We're at 5 minutes to midnight, and it appears that Joost is the new TV - it appears to be getting some reaonable coverage at the moment, but looks far too much like another closed app using proprietary protocols - the world has gone DRM crazy - someone stop it, I want to get off. DRM is a myth, if you can play it, you can copy it (not neccessarily easily, but it's still possible). The NewScientist article is quite interesting in the claim of "piracy-proof"... if you can play the video, you can capture it, if you can listen to music you can record it, when is the media industry going to realise that DRM is a very dumb idea that shouldn't have been allowed to get this far - pirates can (and always will) find a way, how about going back to trusting your users rather than tarring them all with the "you're a pirate" brush. The Register 's article appears to have a typo in it... well, unless you really do need a 500mbps line in order to use Joost - seems unlikely, I think they meant 500kbps. Anyways - nice idea, not sure that it's better than anything else though, I'll continue buying DVDs that let me play back when I have no interweb connection. Back to being at 5 minutes to midnight, eeep! We're all going to die! Maybe it's the introduction of DRM that's led to so much terrorism, or maybe just that the media industry appears to be out to shaft everyone. Bah. Only one other article has caught my attention this morning, it's another look at the iPhone, it appears that no one is actually getting a reasonable amount of time to play and review this device, and it brings up a number of my issues with the iPhone. So, yes, that's the morning covered - maybe more this evening.

One of the student groups I’m involved in at MIT is the SIPB, the Student Information Processing Board. It’s a volunteer computer group so old that they called it “information processing” back then. They run a bunch of different servers and provide lots of cool services for the MIT community. One of the things that they do is teach classes about various things related to computing during IAP, MIT’s Independent Activities Period. So back when I had just gotten started with the group, one of the members was like, “Hey! You want to teach an IAP class!” and, being a frosh, I was like, “Er, I didn’t know that… but, um, okay.” So I taught one about Debian, of course. This year’s topic was Giving Back: Contributing to Debian and the New Maintainer Process. It was a three-day series, as described here. The lengths of the talks varied, with the first day being ~45 minutes, the second being ~1.5 hours, and the last being ~30 minutes. All of the lecture materials can be found here. The audience was on the high side of technical, and a lot of the slides were more to nudge me into what I was talking about rather than to be really awesome slides. Which probably should have involved less text. The packaging crash course definitely drew a much larger audience than the first or third parts, which mostly consisted of people I know who work on Debian-Athena, the unexpected appearance of my friend Aaron Swartz who’s in town for a couple weeks, and a few faces that I didn’t know. Maybe next year I’ll try to plan something that just involves a more intensive packaging course. Because, although I procrastinated, pushed the original lecture dates back a week from original plan, and made my lecture slides on the day they were presented, I actually did have fun. And it’s good practice.

It appears that some people don't understand what right-wing means in terms of politics, apart from using it as a general term of abuse.

I recommend visiting the site http://www.politicalcompass.org/ to see your own political beliefs (as determined by a short questionnaire) graphed against some famous people. The unique aspect of the Political Compass is that they separate economic and authoritarian values. Stalinism is listed as extreme authoritarian-left and Thatcherism as medium authoritarian-right. Nelson Mandela and the Dalai Lama are listed as liberal-left.

I score -6.5 on the economic left/right index and -6.46 on the social libertarian/authoritarian index, this means that I am fairly strongly liberal-left. Previously the Political Compass site would graph resulta against famous people but they have since removed the combined graph feature and the scale from the separate graphs. Thus I can't determine whether their analysis of the politics of Nelson Mandela and the Dalai Lama indicate that one of those men has beliefs that more closely match mine than the other. I guess that this is because the famous politicians did not take part in the survey and an analysis of their published material was used to assess their beliefs, this would lead to less accuracy.

The Wikipedia page on Right-Wing Politics provides some useful background information. Apparently before the French revolution in the Estates General the nobility sat on the right of the president's chair. The tradition of politically conservative representatives sitting on the right of the chamber started there, I believe that such seating order is still used in France while in the rest of the world the terms left and right are used independently of seating order.

Right-wing political views need not be associated with intolerance. If other Debian developers decide to publish their political score as determined by the Political Compass quiz then I'm sure that we'll find that most political beliefs are represented, and I'm sure that most people will discover that someone who they like has political ideas that differ significantly from their own.

