Tezcatlipoca, the smoking mirror, was (quoting from Wikipedia) the god of the night, the north, temptation, sorcery, beauty and war. He was known by other descriptive names, such as Titlacauan (We His Slaves), Ipalnemoani (He by whom we live), Necocyaotl (Sower of Discord on Both Sides) and Tloque Nahuaque (Lord of the Near and Nigh) and Yohualli ecatl (Night, Wind). And today, I strongly feel as being born his servant. Why? Because today I took courage and started working on the integration of our ~20 print servers into a single, smarter scheme, with user control and printer assignment done by a central server. I cannot, of course, say that in the course of a day my troubles are over - No, no, quite far from it... But at least, I managed to grasp how to send the CUPS generic Postscript driver as the default driver for W2K/XP clients (no, I haven't worked on older ones yet - and yes, we still have many W98 machines around). I'm quite used to the fact that things in a Unix system are just easy to understand. Yes, sometimes it takes some time, sometimes you have to dig into the manuals, but all in all things can be finally understood. Today, after a couple of hours sticking my nose into the extremely extensive Official Samba HOWTO and Reference guide (chapters 21 and 22) and having my attention drift over the quite interesting Implementing CIFS book in a vain attempt to fully understand what goes on behind the curtains, after trying to debug my Windows-Linux communication issues by grokking what Wireshark finds over the wire... I can only understand that CUPS is pure black magic, although quite well documented. Samba is elegant and feels nice and easy, but really begs to be debugged with the Malleus Maleficarum at hand. CIFS (also here) is the subtle utterance of a dark spell pronounced by a stuttering sorcerer. And the way Windows integrates with it all is... Bah.

One feature I’d like to see at Netflix: a “standing order” for films that match particular criteria. For example, I would be happy to have Netflix automatically add any Pedro Almodóvar film to my queue as soon as it enters the Netflix universe (Volver looks interesting). I also wouldn’t mind any film rated four stars by Roger Ebert to be dropped into the queue. You could even ask Netflix to add anything that its collaborative filters give a top rating based on your past preferences. Then you would just sit back and be surprised at what arrives for you. Rather than “opt-in,” the system would become “opt-out” — similar to those discount CD clubs that were popular in the 1980’s, where you had to tell them if you didn’t want the pick of the month. (I built the bulk of my CD collection in that era by taking advantage of the occasional “3 for the price 1” deals.) The difference here is that you are actually likely to want the pick of the month. A related feature would be “add all” matching a certain criteria with a single action — for example, all Hitchcock films. This is pretty much how I select films anyway. Knowing that a film is directed by Robert Bresson or Akira Kurosawa (two of my favorite directors) tells me a lot more than a plot synopsis. I’d actually rather know nothing about the film itself in advance.

Winter is mercilessly arriving in Mexico City. This is the third day we get an average temperature of 10 Celsius (although the first day it happens with a nice, unclouded sky, as Winter is usually offered here). People wear jackets everywhere, and every conversation starts with mention of the cold weather. Of course, remember very few people have any kind of heating here, as the lowest we ever get is close to the freezing point.
In general lines, I enjoy our winter. However, something happened today that made me have apocalyptic visions: Automatic, synthetic and terrible Christmas music. Yes, somebody brought to the office musical Christmas decorations. I have two choices: Listen to my music loud enough to bother other people (and drown the Christmas chimes) or just go nuts. Well, three choices. If they don't stop it, I might just short-circuit it so it goes to hell forever.

Introduction: This guide will walk you through the creation of an encrypted filesystem using LUKS. LUKS is the Linux Unified Key Setup and is a standard format for linux hard disk encryption. It has a lot of interesting features such as using a key on a removable disk, keeping multiple keys, and more. This is the technology used by the Debian Installer (since etch beta3) and is quickly becoming a standard in the linux world. Who this guide is for: This guide is for anyone who wants to secure their data using an encrypted partition. While it is tailored to users of Debian, it should apply elsewhere in the linux world. This guide is intended to add an encrypted device to an existing install, if you are contemplating a fresh install, the Debian Installer will configure encrypted filesystems for you. Ready? Then let’s begin Prepare the partition (or other block device) to be used This can be a partition on disk, a logical volume in LVM or some other block device. For this example, I created a 40 GB volume in LVM.

