While anyone who has had a 1) medical condition and 2) access to Internet in the last five years probably knows that patients are increasingly using the net (and now google) to diagnose medical conditions, it is only now that the medial establishment is starting to recognize or really admit to the reality of this widespread phenomenon and even doing studies on them, such as the one released a few days ago by the BJP Googling for a diagnosis use of Google as a diagnostic aid: internet
based study. The study sought to ascertain how effective google was as an aid in medical diagnosis. As various new outfits are reporting it is moderately high. What I love about this study and the corollary reporting is the naive tone they have to assume, transmitting the news as if the public knew very little about this, and would in fact, be induced into surprise!!!!!!!!!! when first facing the new. But in fact, I think it works in the opposite way. The surprise is that they took so long to admit to what was in front of us for many years now. While the news articles reporting on the study stay within the province of doctors, the report acknowledges, in fact opens with, the fact that patients may be forging the path in Internet-diagnosis. The authors write in their second paragraph:

It seems that patients use Google to diagnose their own medical disorders too. After evaluating a 16 year old water polo player who presented with acute subclavain vein thrombosis, one of us (HT) started to explain that the cuase of the thrombosis was uncertain when the patients father blurted out But of course, he has paget-von Schrotter symdnome. Having previously googled the symptoms, he gave us a mini-tutorial.. and the correct treatment for the syndrome. This experience led us to ask How googe is google in helping doctors to reach the right diagnosis

Again, what I love about the tone of this opening is that it is as if these doctors stumbled on a great but deeply hidden fact to make a breath-taking discovery, one that, however, since is it is SO very emergent and thus still not *really* verified by Science, they must proceed with great caution, qualifying with phrasees like It seems that patients use Google to diagnose their own medical disorders too . I am sure they and most doctors are personally are not so na ve but since this has been something virtually without no official acknowledgment among professionals and in the journals, the genre of writing just requires it to be framed cautiously. As fun to read are the comments, for they stretch from moral panic:

The implication that ‘googling’ be an adjunct to proper medical school training, continuing medical education through courses and reading peer reviewed journals is laughable and bordering on dangerous. I am shocked that this has been published by the BMJ.

to celebration:

For the modern dermatologist, the internet is indispensible and google is only the start, and for this reason a desktop computer with high speed internet access is an essential tool for all clinicians. Long live the information superhighway!

While others muse on the broader emacipatory possibilities

One can imagine the benefit to young doctor in developing country who now have access to a grand medical library in their hands.

I am especially interested in this very dynamic because it is one pillar propping my next project on psychiatric survivors, which exceeds the particular topic of challenges to psychiatry in its general focus on medical/patient reconfigurations following from Intent-based activism, self-help, diagnosis, and critique. And for those who think I have made a radical departure from my last project, here is where I see one (of two or three) threads of continuity: for patients are generating an enormous amount of amateur knowledge, that I think is not unlike the peer-to-peer production of software hacking, and it is a form labor usually accompanied by a strong critique of expertise and other medical practices. I am now reading some literature on patient activism, like the issue from the February 2006 in Social Science and Medicine that collects 11 articles on patient organization movements. For those who work on this topic, the collection is worth your while and the editorial introduction by Kyra Landzelius is stellar. It is not only written beautifully (which I think is rare for these openings because it is often a rote, unimaginative regurgitation but this was a pleasure to read) but provides an engrossing overview of some new trends and some of the diverging forms of politics that arise from what is really a motley bunch of organizations and contests in patient and anti-patient activsm. She opens by defining four spheres that shape and inform the forms of contents that are part and parcel of these patient movements, the four being: 1. Revolutionary feats in technoscientific engineering
2. Restructuring of healthcare systems across industrialized nations
3. A Revised contract between science and the public stemming from a criss of confidence in science
4. An upsurge in the articulation and diversification of health activisms (p. 530) These four are key but I was shocked that there was no specific inclusion—though it comes out plenty in the introduction in other ways of the Internet. For while I am no techno-determinist, the Internet I think, can’t be ignored for it has fundamentally changed the map and tenor of patient activism, allowing for more rapid connections between various stakeholders, providing a medium by which those officially unrecognized illnesses are given shape and form, and where an ethical cultivation of self-help, self-diagnosis, self-medication, along with copious critique and forging of alternatives is happening, right before our eyes, virtually in real time. It is the medium by which a new chapter of patient activism is being written and I think it is a real mistake not to give it serious attention and credit. And perhaps one of the most interesting things about it is that it without it, it would leave many otherwise home-bound, sick folks, without a medium by which to engage in political activity or even community self-help, for let’s face it, these take a lot time and energy. When you are sick and home-bound, for example, there may be a limited number of types of engagements you literally have the energy to partiicpate in and the Internet lowers the barrier of political entry because of its ease and because you can still type away, even when feeling otherwise totally awful… This may be a brute material point but nonetheless, key to understanding the political power of the Internet. Now of course the question left is will Google capitalize on this and create “Google Diagnosis”?