Several months ago, I set up a low-powered box to act as a fileserver and media center. I don't get cable TV and I have no interest in doing so, so I don't need a PVR. However, I do have a rather large music collection (and new speakers to play it on); I want to be able to put Internet radio on in the background (since we can't get NPR over the air), and a quick-and-dirty slideshow program for my digital camera photos could be nice too. So, I decided to try out the free media center, mythtv. I've summarized the notes I took here for the benefit of other people who don't watch TV.

Setup was fairly straightforward -- I installed the packages from debian-multimedia.org and configured them. I had a bit of trouble getting myth to actually start, but looking over the documentation apparently resolved it (my notes contain no details).

Mythtv has some very well-thought-out aspects. By all accounts, it makes an excellent PVR; since I don't watch TV, this is the last time I'll mention PVRs in this post. :) The interface looks exactly the way you want a TV-based system to look, with bright colors, big fonts and big interface elements. There's even a cute OpenGL mode with fancy screen transitions (I left them disabled because my video driver is unstable even without 3d effects running -- thank Via).

However, it became painfully obvious after a bit of use that MythTV is really meant as a TV program, with everything else being an afterthought. Here are just a few of the problems I noted:

• MythTV can't play internet radio; the functionality simply doesn't exist.
  
• You can do only one thing at once. Perhaps this is fine for TV, but given that it is not uncommon that I want to, say, play music while reading the news, or while ripping another CD, this is a gaping hole in functionality for me.
  
• MythTV can display news (RSS) feeds. However, the news feeds aren't in alphabetical order in either the viewer or the setup screen (where you pick what to see). This makes it rather painful to pick the feeds you want out of the dozens of presets.
  
• The built-in browser crashes with SIGABRT on startup, making the news feeds useless anyway.
  
• The built-in support for ripping flac files is confusing to activate (you have to pretend you're making an Ogg and choose "Perfect" quality!) and doesn't give you control over the process (for instance, replaygain can't be added to the ripped files).
  

That's just a small sampling of the problems I ran into. I ended up just setting up a normal desktop system with a wireless keyboard/mouse, and I'd recommend the same thing for anyone else who doesn't need a PVR. The non-TV features in Myth have a strong smell of being extras for people who occasionally switch away from the TV, rather than a well-integrated media system in their own right.

Russell: I don't think so. I do think that most Free Software people, even more in settings such as Debian, will tend to be in the lower-left quadrant of the political compass. Personally, I ranked Economic Left/Right: -8.00, Social Libertarian/Authoritarian: -6.87 - No surprise for me ;-) And yes, we do have some more upper- or right- sector people, but I think our center of mass will surely fall in the lower-left quadrant. More samples needed ;-)

This morning at LCA Andrew Tanenbaum gave a talk about Minix 3 and his work on creating reliable software.

He cited examples of consumer electronics devices such as TVs that supposedly don't crash. However in the past I have power-cycled TVs after they didn't behave as desired (not sure if it was a software crash - but that seems like a reasonable possibility) and I have had a DVD player crash when dealing with damaged disks.

It seems to me that there are two reasons that TV and DVD failures aren't regarded as a serious problem. One is that there is hardly any state in such devices, and most of that is not often changed (long-term state such as frequencies used for station tuning is almost never written and therefore unlikely to be lost on a crash). The other is that the reboot time is reasonably short (generally less than two seconds). So when (not if) a TV or DVD player crashes the result is a service interruption of two seconds plus the time taken to get to the power point and no loss of important data. If this sort of thing happens less than once a month then it's likely that it won't register as a failure with someone who is used to rebooting their PC once a day!

Another example that was cited was cars. I have been wondering whether there are any crash situations for a car electronic system that could result in the engine stalling. Maybe sometimes when I try to start my car and it stalls it's really doing a warm-boot of the engine control system.

Later in his talk Andrew produced the results of killing some Minix system processes which show minimal interruption to service (killing an Ethernet device driver every two seconds decreased network performance by about 10%). He also described how some service state is stored so that it can be used if the service is restarted after a crash. Although he didn't explicitely mention it in his talk it seems that he has followed the minimal data loss plus fast recovery features that we are used to seeing in TVs and DVD players.

The design of Minix also has some good features for security. When a process issues a read request it will grant the filesystem driver access to the memory region that contains the read buffer - and nothing else. It seems likely that many types of kernel security bug that would compromise systems such as Linux would not be a serious problem on the HURD. Compromising a driver for a filesystem that is mounted nosuid and nodev would not allow any direct attacks on applications.