• For a physical partition, you would need to have an entire partition available on disk. Instructions for this can be found from many other sources
• For LVM, create a partition like this
  lvcreate -n crypto_test --size 40g asimov-vol

Install cryptsetup This utility provides an interface into the code in the linux kernel that handles encrypted block devices. It’s packaged for Debian in both testing and unstable, stable has an older version and I don’t know whether or not it will work in the same manner.
apt-get install cryptsetup Set up encryption on the partition: This initializes the partition for encryption and sets the initial key. People not using LVM will want a path like /dev/hdxY where hdxY is the partition on their hard drive that will be used for encryption. Important! This command will wipe out anything on that partition

cryptsetup luksFormat /dev/mapper/asimov--vol-crypto_test
WARNING!
========
This will overwrite data on /dev/mapper/asimov–vol-crypto_test irrevocably. Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.

Congratulation! You now have an encrypted block device! However, it’s not quite ready to use. Open and map the device: This opens the device (prompting for a passphrase) and maps it to a block device in /dev/mapper. This can be used like any other block device, and the encryption/decryption is transparent. The first path (/dev/mapper/asimov–vol-crypto_test) is the encrypted partition you set up earlier. The name (crypto_test) is the name of the volume, the block device will be mapped as /dev/mapper/<name>.

cryptsetup luksOpen /dev/mapper/asimov--vol-crypto_test crypto_test
Enter LUKS passphrase:
key slot 0 unlocked.
Command successful.

Create the filesystem of your choice on the device: This is just like setting up any other block device. I use ext3, others may prefer different formats.
mkfs.ext3 /dev/mapper/crypto-test Add the definition to /etc/crypttab: /etc/crypttab is a list of encrypted devices that are mapped on boot. The format is <map name> <path to device> <key file> <options> Since we’re using a passphrase, we don’t have a key file.
crypto_test /dev/mapper/asimov--vol-crypto_test none luks Create a mount point: This is where the encrypted device will be mounted on your filesystem.
mkdir /mnt/crypto_test Add the device to /etc/fstab: /etc/fstab tells the computer where to mount different devices on the filesystem. The format is
<source path> <mount path> <type of filesystem> <options> <mount options options> <dump frequency> <fsck pass> More information can be found by reading man 5 fstab. You will want to add a line like this: /dev/mapper/crypto_test /mnt/crypto_test ext3 defaults 0 2 somewhere in this file. Update the initial ramdisk. The initial ramdisk is used to jumpstart the boot process and load modules for the kernel that it can’t load itself (such as drivers for block devices that contain the modules it uses). I’m not sure if this is needed or not, but I wanted to be on the safe side.
update-initramfs -u -k all Congratulations Now your encrypted filesystem is completely set up! Reboot the system and you will see it prompt you for your passphrase during the boot cycle. Once the password has entered, the encryption is completely transparent. If you want to use your encrypted filesystem before rebooting, simply type mount /path/to/mountpoint.