The last time I made any serious contributions to Wikipedia was back in 2001 or 2002. The community was exciting, friendly, and welcoming, and I enjoyed spreading the word as most non-technical people I knew had never heard of wikis or Wikipedia. Since then, I may have corrected the occasional typo or fixed a legal error, sometimes anonymously and sometimes under my account (apparently I “clarified the 13(c) protective arrangement issue” in the Urban Mass Transportation Act of 1970 back in the Fall of 2003, although I have no recollection of having done so), but I hadn’t started any new entries since the early days. At a recent presentation I attended by Sun’s Hal Stern, I learned that his eating club (Colonial Club) at Princeton University has a Wikipedia entry (as do all the other eating clubs). On further investigation, I learned there were no entries for any of the student cooperatives or other upperclassman eating options. To the uninitiated, it may be hard to understand why this matters beyond the insular Princeton community, but — suspend your disbelief just for a moment — the eating clubs have been called Princeton’s “peculiar institution” (a side-long reference to slavery) and have a storied and controversial history going back at least to the 1870’s (see, for example, this summary of the historical record from 1888-1993). It seemed to me that omitting the student cooperatives was akin to having a Wikipedia article on political parties that includes links to both the Republican and Democratic parties but leaves out any mention of the Green Party. Of course, the Green Party doesn’t wield the influence of either of the main parties, but its existence provides insight both into the American political system and the character of the two main parties. If no mention of the Green Party were included in Wikipedia, a foreign researcher attempting to learn about the American party system would come away with an incomplete and misleading understanding. The fact that the Green Party has not been particularly successful nationwide is, itself, interesting, useful, and relevant information. Although I wouldn’t pretend Princeton is as important or interesting as the American political system, it’s still a subject of scholarly investigation, and a topic that a fairly significant number of people are interested in learning about. I thought I would start basically a stub article for the Two Dickinson Street Co-op and spend a couple of days building it out and asking knowledgeable experts to contribute and add sources. Within a few seconds after I created the article, however, it was “speedily” deleted. A bit surprised, I tried to start an explanation as to why the entry warranted at least consideration for inclusion, and the article was deleted again and I found this message on my “talk” page:

This is your last warning.
The next time you vandalize a page, you will be blocked from editing Wikipedia. Diez2 14:55, 9 November 2006 (UTC)

I had gone from citizen to felon in two minutes flat! There then ensued several attempts to at least allow a debate on the deletion, but the article was unilaterally speedily deleted several times by several different editors. Even after one admin restored the article as not appropriate for “speedy deletion,” another admin stepped in and speedily deleted it again. I received some fairly acerbic retorts to my attempts — e.g. this: “We don’t have a page for every club in the world. If you want free web-hosting check out Myspace or usenet. Also anonymous postings do not make a topic notable or important.” (I’m not sure why he accused me of posting anonymously — I didn’t. Also, does “usenet” offer “free web-hosting?”) Finally, the deletion of the article was converted from a “speedy deletion” to a nomination as an “article for deletion” (‘AfD’), which allows at least for some discussion on the topic. The debate is ongoing — see it here — and some of the comments continue to be fairly corrosive. For example, one editor wrote:

• Strong Delete Fails WP:N, WP:V. It should be noted that on User_talk:Eagle_101 the editor of the article hs refused to give even just one reliable source of the article to assert it’s verifiability and notability. That alone should speak volumes for the article’s worth. Wizardry Dragon ^{(Talk to Me) ((My Contributions) (Page Moves) (Support Neutrality on Wikipedia)} 23:01, 10 November 2006 (UTC)

Another editor called the debate a “pointless waste of time” over a “vanity article,” although I can’t find that comment any longer. I admit that I created the article without knowing much about the process, and certainly with little understanding of the numerous acronyms, flags, and the several different ways an article can be killed. Apparently, I didn’t contest the speedy deletion properly, although it wasn’t clear to me from the deletion notice exactly what I was supposed to do, and I assumed the restoration of the article by another admin meant that it would persist for at least a few days. I thus deserve some of the blame for not doing more pre-posting diligence, but I was relying for the most part on my 2001-2002 experience where you could create an article, spend a few days improving it, invite others to contribute, etc., and articles with a colorable argument for inclusion would generally stay in. It seems the new Wikipedia is a much less kind and less gentle Wikipedia. As another participant in the process wrote to me:

This whole situation is so strange. It makes me feel like I just stumbled into somebody else’s trench warfare. The defenders of notability! I wonder how long the constant vigilance of volunteers will hold out…

Of course, a similar phenomenon has occured with many open source projects. Initially, the doors are wide open and everyone’s contributions are, if not welcome, then at least tolerated. I suppose it is a sign of Wikipedia’s success that the front gates are locked so tightly. Still, I wonder how many potential good faith contributors are now permanently alienated by an initial bad experience such as this one, and whether Wikipedia will ultimately suffer from it. Low barriers to entry have traditionally been a key element to attracting participants to peer production efforts, but they seem to break down in direct relationship to the project’s external importance. Incidentally, Stern’s edit to the Colonial Club entry, mentioning F. Scott FitzGerald’s characterization of the club, was quickly reverted by another editor as “nonsense.”

