The readers of debian-devel-games@l.d.o and games@l.fd.o do already know, but the fact pkg-games has it s next (second) meeting on April 30th at 12:00 UTC in #debian-games needs the attention of the whole planet (pun intended)!

• What: Debian/Ubuntu Games Team Meeting #2
• When: 30.04.2011, 12:00:00 UTC
• Where: #debian-games on irc.debian.org
• Who: YOU!

For the agenda we have a whole bunch of leftovers from the first meeting, thus I did not plan any new items (besides of kicking Tolimar to be admin again instead of having the dream to drift away from his position ;)).
As most of us are lazy and wont klick the wiki link to read the agenda, it s served here too:

1. games and cross-distro collaboration
2. pending, removed, orphaned, wnpp & suggested games
3. freedesktop.org/games group
4. sponsoring policy
5. cleaning old, adding new admins (and users)

Do you still remember where you will be on April 30th at 12:00 UTC? No? #debian-games on irc.debian.org. And don t you dare to be quiet! ;)

I just activated a new language in Debian Installer: Uyghur. Uyghur is the language of Xinjiang or Eastern Turkmenistan. This part of the People's Republic of China is the homeland of the Uyghur people and the language is spoken by nearly 9 million people. The translation effort is driven by the Uyghur Computer Science Association (Uyghur Kompyut r Ilimi Jem'iyiti. The next D-I daily builds will offer Uyghur as a choice of language to install Debian. Given the way D-I packages are built, it will however take some time before the entire installation process can be performed by only displaying Uyghur and no more English. Indeed, the new language will appear for each D-I component when the relevant udeb package is built from GIT, which happens most of the time when a D-I developers wants a new feature or bug fix to be available. During the upcoming days, I'll try to rebuild a few packages, though, so that Uyghur users can still have a preview of what will be available when the first alpha or beta release of D-I is out. Moreover, that will help testing the translation and the possible glitches with rendering, fonts or any other display issue.

A newly founded Logic Group in Mumbai, which seems to be a private thing but some professors from the IIT Bombay are taking part, has approached me and asked if I can give a talk about Church s lambda calculus and how he used it to show that Hilbert s Entscheidungsproblem is not solvable. They are starting a series of talk on logic on the occasion of Turing s 100th birth year and because I am finally leaving the IIT campus in two days, my talk turned out to be the opening talk for the series. Roughly guessed about fifty people attended, some professors but most of them students from fields other than mathematics and computer science I hope that they were not too confused by distinguishing truth and provability, expressability and computability, of which I did not give a proper explanation.
I started with a historical exposition of the state of logic in the beginning 20th century, then gave an introduction to lambda calculus, encoding of natural numbers in then, G del encoding. Finally I sketched the proof of the unsolvability of the question whether a lambda term has a normal form and then concluded by showing how this implies that the Entscheidungsproblem is not solvable.
I have before hand written out the talk in full, and again I ended up saying completely different things or at least said things completely different. Nevertheless, I am sharing the (planned) text of my talk, including the timeline that I draw on the whiteboard.

Last week a developer meeting of the FAI project took place in Cologne/Germany. Four core developers (project lead Thomas Lange and 3x Michael ) met for two days to discuss and work on the FAI project. The first day (2011-04-14) started at 11:45 and lasted until around 21:15, the second day (2011-04-15) started at 11:00 and lasted until 22:00. We made 134 svn commits in those two days. The developer meeting was great, we got tons of stuff done:

• New release candidate version for stable release 3.4.8
• Implemented support for CentOS 5
• Website improvements:
  • Put website into svn
  • Deployed FAQ and Team webpage
• Setup-storage improvements:
  • Backport from trunk/experimental of setup-storage into 3.4.8
  • Cleanup of setup-storage patches
  • Minor bugfixes
  • setup-storage in 3.4 got align-at and default to cylinder alignment if preserve is used
• Worked on autotesting using Kantan:
  • new kantan release with new features and better performane
  • prepared initial test-suite scenarios for usage inside Kantan
• Discussed Release management:
  • 3.4.x considered as long term stable release (includes tested bugfixes and tested features that have been backported from developer versions (4.x and experimental))
  • 4.x considered as developer version (inclusion of fast bugfixes, inclusion of big features which might break stable version, )
• Documentation:
  • Officially documented release management notes for stable release
  • Officially documented developer policy (WIP)
• Unsorted other stuff:
  • Removed obsolete branches in svn
  • Grub now being installed from inside the target instead of nfsroot
  • Changelog in trunk got entries from 3.4.X with fixed git commit ids; entries were merged to find exact diff of trunk to 3.4.X
  • Defined what needs to be done after the developer meeting.

Just a note that the slides are available (non-slideshare link) for my presentation Tuning an old but free phone (description) that I held in the tremendously great event FSCONS 2010. It could be described as a smaller scale FOSDEM, but that would be actually down-playing it since the free software effects on society are something that I've actually never seen elsewhere on such a scale. My talk was among the purely technical ones, though.