There has been a lot of interest recently in the VFX VoIP service launched by WorldXchange (WXC), no doubt partly driven by the fact that there is no monthly charge until April 2007. I had a spare Linksys PAP2T so I thought I would try the service out to see how it performed. The signup process didn’t go anywhere near as smoothly as it did when I signed up for my WXC DSL connection. The online signup form tried to force me to select a new WXC DSL Plan (I don’t want to do that, I want to keep my old plan with free National traffic). Despite trying several times and making sure that the only checkbox ticked was VFX each time, it refused to let me go any further. Giving up on the web form, I rang the WXC helpdesk who answered promptly. It is easy to see why WXC won the 2006 award for best call centre. Every time I deal with them over the phone it is a pleasant experience. This time was no exception. The CSR I was talking to explained that the webform was dying because I tried to use a VFX username that differed from my WXC DSL username. There was no mention of this restriction on the website! Anyway, 15 minutes later, with my MAC address taken down and my voice recording completed, I was told we were all done and that I would receive my welcome email and account details with 2 working days! 24 hours later I received the email with the details, followed promptly by a phone call from WXC CSR who was ready to talk me through the process of setting up my PAP2. Configuring the PAP2 was a simple procedure, I had to copy and paste a URL into the Provisioning Rule field of the web interface and reboot the device. It then downloads configuration information directly from WXC (based off the device MAC adddress) and configures itself. I was up and running with dial-tone about 2 minutes after receiving the email. Very smooth. I understand that the process is even easier if you purchase a pre-configured PAP2. The downside to the whole scheme is that in trying to make the process as simple as possible WXC has locked the entire system down very tightly and remove a lot of the flexibility that I would desire. In particular my PAP is now completely locked, I can’t access any of the web interfaces, and even the dial-in prompt on the PAP2 replies with a curt “cancelled” before hanging up. There is no way for me to configure the second line of the device to talk to a second SIP provider. Apparently WXC will create a custom configuration for me so that I can still use the second line, but I imagine this requires giving them all my account details for my second SIP provider, which I’m not sure I’m comfortable doing. It also appears that WXC has an arrangement with Linksys such that every PAP2 now sold in New Zealand comes pre-configured to be used with WXC. I haven’t had a chance to look at one of these PAP2s yet, but if it were to turn out that I had to contact WXC to remove the locking on my PAP2 before I was able to use it with another VoIP provider I would be fairly annoyed. The MyVFX portal is very underwhelming. It insists on opening itself in a new browser window, and isn’t integrated with the rest of the WXC/VFX website. From what I can make out it’s just a branded frontend on to the management system that WXC has purchased. The user interface is reminiscent of the design of the 1990s. I think there is a lot of potential for WXC to improve the experience in this area and I doubt that the average user would be comfortable updating settings via MyVFX in its present state. On the technical side of things the VFX service seems to be fairly well designed and secured. The devices are provisioned and configured using the Linksys/Sipura provisioning tools, which appear to encrypt all conversations with the device. The setup process downloaded two configuration files and a firmware file (v 3.1.10) to my PAP2. Both of the configuration files were binary and appear to be encrypted. Interestingly it appears that WXC downgraded the firmware from 5.1.1 to 3.1.1 during the provisioning process. The MyVFX portal and SIP server appear to be using some sort of BroadWorks device. The device fetches it’s configuration file from the WXC server every time it is powered on, so it will be easy for WXC to push out updates and configuration changes as they desire. The VoIP side of things is performed using SIP, which appears to be using standard HTTP Digest authentication. The username and passsword for this being hidden inside the encrypted configuration files which are downloaded to the device. The voice data uses the G.729 codec inside an RTP stream, and from a few short calls seems to be relatively good quality. Conclusion
Overall, VFX seems like a very easy to use and simple service. Simple being the keyword. By locking down the devices so securely and preventing people from using softphones and devices other than Linksys equipment I imagine many people like myself are excluded from the potential market. I can’t see myself keeping the service after I have to start paying money for it. But I would definitely recommend it to friends and family who are looking for a simple, easy to use VoIP system.

As announced in August, HP has now gone live with support for ProLiant. More information is available at http://hp.com/go/debian. Admittedly its odd to announce sarge support right before etch releases, but hey - we had to start somewhere. On a similar topic, I started a wiki a while ago to track the status of sarge and etch on various ProLiant models. I think it'd be cool to have similar pages for various vendors. By linking to d-i installation reports, I hope this will reduce duplicate information.

This morning I came across Michael Berube’s response to Jodi Dean’s critique of Berube’s book What’s Liberal about the Liberal Arts?: Classroom Politics and Bias in Higher Education… It is a fascinating interchange worthy of a close read or two but without first-hand knowledge of the book, I hesitate to pledge my allegiance on either side. But I will hopefully to do so. The only thing that surprised me was that there was no mention of the grand master of the critique of liberalism, Stanely Fish… Not sure why but he seems like an obvious place to start. These ppst happened to really captured my attention this morening given I found them after reading the Chronicle of Higher Education piece Input or Intrusion? which examines the recent attacks against scholars deemed as “anti-Israel/pro-Palestine,” including against Nadia Abu El-Haj who happened to be on my dissertation committee… It will be very interesting to see how this all pans out and I am sure many of us are watching closely. And as an added bonus, here is a student’s thoughtful perspective on the Berube book.

