At work, I recently encountered #261107 on our distantly Debian-derived server and workstation distros. It really annoyed me because installing the mysql-server package fell over in a screaming heap when it went to create the mysql user. I'd seen a bug filed internally, relating to this particular use case, and initially I thought, based on the output, that it was the MySQL package's pre-install script not quoting the string "MySQL Server", but upon further investigation with strace, it turned out to be adduser's internal call to chfn that was failing, all because of the lack of a controlling terminal. Anyway, a colleague fixed the problem, and pointed me to the abovementioned bug, and this is what strikes me as so strange: the bug has been open for approaching 3 years. I can't reproduce this bug with a stock sarge or etch install, yet I can reproduce it on an Ubuntu Dapper-derived system at will, by calling chfn -f with /dev/null redirected to stdin. If this bug was biting with any sort of regularity, there'd be people rioting, because their adduser calls would be falling over, left, right and centre. Yet it was obviously reproducible for the bug submitter, and I can reproduce it at work. There's more to it than the lack of a controlling terminal. The plot, it be thick. Update Mystery solved. Apparently if you specify terminal restrictions in /etc/security/access.conf (even explicitly restricting it to "ALL"), pam_access gets all bitter and twisted if there's no controlling terminal for the thing being authorized. Wicked.

So I hauled my ass to the Nintendo World Store in Rockefeller Center a couple of weeks ago to get myself a Nintendo Wii. I can see what all the fuss is about, the controls are just so amazing, it's really a much more fun and comfortable experience. I've also spent way to much time playing The Legend of Zelda: Twilight Princess. I have lost much sleep because of that game. I also bowled a 245 in Wii Bowling, which is so much better than I would bowl in real bowling it's not funny.

I'm starting to get antsy for the release. I'm scared to touch my packages now, which is no fun. I also want the shiny new software that will pour into unstable after the release is done.

At 8pm on Tuesday, April 10th, I will be giving a talk about Debian to the Long Island Linux User Group (LILUG)

I just received the latest Dell advert, they are offering a 22 inch monitor with 1680x1050 resolution for $499 including delivery! This is a great deal, I've got the same model of monitor at home (I paid $750 for it almost six months ago) and have been totally satisfied. The same monitor with a $499 price is amazing value.

In the past I blogged about the benefits of larger monitors for software development. Now these benefits are available to most computer users in first-world countries.

Now that 1680x1050 is commonly available I expect to see higher resolution monitors dropping in price, at the $800 and $1200 price-points there will need to be something better than that.

The next development will be new software to take advantage of this. One thing that I have heard of is a window manager that splits the display into two halves (in this case they would be 840x1050 resolution). The benefit of having this configuration (according to the people who use it) is that for maximising a window will make it take half the physical screen. This means that you could have a debugger in one half of the screen and your application in the other, to "maximise" the application would not occlude the debugger. Or you could have a web browser and a MUA each using half a screen.

Of course the same result could be achieved by getting two physical displays, but this requires a graphics card that supports "twin-head" operation, and the purchase price of two displays (which will add up to more than $500).

Splitting a screen into two virtual displays is not something that would suit my working patterns. For a lot of my work I just have a screen filled with as many Xterms as will fit. For the GUI stuff I am happy to manually resize things. Maybe a KDE addition that would allow one "Desktop" to be split while another isn't would work.

A final impediment to splitting the screen is that 840 pixels is not enough to correctly display all web sites (many of which are designed for 1024x768). Maybe if I had a split desktop with an icon on the title-bar of the window to unsplit it for one particular window then it would work.

Another use for a large display is virtualisation. I previously blogged about how to use Xephyr to run multiple X sessions on one display, as Xen is now supported in all Linux distributions and KVM and other
virtualisation technologies are also being developed there should be a lot of demand to have multiple virtual machine GUI displays on one desktop (although you could probably do this by manually sizing the windows).

These are just some wild ideas, I have no plans to write the code for any of them, so it'll be a matter of whatever is desired by the people who write the code or pay them. But one thing is certain, the low prices of such monitors will drive new research into how to use them effectively. New technology to effectively use large displays will then drive demand for even larger displays (as will the people who just want to get something better and more expansive than their neighbours). I wonder when we will get to the stage when people are satisfied. For basic office applications commodity PC hardware has far surpassed what is needed for people to do their work.