I was planning to hold on with this blog post until the recorded videos arrive, but since it seems it might not be during this year I will just post this now that slides are available.

I've shared a few photos as well at Flickr...


Keynote: Karin Kosina, The Inanna Project. A tech + art workshop for female artists in Damascus, Syria. An experiment in art, technology, and the transformative power of Free Hardware and Software.


Erik de Bruijn, The Future of RepRap, a self-replicating open source 3D printer that fabricates arbitrary objects including parts of itself.


Social event at the Berg 211.


Malin Nilsson on Gender, class and global flows. Using free software to fuel a revolution in home based industrial work.


Keynote: Glyn Moody, Ethics of Intellectual Monopolies.


Keynote: Glyn Moody, Ethics of Intellectual Monopolies (audience).

A few summaries available on a Qaiku seminar channel.

So how much wind energy can we realistically use? A paper (Earth System Dynamics, DOI: 10.5194/esd-2-1-2011) by Miller,Gans and Kleidon (MGK10) has generated a lot of controversy courtesy of a New Scientist review (See Climate Progress for a good rebuttal). They argue that the effective limit we can safely extract without (bad) climatic consequences is around 18--68 TW (we currently use 0.2 TW of wind power). This paper is a follow-on to Kleidons work on the thermodynamics of the climate, where he points out that the free energy is the important measure of what energy can be generated by renewables. The free energy of the atmosphere is on the scale of hundreds of TW, he argues, much less than the heat energy of ~10^5 TW that comes from the sun. He argues that not enough attention is paid to the free energy budget, and argues that from MEP theory that free energy flows through different geophysical processes are more important than people currently think: such energy and momentum flows then lead to faster depletion of gradients than people currently use in their models. Frequently we use "diffusive-like" approximations to stuff we can't explicitly handle,such as convection and eddies below the resolution of our computer models. That the free energy budget, and small-scale processes need more detailed study (such as the transfer of momentum and energy from wind to water), I agree. But paradoxically, MGK10's estimates based on diffusive processes are what gets it into trouble. The critiques (e.g. Jacobsen and Archer) seem to concentrate on the estimates for diffusive and other energy losses (eg. wake fields) and climatic consequences are very loose, and out by factors of 50-100. They also ignore the fact that using wind as a substitute for more destructive energy sources produces a net gain, climate-wise. Based on these numbers, the real limits on wind power are more limited by where we can realistically place turbines, and the use and availability of rare earth metals in turbine magnets (MW sized turbines use over a ton of neodynium each in magnets!) One of the focuses of research at ICHEC and Met Eireann is wind for wind power: this becomes increasingly important for Ireland as we have more energy production by wind. I've been recently involved in a European project Weather Intelligence for Renewable Energies on investigating weather and climate forecasting needs of wind energy. In our weather models, we are getting to finer and finer resolutions (down to 2-5 km operationally, but working on 1 km in research), but as yet do not take account of wind energy changes. Modelling the wake turbulence, etc. and other effects of turbines is a 'fluid dynamics' problem done by the wind turbine manufacturers, mostly, in order to lay out turbines in a farm efficiently; this is done on the timescale of metres and seconds, while on the other end of the spectrum work is done in climate research on the changes in potential winds to see if wind energy will change in a few decades. But little is done on 'weather' scales of kilometres, minutes and hours: it turns out there are wind patterns that we don't predict in our models (vortices, etc.; especially for offshore turbines) that affect wind energy production, but would be very useful for wind farm and electrical grid operators to know about. So we should think about adapting our weather models for these. Either way, it looks like more detailed work on the interactions between atmospheric dynamics and wind farms would be a good thing. Incidentally, whatever about the alarmist nature of the article, kudos to New Scientist for their linking to papers: they quoted the names of the journals (Earth System Dynamics,Philosophical Transactions of the Royal Society), but where the article was not yet published (or behind a paywall), linked to the Arxiv.org version. More could do this. Tags climate, energy, thermodynamics, science, wind, renewables

