would drop any sporting event with a doping problem like cycling. So, if ZDF have dropped cycling for 1 in 189 participants being accused of doping, then if any footballer is accused of drugs offences, they cannot show any matches involving them. If you want to take football off ZDF, you know what to do... Thijs Kinkhorst reports in "Too much testosterone" that NOS also continues coverage, like our itv. Good on them. Let's applaud any drug cheats getting caught and punished, after we're reasonably sure.

Metro, the free newspaper distributed at train stations, has published an article about the Korenslag television show last Thursday. To my great surprise, they used two photo's to illustrate the article - photo's taken directly from my web site. This without any contact, or without any credit. I've sent them an email expressing my dissent with this and I've asked them to come up with a solution for this situation. If they'd asked beforehand I'm certain that they would have gotten my permission if they'd put a photocredit as they do with nearly every other photo in their newspaper. I'm curious what their response is going to be. Here's a scan of the article, the original photos are here: 1, 2.

Patrick Sinkewitz has tested positive for testosterone, and German public broadcasters ARD and ZDF have instantly canceled reporting on the tour except for more doping "news". The Germans broadcasters are going out of their mind in their witchhunt. Luckily the rest of the world seems more sensible. A.S.O. asks whether they're supposed to stop doing tests if apparently one positive is enough for ARD and ZDF to cancel everything. Manager Luuc Eisenga of the T-Mobile team asserts that newspapers will keep on reporting about business news even if one company is accused of fraud. Dutch public broadcaster NOS says: "We're here to report on what happens in the tour, not to exercise moral judgement over it." I'm happy that I can just continue to watch the tour even if one cyclist crosses the line.

Since I'm a member of the set of people "somebody better suited to explaining it" mentioned in Silvia Pfeiffer's "A Long Story of Logins", I suppose it falls to me to explain what the hell we actually did to make the thing work. A quick recap, for anyone who hasn't read Silvia's article: the Vquence website is a very AJAXy, Web 2.0 style video socialisation site. Since we want the site to be available to all as much as possible, we don't lock any part of the site away behind a "login required" page unless we absolutely have to. An unpleasant side effect of this is that, when it does does come time for you to login, pushing you off to a separate "please login" page is going to be, well, a pest. There's all sorts of state about what the user is up to (it's a web-based video mashup creator, after all) that we need to submit -- but only after the user has logged in. Enter the realm of the Web 2.0 Login. Instead of sending the user to a login page, getting them to login, and then redirecting them back to where they want to go, you just have some sort of popup form that, when submitted to, does a background request and logs the user in behind the scenes. This isn't a new concept by any means -- for example, try voting up or down a link on reddit when you're not logged in. However, most sites that implement this sort of thing (based on our brief informal survey around the office) don't protect the password information in any way -- it goes over the wire as a plaintext HTTP request. We don't like this, so we wanted to send the login form over HTTPS. And there began our problems. The trivial implementation of a Web 2.0 Login page is as you'd expect -- the AJAX stalwart, XmlHttpRequest, POSTing to a handler somewhere that validates the login, sets a session, and sends back some javascript to change the page layout a bit to show you're logged in. We had this working nicely, until we started testing on our staging environment, where HTTPS comes into play... You see, XmlHttpRequest doesn't like making a request to a domain other than the one that the main page comes from -- for security. It also thinks that the same hostname via a different protocol counts as a different domain, for the purposes of this security check. (I can see the theoretical reasoning for it, but it is a bit weird for HTTP to HTTPS transitions) So if you want to POST to https://www.vquence.com/something using XmlHttpRequest, you need to be doing it from a page which is retrieved from somewhere in https://www.vquence.com/ as well. We considered just turning on HTTPS across the board, but that would have all sorts of unpleasant ramifications, so we decided against that. But the problem remained, how do we get the user's credentials to our server in a secure manner with a minimum of unpleasantness? We came up with all sorts of options. This is where the infamy of "bug #93" started -- it's a monster of a bug log. Lots of it is me going "we could do this, but it'd suck, or we could do this, but it would suck". Finally, Silvia (I think) suggested we look at using an iframe. "Eeew" was the general response, but it might at least give us a way to set a part of the page to HTTPS, which we could use as a launching point for our XmlHttpRequest call. While researching how to make this all work (I had, to my great pride, never inflicted an iframe on the world before), I managed to come across a few articles on how you can use a hidden iframe to handle requests instead of using XmlHttpRequest. Basically, the trick is that you do a regular POST on your main page, but set the target of the form to a hidden iframe in your page. A general discussion of the principle is available At the Apple Developer site, and there's also a Rails plugin that implements the concept rather nicely. When I found these, I briefly danced for joy. My quest was over. POST to the iframe, the iframe get some JS back from the server, JS mangles the main page's layout to show the user is now logged in... aaaand profit. Like fun it was. My implementation was short and sweet -- a true work of genius (if I do say so myself). Everything worked like a charm. Until we got it back into staging. Then cross-domain security bit me again. Naturally, if you don't want XmlHttpRequest calls to perform cross-domain, you probably don't want iframes for different sites to be manipulating each other's content either. That's exactly what happened -- the iframe can't manipulate the main page's layout as we need it to. Why I didn't think of this before I charged mightily ahead I don't know. My only defence is that I've never claimed to be a web development guru. Sneaky tricks will defeat any security measure, though. For instance, we control both sites (http and https), so we can send the user back to the unsecured site after login and then that location (still in the hidden iframe) can manipulate the main page layout. Redirect to the rescue! That worked really well in Firefox, even with HTTPS in staging. We were saved. At least until IE came along. Bloody Microsoft, ruining all my cunning plans. IE complains when a HTTPS site redirects (using the Location HTTP header) to a HTTP site. You apparently can't turn this off. I was shocked that Microsoft cared so much about their user's data security -- it's certainly not the first thing I think of when I think "Microsoft". My faith in the world was restored when Silvia pointed me to a workaround for the problem -- if you send the redirect in a <meta http-equiv="refresh"> tag instead of a Location header, IE is more than happy to let it pass. Because obvously a chunk of HTML that says "HTTP equivalence" is completely different to a HTTP header. Sheesh. To snatch defeat from the jaws of victory, after all this brilliant hacking, I managed to make a newbie error with the contents of the http-equiv by setting the content to "0;http://www.vquence.com/blah" instead of "0;url=http://www.vquence.com/blah" (note the url=, because I sure didn't). IE complained by looping infinitely on the source URL, while Firefox just made sense of it and did the right thing. I managed to waste most of an hour of three of us over that little stuff-up. Go me! (Sorry about that guys, by the way) Feeling very chuffed, I went home for the evening. The next morning saw a browser compatibility defect in my queue -- Safari didn't like the new setup. Instead of doing the right thing, clicking on the login button would create a new tab instead of logging in. The fix? Changing the style of the hidden iframe from "display: none" to "width: 1px; height: 1px; border: 0" did the trick. Fark. So much for "hidden" iframes. What's particularly funny is that Apple's own tutorial on hidden iframes says to avoid "display: none" because NS6 doesn't like it, but doesn't mention it's own glaring deficiency in this area. So, what are the lessons learned?