(No, this is not security related. Some people call screensavers hacks . But I did get your attention, didn t I?) Whenever I happen to run gucharmap, I like to just browse and have a look at all those weird characters other people, especially asian, are using: A lot of them look really cool. So I thought: This would be a great screensaver.After some API digging I created that screensaver. It uses fontconfig to open the FreeSans and the DejaVu Sans fonts, selects a random glyph from these and display s it full screen. Below, the unicode code point and characer name are printed. After a few seconds, the next character is displayed nothing else, nothing hectic, quite relaxing.When you download the code, you will find a file uncode.c , which is the hack itself, a file unicode-names.h , which is taken from gucharmap and only slightly modified, as well as a buch of files from the xscreensaver distribution. To re-compile the binary, use the script compile , which runs gcc with flags I stole from the xscreensaver Makefile. I know this build system is everything but correct or sensible, but it works for me...Unfortunately I don t think it can be included in xscreensaver, as it depends on libfontconfig. If someone would rewrite it using only libX11, this might be possible, so if you like it, feel free to steal the idea.

This is the first of my two formal reports to the Dunc-Tank board on the release management funding experiment. Although submitted to the board some time earlier, I've delayed publishing it to the wider community until a release update could be sent out with more concrete information on timeline adjustments as Debian developers are wont to demand.

---

I'm supposing that I don't need to give you any more specific details on what I've been working on than what's already been posted in my blog. There has certainly been plenty to keep me busy the past three weeks, including a lot of triage work on the state of bug reports in the BTS, managing the last of the major package transitions into testing for etch, removing packages and NMUing them, and it has indeed kept me busy. Busy enough that I've been lax when it comes to talking about it, either here or in my blog. :) Has the hard work paid off? Well, http://bugs.debian.org/release-critical/ shows a sharp decline in release critical bugs affecting testing over the same time period, following the peak resulting from Dunc Bank's successful campaign of identifying latent release-critical bugs in etch. Unfortunately, we have no statistics that track the number of RC bugs closed or opened over time, which makes it hard to judge how large of a dent my own work has made in the overall bug count. It's also totally guesswork to try to judge whether Dunc-Tank has encouraged others to help with the release overall, or discouraged them from doing so. What I can say is that, even though the past month coincides both with the tail-end of the Dunc Bank mass bug filings and multiple archive-wide rebuild efforts, the bug count is moving in the right direction, and I am seeing many maintainers being responsive to bugs in their packages and a number of active NMUers. If not for the buzz-kill of Lucas Nussbaum's latest round of build failure reports :), we would be down from over 300 RC bugs to less than 200 right now, which probably represents at least twice that many RC bugs closed. In terms of how the time I'm putting into this release compares with the sarge release, I'd say it's pretty comparable. That's actually quite a positive statement about Dunc Tank's role, IMHO; getting a Debian release out is uphill all the way, and whereas the sarge release came at a time when I was in a position to work more or less full time on it without compensation, my availability this time around would have been greatly reduced, and progress would have been much more heavily dependent on individual maintainers and semi-periodic bugsquashing parties, which I'm not sure is any longer enough to offset the rate at which new RC bugs are created in the distribution by uploaders. As it stands, I do find myself trying to consciously avoid a hero complex of needing to fix every bug personally, but there are after all only so many options for getting bugs fixed for release. A lot of maintainers respond positively to gentle nudging about their RC bugs, but there are still bugs that the maintainers can't or don't fix and that no NMUers take on, which does leave it more or less up to the release managers to address -- which is why one of my tasks for this week is to try get the count of RC bugs over 20 days old down from 90 to around 20-30, as these are the bugs that really do need more attention to get them resolved. So yes, Dunc-Tank is making a positive difference. Andi and I have reviewed the status, and while we don't think we'll be able to hit the Dec 4 deadline (even if we get the bug count down immediately we're waiting on the debian-installer to release, which needs at least one more release candidate with the 2.6.18 kernel), we do believe that a release before the end of the year is very possible and I'm looking forward to starting the full freeze in the next few weeks.

Robert Collins writes: "Added to my list of 'things we need'... a version of icheck that requires less configuration to hook into package builds. Ideally one that we can get running automatically on any package build." There's only so much you can do without having debug information from both versions, which of course we don't keep at present. However, Steve Langasek implemented some basic checks on exported symbols in the unixodbc package which you can find in its debian directory. I'm slowly starting to work on a more comprehensive ABI checker that would use debug information. This would require someone to keep or rebuild debug information from the previous version (and to delay stripping it from the new version) so I don't think it could be automatic.