Meike Reichle is a Debian developer since 2008 but has been involved for longer than that, in particular in Debian Women. She s a great speaker and shared her experience in a Debconf talk. She s also part of the Debian publicity team and managed the live coverage of the last release on identi.ca. Enough introduction, learn more about her by reading the interview. My questions are in bold, the rest is by Meike. Who are you? My name is Meike Reichle, I am a studied information scientist and work as a project manager at Pengutronix, an embedded Linux company probably best known for their ARM kernel work. I live in Germany, more exactly in Lower Saxony, but I was originally born and raised in Swabia. Although I moved here ten years ago I still have a rather strong Swabian cultural identity. (Among other things I pride myself on having introduced a number of fellow DDs to the true promise that are real hand-made Sp tzle ) I am married to Alexander Reichle-Schmehl, we ll have our third wedding anniversary this summer. Apart from Debian most of my spare time is used for all kinds of crafts and DIY activities. Making things with my hands always gives me a great sense of accomplishment. My Free software history is summed up pretty quickly. Like most women of my age I wasn t introduced to computers until well into my teens. I didn t have a computer of my own until I started studying at the university in 2001. From there on things developed rather quickly: Working on the University s Unix terminals got me hooked on *nixes, so I got me one of those Linuxes everyone talked about. I tried a couple of different distributions, ended up with Debian around 2004, started contributing in 2005, and finally became a full DD what a nice coincidence! exactly this day (Apr 18th) three years ago. You re part of Debian Women. How is the project going? I have the feeling that the number of women involved in Debian has not significantly increased. The amount of women active within Debian is a tricky thing to judge. Here s a quick example why: When the DPL was elected in 2004 there were 911 Debian Developers eligible to vote, 4 of them were female. Shortly after, during DebConf4, debian-women was founded. When the current DPL was reelected last month, there were again 911 Debian Developers eligible to vote, but this time 13 of them were women. You can look at these numbers and say The number of female DDs has more than tripled, what a success! Or you can pull out your calculator and it will tell you that in terms of ratio this puts us from a measly 0.4% to an only slightly less measly 1.4% ratio of female DDs. This still is pardon my language a bloody shame, but sadly also pretty close to the average ratio of women in Free Software. So, while I do think that the debian-women project did already have a significant impact on the Debian project as a whole, I don t think it has achieved its goals yet. Not for a long time. There s still a lot to be done but unfortunately the debian-women project has somewhat run out of steam at the moment. The seven years of its existence divide quite equally into the first half, which was very active and saw great results, and the second half, which was very slow and much more passive. In my impression debian-women is currently undergoing a rather bumpy generational change. On the one hand a lot of the original members, including myself, have reduced their involvement. Speaking for myself this is caused by shift of interests as much as general weariness. On the other hand there are only very few women following up. This development is also reflected quite harshly in DD numbers: If I don t misjudge any first names (and I desperately hope I do!) for the last three years not a single woman has joined Debian as a developer! After the great start debian-women has had, this is a very painful thing to see! That said, things don t look all bad. There is a number of women maintaining packages without being DDs and there s also at least one woman currently in NM, so there s hope this standstill won t last very much longer. But still, the fact remains that debian-women is suffering from a rather serious recruitment problem and I hope that this interview might actually help to spur some new or not yet active members into action. The aim of debian-women is far from achieved and now that its initial members are receding its time for new members to step up and take initiative. What should Debian do to be more attractive to women ? I think the general atmosphere has improved, we re less tolerant with rude behaviour, the usual tone on mailing lists has improved. Yet it doesn t seem to be enough. If there was a female DD for every time I answered that question First of all, I agree, Debian as a community has improved tremendously! Our general tone is much more friendly and cooperative and there is now a much better awareness of the impression we give to outsiders and newcomers. Now on to the difficult part: The question what should be done to get more women into Free Software has been around almost as long as Free Software exists, and it has been answered very well by a lot of people: Twenty years ago Ellen Spertus wrote Why are There so Few Female Computer Scientists? and most of it still holds true. Almost ten years ago Val Henson (now Aurora) wrote HOWTO Encourage Women in Linux and that also is still pretty accurate. In 2006 Floss Pols undertook extensive research to find out why there were so few women in Open Source and Free Software and how that could be changed. They also came up with a very good set of recommendations. All of these texts highlight different aspects of that question and all of them have very good points. I personally have, over the years, arrived at a rather sociological, not to say holistic point of view. In fact I answered the exact same question a few days ago, and the answer I gave then was this: After ~10 years of women in tech advocacy I d say the ultimate and final measure to get more women into Free Software is by finally achieving a truly equal society and at the same time dramatically improving child care support in almost any country. I ve come to the conclusion that what really holds women back in practice is not so much a lack of skill or interest but a simple lack of opportunity. For most of us Free Software is what we do in our spare time and that s something that women, even today, have considerably less of than men. Even in couples where both partners work full-time it is still mostly the woman who does the majority of the housework and child care duties. In most cultures men have a perceived right to their leisure time that does not to the same degree exist for women. That is one major reason, the other is instilled modesty, which has kind of become my personal arch-enemy by now. I