• Firstly, IE is different. I knew this already, but living in an all-Linux, not-normally-a-web-frontend-developer world, I need to be reminded every now and then.
• Safari is differently different. Being a former Konqueror user, and wrangling with that browser's retardations in an earlier existence, I should have been ready for this one.
• "Code to the standards" is a crock of shit. That's not to say that we shouldn't encourage it, but I'm fairly sure that the HTML 4.01 standard is silent on whether or not an iframe with it's display property set to none is a valid target for a form submission (I had a quick look, and nothing jumped out at me). Anyone who dismisses the difficulties of web development with a hand wave and a casual "just code to the standards" will get a double-spaced, 24pt printed and bound copy of all of the W3C standards dropped on their head from a tall building.
• No matter what security measure you think has stopped you, there's always a workaround. Can't do a XmlHttpRequest to a different domain? POST to a hidden iframe (you can post to any domain you want, too -- so much for cookie security). Want to run JS you got back from POSTing to a different domain? Just redirect back to the first domain. Can't redirect from a HTTPS to a HTTP page? Don't use a HTTP redirect, use a meta refresh. Sigh.
• Hidden iframes are cool. While I'm firmly in the "frames are evil" camp, they're a nice freaky behind-the-scenes tool if you want to do something more than what a simple XmlHttpRequest gives you. It's like having a whole separate scratch-pad of a browser you can play with, and the user never has to see it.
• Web development is frustrating. I don't do a whole heap of it (I'm more a backend code / infrastructure guy), so when I do some web UI work, I have to re-learn exactly how much of a pain it is to have to cater to the needs of a bunch of different browsers, each with their own quirks and irritations. Suddenly supporting a bunch of different Linux distros seems so much less frustrating.

The Weston Mercury repeats that a Recycling review will be carried out as a result of "staff will just take it for granted that green waste is in the green lorries" allegations, but no new news. Guardian: Fortnightly collections not always the answer, say MPs so hopefully that will discourage any more one-measurement-fits-all moves. Centred on Cambridge, cam.misc posters are describing what really happens when your recycling gets missed Meanwhile, the WWN reports about The 300K Mistake so I think some signs may need recycling. Come back Tea's - your town needs you!

It cost me a small fortune in text messages, but Dekoor are the winners! (what's this?)

I have just received my new mobile phone: a Sony Ericsson K750i which I have chosen mainly for its price and multimedia features, but also because it has an internal modem, accessible via both bluetooth and irda. So far, I was already able to connect to the internet in GSM, will try GPRS tomorrow as I need to change my SIM card. libbtctl and gnome-bluetooth 0.9.0 were also released today. Updated packages have been uploaded to my unofficial repository (please read carefully the release announcement which explains these packages have been deprecated). I have also tried wammu for the first time, it will help me update my address book.

As you probably already heard, the GPL, version 3 has been released, together with the LGPL, version 3. I haven't yet read the licenses in detail, so I cannot say much about them, but more information is available in the (updated) GPL FAQ. The compatibility table from the GPLv3 Discussion Draft FAQ can be pretty helpful, too. There's a Why Upgrade to GPLv3? text and even a video of Richard Stallman (Ogg Theora, transcript available) introducing the GPLv3, the rationale behind it and some of the changes in this new version. (One nice advantage of the GPLv3 I like is that it's compatible with the Apache license now, btw.) Probably the most interesting GPLv3 resource at the moment is Palamida's list of projects which already switched to the GPLv3, which includes a number of GNU tools (sed, tar, ed, bison, texinfo, cpio, coreutils) and some other major projects such as Samba. Currently the page lists ca. 140 projects which switched. It'll be interesting to see how the adoption proceeeds. My guess is that in a few months it'll be hard to build distributions or embedded (GNU/Linux-based) hardware devices without GPLv3 code...