A while back, my brother's computer had issues. It would dump core of random programs, and would produce a BSOD under Windows at random times, too. Running memtest86 showed that something was wrong with the memory, so we replaced it. Unfortunately, that didn't help; so the conclusion I made was that there was something wrong with something between the processor and the RAM—the cache (L1 or L2), some data or address line degrading, or perhaps even the memory controller. In any way, that didn't matter; what mattered is fixing the issue. So we replaced the mainboard and the processor with something newer. He's now got a pretty modern mainboard, with all the interesting bits and pieces found in such a thing, and a Dual Core Pentium4 at 3.4Ghz. Occasionally, I must say that the socket 775 is pretty... weird. But I digress. Upon installing everything, I found that trying to run the system with broken memory had managed to corrupt whatever was on the hard disk; his ReiserFS superblock thought the filesystem was some incredible amount larger than it really was, and Windows would turn up a BSOD before even booting. The first was pretty easy to fix; I hit 'e' in the grub menu, added init=/bin/bash to the end of the kernel command line, and instructed some tool from the reiserfs toolkit to fix the filesystem. After that finished, and after a subsequent exec /sbin/init finished, Debian was up and running again. That took all of a few minutes. Having booted it, I proceeded to install the security updates that had accumulated for Sarge since the time his system had started to break down (which is a few months). Then I realized that I had to reconfigure the system to understand the new mainboard. Only that had already happened. Hotplug, discover, and perhaps some friends, had all done their work and there was nothing to be done anymore. Isn't that nice. The same couldn't be said for Windows. Booting from the install medium and choosing "recovery" in the install menu didn't fix things. Even reinstalling the system without formatting the hard drive didn't get us any further. The only thing we could do was to wipe the drive clean and reinstall. Windows better hardware support? My ass.

I am very passionate about open source (or free software, or whatever you want to call it) software. In one way or the other, it seems I'm always drawn back to it, whatever else I'm supposed to be working on. I get a good feeling from the community aspects of it, believe in the potential for technological benefits, and appreciate that being open is often the best way to advance the state of the art. One thing that has always been something of a mystery though, is how the whole thing works in economic terms. There is no doubt in my mind that open source works in terms of creating value, but what isn't so simple is how it sustains itself, and where it makes sense. Some people, like Richard Stallman, sustain that all software should be free. Others take a more laissez faire attitude. Aside from philosophical debates, though, there is a very pragmatic question of how it works in practice, and if the process could be made more efficient, and in which cases should one simply decide to 'go proprietary' in terms of maximizing monetary returns. In the proprietary software world, this is all rather "simple" - (well, conceptually at least - it's not actually easy for anyone). If you write some software that you then sell, and people like it, they'll buy it, which in turn gives you money that you can funnel back into improving the product. If it stinks, you won't get any money, and presumably you'll move on to something you are more qualified for. It's a pretty simple and direct feedback loop. With free software though, it gets much more complex, because there is not necessarily an economic link between users and developers, which might mean that while the software provides very real economic benefits in terms of flexibility, avoiding vendor lock in, and low costs, none of those benefits necessarily flow to the person or people who actually wrote the software. This, in turn, means that they may have to support themselves in some other way and may not be able to dedicate much time to working on the code. This system is thus 'inefficient', because there is a disconnect between the value and the person who created it. A lot of thought has been dedicated to "solving" this problem, but it doesn't seem to have a satisfying answer just yet, although there are several free software companies that clearly do function, with a variety of models. One of the original ideas about how people would live in an entirely free software based economy, proposed by Stallman, is services. In other words, the software is free, but you get money to fix it, teach people about it, improve it, provide support for it, customize it and so on. While riding my bike around the Colli Euganei the other day, it occured to me that a pure services business is a lot like running. The minute you have fewer clients, go on vacation, or otherwise ease up... revenue drops proportionately, just as if you had slowed from a run to a walk. Ease off on the effort completely, and the money is gone, because you have no way of carrying your momentum forward. With a bicycle, on the other hand, it's more like a product-based business. It's certainly still an effort, and you have to be strong to beat your competitors, however, you can stop pedaling for a moment now and then, and you do get the descents after riding up the hills, and for a few meters at least, you can stop pedaling altogether and coast. What prompted me to think about products versus services was a small web application I developed recently. It's a nice ajaxy to-do list/time-tracker that I started developing with Ruby on Rails. My first instinct, and the easiest thing to do, of course, would be to open source it and let it go at that, but... I also wonder if I could make a little bit of money at it if I were to commercialize the product somehow. Not "get rich quick" money, but enough to pay me back for the time I sunk into making it work, and enough to let me justify doing more work on it to meet people's needs and requests. A couple of strategies come to mind:

• Just open source it and be done with it.
• Sell google adsense. I don't think that would cover it though, because it's a reasonably resource intensive system.
• Sell access to an advanced version that allows group collaboration, sharing/trading of tasks, and so on.
• Sell a downloadable version that people can run locally, perhaps on an intranet.

Whatever ends up happening with it, I'll be sure to post further information as it becomes available.

My post about securing an office received many comments, so many that I had to write another blog entry to respond to them and also add some other things I didn't think of before.

One suggestion was to use pam_usb to store passwords on a USB device. It sounds like it's worth considering, but really we need public key encryption. I don't want to have a USB device full of keys, I want a USB device that runs GPG and can decrypt data on demand - the data it decrypts could be a key to unlock an entire filesystem. One thing to note is that USB 2.0 has a bandwidth of 30MB/s while the IDE hard drive in my Thinkpad can sustain 38MB/s reads (at the start - it would be slower near the end). This means that I would approximately halve the throughput on large IOs by sending all the data to a USB device for encryption or decryption. Given that such bulk IO is rare this is feasible. There are a number of devices on the market that support public-key encryption, I would be surprised if any of them can deliver the performance required to encrypt all the data on a hard drive. But this will happen eventually.

Bill made a really good point about firewire. I had considered mentioning it in my post but refrained due to a lack of knowledge of the technology (it's something that I would disable on my own machines but in the past I couldn't recommend that others disable without more information). Could someone please describe precisely which 1394 (AKA Firewire) modules should be disabled for a secure system? If you don't need Firewire then it's probably best to just disable it entirely.