Every delegate of LCA was given a CD with Minix 3, I'll have to install it on one of my machines and play with it. I may put a public access Minux machine online at some time if there is interest.

Erich commented:

"Pbuilder is great (and cowbuilder even more so). First of all, it makes setting up and upgrading chroots easier (even easier than dchroot etc.), but it will also handle dependencies and do install/removals (well, technically it won't remove stuff, the chroot is just thrown away afterwards). That way, pbuilder helps getting build dependencies right, and ensures the package is currently buildable (not with some library package you still happen to have on your system, but that has been removed from Debian; not uninstallable for some reason etc.). This makes the job easier for porters, since a FTBFS is less likely to be an error in packaging by the maintainer... At some point I had like 6 pbuilder chroots... woody, sarge, unstable, woody with some backports, sarge with SELinux backports, unstable with experimental. Sure, we don't need debhelper either? After all, it just does some cp and mvs, doesn't it? There IS some benefit in having stuff automatized in a standard way; even though we could all do our chroots ourselves, I want to express my thanks to the pbuilder (and cowbuilder) authors and maintainers for making life EASIER for me. A lot easier. I could live without, but I would probably not keep that many chroots."

Ken Bloom added:

"One important feature of a pbuilder chroot is that pbuilder installs build-dependencies as you ask it to build debian packages, and removes them as soon as it finishes building the packages. In this sense, pbuilder is specifically intended to replicate the buildd environment, so you can find out whether your packages will break on a buildd (e.g. whether you've remembered to include all of the build-deps in debian/control, because things will break on the buildds if you forgot to add a build-dep because the build-dep was just lying around on your system (or in your unstable chroot)."

Sven M ller wrote:

"Well, pbuilder has several benefits, but the most important one to me is that it restarts from a clean system (only base packages + build-essentials installed) on each build. Sure this adds to the time needed for the build, but it also makes sure that I get all build-deps right and that the whole build process is as reproducible as possible."

Ben Hutchings commented:

"The major difference between pbuilder's approach and simply building in a chroot'ed installation is that pbuilder tries to build on a minimal system plus the specified build-dependencies. If you always build with pbuilder or similar it's much less likely that you will miss a build-dependency or otherwise produce a package that can't be auto-built elsewhere."

I take the clean chroot point as a clear benefit, but it still strikes me that there are easier ways to do the same thing (rsync --delete) without all the waiting around for pbuilder on my slow mipsel. I guess that's the difference with debhelper: debhelper use doesn't seem to slow me down.

Update: it seems that comment also appeared at Newsome.Org flyte blog and c net. There are more posts apparently by the same author at ZDnet

After some hiccups with delivery, the bluetooth keyboard and mouse I ordered had miraculously turned up at the leasing office on Sunday, when we poked our head in on the way home in the early evening. I had a quick play at getting them working. The USB Bluetooth adapter was recognised by Debian Etch's 2.6.17 kernel without and problems, and I installed all of the BlueZ packages and had it happily looking around for devices. I tried to get the mouse working first, as the documentation said that it didn't require a passkey. I successfully paired it using hidd --connect bdaddr whilst having it in discoverable mode. Sure enough, some extra stuff turned up in /dev/input (interestingly, whenever the mouse (or keyboard) puts itself to sleep, everything vanishes again, and when it reawakens, it scores a new numbered "input" entry in /sys/class/input, so I wonder if that's going to do anything unpleasant when the number gets sufficiently high). I next tried to get the keyboard working, expecting more of a fight, because it required a passkey. Turns out, I could get it connected and working with exactly the same procedure. No passkey required. That bothers me slightly. So at this point, I added what was essentially a second mouse device to my xorg.conf (which I suspect became redundant after I disconnected the USB mouse), restarted X, and hey presto, either mouse worked. I then removed the USB keyboard and mouse, restarted X again for good measure, and everything continued to work. As I haven't touched a config file yet, restarting the bluetooth services loses the pairing and I have to repeat everything, so I need to figure out how to make this all "just work" at bootup, but it's not high on the list of things to do, as I don't reboot my MythTV box very often, and I use the keyboard and mouse even less. In terms of functionality, the wheel on the mouse isn't working. This appears to be a bluetooth-level problem, as doing a hcidump shows no activity whilst the wheel is being used. Interestingly, it works as a button, just not as a scroll-wheel. Similarly, on the keyboard, none of the grey extra buttons work (nor does the wheel). Some preliminary Googling shows people having similar problems, and there are mentions of kernel patches. I need to do more research. I also need to do some bluetooth pen-testing with my laptop to figure out if the keyboard is really as secure as I'd like it to be. Oh, and "Windows XP only" be damned, the thing works fine (enough) on Linux :-)

