There have been a lot of web browsers embedding the Gecko engine, especially through the gtkmozembed library (it was not really a proper library but let s call it like that). I remember being a happy user of galeon, which went on as epiphany, but there were also all these small applications that just need a good HTML renderer in one of their widgets, like yelp, or several Python applications using python-gtkmozembed. Anyone having had to deal with these applications, especially the most complex ones, could tell you a few things:

• the Mozilla developers never gave a friggin damn about embedding;
• they don t know how to develop an easily embeddable library;
• the notion of a stable interface is a very arcane concept that they don t wish to grasp.

So, today, it is official: Mozilla is dropping gtkmozembed from their codebase. I don t think this will come as a surprise to anyone. You can t develop a new version of a behemoth, monolithic application every 3 months while still caring about the interfaces underneath. Embedded applications have been migrating to webkit over the recent years, and those that don t do it really soon will die. The interesting part of the announcement is not here. It can be found hidden in a bug report: a stable and versioned libmozjs will just never happen. What does it mean? First of all, it means that Debian and Ubuntu will have to go on maintaining their own versioning of libmozjs so that it can be linked to in a decent way by applications using the SpiderMonkey JS engine. It also means that this version will have to be bumped more often. But it also puts into question the whole future of SpiderMonkey as a separate library. With a shortened release cycle, the Mozilla developers will be tempted to add more specific interfaces to SpiderMonkey, reducing its genericity in favor of its use in Firefox itself. This will produce less and less useful libmozjs versions, until we reach the point when they ll make the same announcement as above, with s/gtkmozembed/libmozjs/. This is especially relevant in the context of the GNOME Shell, which is at the core of the GNOME 3 experience. The developers deliberately chose to avoid using JavaScriptCore (the JS library inside webkit) through the Seed engine, and used GJS instead, that relies on libmozjs. In my opinion this was done for frivolous reasons (being able to use more language extensions); and not only this put the GNOME developers in an awkward situation where 2 JS interpreters compete in the same desktop, but now it puts a risk on a technology which is at the core of the desktop. One of the reasons for the limited adoption of JSCore is that it lies currently in the same library as Webkit, which is a huge dependency. I ve been very glad to learn that Gustavo is considering the idea of splitting it. We need to provide an escape route for applications using libmozjs, and it looks like more than a decent one. I hope that GNOME Shell follows it sooner than later.

It's the first World Backup Day today. As the Obnam author, I can wholly agree. See source at backup-poster.svg. (Sorry, I didn't have the right font, so it doesn't look quite right.)