To enable encryption in Fedora Core 6 you need something like the following in /etc/crypttab:

home_crypt /dev/hdaX /path/to/key
swap /dev/hdaX /dev/random swap

Debian uses the same format for /etc/crypttab.

The Peregrine blog entry in response to my entry made some really good points. I wasn't aware of what SUSE had done as I haven't done much with SUSE in the past. I'm currently being paid to do some SUSE work so I will learn more about what SUSE offers, but given the SUSE/MS deal I'm unlikely to use it when I don't have to. Before anyone asks, I don't work for SUSE and given what they have just done I will have to reject any offer of employment that might come from them.

I had forgotten about rsh and telnet. Surely those protocols are dead now? I use telnet as a convenient TCP server test tool (netcat isn't installed on all machines) and never use rsh. But Lamont was correct to mention them as there may be some people still doing such things.

The Peregrine blog made an interesting point about Kerberised NFS being encrypted, I wasn't aware of this and I will have to investigate it. I haven't used Kerberos in the past because most networks I work on don't have a central list of accounts, and often there is no one trusted host.

I strongly disagree with the comment about iSCSI and AoE "Neither protocol provides security mechanisms, which is a good thing. If they did, the additional overhead would affect their performance". Lack of security mechanisms allows replay attacks. For example if an attacker compromises a non-root account on a machine that uses such a protocol for it's root filesystem, the victim might change their password but the attacker could change the data back to it's original values even it if was encrypted. Encryption needs to have sequence numbers embedded to be effective, this is well known - the current dmcrypt code (used by cryptsetup) encrypts each block with the block ID number so that blocks can not be re-arranged by someone who can't decrypt them (a weakness of some earlier disk encryption systems). When block encryption is extended to a network storage system I believe that the block ID number needs to be used as well as a sequence ID number to prevent reordering of requests. CPU performance has been increasing more rapidly than hard drive performance for a long time. Some fairly expensive SAN hardware is limited to 40MB/s (I won't name the vendor here but please note that it's not a company that I have worked for), while there is faster SAN hardware out there I think it's reasonable to consider 40MB/s as adequate IO performance. A quick test indicates that the 1.7GHz Pentium-M CPU in my Thinkpad can decrypt data at a rate of 23MB/s. So to get reasonable speed with encryption from a SAN you might require a CPU which is twice as fast as in my Thinkpad for every client (which means most desktop machines sold for the last two years and probably all new laptops now other than the OLPC machine). You would also require a significant amount of CPU power at the server if multiple clients were to sustain such speeds. This might be justification for making encryption optional or for having faster (and therefore less effective) algorithms as an option.

I believe that the lack of built-in security in the AoE and iSCSI protocols gives a significant weakness to the security of the system which can't be fully addressed. The CPU requirements for such encryption can be met with current hardware even when using a strong algorithm such as AES. There are iSCSI accellerator cards being developed, such cards could also have built in encryption if there was a standard algorithm. This would allow good performance on both the client and the server without requiring the main CPU.

Finally the Peregrine blog entry recommended Counterpane. Bruce Schneier is possibly the most widely respected computer security expert. Everything he does is good. I didn't mention his company in my previous post because it was aimed at people who are on a strict budget. I didn't bother mentioning any item that requires much money, and I don't expect Counterpane to be cheap.

Simon noted that developing a clear threat model is the first step. This is absolutely correct, however most organizations don't have any real idea. When advising such organizations I usually just invent a few possible ways that someone with the same resources and knowledge as I might attack them and ask whether such threats seem reasonable, generally they agree that such things should be prevented and I give further advice based on that. It's not ideal, but advising clients who don't know what they want will never give an ideal result.

One thing that I forgot to mention is the fact that good security relies on something you have as well as something you know. For logging in it's ideal to use a hardware security token. RSA sells tokens that display a pseudo-random number every minute, the server knows the algorithm used to generate the numbers and can verify that the number entered was generated in the last minute or two. Such tokens are sold at low prices to large corporations (I can't quote prices, but one of my clients had prices that made them affordable for securing home networks), I will have to discover what their prices are to small companies and individuals (I have applied to evaluate the RSA hardware). Another option is a GPG smart-card, I already have a GPG card and just need to get a reader (this has been on my to-do list for a while). The GPG card has the advantage of being based on free software.

One thing I have believed for some time is that Debian should issue such tokens to all developers, I'm sure that purchasing ~1200 tokens would get a good price for Debian and the security benefits are worth it. The use of such tokens might have prevented the Debian server crack of 2003 or the Debian server crack of 2006. The Free Software Foundation Fellowship of Europe issues GPG cards to it's members, incidentally the FSFE is a worthy organisation that I am considering joining.

Today I received a copy of the PIN for my MBNA credit card in the post, despite not having asked for it. In response, I've cancelled my account, and reported their incompetence to You and Yours. I suppose I shouldn't be all that surprised, since MBNA have a habit of randomly sending out unsolicited cheques (which also has worrying security implications), but I actually found it quite shocking to see the PIN that I'd chosen printed in clear text. Obviously, in the first instance they generate a random PIN, and print it out, but I was rather hoping that their systems would be set up so that that random PIN, and certainly any PIN subsequently selected by the customer, would not be available in clear text at any time. If I forget my PIN, they should generate a new one, not remind me of the old one. They should not be able to remind me of the old one. The two people I talked to seemed surprised that I would cancel an account that I've had for about 13 years over a single PIN in the post, but given that that's their policy, I don't think it's a massive leap to think that a corrupt postman might be tempted to collect these PIN letters (which are pretty easy to spot and most of which are not being expected, so won't be missed). Then, assuming that a reasonable percentage of people will match MBNA's laxness by setting all their PINs alike, the criminals will be armed with all the information they need to do a targeted mugging for the card(s), with an average return in tens of thousands of pounds, especially if they hospitalise/kill the victim to ensure they don't get to cancel the cards.