Monday morning started with setting up two more graphical stats about the number of Release Critical bugs. They contain how many RC bugs affect etch currently, how many affect only etch (i.e. usually untransitioned fixes), how many affect both suites, and how many affect both suites after 20 days. Both graphs are available for the last 3 weeks and 3 months, respectively at http://bts.turmzimmer.net/graph-small.png and http://bts.turmzimmer.net/graph-large.png. As you can see with the large graph, we did some important progress. As the small graphs show, we should try to get better again. :) So, let's work together on that, and let all three curves go down again. After that was done, some normal RC bug squashing started - nothing special about, just "another few bugs gone".

Well, I finally got around to doing it -- I signed up for an i-name on 2idi. i-names are a universal identification format for the Internet -- kind of like OpenID, but a lot more centralized and a lot more authoritative. My i-name, for example, is =evan.prodromou -- a brief little string that doesn't really say that much. But you can make it an URI with an "xri:" prefix, and it can be resolved at http://xri.net/=evan.prodromou is the canonical link to my blog, and =evan.prodromou/(+work) is the canonical link to my work. I can change the forwarding when I change blogs (or work, or whatever). It's a neat system, and I guess it's pretty complimentary with OpenID. OpenID 2.0 will support i-names for login, although I'm not sure how well it works. I'm going to be upgrading Wikitravel to use the new OpenID libraries soon, so it'll be i-names capable... and I'll need a testing account, of course. tags: i-names openid identity

ikiwiki supports OpenID Ikiwiki is a wiki/blog/CMS engine by the unstoppable hacker Joey Hess. He just announced that he's made an OpenID plugin for ikiwiki. I think that's pretty cool. tags: ikiwiki joey hess openid plugin

Added to my list of 'things we need'... a version of icheck that requires less configuration to hook into package builds. Ideally one that we can get running automatically on any package build. Yes, its sci-fi, but avoiding ABI breaks across all libraries would be fantastic.

Debian Jr. development revived Recently there has been some lively discussion on the Debian Jr. list about how to arrange an account for a child of 1 to 3 years of age. Suggestions included using set-top box software like Freevo, tailoring DEs with panels and large buttons, using simpler WMs like fvwm, or using an “activity centre” app like Gcompris. Now, I respect those parents who hold that a child this young should interact more with the “real world”. While I wouldn’t go so far as to outright prohibit my young ones from computer use, I can see the wisdom in keeping it to a minimum. But, for better or worse, our family is one of several who have some experience helping our youngest members use our Debian systems. We would like to share what we’ve learned through the Debian Jr. project. Getting started with live.debian.net To that end, last week I was inspired to follow the Debian Live ISO Howto to produce my first rough draft of a Debian Jr. live CD built from scratch on Etch. For the final product, we’ll want to use a local partial Debian archive mirror, as it not only optimizes fetching packages for several build iterations, but also can be kept stable, which is important as we near release. But for this draft, I ran into trouble building the complete package list to populate the partial mirror, as cdebootstrap, which make-live uses, has no handy --print-debs switch like debootstrap does. So for now, I rely on approx to cache packages for optimization only. A straightforward process to create a working live CD The rest of the process was straightforward: using live-package, I created a package list¹ containing Gnome and the Debian Jr. metapackages, I configured /etc/make-live.conf to point at my proxy, and then I ran the make-live script on the package list. The end result was ./debian-live/binary.iso, which successfully booted under qemu. At this stage, there is not much to show. To be truly useful, the live CD needs to be set up so that children and their guides can immediately find and use the material intended for them. We will need not only one live CD user, but four, varying in age range and role. (More about this in a future article.) However, it is an encouraging start, and shows that we may be able to produce something usable by the time Etch releases.