ve talked to so many girls and women at all sorts of events about why they won t take up Computer Science studies or join a Free Software project and the answer I hear most often is that they do not consider themselves good enough in one or another aspect. Sometimes they will doubt their technical skills, sometimes their language skills, sometimes their stamina. Needless to say these girls and women were not any less qualified than the people already active in Free Software. So, yes, in the short and medium term making Debian a more welcoming and friendly place is the way to go. As many others pointed out already this will not only benefit prospective contributors but the community as a whole: those new to it as well as those who ve been in it for a long time. In the long term however what we need is empowerment! Women who are just as confident about their skills as men and are not discouraged by uncooperative environments. This is of course something that is culturally deep-rooted and can only happen in a very large time frame. So, for the moment the way to go in my view is accessibility: a cooperative atmosphere, a code of conduct, comprehensive documentation not only of technical aspects but also of structures and processes. The other thing we need to do is to have as many already active women as possible attend as many Linux/Debian/Free Software/Whatever events as possible. In my experience it happens quite often that other women see these women, feel very inspired by them, get to talk to them and then a few days later show up on some mailing list or IRC channel. From what I ve seen personal contact still beats any other kind of recruiting measures. You re a Debian developer but you re also married with a Debian developer (Alexander Reichle-Schmehl). Did you meet because of Debian? If not, who introduced Debian to the other one? We did in fact meet because of Debian. More specifically during our booth shift at the Debian booth at LinuxTag 2005, where I did a talk on the debian-women project and Alex organised the DebianDay. After that our relationship developed pretty much along our Debian activities: After our initial meeting we talked a lot on #debian.de, when Alex went to DebConf5 and I didn t we noticed that we kind of missed each other. The first gift he ever gave me was a Debconf5 shirt and a box Finnish chocolates (I still have one of them today. ) Our first secret kiss was at ApacheCon 2005, where we were both staffing the Debian booth (kudos to abe for pretending not to notice). We then became an official couple at Berlinux 2005 where we were both staffing the Debian booth and giving talks on packaging and user motivation. Our first real relationship stress test was when we both joined the DebConf6 orga team. It was a stressful time, but we passed it with flying colours! About a year later we announced our engagement via planet.debian.org. Our wedding was a veritable MiniDebConf, one of the best gifts we got was a Debian cookbook including the favourite recipes of DDs from around the world. By now we ve both finished university and work full-time jobs, so we don t do as many talks and attend as many Debian events as we used to. Instead we now mainly focus on press and publicity work, which is quite practical to work on as a pair. It s actually rather funny that way, Alex and I get confused with each other quite often, since we have almost the same name, often pick up on each other s E-Mail conversations and are most often quoted by our function rather than by name. Because of we have kind of merged into this virtual Debian Press Person in the perception of many of our contacts. You also have another hat : Debian Press Officer. What is this about? What would you suggest to people who would like get involved in that domain? Debian press work is mainly about providing an official and coordinated point of contact to anyone wanting information from or about Debian. The press team answers all sorts of inquiries (the most popular one is is of course always the next release date) and makes sure all important events and developments within Debian receive the attention and recognition they deserve. Debian is a diverse project where every sort of contributor is free to voice his or her opinion in any way. We don t have NDAs or prescribed terminology. That s one of the things I love about Debian but also something that makes us difficult to handle for conventional media. They want official statements, in generally understandable terms, at appointed times. That s what the press team takes care of. Almost all of the press work is done in the publicity team, which coordinates using IRC, Mail and SVN. The publicity team also publishes the Debian Project News, which are very popular among our users and developers. Press work is also an area of work that offers lots of possibilities for non-technical contribution. http://wiki.debian.org/Teams/Publicity lists a number of possibilities for contribution and, like most Debian Teams, we d be more than grateful to get some more helping hands and happy to introduce interested newcomers to our work. What s the biggest problem of Debian? In my view: Overwork. Debian has thousands of contributors but still a lot of the main work rests on very few shoulders. We need more contributors, especially, but not only in the key teams. In order to get more people we need to do some marketing which is very hard for us, since we are very proud of our independence and have a strong focus on purely technical aspects rather than aiming for popularity. However, with the current amount of Open Source and Free Software projects to join we find ourselves not only in a contest on technical excellence but also a sort of popularity contest that is about perception rather than hard facts. This popularity contest is difficult for Debian and currently costs us quite a bunch of very capable people. Do you have wishes for Debian Wheezy? My answer to that is a non-technical one: I think Debian is currently very under-appreciated, we do a lot of great work and maybe even more importantly we do a lot of important work for Software Freedom, sometimes even at the cost of our above-mentioned popularity. I hope people will appreciate that more again in the future. Is there someone in Debian that you admire for their contributions? Over the years I have made a lot of friends within the Debian community, some have even become family. That makes it somewhat hard to single out individual people. I think what I admire most is continuous commitment. I am very impressed by those among us who have kept up a high level of commitment over many years and at the same time managed to bring that in line with a fulfilled personal/family life. That s something that I hope I ll also be able to achieve in the years to come.