So, today (other than work, where I've mostly been battling Java), I've been battling in my mind between 2 things that are (probably) never going to happen - in both cases I've been told at various points that they're never going to happen, so I mostly believe that - but being an optimist at heart (and a pessimist by trade), I can't garantee that either isn't going to happen, and that makes my head hurt. Lots. I can't understand what anyone would ever see in me being one of the greatest problems, I'm not particularly good at chatting, I have a limited experience of the world, I don't understand football, I don't understand religion (I can see merits in it, but also a whole lot of downsides), and I'm generally (mostly) boring... so, with all that in mind, the probably from the first paragraph mostly disappears and we're sorted! Anyways - it's gone 1.30am, there's work at 9am, and there's lots to do when I get there, so I should stop thinking and start sleeping for the good of everyone. Night all.

Honya budo is the martial arts skill of visiting a bookstore without buying a book. It is an arcane art, practiced by secret masters in obscure parts of the world for several centuries. During the 20th century, when literacy went up in the western world, and people from every social strata started frequenting shops selling books, this venerable art has begun to rise in popularity. The first level of honya budo is the "Way of the In-Out". It consists of going into a bookstore, looking around to see that they do indeed have many books for sale, inhaling the intoxicating smell of new books, and then immediately leaving the premises. This way, a novice learns to use the door and gains the right to use a plain white bookmark. The second level of honya budo is the "The Feeling of the Touch". This consists of the novice doing the "Way of the In-Out", but before leaving, actually taking a book off a shelf, opening it, caressing it with gentle hands, feeling the texture of the spine, and enjoying the exquisite sensual smoothness of the paper. When the novice can do this, and put the book back on the shelf and leave the store without buying anything, the novice has achieved enlightenment of the second level and becomes an apprentice, and gains the right to use a colored paper bookmark. The third level of honya budo is the "Path of the Randomly Hopping Rabbit". The apprentice enters the book selling establishment, visits every department therein, and looks for a book they have previously shown a special desire to have, which may not have been published. When they can't find it, they then speak to a salesperson, inquiring about the book. When the apprentice can do this and leave the establishment, without making the salesperson annoyed, and without buying anything, they have achieved enlightment of the third level and become an adept, and gain the right to use a leather bookmark. The fourth level of honya budo is the "Stretched Leg of the Giraffe". The adept visits a bookstore with another adept, and spends an afternoon there, wandering from book case to book case, taking out books and discussing them with each other, commenting on their good and bad points, and recommending especially good books to each other. When an adept can recommend a book that the other will happily buy, but they themselves do not buy anything, then they achieve enlightenment of the fourth level and become a master, and gain the right to use a bookmark signed by the author of a book. The fifth level of honya budo is the "Flight of the Serpent". When the master can visit a bookstore, and get given books for free, they have achieved enlightenment of the fifth level and become a supreme grand master, and can use any kind of bookmark they wish.

I had my first day of class at the Montreal Goethe-Institut today. It was a great walk down through Parc LaFontaine and rue Cherrier out to St. Denis. There were footprints in the snow over the pond in the parc, so I assume the ice is frozen. It'd be great if the lake were open for skating sometime this winter; it was liquid last week. The class itself was great. The building itself is like the office of a dot-com with good VC backing -- indirect lighting and modern furniture and quiet carpeting. My lehrerin is a nice woman from Freiburg. We had about 8 people in the class, a good mix of men and women, young and old, Quebecois and eux autres. We spent most of the class time practicing how to introduce ourselves, say hello and where we were from and where we lived and such and so. I haven't taken a class in so long, it was a little hard to get back in the swing of things. I didn't even have a notebook with me -- just my Moleskine notebook, which it seems a waste to fill up with irregular verbs. But we'll see. I got home and sang the song we learned to Maj and Amita June, just so they knew how Deutsch I am now. Here's the song (to the tune of "Twinkle, Twinkle, Little Star"):

 "Guten Abend! Ich hei e Knabe!"
 "Freut mich! Jonny Watanabe."
 "Kommen Sie aus Tokio?"
 "Nein! Ich komm' aus Buffalo!"