A while ago I said Koen from Emweb made an interesting proposal at FOSDEM about emerge, the KDE Windows build tool. Yesterday, Jaros aw Staniek and I reaffirmed our commitment to emerge . Today, I d like to go a bit further: let s bring more developers to emerge by opening it up to other projects. Keep reading! What is emerge, why is it important and what was Koen s proposal? Fact: Microsoft Windows is very different to Unix in regards to development. On Unix platforms -that includes Linux and Mac OS X-, software is usually installed to /usr: applications in /usr/bin and /usr/sbin, libraries in /usr/lib, headers in /usr/include, common resources in /usr/share, etc. Also, dependency management is usually something you can count on: when you install kdelibs5-dev in Ubuntu, it will automatically install libqt4-dev, kdelibs5-data, libfreetype (runtime), etc That makes setting up a development environment a very easy task: look for shared libraries, header files, etc in the common places and you will probably find them. On Windows there is nothing like that. When you want to compile an application, you need to provide (build and install) all its dependencies, and you need to tell Visual Studio where to find everything. Even CMake usually needs some help in the form of a hint for CMAKE_PREFIX_PATH. As you may imagine, building KDE, which has more than 200 third party dependencies and tens of modules (and with the move + split to git, many more) becomes an almost insurmountable task. Emerge to the rescue: inspired by Gentoo s emerge, Ralf Habacker, Christian Ehrlicher, Patrick Spendrin and others (yours faithfully included) developed a tool which downloads the source, configures, builds, installs and packages KDE and its dependencies. It makes a world of difference when building KDE. Actually, it makes building KDE on Windows possible. Once more: thank you very much guys, impressive tool. There are two well-differentiated parts in emerge, the engine and the recipes . The engine takes care of downloading the sources (tarballs, checkouts from Subversion and git clones, etc) , configuring and building for the usual build systems (QMake, CMake, NMake makefiles, etc), installing, bundling packages together and much more. All that for four compilers (MSVC2008, MSVC2010, MinGW32 and MinGW-W64). It s the equivalent to Gentoo s emerge, Debian s dpkg + debhelper/cdbs or Homebrew and MacPorts for Macintosh. The recipes are the package-specific instructions a particular piece of software needs to build: what s the name of the tarball? URL to download from? What versions are available? What build system to use to configure and build? Does it need any Windows-specific patch? They are written in Python using some helper modules emerge provides (the debhelper-like part I mentioned above). Currently, there are about 70 recipes in emerge, organized in our portage tree (bear in mind the names are taken from Gentoo but the internals of the tool are completely different). With those 70 recipes, we are able to build most KDE modules. Problem is to provide all the optional features, we are missing probably 200 to 250 more recipes. Given that KDE on Windows is quite short on developers, we have to decide: either we fix bugs and improve the integration of KDE on Windows, or we keep track of the dependencies. I won t lie: for KDE on Windows, I d rather focus on development than on packaging. Given that writing and maintaining recipes does not strictly require programming skills (although they help ), during my talk at FOSDEM I kept asking people to join the KDE on Windows team as packagers, even if you know little to nothing about software development. If you think about it, that s what we have in Linux distributions: there are hundreds (thousands?) of packagers in Debian, Fedora, openSuse, etc which take care of the recipes to build software developed by someone else ( upstream , in the parlance). What we have in KDE on Windows, where we are the KDE packagers, the KDE developers (upstream) and the emerge developers, is actually an anomaly. Then Koen took the microphone and said: why don t you open emerge to other projects? And I there I realized he was damn right We have developed an awesome tool to download, configure, build, package and install third party software on Windows, to manage dependencies, to update, etc. For four compilers, no less. The engine of emerge is not really tied to KDE. We already have a lot of recipes for software which is not KDE specific: openssl, Qt, bzip2, libpng, mysql, etc. I see no actual reason to disallow Gnome, GStreamer, OpenSceneGraph, LibreOffice and many others in (assuming someone wants to take care of them, of course no, do not look at me! I don t have time!). Currently, the only barrier preventing those recipes in is emerge is developed in the KDE repository and you need a KDE developer account to commit your recipes. That s about it. There is also a perception problem: if emerge is developed in KDE, it s because it s a KDE-thingy, right? . Well, no. One way to avoid that would be to graduate emerge from KDE and make it an independent project, one in which the current developers have accounts, and new developers get an emerge project account instead of a KDE account to commit recipes. Please note graduating does not mean expelling , firing or anything peyorative. It does not mean that emerge developers (engine and recipes) are worse than KDE developers, or less KDE developers than our god David Faure: in KDE, we consider Debian, Fedora, openSuse, etc KDE packagers as equals, they are also KDE developers and many of them are in the KDE eV (funny thing is I am not). My wish for today: think of one application or library you d like to see in Windows and become its maintainer in emerge for Windows. For now, let s do this in the kde-windows mailing list and if this idea succeeds, then we ll talk about graduating. You could also try to add support for a new compiler (OpenWatcom, Intel C++, etc) but that s a lot more more and it s not a priority now. PS: Yes, I know about CoApp, Microsoft s similar effort, with some magic involved. I ve been watching and trying it since day 1. I m really interested. It s just not there yet and I do not have spare time to help Garrett (hey Microsoft, hire me and I ll have all the time in the world! )