---

Thank you to Meike for the time spent answering my questions. I hope you enjoyed reading her answers as I did. Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Twitter and Facebook.

2 comments Liked this article? Click here. My blog is Flattr-enabled.

While we are waiting for Lintian 2.5.0~rc3, here is a little update on what you can look forward to. About a week ago I had the pleasure of merging my branch into the Lintian master branch. While the IRC bot DOS ed the #debian-qa channel[SRY], cross-package checks became part of the official Lintian. Beyond the reduced amount of binary-without-manpage false-positives, circular-dependency checking and a partial broken symlink detector, the 2.5.0~rc3 release will also feature java and multiarch checks (kudos to Vincent Fourmond and Steve R. Langasek, respectively). The new java checks are based on the Java Policy and currently mostly covers checking for possibly build misconfigurations (jars without class files etc.), weird classpaths and missing Main-Class/depends on jarwrapper for executable jars. Note that #539315 has not been fixed, so executable jars will still trigger a warning. For people wanting to upgrade their libraries to multiarch, Lintian will have a check to see if you remember the Pre-Depends on multiarch-support. Personally I have not followed the progress of multiarch too closely, but last I checked multiarch-support was not in unstable. I guess we are ahead on this one. Other highlights include dont install stuff in /run , armhf support, less false positive on missing B-D on dh_python 2,3 and recognition of 3.9.2 as the latest version of the Policy Manual. I am also planning on starting a new branch and this time I intend to work on Vendor-based customization of Lintian. If you have any ideas/suggestions, by all means follow up on the thread on the Lintian list. [SRY] Sorry to anyone present in the channel!

I have noticed some problems with how Debian is using the popularity-contest data.

• popcon units are unknown Using the popcon score of a package to measure its use is like using the bleeple score of a trip to measure its distance. Both scores have no sensible units attached, though they may be loosely derived from a unit value. Is a trip with a bleeple score of 99 a long trip? Is a package with a popcon score of 99 a rarely used package? The only way to resolve this ambiguity at all is to compare ratios of values, so the problimatic units cancel out. A flight from NYC to AMS with a bleepie score of 99 is 50 times as bleepie as my drive home, which scores 2. So, any statement like "low popcon score" is basically so lacking in context as to be meaningless. Such statements are deprecated, and should be ignored.
• not all popcon scores are comparable The above example is intentionally bad. Plane flights and car trips are not very comparable when you don't know what units (time / CO2 / distance / number of people sharing a confined space / security theater points) are being used. Similarly, comparing a high popcon package like gnome-terminal with a relatively low popcon package like udhcpc is very deceptive. The former is installed by default in the desktop task, but plenty of desktop users would not miss it. The latter is installed only on embedded systems, which can exist in absurd numbers, and none of which will tend to report to popcon. So, any attempt to compare popcon scores should include a rationalle about why the two scores are comparable. For example, gnome-terminal and rxvt are somewhat comparable since they are both terminal emulators. But, only the vote scores, not the inst scores should be compared, since gnome-terminal is installed by default. dhcp3-client and udhcpc are not comparable despite being similar packages.
• popcon scores do not measure long tail effects A strength of Debian is that not only commonly used, but also uncommon and niche software is packaged. Popcon does not measure the benefit of some little used peice of software being there, packaged and ready to use when a user needs it. For six years I kept satutils in Debian, despite it probably having no users. It has a very specific use case, to control a motorized internet satellite dish typically installed on an RV. I did that because it was essentially no work (the package was approximatly bug free, and required no changes since 2007), and because of the possible payoff if someone needed this thing and there it was, in Debian. The value of Debian in that occasion would spike to a value that, while not directly comparable with a popcon score, would be pretty epic, for that one user, as they pushed arrow keys to move a satellite dish around. (It also had the best WITHOUT WARRANTY statement I've had the pleasure to write: "If you break your dish off your vechicle using this software, you get to keep both pieces.") Every removal of a package for "low popcon score" runs the risk of silently degrading this overall value of Debian.
• who wants to be popular? Part of the problem is that popcon has been around long enough that the connotations of its name, "popularity contest" have been dulled by repetition (and abbreviation). Popularity contests are not pleasant things. They rarely reach the best result. They embody the tyranny of the majority. The name was originally, to the best of my knowledge, chosen exactly to imply all these failings, to say that hey, popularity-contest is deeply flawed, but is better than nothing for this one specific use case (ordering packages to place on CD sets). We no longer think of popcon with these caveats. That is a regression in your brain. Fix it. By removing packages that appear unpopular, we run the risk of Debian becoming bland and homogenous.