Finally, I managed to sent out those “You (maybe) get money” / “Sorry, no money” mails to the DebConf7 attendees that asked for sponsorship. Nice amount of mail. The process to get to this point involved a bit of mail discussion but also two long and exhausting meetings of the whole team. Basically we had to go through the whole list of people, voting if we would give them money. We could vote yes, no, maybe, pass, which gets scored as 1, -1, 0.5, 0. Then after the meeting simply add all votes for one single attendee together and you know a score for him between 100% and -100%. I wrote a little script for my irssi, making it a bit simpler, but still lots of work. That was later on followed by a second meeting where you decide what you do with the score rates, basically - where do we draw the line of “Gets money”, “Gets no money”, “Maybe, if we have enough”. And you are done. Sounds simple, but uses a lot of energy. Fortunately that was most of the needed work. There will be a little bit during DebConf, and some small pieces until then, but majority is done. Now, everyone, say thanks to those who participated in this team, making it possible for me to send the mails: * Anthony Towns * Steve McIntyre * Moray Allan * Holger Levsen * Amaya Rodrigo * Margarita Manterola * Martin Wuertele * Gunnar Wolf * Junichi Uekawa * Neil McGovern * Marcela Tiznado * Felipe Augusto van de Wiel One thing you encounter with such a wide-spread team is that of “What damn time can we meet?”. You end up with some having the meeting near midnight, while the other have problems waking up.,. :)

My brain hurts. Cross-building can get very confusing at times. I've been experimenting with debootstrap, trying to make a complete Emdebian cross-building environment that can be compressed to a base.tgz as with pbuilder. Changes to the chroot can be discarded, just as with pbuilder, allowing dependencies to be tested. The main benefit is that packages can be built without having to install long chains of cross dependencies via apt-cross or dpkg-cross on
the main system. To me, it's the only way to cross-build GUI suites like GPE against a background of changing dependencies.

The same code should also be able to create a native chroot so that the cross-built packages can be installed alongside each other for more testing. These chroots have already been tested and instructions exist in the Wiki.

Between that and the ongoing problems with empath: navigating a path from package_set A to package B via a changing set of build-dependencies . . .

Gar. I had to go downtown today to sign some legal papers with our lawyer. He's taken a gig as the interim chief of staff for the president of Concordia University, but he's kept a few of his older clients, including us. Maj and I stopped at the bank beforehand to sign some mortgage papers, and then we went to the SAQ across the street to buy some wine. We then piled back in the car, drove downtown, and with a little time to spare we stopped at Zyng for lunch, walked around St. Catherine a little bit, did some furniture shopping, and then met our lawyer near his office. We had a good coffee together and saw the new engineering building there -- it's quite nice. When Maj and I got back to the car, I realized that I didn't have my remote starter for the car -- which also disables the car alarm. This little gadget has been a real pain for me since we got the car -- the thing that attaches it to the keychain almost instantly broke, so I've had to carry it around separate from my keys. And now it was gone, and I had no idea where it was. So we retraced steps -- another 45 minutes walking around to the noodle joint, the furniture store, the Concordia caf . Nothing. We looked around on the street for a while, then jumped in a cab and came home. Maj had her keys here, so I borrowed them, cabbed back to where the car was parked, and as I was getting into the car I saw this: That's the clicker, right under that SAQ brochure about Italian wines. DOH! Moral of the story: attach your car-alarm clicker very carefully to your keychain. Sure, not much of a moral, but it's what I learned today. tags: car alarm clicker montreal concordia zyng car

RSS validated So, after starting an RSS 1.0 feed for my blog, I was having some problems using it in different readers. A few Google searches later landed me at the [$$vote for http://validator.w3.org/feed/, which is totally cool. Why didn't I know about this before? It turned out that my Tag URI format was invalid. I was using tag URIs for RSS item identifiers, and I'd left off the all-important validity date. So I had to update those. It seems to be working pretty nice, now; the validator gives the all-good sign for both my RSS 2.0 and RSS 1.0 feeds. tags: rss validation w3c

Greek Wikitravel Expedition So, I'm going to be interviewed this week for Hellas Spectrum, a Greek-language television show here in Montreal focusing on the local Greek community and culture. (I know - wow!) Apparently the interview will be "mostly" in English, with "a little bit" of Greek. Uh-oh. I studied some Greek in college, and I spent a summer in Crete and made my way pretty nicely, but I definitely haven't used the language in years. So this should be fun. I'm pretty embarrassed that I'm so inept in my ancestral tongue, and I hope that Amita June learns more than I have. The whole thing has reminded me that we don't have a Wikitravel language version for Greek -- yet. So I started a Greek Wikitravel Expedition to try to collect a group of users to make the wiki work. I've asked already on Greek Wikipedia, and I hope to find some more centres of Greek Open Source/Open Content culture on the Web. Greek people are disproportionately represented in science, engineering, and technology, so I think there will be a lot of interest. So, question for the LazyWeb: where are the good Greek Open Source/Open Content community Web sites? Influential Greek bloggers? What's the Greek Barrapunto? How can I get more interest in this project in the Greek Internet community? Contact me and let me know. tags: greek wiki wikitravel