Today, I continued chasing easy apache2 bugs. The following bugs seem to be easy to fix (and should be fixed in my opinion prior to Etch).

• #396782: apache2.2-common: Upgrade adds "default" virtual host; breaks existing config: the problem is that apache2.2-common is new in any case, as we had apache2-common in sarge. One possible fix would be to detect if any site is active in /etc/apache2/sites-enabled (e.g. via find) and add the default site only if none is there at all.
• #396265: apache2: mod_proxy_ajp connection reuse bug: This problem is perhaps not specially easy, but - there is a patch upstream, and it seems to have some security impact as well.
• #395936: Apache2 SSL service stopped working since upgrade to 2.2.3-2: -D SSL went amiss when apache2 and apache2-ssl were merged - in case we can't fix that with reasonable effort, it should be documented in the etch release notes
• #391813: apache2.2-common: man page for apache2 missing in apache2.2-common: obvious fix
• #338472: apache2: Move /server-info and /server-status conf to mods-available: obvious fix, but that's a policy decision

Some more bugs were obviously outdated, so I closed them. I also started collecting information for the release notes about apache2.

Sometimes doing a Google News search for debian turns up some fascinating little gems. Today’s was this article:

Einfeldt says that the project also plans to sell copies of the film, or at least one of the versions of the film. Taking a cue from the Debian project, Einfeldt says that there will be several versions, starting with the edit codenamed “Buzz.” He says that there will be another version codenamed “Rex” that will be sold on DVD and through other avenues like Lulu.com that cater to self-distribution.

Some interesting quotes in the article from Postgresql hacker and SPI treasurer Josh Berkus, along with a link to the Digital Tipping Point wiki.

With all the talk about binary drivers, and Ubuntu's recent decision to ship them by default, I was going to try and rant or philosophize about the various issues it raises, and how I think ripping Ubuntu a new one for this move is justified, but instead I'm going to talk about kitties and happy things.

On the XSF front, the coolest news has come from people other than me. In addition to providing compiz updates and improvements, Thierry Reding has been busy cleaning up the Debian mesa packaging in the XSF repo. Mesa's Debian maintainer hasn't been very active over the past few months, so Thierry has stepped in to help out there.

Julien Cristau, who helped in the early work moving from XFree86 to Xorg, has returned to the XSF to take over maintainance of xterm, which I've almost completely neglected. Both these packages needed more dedicated maintainance than I could provide, and it's great to see them both being beaten in to shape.

Drew Parsons has been as industrious as ever, packaging updates for drivers so we can ship Etch with driver support that is very close to what will be released upstream as 7.2. In addition, he's packaged the modesetting branch of the i810 driver. This is an experimental development branch that will become the mainline in the nearish future, and it basically allows the driver to set modelines that aren't specified by the BIOS, just like other drivers.

Christian Perrier continues to rock the translations.

I've been doing unglamorous work bringing the Xorg docs in to the late 90's, thus making sure that we ship with docs so that users can tell what's on their systems.

Finally, Thierry has put a ton of work in building infrastructure to move the XSF svn repo over to git. I've been evaluating this, and hopefully we can make the move soon so that we hit etch+1 development running. Using git will provide an easier means of pulling from and pushing to upstream. Hopefully, downstream derivatives will also use git as well to facilitate this. I'm really excited about all of this because it feels like we're active across the board.

And now for the kitties. Nicole and I have adopted a cat. We get to take her home from the shelter next Wednesday, so if some random characters start to appear from me on irc, it's probably her fault. Rest assured that when I never run for DPL, she will be a far better running mate than Zeke. As a favor I would like to ask you, all my loyal readers: if I start to talk about my cat constantly, like one would one's own child, please punch me in the kidney. Thank you.

Getting to the gym consistently is one of the biggest hurdles that I have stuck to jumping over while I'm trying to lose a bit more than a few. I seem to have no consistent schedule, except that I do end up doing it every day that I can. One downside of this is that I tend to work out late at night, almost always an hour or less before I go to bed. I've heard that this is not the best for the sleep, but I suspect it is actually better than nothing, so I continue to get to the gym at 11pm or 12pm. Unfortunately, I found myself with some extra roadblocks this week: the exercise room was half broken. The breakers on one half of the room tend to trip when the air conditioner and two machines that are on that circuit are all in use. This means that no one can use those machines until someone from the coop management goes and resets the switch. The treadmill machine, my weapon of choice for shedding a few pounds, is inconveniently on this circuit, and can't be plugged in anywhere else. This happened 3 times this week, Wed-Fri. I'm calling the office for the second time tomorrow.

It is significantly harder to exercise when I don't have the treadmill handy — the stepping machine works on semi-powered days, but it tires me out much too quickly and I cannot get enough exercise in. I'm not the kind of person to reliably run in place or do jumping jacks. My solution was to move the exercise bike to the powered side of the room. The biggest problem with semi-powered days is motivation. Usually I have the motivation to get to the exercise room and start the machine, and once I've started I can stop. Opening the door to a bunch of non-working machines is a huge motivation hit though. It's so much easier to take a roadblock like this and skip a day — in fact I did this week once. Luckily I discovered that the bike is on wheels on one side so it is easy to move to the other side of the room. However, I'd like to solicit suggestions for alternate exercises for semi-power days. The things that work in the room are a weight machine with a bunch of attachments, the stepping machine, and the exercise bike. I can't really go outside and exercise, because of the late hour and neighborhood that I live in, so it needs to be an inside task. The last requirement is that it focuses on losing weight, not gaining muscle. I'm fairly sure that I'll be gaining some muscle along this process, but the goal is to drop the weight.