The last weeks I spend quite a lot of time hacking on a Python library for the AR.Drone. The AR.Drone is a nice toy for nerds. You connect to it via WIFI and soon you ll realize that it has 4 ports open. Reading the specs you ll find, that on one port it listens for AT-Commands with which you can remote control the drone, on the other two ports it waits for an incoming package which will trigger the drone to send the navdata (speed, angles, battery status, etc) and the video stream. Heck, you can even telnet into the drone Unfortunately it comes without a proper software to control the drone, only an iPhone app (w/o iPhone of course). But given the documentation, it should be easy to write your own. While getting the beast to fly was relatively easy, decoding the almost -jpg-video-stream was not. Almost-jpg, since the images the drone sends are more or less jpg with a small difference which makes it impossible to decode them using standard multi-media libraries. Anyways, the format is documented and implementing a decoder was not that hard. The tricky part was to get the framerates from unacceptable 0.5 FPS to 12-22 FPS the whole decoder is written in Python. I m cheating a bit by using psyco, but the code in arvideo.py is heavily optimized to minimize calculations and to please psyco. In the code is also a small demo app which uses Pygame to display the video stream and allows to control the AR.Drone with the keyboard. It should be ready-to-use as soon as you are connected to the drone via WIFI. The git repository is here, the license is MIT. Suggestions and patches are welcome. Here is a video of the drone flying through the office.

No, it hasn't been released yet, but they're working on it. We've not been doing much about beid since squeeze was released, mostly because we understood that version 4 of the software was quite close, and that working on some 3.x version in that light would not make much sense anymore. But that doesn't mean I haven't done anything about it, at all; a while back, the FedICT people contracted me to help them build Debian packages they could put an 'official' stamp on, and provide through their website or some such. Some pre-release versions of these packages are now available through their google code project, and it would be welcome if people could try them out and give feedback. Links:

• The middleware package contains the browser plugin, which doubles as the PKCS#11 library. It should even auto-install, which the packages currently in the archive don't (due to technical reasons that would take us too far).
• The viewer contains an application that allows you to view the data on your eID card, print out a page with identity information, etc. It's not required for everyone, but can be interesting none the less.

In both cases, look under 'featured downloads'. These contain snapshot builds that should be fairly stable, but are not officially supported yet. Alternatively, you can track the head of the code (packages that are built automatically upon commit) by going to some alternative pages for the middleware and the viewer. Feedback is welcome, preferably through the relevant Google Code bugtrackers.

When you don t update a blog, it gets stale fast. Tim Bray Of course, I didn t intend to violate this basic rule of blogging. It just happened one thing leads to another, and pretty soon you notice just how little your front page has changed in the past two-and-a-half years. So, I shall begin again. Quite a bit has changed:

• It s especially ironic, given the previous post, that our family has given in and replaced the main television with a HDTV. Not that I ve changed pmy mind much; it s just that I ve decided to live with the limitations of the technology, and have figured out how to work around some of them.
• Although my suspicion of the cloud remains, my participation has greatly increased. I m now on Twitter, Facebook, LinkedIn, and piles of Google services.
• There s been a major health scare in the family, which is now behind us.

All of these will get their own posts in the very near future. In the meantime, enjoy the new look. (Especially on mobile!)

Generally speaking it is a really bad idea to hold passwords in cleartext. I am actually amazed people still do this! The standard way of holding passwords that has been around for years is to encrypt or hash the password and store the result, called a ciphertext. There have been many ways of hashing the password, starting off with plain old crypt with no salt (a random pair of characters) then crypt with salt through to MD5 and SHA. The thing is, each one of these hashing techniques results in a ciphertext in a different length. Now with most languages, this doesn t matter because you know what hash you are using; its simply the name of the function or some flag you set. PHP is different, because all of these methods use the one function called crypt which is a little confusing because it is more than plain old crypt. Around the PHP version 5.3 the developers started putting in the more complex hash algorithms which is good, but the ciphertext has been growing. A lot of applications store this hashed password in a database and the decision needs to be made; how big should this field be? For a long while, 50 characters would be enough and this is what programs like jffnms use. Unfortunately the SHA-512 algorithm needs 98 characters so what you get is half a hash stored. When the user enters their password, the program compares the full hash from that password to the half hash in the database and it always fails. I ve adjusted JFFNMS to use 200 character long fields which is fine for now. The problem is who knows what the future will bring?

Related articles

• France to require cleartext password storage (boingboing.net)
• Are You Sure SHA-1+Salt Is Enough For Passwords? (it.slashdot.org)
• What All This MD5 Hash Stuff Actually Means [Technology Explained] (makeuseof.com)
• Serious Security Flaw in Amazon.com Passwords (techie-buzz.com)

python-apt 0.8.0~exp2 bug fix release On Tuesday, I uploaded python-apt 0.8.0~exp2 to experimental, fixing about 10 bugs reported in Ubuntu and Debian bug trackers. It should know even convert integers correctly on all architectures, previously we could have passed long via varargs where int was expected. Bugs Until Thursday, I went through the bug list in Launchpad and closed/fixed/reassigned/merged about 100 bugs in APT and python-apt. APT & python-apt updates for squeeze Today, I uploaded updates of apt and python-apt to stable. They include support for xz and parsing multi-arch dependencies, as wanted by ftpmasters. APT 0.8.14 and wildcards/regular expression pinning Today, I uploaded apt 0.8.14 to Debian unstable, introducing support for pinning using glob() like Syntax and POSIX extended regular expressions. Let s say we want to pin all packages starting with gnome or kde to 990. The following example does this, using glob-like patterns for gnome, and a regular expression enclosed in / for kde:

Package: gnome* /^kde/
Pin: release a=experimental
Pin-Priority: 990
This closes 10-year-old Bug#121132 in Debian. Have fun with this feature, but please note that it may not be the fastest thing on earth, as it checks every package in the cache on initialization of such queries, which may take a few 10 ms. Since some time already, it s also possible to use such expressions for the Pin field. Thus users of Ubuntu releases could use the following piece of preferences to pin all packages in archives starting with lucid (e.g. lucid, lucid-updates) to 990:

Package: *
Pin: release a=lucid*
Pin-Priority: 990
Those types of pins do not have the negative performance impact of complex expressions in the Package header, as they are only checked against a smaller set of packages, or if Package: * , simply checked against the package files in the cache.
Filed under: Debian

The password-gorilla package has lacked some love since a while and at some point in time I orphaned it.
That happened due to the fact, that the upstream author was pretty unresponsive and inactive and my own TCL skills are very limited. As a result password-gorilla package was in a bad state, at least from a user point of view, with several (apparently) random happening error message and alike, stalling feature development etc.

But in the meanwhile there was a promising event arising. A guy, named Zbigniew Diaczyszyn, wrote me a mail that he intended to continue upstream development. Well, meanwhile is kind of an understatement. That first mail already happened in December 2009. And he asked me, if I'd like to continue maintaining password-gorilla in Debian. I agreed to that, but as promising as it sounded to have a new upstream, I was not sure if that would work out. However: My doubt were not justified.

In the time between 2009 and now Zbigniew managed to become the official upstream (with the accreditation of the previous upstream), create a github project for it and make several releases.


I know there are several people out there who tested password-gorilla. I know there were magazine reviews including the old version, which were a bit buggy with recent tcl/tk versions. It made a quiet good multi-platform password manager, with support for very common password file formats, stand in a bad light.
I recommend previous users of password-gorilla to try the new version, which recently has been
uploaded to unstable.

For marathon freaks, Boston marathon is a mythical one. Probably more than New York marathon, because this is the world's oldest annual marathon. Also because is is quite difficult to register for it (this year, the 20,000 seats reserved for qualifiers were distributed in....8 hours). In order to qualify, runners must have a previous mark that depends on their age and gender. For instance, in my age category (50-54), the required mark for men is 3h30, something I never achieved yet. This is what's required for the 2013 race. For 2012, it will be still 3h35, but a rolling process will be held to give best runners priority. So, in short, it will probably stay among my dream marathons forever..:-) The 2011 race happened yesterday and was a great event. Kenyan runners Geoffrey Mutai and Moses Mosop even broke Haile Gebresselassie's world record, set in Berlin, back in 2008. The ran in 2h03'02" while Gebresselassie's mark is 2h03'59". However, this record will not become official because Boston's race is one-way (thus with a possibility of consistent tailwind) and has a too big altitude difference between start and finish. However, many consider that hills on the race compensate this quite strongly, so this year's time is a really great time. And, really, from all reports I read and all images I saw, the level of support you get from the crowd is incredible there, with world famous moments like Wellesley College "scream tunnel", or Kenmore Square where, traditionnaly, the Red Sox have a game prior to marathon and the crowd then goes from Fenway Park to Kenmore Square to cheer the runners for their final mile (I have no idea how they can manage the unpredictable length of a base-ball game). And I can't even mention the final mile on Commonwealth Av., then Bolston St. Everybody who ran this once says this is something you have to do once in your life. So, well, I'm still crossing fingers..:-)...Maybe, one day a miracle happens, I can qualify *and* I get a seat and I fly to Boston...

Current mood: moved Today is an amazingly great day. I wrote a blog post about an event that I put together, and an attendee then followed-up by writing a long-form comment. The thing is, the attendee did a far better job of writing about the event than I did. The amount of emotional positive reinforcement that this comment gave me is hard to overstate. You can find it toward the end of the blog post but I hope you'll read the copy below. I am stunned and awed. I guess I have my work set out for me.