Ubuntu got AppArmor support. This is bad news. AppArmor is a weak design. IMHO it gives the users a false impression of security, while leaving too much open to bypass security. But the biggest problem IMHO is that noone at Ubuntu seems to be working on their SELinux support. All I've seen is Ubuntu users breaking their system to a point where they didn't know how to fix it in the attempt to install their SELinux packages. The packages are mostly a 1:1 copy of the Debian packages I guess, but for example their new 'upstart' init-replacement likely isn't capable of actually starting a SELinux enabled system. Oh, and Debian didn't include the relevant package in any 'stable' release, Ubuntu had it in 'universe' since 'warty'. Right now, feisty will include the package, though it reportedly can't be installed. In the example used in the blog, evince is maybe protected from exploits by bad PDF files, but if you do a cp /usr/bin/evince /tmp and run that copy, all the protection is gone. A symlink might already be sufficient! So AppArmor is heavily relying on the user playing nicely. You might want to read this Article at LWN about AppArmor and why it's having a hard time getting into Linux mainline and "Security Anti-Pattern: Path based access control" in Joshua Brindle's "SecurityBlog" for a detailed article on the weaknesses in AppArmors approach. And their constant claim of being easier to use than SELinux isn't true either: the 'learning' mode itself will only generate you an incomplete policy. It's about as much as you can achieve in SELinux by transforming audit errors to allow rules using the "audit2allow" tool. Maybe even less; for example when an application accesses a font file, SELinux audit2allow will generate a rule that allows access to all font files (since they have the same type). This doesn't rely on any directory globbing magic, but because there is a type for font files. I expect that future versions of audit2allow will actually recommend which interfaces to add instead of just listing raw allow statements. AppArmors 'abstractions' seems to match what is called 'interfaces' in SELinux, except that interfaces in the SELinux reference policy are well documented and much more extensive. The 'abstractions' offered look like an early, incomplete version of the old NSA policy to me, before this was restructured to become the 'reference policy'. Interaction between processes also seems to be completely ignored by AppArmor. So it seems to me that "preventing evince from trashing your home directory when opening a malicious PDF file" is pretty much all you can do with AppArmor? But again, this isn't so much about bashing AppArmor or Ubuntu. I'm just disappointed that noone at Ubuntu seems to work on the more sound and solid SELinux. Most of SELinux is already in Ubuntu (inherited by their Debian roots), but it's lacking some integration work and such. Ubuntu is often said to be more agile than Debian and better at adopting new technologies, but in my experience, this often is limited to 'visual' stuff. If Debian were better at recruiting new people (for example in the SELinux section, we also seriously lack manpower), I'd probably be annoyed by Ubuntu 'trying to be first with all the pretty stuff' (yes, saying this would not be fair, that's why I'm putting it in quotes). Right now I'm mostly happy that they 'divert' many newbies off Debian and to their huge forums. Although it occasionally means I need to help an Ubuntu user to fix his system when he doesn't get any help there.

When looking through my Webalizer stats recently I noticed that *.search.live.com is transferring about four times as much data from my domain than *.google.com. This wouldn't concern me if I saw some people being referred to my site from live.com, however I see almost none, while google.com is responsible for referring about half the traffic to my site!

Then I looked through the aggregate stats for all web sites hosted on my ISP and noticed that live.com has three times the bandwidth use of google while not showing up in referrals.

I did a couple of test searches with live.com and it seems that one reason why I'm not getting hits is because the search engine just isn't much good. The search string "bonnie++" does not return any links to my program on the first page (maybe live.com can't handle a '+' character).

So I'm now wondering whether there is any reason to permit the live.com servers to use my bandwidth. It's costing my ISP money for no apparent good cause.

In the past there was a previous MS search engine that I had to block because it's attacks (which can not be described in any other way) were using half the web bandwidth of the entire ISP). This case is not so obviously an attack and I'm wondering whether I should permit it to continue for a while just in case they end up giving me some useful referrals.

Of course the other possibility is that if we all block their servers then the live.com results will become even more useless than they currently are and they'll give up on the idea.

I look forward to comments on this issue.