Cory Doctorow wrote an interesting article for The Guardian about Harper-Collins attempts to make self-destructing books [1]. They claim that a traditional book falls apart after being read 26 times (a claim that Cory disputes based on personal experience working at libraries) and want ebooks to be deleted after being borrowed so often. Really the copy-right fascists are jumping the shark here.Socialogical Images has an interesting archive of adverts for supposed treatments for autism, obsessive-compulsive disorder, asperger syndrome, and attention deficit and hyperactivity disorder [2]. The New York University Child Study Center conducted the campaign of fake ransom notes to describe a psychological difference as something that kidnaps a child. The possibility that parents should to some extent learn to adapt to their child s nature rather than fixing them with medication is something that most people can t seem to understand.William Cronon has written an interesting analysis of the way Conservative , lobby groups work [3]. They are more organised than I expected.The Reid Report has a good summary of some of the corporat issues related to the Japanese nuclear melt-down [4], apparently the company that runs the reactors decided to delay using sea-water in the hope that their investment could be salvaged and thus put everyone at increased risk. I think that this proves that reactors shouldn t be privately owned.Ian Lowe wrote a good summary of the reasons why Australia should not be using nuclear power when we believed that the Fukushima disaster was over [5]. But it turns out that the Fukushima problems were worse than we thought and the melt-down is getting worse.Christopher Smart wrote a good analysis of Microsoft s latest attempt to extort money from Linux users where they assert patent claims over Android [6]. He points out that .NET/Mono is a risk to Linux.Major Keary wrote a positive review of Snip Burn Solder Shred which is a book about Seriously geeky stuff to make with your kids [7]. Sounds like a fun book.The internal network of RSA has been cracked in some way that apparently weakens the security of SecureID, Bruce Schneier s blog comments section has an interesting discussion of the possibilities [8]. I expect that it s a fairly bad attack, if the attack was minor then surely the RSA people would have told us all the details.Hans Rosling gave an interesting TED talk about The Magic Washing Machine [9]. He describes how his family benefited when his mother first got a washing machine and how this resulted in better education as his mother had more time to get library books for her children. It seems that deploying more electric washing machines should be a priority for improving education and food supplies in third-world countries.Paul Root Wolpe gave an interesting and disturbing TED talk about bio-engineering [10]. He catalogues the various engineered animals and talks about the potential for future developments.Ron Rosenbaum wrote an interesting and insightful article for Slate about Maj. Harold Hering who s military career ended after he asked how to determine whether a nuclear launch order is lawful, legitimate, and comes from a sane president [11]. The question never received a good answer, this is a good reason for moving towards nuclear disarmament and for Americans to vote for the sanest and most intelligent candidate in the presidential elections.Eythor Bender gave an inspiring TED talk about human exoskeletons [12]. He had live demonstrations on stage of a soldier using an exo-skeleton to carry a heavy backpack and a woman who suffered a severe spinal-cord injury walking after being in a wheel-chair for 19 years.

• [1] http://www.guardian.co.uk/technology/2011/mar/08/ebooks-harpercollins-26-times
• [2] http://thesocietypages.org/socimages/2008/02/26/mental-illness-steals-your-childs-true-self/
• [3] http://scholarcitizen.williamcronon.net/2011/03/15/alec/
• [4] http://blog.reidreport.com/2011/03/when-the-corporation-is-in-charge-japanese-nuke-co-delayed-sea-water-solution/
• [5] http://www.theage.com.au/opinion/politics/no-nukes-now-or-ever-20110319-1c1ed.html
• [6] http://blog.christophersmart.com/2011/03/22/microsoft-licenses-its-patents-to-android-manufacturers-sues-if-they-dont-agree/
• [7] http://luv.asn.au/review/snip-burn-solder-shred
• [8] http://www.schneier.com/blog/archives/2011/03/rsa_security_in.html
• [9] http://www.ted.com/talks/hans_rosling_and_the_magic_washing_machine.html
• [10] http://www.ted.com/talks/paul_root_wolpe_it_s_time_to_question_bio_engineering.html
• [11] http://www.slate.com/id/2286735/pagenum/all
• [12] http://www.ted.com/talks/eythor_bender_demos_human_exoskeletons.html

* Finally! Thanks to Sham who forced me for this

This month I built two systems with identical hardware component (except for the case). Here s the list of components:

• Case 1: Silverstone Sugo SG02-F white
• Case 2: Arctic Cooling Silentium T11 white
• Motherboard: ASRock 880GMH/USB3 R2.0
• Processor: AMD Phenom X4 840 boxed
• Memory: Corsair XMS3 2x 2 GiB DDR3-1333
• Hard drive: Samsung SpinPoint F3 1 TB
• Power supply: be quiet! Pure Power 430W

Cases often don t meet my high requirements. Many cases are sharp-edged, bad designed (inside and outside), use cheep plastic, and/or vibrate, because the hard drives confer their vibration to the case. The Sugo SG02-F case is not perfect, but I will recommend it. The Silentium T11 case has no shard edges, but I won t recommend it. Too much plastic and optical not appealing. You probably have to replace the boxed CPU heat sink and use a better power supply if you want a silent system. How well do these components work with Ubuntu 10.10 (and probably other recent GNU/Linux distributions)? Perfectly. Everything that I tested worked:

• The USB 2.0 and USB 3.0 ports work with everything plugged in (mouse, keyboard, flash drives).
• Audio works (only stereo output tested; 5.1 sound was available in Pulseaudio)
• 2D and 3D graphics work with the free (libre) radeon driver (Compiz runs)
• LAN works

Today, in an IRC channel near you, the discussion came to recover files from lost+found somehow. Two years ago I wrote some scripts to automatically recover files from lost+found, so this is some sort of a repost. There are two scripts: one that generates some kind of ls-LR file to have all the information needed for the second script, which restores those files in lost+found to their original folders. Here is the information from the original blog post: make-lsLR.sh - call this regularly (cron) to create the needed files that are stored in /root/. Of course you can alter the location easily and exclude other directories from being scanned. check_lost+found.py - The second script is to be run when your fsck managed to mess up with your files and stored them into lost+found directory. It takes 3 arguments: 1) the source directory where your messed up lost+found directory is, 2) the target directory to which the data will be saved and 3) a switch to actually make it happen instead of a dry-run. You can find both files as attachment end the end of this blog post.

I've chosen to copy the files to a different place instead of moving them within the same filesystem to their original place for safety reasons. Primary goal is to retrieve the files from lost+found, not to replace a full featured backup and restore application. Because of this the script doesn't handle hard- nor symlinks correctly. It just copy files.

Of course there's still room for improvements, like handling hard-/symlinks correctly or using inode number instead of md5sums to move data back to its prior location. But it works for me[tm] well enough in this way, so I'm satisfied so far. You're welcome, though, to improve this piece of ugliness if you like.

Maybe someone else finds this usefull as well. Use it on your own risk, of course. :)

Kristian Ki ling from the Ubuntu User magazine interviewed me at the last Ubucon. You can read the (German) interview in Ubuntu User 02/2011 or on-line.

I found some time ago this site which aims at proving that Linux desktops are currently over 1%. So, I registered my and my wife's Debian GNU/Linux desktops to contribute to the statistic.

http://www.dudalibre.com/gnulinuxcounter?lang=en

As publicity for GNU/Linux, this project has potential to put Linux on the radar of more producers, so, please, add your desktops to the counter!

I have generated a new GPG key (4096R/7C5BB6A5) associated to my personal identity, for the needs of my application as Debian Developer. Therefore, the old key (1024D/B4C5F37F) will soon be retired. If you happen to meet me, I d be glad to have my public key signed again by you.
Here s a copy of the new public key, and one, signed with the old. I ve also added a transition document here. If it suits your signing policy, you may as well sign the new key without meeting me again, if you had signed the old one already. As usual, you may download it from keyservers with something like (for instance on keys.gnupg.net):
gpg --keyserver your-preferred-key-server --recv-key 7C5BB6A5

Recent attacks against the DNS infrastructure have exposed the limitations of relying on TLS/SSL certificates for securing connections on the Internet.

Given that typical mail servers don't rotate their keys very often, it's not too cumbersome to hardcode their fingerprints and prevent your mail software from connecting to them should the certificate change. This is similar to how most people use ssh: assume that the certificate is valid on the first connection, but be careful if the certificate changes afterwards.

FetchmailHere's how to specify a certificate for a POP/IMAP server (Gmail in this example).

First of all, you need to download the server certificate:

openssl s_client -connect pop.gmail.com:995 -showcerts
openssl s_client -connect imap.gmail.com:993 -showcerts

Then copy the output of that command to a file, say gmail.out, and extract its md5 fingerprint:

openssl x509 -fingerprint -md5 -noout -in gmail.out

Once you have the fingerprint, add it to your ~/.fetchmailrc:

poll pop.gmail.com protocol pop3 user "remoteusername" is "localusername" password "mypassword" fetchall ssl sslproto ssl3 sslfingerprint "12:34:AB:CD:56:78:EF:12:34:AB:CD:56:78:EF:12:34"

PostfixSimilarly, to detect changes to the certificate on your outgoing mail server (used as a smarthost on your local postfix instance), extract its sha1 fingerprint:

openssl s_client -connect mail.yourisp.net:465 -showcerts
openssl x509 -fingerprint -sha1 -noout -in isp.out

Then add the fingerprint to /etc/postfix/main.cf:

relayhost = mail.isp.net
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = fingerprint
smtp_tls_mandatory_ciphers = high
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_fingerprint_digest = sha1
smtp_tls_fingerprint_cert_match =
12:34:AB:CD:56:78:EF:90:12:AB:CD:34:56:EF:78:90:AB:CD:12:34