¹ For this exercise, I simply combined /usr/share/make-live/lists/gnome with the junior-* metapackages in Etch, and added mozilla-firefox-gnome-support to satisfy Gnome’s web browser dependency and cut down on redundancy, resulting in the following list.

junior-art
junior-doc
junior-games-card
junior-games-gl
junior-games-net
junior-games-sim
junior-games-text
junior-gnome
junior-internet
junior-kde
junior-math
junior-programming
junior-puzzle
junior-sound
junior-system
junior-toys
junior-typing
junior-writing
mozilla-firefox-gnome-support
eject sudo
console-common locales
gdm gdm-themes gnome-desktop-environment gnome-cups-manager gnome-screensaver
gnome-themes-extras
rhythmbox synaptic
x-window-system-core

This weekend my boss installed Debian Etch on his notebook and was very happy, he gave it to me because he couldn’t get ipw3945 run. Ok, it was really not as simple as I thought because I had to pick up some packages from unstable, but finally everything worked fine. Thanks to all the people who worked on this! Hmm, then I had a second idea of what I could try, we have a very proprietary network with Cisco Accesspoints which authenticate against an ActiveDirectory. Ok, after some miuntes (with an almost empty configuration) my wpa_supplicant daemon worked, so I tried out wpa_gui and kwlan to configure it. Configured… But it didn’t work and I didn’t get any useful messages about what’s going wrong. Has anyone experience with this wpa_supplicant in a proprietary Cisco network using LEAP? I would be really happy about configuration files, because on the internet I can’t find useful ones.

In two weeks (Dec 3rd) there will be presidential elections in Venezuela. This will be the third time where Hugo Chavez, the current President, will be participating in the elections. The first time, in 1998, he won by 62%, then dropped to 59% in 2000 and currently some polls are giving him between 50 and 60 percent of vote intention. Since 1998, we’ve got a very active electoral movement and controversial situations which have raised very diverse opinions about our electoral system. If I recall correctly, in 1998 people voted using optic forms. In that moment, spanish Indra was the company in charge for the machines and most of the technology used in the elections. That was the time where the Supreme Electoral Council depended on the Executive power, i.e., the President. In 1999, Chavez proposed to rewrite the Constitution, and the National Electoral Council became an independent power. This Constitution was approved in two referenda in 1999, where touchscreen machines were used. In 2000, after the new Constitution was approved, new presidential elections were made. The same touchscreen machines were used and we made a transition between Indra and a multinational holding named Smartmatic. In 2004, after two millions and a half of signatures were gathered to recall Chavez presidency, the revocatory referendum was made, using the Smartmatic machines. Almost six million people voted to maintain Chavez in power. Of course, after eight years of the same party in the power, as well as other problems (namely a national strike and a Coup d’Etat in 2002), several ideas arised regarding the legitimacy of the election process.
Today, the National Electoral Council released a flyer in the press, where they try to issue these topics. I must recognize that, being a newbie voter, I was unaware of several of the things they published today. For example, 8 of every 10 venezuelans over 18 are signed for voting in the elections. That’s one of the higher percentages of public awareness about elections in Latin America, higher than, for example, Colombia. That means 16 million people are able to vote, and we’re used to get around 60 percent of participation. We do vote with touchscreen machines, and the results are completely computerized. The military guards all the equipment, and provides security to the randomly elected civilian which work as temporary personnel. Members of every involved party are present in all the election centers, as well as national and international observers. After you’re checked to vote, you have to give your fingerprint in a special biometric device. This is transmitted live, were possible, avoiding two people voting in the same day. After you vote, your finger is marked with silver nitrate, which goes away after two days or so. Of course, you’re only allowed to vote if you don’t have the mark in your fingers. The touchscreen machines prints a paper which you put into the traditional box. After the voting has concluded, more than half of the boxes will be opened and checked against the information in the machine. The boxes subject to this check are randomly selected, as well. A brief thought about the software used in the machines. In 2004 or so, we (the Free Software Community in Venezuela) struggled and made pressure to the National Electoral Council to reveal the code and publish it wide open. This has been achieved until some point, since every interested person or organization is allowed to take a peek at the code. Dozens of organizations have already done so and are impressed by the features that are now present in the code. Before the first vote is registered, the machine prints a zero-vote confirmation, and then subsequently randomizes the order of the votes registered in memory. Only after all the election centers are closed, the machines start transmitting information. This year, three hours past the closing time we’ll have the results. The final and most important, from my point of view, argument held to support our election system is the random queue organization at the election centres. The registry is sorted by ID number, the votes are randomly stored in the memory and the biometric device is used in a per-arrival basis. Therefore, since nobody takes the same time to vote, the queues will be unarranged therefore making it quite difficult to determine a possible vote sequence. This has been certified lately by the European Union, the Organization of American States and other organizations. Whoever wins this election, I’m quite confident about our election system. I just hope that other institutions in our Country start using reliable systems (for example, the national ID office) in order to give at least the feeling of being in a rightful State.