About two years ago I bought a new laptop. I wanted a unix without messing around with drivers for graphics and wireless, so I choose a Apple iBook with OS X. I havn’t regretted but the inflexibilities of Apples user interface is a burden. So I’m playing with installing Debian on a Firewire-drive. The installation (etch debian-installer RC2) worked fine until the installation of yaboot (the lilo and grub equivalent on powerpc). Google knew the solution: http://www.boborosso.com/. Problem number two was network: My wireless uses WPA-PSK and I don’t have a free cabled connection. More googling: wpa_supplicant was the solution but it wasn’t on the netinstall cd. Boot into OS X and download wpa_supplicant and some other usefull packages. Problem solved. So now I have a firewire-drive with a pretty basic Debian install with X11 running. But I actually used 2 Apple applications (Safari and iTunes) and 2 other pieces of Apple hardware (iPod and Airport Express). Safari is a minor problem, I just have to convince myself that my banking is just as (un)suportted with Firefox as it is with Safari. More interesting is the iTunes/iPod/Airport Express problems. iTunes is easily replaced by xmms but I really likes playing music through AirTunes and I need to keep my iPod updated. So it will porbally take some nore evenings to get completely rid of OS X. And the I need two more mouse buttons…

Nothing serious should be announced on April 1st. I still receive mails asking whether the Smith Review Project is really a serious announcement. Indeed, unless I really suck even more than I thought in English, nothing is really funny in that announcement, except maybe its disclaimer. We will really review English in Debian packages. So, people with English as native language, just stop laughing et my Frenglish and join debian-l10n-english. As all good projects, we have a wiki page and a name. However, unlike other projects, we already have a few results which is certainly the most important part of the story.

Spring has arrived in many parts of North America. But in Edmonton, North America’s largest and most northernly city, spring has sort-of-come-but-not-really as it recedes fairly quickly. There will be a day of explosive warmth (you know, a balmy 45-55 F) and of course locals strip down to near nakedness, wearing shorts and, the more flamboyant will don an 80’s inspired cut-off tee. Hot. This sartorial statement says WE are SO ready for the long winter to leave … for good. Despite the collective sentiment, which is probably shared by 99.999999% of Edmonton’s inhabitants, the winter cold, snow, and breeze are indifferent to our deepest pleas and they come right back, making us sport at least a few layers of winter clothes. Within this dance between winter breeze and spring warmth, I have spent most of my time staring at my computer doing everything possible to transform half-baked ideas, hunches, sentiments, and theories into coherent words, sentences, paragraphs, and chapters for my book. I am working on it full-force and am enjoying it more than I have in a year though from time to time I get fed-up, lost, sick of it, and my writing soul descends back, deep into one of Dante’s infernal rings, where I fester with my frustration, convinced that I should have become an organic flower farmer/acupuncturist that I almost became (well not really, but I have always fancied that combination as an ideal and fulfilling career path). Slowly I usually make my way back up, brush off the cobwebs of despair, and proceed anew. Within this highly secluded life of monastic-like repetition, thankfully, I have been enjoying some new things this spring. Once a week I head over to an University of Alberta off-site library facility to pour over archive material for a new project, which I am not going to talk about here (it is super-duper-top-secret) but it has been interesting working at an archive, especially one that is housed in an old Ikea. Since I am one of those right-brained people, I like to listen to music while I work, and lately I have also become pretty obsessed with house & electronic music, mainly thanks to a local DJ, David Stone whose weekly radio show on CJSR, BPM, is simply the bomb. He claims to bring the latest and greatest of electronic dance music from around the world and I think he is totally right. If you like this type of music, do catch his weekly show on Sat nights at 6 PM (MST). I sometimes get a little sad when I listen to some good music or see some stellar performance because it reminds me that what I may one day have to offer to the wider world an academic book and article here and there simply cannot bring the type of joy that musical performance and other creative expressions can bring. While you can listen to songs and over again, a book, if it is really superb, may attract a second or third reading. An academic book or article may at times light an inner light of joy, but let’s face it, it is usually a pretty cerebral light oh’ joy, leaving untouched those part of the brain, soul, heart, where more visceral, mysterious, yet fully self-enveloping feelings of joy reign high (but I am trying my hardest to stick a funny section or two in every chapter to leave a trace of laughter because if I can’t manage that with an ethnography on hackers, I will have failed miserably). Every track David Stone plays is something I want to listen to over and over again and thanks to mplayer stream dump function, I can. And funny enough, is that in the last month software believe it or not has brought me much joy as of late. I have been using free software since 1997 and I used to get A LOT more annoyed no make that a downright frustrated with programs (or lack of programs) than I do now. In fact, now, I am simply stunned whenever I upgrade to a version of a program. For example, Word Press 2.0 is like so much nicer in terms of usability and functionality than 1.5. The same goes for Open Office, the Gimp, and even Firefox, which has some bugs, but is so much better than its predecessors. I once described free software using the well-worn clich as “the gift that keeps on giving. And I think that this is becoming more and more true. And like wine, with the passing of time, these gifts usually get better and better. And like a unexpected present that arrives on your doorstep, these software packages induce some joy, because it is actually pretty neat to see these programs develop and grow into something stronger and more useful; so thanks to those who spend their time hacking away at making and improving this software and thanks to those (you know who you are) who helped with my recent WP upgrade!