8----< CUT HERE >-----8

I have never written software for an open source project. I am not subscribed to any development mailing lists. I have not been in a chat room on IRC for months. Yet I was delighted to see this tweet from @torproject on 04/15/2011 https://blog.torproject.org/blog/vidalia-get-involved Join us in #vidalia on irc.oftc.net today at 13:00 UTC. The blog post described the Build It initiative for the Vidalia project, where people would be available to help you setup your build environment and compile the project. I have wanted to participate in open source projects for quite a while, but never really knew where to begin. I have experience (and enjoy) writing software. I am glad to learn the languages they are using. I know how to compile software. I m glad to learn their versioning system and build system. I looked into participating in several projects, but felt like I would be more of a burden than a help considering the relatively small amount that I was intending to contribute. I can generally figure anything out on my own, but it s nice to have somewhere to turn when you are struggling with something simple . I thought that this would be a perfect opportunity for me, since I already preach the use of Tor and Vidalia. I ve even demonstrated the bundle at a local LUG meeting. :) I joined the OFTC #vidalia room and waited nothing happened around 13:00 UTC, so I figured I d missed the event. They began around 13:30 UTC and walked us through the source code download process and compilation process. They directed our attention to the Volunteer page and the HACKING page. chiiph even suggested several simple OSX-specific tickets for me personally, since he knew that I was building on OSX. I ve already managed to contribute a patch for one ticket and am ready to begin a second ticket. I wouldn t have done it without help and feedback from chiiph and others. I am confident that there are many others who would be glad to help out with one or more of their favorite open source projects if they only had some place to begin. I hope that other project members or leaders offer a similar Build It events for their users. Jason Klein

Around a year ago, I bought a new videocard (Radeon HD 4870). It worked very nicely via the radeon(4) driver, and even the transition to KMS was pretty straightforward. Performance in games was also pretty good, at least for the games I was playing. However, I knew it's a bit of a power hog, especially at idle, so I always ran the card (under Linux) at low power, via class/drm/card0/device/power_profile = low. Wall-socket measurements gave me a somewhat high ~167 Watts of power (whole system). Recently I learned that 2.6.38 finally supports the Northern Islands/Barts chipsets, so I moved to a new HD 6870, mostly for DirectX 11 support (tesselation is shiny!) (even though I don't have yet any DX11 games). Had to run a rc kernel for a while, which didn't happen in recent times, but Linux still works nicely (and remember to update the firmware embedded in kernel if you change the GPU!). Also, performance in games is better, but the biggest surprise was the new idle power consumption: just 95W. Going from 167W to 95W, a ~40% reduction in overall power consumption just by replacing the videocard is surprising to me. Hey, if I would keep my computer powered on all the time for a few years the videocard would actually pay for itself Probably when talking just for the videocard itself the change would be more like 60% reduction in idle power consumption. I'm not sure whether to be upset with AMD for the very "bad" old card, or the very good results with the new one

My brother did invite me to the concert of the Wise Guys, a German acapella group. They are one of those special groups who are able to give a cheering live show and have this special cheek-in-tongue humour in a fair amount of their songs. This is the selection that helps me keeping my mood up though, you are invited to dig further.

• Jetzt ist Sommer: This was the first song I heard from them and got me interested to dig further into this band. And yes, it's true, summer is an inner feeling, not something governed by the outer world.
• Lass die Sonne scheinen: I have the feeling that this is a sequel to the former song. And it definitely helps too.
• Am Ende des Tages: No matter how your day went, what matters most are the people you think of at the end of the day.

Hope you are able to appreciate them as much as I am. At least they are able to cheer me up a fair bit.

/music permanent link Comments: 2 Flattr this

One of the more exciting upcoming features of Farsight is the ability to change the amount of required bandwidth depending on network conditions. Which means Telepathy based VoIP clients will be able to use higher resolutions and better audio/video quality if the network connectivity allows. And ofcourse, when the available bandwidth is low, the bandwidth usage can be lowered such that calls are still possible with lower but hopefully still acceptable quality. One side of the full story is measuring the available bandwidth, which hopefully Olivier will tell at some point. The other part is actually using less bandwidth. In case technical details are not that interesting to you, probably best to stop reading at this point.. An important way to control the bandwidth we're using in a call is setting the target bitrate on the encoding GStreamer element. While previously it was enough for us to set the bitrate before encoding started, we now need to be able to change it at runtime. And not only that, the codec implementation should ideally respond within a few frames and have a reasonable constant per-frame size. All in all, a lot of requirements on codecs we didn't really have before. Which usually means we need to retest the various codecs we often use and make sure we configure them correctly for the behaviour we'd like to see (and fix them if necessary). To do this I've written a small test program, which simply changes the target bitrate over time and outputs some numbers suitable to feed into gnuplot to turn into graphs. For example, when using x264enc with the current default farsight settings a part of the resulting graph looks something like this (full graph here): The blue impulses is the per-frame size (scaled), the green line the bitrate average over 10 frames and the red line the target bitrate. Clearly this isn't an ideal picture, we will need to do some more tweaks to our default settings to make x264 behave the way we want. The same will be true for all other codecs and codec elements, at the moment the GStreamer VP8 element doesn't handle run-time bitrate changes at all and the Theora element acts it its very own interesting way (graph here)