I also updated my Wikitravel German user page with my newly-learned personal information. We'll see how that progresses over the next few weeks. tags: deutsch goethe-institut class buffalo

One can dream, considering that Obama started a Presidential Exploratory Committee. It's too early, but with or without him running for president i wish the world^W USA a better president.

The recent goal for Haskell' has been to actually start committing modifications to the Haskell98 report. Well, as mentioned on the mailing list, we've started making changes relating to Pattern Guards. The current draft of the Haskell' report will be auto-generated whenever someone submits a patch. Thanks for setting up the build system, Malcolm! Haskell' ("Haskell Prime") is the working name of the next Haskell language standard. Haskell is the best programming language in the world.

Prompted by a friend who finds a dialup internet connection about as appetising as being food for mosquitoes, I thought I'd share some tips for using the current internet on dialup. It's easy to say that dialup is dead, but I've transitioned from dialup to broadband and back something like 4 times so far, and since I don't want to rule out spending time in the middle of nowhere in Costa Rica, or at McMurdo, or in an RV, or in a Bigelo orbital hotel, amoung other dream destinations, I don't let availability of bandwidth deter me. Here's some habits you can learn to lessen the pain: work local This is the most important thing. ssh is great, but latency sucks. If you need to edit a file on a remote system, edit it locally, and copy it across. Since I keep most of my files in subversion, I edit it locally, commit it, and update on the remote machine. If ssh isn't appropriate, use rsync or something. Editing files is just one example; I try to avoid doing anything on a remote machine if I can do it locally. For example, even though an irc client in screen on a remote machine is a nice setup, it's to be avoided on dialup. Another example is using offlineimap to download your mail, so you can read it locally. Yet another example: I have all my projects scripted so I can make a complete release with just single locally ran command, that goes off and automatically triggers everything that needs to happen on the server. Same for blogging, and for making changes to my wikis. cache everything This is an obvious one, but worth mentioning. The most important cache is probably actually a caching dns server. Dns lookups are an easily missed slowdown (true even for many cable/dsl connections). Other useful caches include a squid web cache, and a shared apt cache. Also get in the habit of squirelling files away, instead of deleting them, to avoid re-downloads. know your traffic Look at everything that causes internet traffic, and turn off the fluff. Even the small fluff will make a difference on dialup. This includes turning off VPNs, not keeping chat programs running in the background. If you're not currently using irc, close it. Use a remote irc proxy server to cache messages while you're away, to avoid missing anything. Avoid sitting on web pages that refresh or stream content. Keep iftop running all the time, and know what all the sources of traffic on it are. You can easily waste 25% of a dialup pipe with fluff if you don't keep it under control. downloads are batch jobs Learn to treat downloads (and uploads) as batch jobs that go on in the background or overnight. Don't let your work be blocked waiting on a download if at all possible; don't sit staring at the screen every time a five minute download pops up; go do something else instead. When possible, try to anticipate what you'll need and download it the night before. Set up a remote download queue, of things you want to download at some point, sorted by priority, and rsync from it as a batch job overnight or when you don't need bandwidth for anything else. If you upload a lot of stuff, set up an upload queue too. don't try to do everything on dialup Some things are just not appropriate for dialup. There's no point in trying to download CD images, or much music, or apt-get dist-upgrade, or watch the latest videos on YouTube, or whatever. Even things like Google Maps are just not designed for dialup; the one square you want to see is always the one that will fail to download while the other 8 squares slooowly download in parallell. And AJAX sucks. So avoid this stuff on dialup, don't frustrate yourself. Schedule pit stops where there's high bandwidth to do this kind of thing. Find alternatives you can use while on dialup -- use old fashioned mapping services, and instead of pursuing the latest and greatest videos, download an e-book -- a whole book downloaded in just 5 minutes -- who said this dialup was slow?