I have taken Saturdays to be my day off, so that I can get a little rest and not be so stressed about things, but I'm not taking it this week as I need to "make up" for the skipped day.

This week (Nov 3 - Nov 9):
Minimum: 338.0 (-0.5) (Nov 7)
Maximum: 340.0 (-1.0) (Nov 4)
Average: 339.25 (-0.35) (139.25 to goal)
Exercise Calories: 2314 on 5 days
Average Calories per session: 462.8

I finally got myself a nice digital camera. Nice as in, it fits in a pocket, it takes reasonably good-looking pictures, ant it's not a Canon so I can access it as an USB mass storage device. (For those who care, it's a Kyocera/Contax U4R.) So I've started using F-Spot (which is tremendously cool) and Gallery a bit more intensively than previously, and I noticed something curious: my pictures had wrong times. I thought that digital cameras stored them inside the picture files... Hmm. On to investigate. Time passes as I follow the threads of the information flow (use the source, Luke). Then I scream in horror. Then I go see something I hope is authoritative and therefore likely to have been well thought-out (read the spec, Luke). Then I scream some more. Let it be widely known that the Exif specification, which is the standard for embedding metadata into image files from digital cameras, encodes the date and time of the picture as a string. A fat, ugly, 20-character string. More precisely, the format is YYYY:MM:DD HH:MM:SS. I don't have anything against strings, they are rather easy to parse by humans (as demonstrated by strings /home/roland/images/photos/contax-u4r/kicx0700.jpg head). But they should be done right. In this case, it would have made a lot of sense to enlarge that string to 26 characters and add +ZZZZ or something similar. So as to be able to encode, say, a timezone, for instance, in order to, say, have dates and times that actually mean something, instead of something that may or may not be the current time plus or minus a random number of hours and minutes. I thought I could cheat by starting F-Spot with TZ=UTC f-spot (among my electronic gadgets, those that can't cope with timezones are set to UTC, with the exception of my alarm clock). The result is bizarre: the date is shown as being one hour late. I could understand if it were two (I'm at UTC+2 these days), but where does that one come from? I suppose I'll have to cheat differently, by keeping a patched version of F-Spot that interprets the TimeDate data from Exif as UTC, instead of using the current timezone. Or maybe I could do that in my hotplug script: it already rsyncs images from the digicam to the harddisk then makes sure the digicam's memory has at least $foo megabytes of free space on the card memory. I suppose it could also fiddle with the Exif tags on the fly. Anyway. People need to learn: text without encoding information is useless, cryptography without a web of trust is useless, and date/times without timezone info is useless. If one of my esteemed readers happens to be (or know) a member of the Exif specification group (I understand it's called "JEITA"), please tell them that this needs to be fixed in a future version of the spec. I suppose I'll have to live with it with my current digicam, but maybe the next one will be better in that regard. The pictures themselves are nice, though.

So I spent most of the (long) week-end hacking on various things, and behaving geekishly. Gforge 4.0 packaging goes along rather nicely. Packages built from current CVS won't use LDAP anymore (except for the old gforge-mta-exim, but you really should be using gforge-mta-exim4 or -mta-postfix by now). Shell accounts, e-mail redirection and mailing-list resolution now use direct PostgreSQL lookups. No more install-ldap.sh scripts running hourly and taking forever. No more nightmares setting up slapd and trying to clean after it when it explodes. Yay! Other news, on the video front: okay, I gave in, I finally accepted the next-best-thing that so many people have sent me. My raw1394 and dv1394/host0/PAL/out device nodes are now statically created by me, and symlinked by udevd via links.conf. Urgh. It means I can grab video from the camcorder, edit it, and export it back to the camcorder, all that in the same Kino session (and under a reasonably current 2.6 kernel). Editing video is nice, but it's not very useful if you have to carry your camcorder along at all times to show people, though. So I wanted/needed a free, working encoder for a nice codec that I could use. I wanted Theora. I whined for sometime, and I finally understood that Kino wouldn't have anything to do with it, and I had to use ffmpeg2theora. Blargh. Whatever, I grabbed it from upstream and packaged it (it's at http://roland.mas.free.fr/debian/ if you want it -- someone please ITP it, take it, write a manpage, and upload it to Debian). Now Kino can export to Theora, cool. Now I just have to find one media player able to play Theora correctly, and things will be fine. Xine only wants to play the Vorbis (audio) track, and shows me a visual representation of it. VLC is fine after like fifteen seconds, but it starts by playing audio too fast, then slows down, while video takes long before coming, then it comes up too fast and slows down to a normal speed too. As for totem-gstreamer... It starts by playing audio fine, but video is about 5-6 times too slow for as long as there is sound to play. When the end of the audio track is reached, all the video is played as fast as possible (and in total silence). Oh, and I also got my ass kicked at Freeciv. I used to play Civilisation for days in the good old Atari ST days, but I seem to have forgotten quite a lot. Or maybe I was no good to start with, who knows, the AIs never told me. So I need to practice against AIs, I suppose, before I next connect to a game server. Okay, so I spent the whole weekend on a computer. So what? It was raining anyway.