I've been playing with Google for your Domain over the past couple of weeks for Angie and my's email. A few observations so far:

1) Still a bit worried that Google now has a pile of my data. I don't know that there's a way to resolve this. I'm wondering if there's a way of doing GPG overlays onto gmail? For the most part I don't really care, but it would be nice to preserve the option of doing a local decryption.

2) It's nice to use my email address for my Jabber account finally. No more having to remember to check the gmail account from time to time to see if someone decided sending an email there would be a good idea. I should probably do the same with my hotmail account.

3) Google talk and Orkut don't play along with GfyD.

4) Google's incremental improvements are cool. In the past week they added customised start pages, which means that I can see my mail and calendar from a start page. The start page isn't as fully featured as the original start page (historical searches, various customer applets, etc. don't work), but looks alot like it did awhile ago.

5) gmail doesn't have a way of filtering on mailing lists. This annoyed me at first, but now is more of a reminder that I should unsubscribe from lists that I don't actually read anyway. The volume on the rest is low enough that I can continue to filter by hand.

Update: It seems that gmail *can* filter on mailing lists, it's just not documented. I've just setup a filter for listid:bug-gnulist.gnu.org and it seems to work. Use it in the "Has the words" section of the filter. Bug #83778177 filed with gmail for an update to http://mail.google.com/support/bin/answer.py?answer=7190

As the hard-disk of my PC exhibited its first hard error after months of strange noises I was forced to replace it. This machine dual-boots WinXP (on NTFS) and Debian, Windows' boot manager invokes grub and I absolutely did not want to re-install either Windows or Debian or try to figure how to resurrect a broken WinXP bootmanager. So I used the the dd-method again:

1. Plugin new disk as hdc
2. dd_rescue -b 512k -A /dev/hda /dev/hdc (I had to use -b 1 for copying the almost broken sectors.)
3. Either re-partion or simply add more partitions at the end. (The new disk is always bigger.) Don't touch the first partition, which is NTFS and take care that the partion containing /boot gets the same partition number/position. - This way grub will grub will continue to work. Use cp -ax to acually copy the data to the new partitions. (cp is dog slow for copying directories containing many files, like ~/mail or ~/.ccache. - Two tar instances talking to each other over a pipe would probably be a lot faster but I cannot remember the 42 options needed to replicate cp -ax behavior.)
4. Power off, switch disks, power on.
5. Verify that your data is still there and clean the old disk, using shred(1) and openssl rand -rand /dev/urandom -out /dev/hdc1 somereallybignumber.

The process would be smoother if I knew of a sane way of copying NTFS (preserving ACLs) and could be bothered to actually remember how I setup grub in the first place. ;-)

Sound Juicer "Wish I Could Stop You From Talking" 2.16.2 is out. Tarballs are available on burtonini.com, or from the GNOME FTP servers. Loads of fixes!

• "None" directory path shouldn't create blank directory name (#374831, Adam Petaccia)
• Don't disable re-read when playing (#347218, Stephen Cook)
• Update bacon volume (#369490)
• Set a11y relationships (Robin Sonefore, #364386)
• Fix prefs dialog spacing (#332561, Christian Persch)
• Fix dates with 0s in (#364976, Alex Lancaster).
• Replace spaces with underscores in path_patterns and file_patterns when "Strip special characters" is selected (#357111, Luca Cavalli).
• Port to automake 1.9, update desktop file for new Bug Buddy (#357682, Christian Persch)
• Reset the extract speed on every track just in case (#343544).
• Initialise the authentication manager (#356578)
• Show error messages when the pipeline doesn't link (Tim-Philipp Muller, #361151)
• Add 32x32 icon

I'm reporting to you live from Stockhom, where the Northwestern European Programming Contest has started. Our teams (some even have their own website) have yet refrained from beating every other team but are trying hard. As expected, team Messed Up from Twente is taking the lead, even though their key contestant just flew in this morning from San Diego... There's a live scoreboard available for those at home, and maybe just as interesting, a live video stream. The guys here at KTH are doing a good job in organising, even though it was mostly a copy of last year, up to exactly the same lunch and same dinner. We (Jan, Jaap and I) have been participating in the organisation so we'll be prepared for some of the caveats when the contest is coming to Utrecht next year.