Several people have wondered why were Nadezhda's and my site offline this weekend. Well, it surely raised my ego ;-) What happened?
As many of you know, this blog is hosted in my home machine - A Mac Mini connected by DSL. A couple of weeks ago, my ISP announced the doubling of our connection speed (it was 512/128k, it got increased to 1024/128, so it's not exactly doubled, specially if you are used to saturating the upstream channel... but anyway). From then on, we started suffering all kinds of connectivity problems. The connection would drop several times a day, it would be sluggish at times... I decided to wait a bit, to let them upgrade their whole network.
Anyway, it didn't happen. Nadezhda was pissed at it, as she is our main user - And just to make sure I was not doing NAT wrong in my server, I decided to set up my DSL modem (a SpeedStream 5200) as a router instead of a switch. Yes, Ta^3, some people never learn ;-)
In short: I hosed the connection, and had to work with Prodigy Infinitum's staff on getting it back online. Contrary to the popular belief, Infinitum support is up to the task, customer-friendly and helpful (although they insisted on me shutting down my Linux server and configure it from MacOS - I don't blame them, after all. Thank $deity I didn't have to set up a Windows machine after all!).
But after recovering connectivity, the speed still sucked.
I was prompted to use a temporary account, which they provided me, and the connection was just perfect, 10KBps upstream, 105KBps downstream. WTF?! Well, the girl told me that my login/password pair had a problem (?!) and I needed to change them. Ok, no sweat, we changed them, so I'm no longer gwolf_at_prodigy - I had not even used that mail address, so no worries.
What happened? Well, as my username/password is the same for all of Prodigy's services (dialup, Wifi hotspot and DSL), and as I have lent it to a couple of people over the years, I just guess they penalized me :-/ But... Why wouldn't they tell me about that? Not even after changing my login/passwd (no, they would not keep even the old login) Why wouldn't they request me not to share my credentials? Go wonder.

I sent an email to my boss a couple of weeks ago, asking for some days in June to be able to go to DebConf7. I wanted to buy the plane tickets as soon as I could, to be able to get a lower price. Last year they weren’t very happy about us having our holidays whenever we wanted, so this year they’ll probably decide that we must take them in August, whether we want or not. They’re having a meeting one of these days, if they find some time to do it, to discuss about that stuff, so I might find out soon whether I’ll be able to go or not. Or maybe I won’t be able to know until some days before, who knows. I was very happy about going to EDI this year, so if I cannot go, and if the perspective is that I’ll never be able to go to a DebConf again, unless they’re in August, I might need to start thinking about finding a solution, even when it might be quite drastic. I’ll keep you informed.

Binary file parsing is difficult. There is a lot of byte swapping, offset computation and magic bit mask handling involved. Add to that the fact that many binary formats were reverse-engineered and do not even have a public spec, are so convoluted that there is no way to write a decent parser, or have so many buggy writer implementations that the readers need to accommodate for that. Media players, web browsers and email clients are probably the most exposed ones. These programs are full of bugs, not more than any other program, but more dangerous bugs. Admit it, you just play any video you find on the Intarweb, click any image link and read your email (seriously, even mutt uses antiword to read .doc attachments). It is no longer necessary to have network listening services to be exposed to security issues, the users themselves listen to the world. Using my fuzzing tool zzuf that I eventually decided to release, I found more than 40 bugs in common Unix tools, popular media players and other utilities, simply by reading valid files and slightly corrupting them. The most scary ones are the media player bugs:

	VLC	MPlayer	xine	FFmpeg (ffplay)	GStreamer (gst-launch)	mpg321	ogg123
MP3	robust	SIGSEGV	robust	robust	robust	robust	N/A
Ogg Vorbis	robust	SIGSEGV	robust	SIGSEGV	SIGSEGV	N/A	robust
MPEG-1	SIGSEGV	SIGSEGV	SIGSEGV	SIGSEGV	robust	N/A	N/A
MPEG-2	SIGSEGV	SIGSEGV	robust	SIGSEGV	SIGSEGV	N/A	N/A
MPEG-4 AVI	SIGSEGV	SIGSEGV	SIGSEGV	SIGSEGV	deadlock?	N/A	N/A
FLAC	robust	SIGSEGV	robust	heap corruption	robust	N/A	SIGFPE
Ogg Theora	robust	SIGSEGV	robust	SIGSEGV	robust	N/A	N/A
WMV	SIGSEGV	SIGSEGV	N/A	SIGSEGV	robust	N/A	N/A
AAC	heap corruption	SIGSEGV	SIGSEGV	N/A	N/A	N/A	N/A
AC-3/A52	SIGSEGV	robust (I KID YOU NOT)	robust	SIGSEGV	N/A	N/A	N/A

Each of these segmentation fault bugs is a potential security hole in Debian. zzuf also found bugs in Firefox, Openoffice.org, antiword, ImageMagick and even objdump. And there is more to come.