Yesterdays statistic from debian-devel-changes: 17x “New upstream release” with only 2 packages actualy fixing bugs! 5x “Initial Release“! Guys, that close before the release, use experimental, that is what it is for. And it gets autobuilded for almost all architectures (1 buildds (s390) currently down). Thanks for helping to get the release out in time. No Tags

Liberty and the Librarian [Guest commentary by Beverly C. Lucey at The Irascible Professor]

Access to computers in libraries is also critical to learning and a pathway to the outside world. It's a small attempt to even the divide among economic classes. Many libraries now subscribe to a pricey database that can allow sophisticated research beyond the clutter of regular search engines. A self-directed learner could gain quite an education by employing the new technology with some old fashioned digging. We have a smart, productive population. But millions of poor or newly arrived people do not have a free ticket to ride the campus bus.

I m still at the school in Ghana, and although I have quit, there are another five weeks to make use of. Linux is installed on quite a few machines, but it is not used very often, partly because the studentds don t know about it. I was instructed to boot to Windows by default, so they don t stumble over it either. To raise a more interest, I announced a Linux Gaming Tournament, and put up some posters. The participating students will compete in Frozen Bubble, the game formally known as Tuxracer and Tetrinet.As it turned out I got the permission to do so based on a misunderstanding: The principal thought I would create a game that itself would teach students to use Linux (maybe some kind of rally with hidden hints in various applications and folders, and whoever finds them wins). My original plan would not have been allowed, as there is a officially strict school policy against computer games, and because it is a boarding school, it is also a life policy for the students for four years.Because the tournament was already announced and students signed up for it, I will still be able to hold it, as an explicit exception to the rule. But what the administration would like to see, also to keep the interest in Linux up even after I will have removed the games again, is a longer lasting competition in a game with a more educational purpose. An old Mac game was named where the player has to run a business and in the process learns about spreadsheets.So, dear lazyweb, do you know of a game that

• runs on Linux. (i.e. no web based game)
• takes a while to complete. (i.e. several hours during the course of one or two weeks)
• has an educational purpose. (e.g. a economical simulation, maybe a simulation of evolution)
• maybe even is realtime in the sense that certain events happen after a certain amount of real world day, not just gaming hours.
• maybe even interacts with other people playing the game, over the network.

I know that the last two wishes would point to a web based game, but that defies the purpose to lure the people to start Linux.

One of the annoying features of reading several planets, is that you end up reading entries from people you otherwise respect, who seem to have various complexes about nonsensical issues. We all saw the month in which half of Debian decided it was cool to rip on Ubuntu, and now apparently it's the new cool thing to do if you work on Fedora.

According to a particularly obnoxious entry, the quality or otherwise of Ubuntu's kernel[0] does 'damage to the free software community'. Now, they've focussed on binary drivers. Which is fair enough: I am personally quite uncomfortable with binary drivers, and extremely unimpressed with Ubuntu's recent move towards binary drivers by default. While I respect the fact that they still encourage users to install free drivers, providing them by default is not a winning move, in my opinion. But I'm not going to discuss this further right now, because if I do, the terrorists win.

The reason the terrorists win, is because some people like to furiously handwave and make strawmen. Apparently now, everyone who's ever touched Ubuntu is rabidly for binary drivers, but the problem here is the handwave from criticism of Fedora's alleged community into yet another ramble about the kernel tree and binary drivers.

I certainly hope the Fedora community is more mature than this, both in general, and in their ability to have a constructive debate about the level of its community involvement. Right now, it is not even disputed that there is effectively none. At first glance, they may appear similar, but if you look further, the similarities vanish. Anyone can come in and get involved in the decision making in Ubuntu, but more important than that, the process is at least completely transparent, so you can see what's going on, on public lists, at every step. Fedora does not have this: decisions magically appear On High from RHEL types. This is not necessarily a bad thing, and does not necessarily result in a lower-quality distribution, but if everyone could just accept this as being true and move on, rather than bitterly baiting a successful community distribution about it, I think everyone would be a lot happier.

The biggest difference is -- yes, basically all the Ubuntu core developers are employed by Canonical. These people were handpicked from the Debian community originally, and now a great deal of them start as Ubuntu community members, and are employed by Canonical because having them work full-time on this stuff would be awesome. The process is still entirely transparent: being employed is a mark of recognition (sorry), and a request to continue working on this even more, rather than a pre-requisite to being able to do anything. Witness Fedora Core vs. Fedora Extras, for example: there are quite a few packages that non-Red Hat employees are prevented from meaningfully contributing to.

So, the summary in a nutshell: binary drivers bad (and Ubuntu moves towards promoting same even worse), Fedora 'community' not at all, handwaves bad, refusal to get involved with a meaningful debate about community governance and structure without engaging in petty mudslinging and pointless handwaves inexcusable.

(Disclaimer: I am not involved with any distributions, nor do I have any professional affiliation with them either. I'm just an irritated observer.)

[0]: I don't claim to have any insider knowledge here; the only point at which its quality or otherwise has become an issue for me lately, is a random hang in gettimeofday() in a corner case recently, which I've been too lazy to isolate and report as a proper bug; I worked around it in the X server anyway.

One issue that is rarely considered is how to deal with office break-ins for the purpose of espionage. I believe that this issue has been solved reasonably well for military systems, but many of the military solutions do not apply well to civilian systems - particularly the use of scary dudes with guns. Also most office environments don't have the budget for any serious security, so we want to improve things a bit without extra cost. Finally the police aren't interested in crimes where an office is burgled for small amounts of cash and items of minor value, it gets lost in the noise of junky burglaries, so prevention is the only option.