I've written a draft process for dealing with alleged violations of the Ubuntu Code of Conduct. With luck this will be discussed at the meeting on Tuesday, so if anyone has any feedback before then it'd be helpful.

In a yet futile attempt to write an April Fools’ Day joke, Palm Inc. will be offering palm leaves to Christian Palm buyers in observance of Palm Sunday. Palm officials declined to comment.

Apple has a series of funny commercials comparing the Macintosh with a PC running Windows. They are very well written and presented. I recommend viewing them for the amusement value (view them here - but you need Quicktime).

Novell has produced a few short parodies of those adverts, they don't have the same production quality but are well written and not nearly as cheesy as I had feared (view them here). Novell's ads are in OGG and MP3 format.

Update: A comment pointed me to this site which has other parodies of the Mac adverts. There is quite a bit of bad language and the parodies will offend some people in several ways. But they are amusing and do make some interesting points.

I just filed Intend-to-package bug number #416996:

* Package name    : stereo
  Version         : 2.0 beta
* URL             : http://www.mono-project.com/Stereo
* License         : LGPL
  Programming Lang: C#
  Description     : Mono (.NET) extension for running
                    multiple applications

Stereo is an extension to the Mono (.NET/C#) platform for running multiple applications at the same time. As you probably know, C# is a language using a bytecode, called CIL: Common Intermediate Language. Using code in an intermediate language has benefits for platform and operating system independence (Java is the most prominent example of this approach), however it also means an overhead when running the applications. Various approaches have been tried to remedy these effects, such as JIT (just in time) compilers translating the bytecode to native code when needed. Applications running based on such bytecodes tend to use more memory than regular applications (for example, they need to keep the compiled code in writeable memory, whereas regular applications can use shared read-only memory for this), and you probably have heard many people complain about the memory usage of Java and .Net applications. Some people even claim the Linux .NET platform is called "Mono" because you can run at most one such application at the same time. That how "stereo" was born: an extensions to run two (or more) applications in the same mono environment, thus reducing the memory overhead significantly, and making it useful for more people. Future versions should even be able to run Python (using IronPython) and eventually Java applications in the stereo runtime. It is also planned to add support for multiple user operation. So eventually, it will be able to replace your whole system. The project will then also change it's name to Multics, to reflect it's unique multi-user capabilities. At least if we get enough funding by Dunc-Tank, who is currently sponsoring all our development efforts.

Clifford just released version 0.8 of his Structured Terminal Forms Language/Library stfl.

STFL is a library which implements a curses-based widget set for text terminals. The STFL API can be used from C, SPL, Python, Perl and Ruby. Since the API is only 14 simple function calls big and there are already generic SWIG bindings it is very easy to port STFL to additional scripting languages.

A special language (the Structured Terminal Forms Language) is used to describe STFL GUIs. The language is designed to be easy and fast to write so an application programmer does not need to spend ages fiddling around with the GUI and can concentrate on the more interesting programming tasks.

The new version just fixes (finally you will be able to use page-up/down in newsbeuter) some minor issues but also includes proper locking for mutexes now which was needed for newsbeuter.

Just uploaded to unstable, test please

The mighty uClibc has been repackaged and should be on its way to the NEW queue soon. The most prominent change is that it can now be cross-compiled for a number of architectures using dpkg-buildpackage's -a switch (you might want to install dpkg-cross). There are a few regressions that will have to be sorted out by trial and error, but these only affect architectures no one cares about anyway, like i386. Known bugs:

• 32/64 bit arches that use the same compiler (like i386 and amd64) can not cross-compile for each other yet
• hppa, sh, s390 and ia64 are not supported at all
• locale support is disabled
• static libraries are built as PIC code

There is probably a lot more that will only crop up when actual other packages are built against it (so far, my shiny new busybox works, but the CFLAGS I had to pass to make that work are illegal in some states). Next up: reintegrating the magic specs file that implements (cpu)-linux-uclibc.