Having heard more information about such break-ins than I can report, I'll note a few things that can be done to improve the situation - some of which I've implemented in production.

The most obvious threat model is theft of hard drives. The solution to this is to encrypt all data on the drives. The first level of this is to simply encrypt the partitions used for data, support for this is available in Fedora Core 6 and has been in Debian for some time. The more difficult feature is encrypting the root filesystem, encrypting root means that important system files such as /etc/shadow are encrypted. Also if the root filesystem is encrypted then an attacker can't trivially subvert the system by replacing binaries. An unencrypted root filesystem on a machine that is left turned off overnight (or for which an unexpected reboot won't be treated seriously) allows an attacker to remove the drive, replace important system files and then re-install it. If the machine is booted from removable media (EG USB key) which contains the kernel and the key for decrypting the root filesystem then such attacks are not possible. Debian/unstable supports an encrypted root filesystem, but last time I tried the installer there did not appear to be any good support for booting from USB (but given the flexibility of the installer I think it's within the range of the available configuration options). I have run Fedora systems with an encrypted root filesystem for a few years, but I had to do some gross hacks that were not of a quality that would be accepted. With the recent addition of support for encrypted filesystems in Fedora it seems likely that some such patches could be accepted - I would be happy to share my work with anyone who wants to do the extra work to make it acceptable for Fedora.

Once the data is encrypted on disk the next thing you want to do is to make the machines as secure as possible. This means keeping up to date with security patches even on internal networks. I think that a viable attack method is to install a small VIA based system in the switch cabinet (no-one looks for new equipment appearing without explanation) that sniffs an internal (and therefore trusted) network and proxies it to a public network. This isn't just an issue of securing applications, it also means avoiding insecure protocols such as NFS and AoE for data that is important for your secrecy or system integrity.

An option for using NFS is to encrypt it with IPSEC or similar technology. AoE can be encrypted with cryptsetup in the same way as you encrypt hard drive partitions, it doesn't use IP so IPSEC won't work but it is a regular block device so anything that encrypts block devices will work. I have been wondering about how well replay attacks might work on an encrypted AoE or iSCSI device.

Security technologies such as SE Linux are good to have as well. An attacker who knows that a server has encrypted hard drives might try cracking it instead. A thief who has stolen a laptop and knows that it has an encrypted drive can keep it running until future vulnerabilities are discovered in any daemons that accept data from the network (of course if you have enough technology you could sniff the necessary data from the system bus and from RAM while it's running - but most attackers won't have such resources). I have considered running a program on my laptop that would shut it down if for a period of 48 hours I didn't login or un-blank the screen, that would mean that if it was stolen then the thief would have 48 hours to try and crack it.

Prevent access to some hardware that you don't need. If you allow the system to load all USB drivers then maybe a bug in such a driver could be exploited to crack it. Remember that in a default configuration USB drivers will be loaded when a device is inserted (which is under control of an attacker) and the device will use data from the attacker's hardware (data of low integrity being accessed by code that has ultimate privilege). Turning off all USB access is an option that I have implemented in the past. I have not figured out a convenient way of disabling all USB modules other than the few that I need, I have considered writing a shell script to delete the unwanted modules that I can run after upgrading my kernel package.

Once these things have been done the next issue is securing hardware. Devices to monitor keyboard presses have been used to steal passwords. The only solution I can imagine for this is to use laptops on people's desks and then store them in a safe overnight, unfortunately laptops are still quite a bit more expensive than desktop machines and consequently they are mostly used as status symbols in offices. Please let me know if you have a better idea for solving the key-logging problem.

For servers there is also a problem with keyboard sniffing. Maybe storing the server's keyboard in a safe would be a good idea.

Security monitoring systems are a good idea, unfortunately they can be extremely expensive. There has already been at least one recorded case of a webcam being used to catch a burglar. I believe that this has a lot of potential. Get a webcam server setup with some USB hubs and cameras and you can monitor a small office from all angles. When the office is empty you can have it GPG encrypt pictures and send them off-site for review in the case of burglary. You could also brick the server into a wall (or make it extremely physically secure in other ways) so that the full photo record would be available in the case of damaged phone lines, and to give more pictures than the upload bandwidth of an ADSL link would allow (512Kb/s doesn't allow uploading many pictures - no-where near the capacity of a few high-resolution web-cams).

This is just a few random thoughts, some things I've done, some things I plan to do, and some that just sound like fun. I expect comments telling me that I have missed some things. I may end up writing a series of articles on this topic.

PS I've uploaded day 32 of the beard (which was taken yesterday). Last night at a LUV meeting I was asked to stand in front of the audience to show them my beard. I had imagined that they might have seen it enough through my blog, but apparently not.

The 5th International GPLv3 Conference will hold in Akihabara, Tokyo, Japan, Nov 21-22, 2006. I am a board member of FSIJ (The Free Software Initiative of Japan), and the organization is hosting the conference. I'm also working to prepare the conference. The most major usage of GNU/Linux is for embedded system in Japan. I think many people know "Zaurus", a linux-based PDA. And other many embedded systems are here and there in Japan. So we will discuss about embedded system and Free Software. I consider to broadcast the conference by Ogg/Vorbis and Theora, XCAST6 with vic and rat, and IRC. I hope that many people see the conference via network and directly. BTW, the blog's category is not match to the subject. I need to make other category...