Search Results: "ag"

13 February 2011

Norbert Tretkowski: MySQL source tree available in Debian as binary package

MySQL supports a plugin interface since 5.1, which enables creation of server components. Plugins can be loaded at server startup, or loaded and unloaded at runtime without restarting the server. Most of these plugins require the full MySQL source tree during their build, which was not available in Debian as a binary package until I uploaded 5.1.54-2 to unstable last week. I had this item on my TODO list since MySQL 5.1 was uploaded to Debian unstable, because it is not possible for a Debian source package to build-depend on another source package. Thankfully, Clint Byrum from Ubuntu sent me a small patch which added the new binary package.

The first package making use of the new mysql-source-5.1 package is HandlerSocket, a NoSQL plugin for MySQL. It is currently waiting in Debian's NEW queue for approval, and I am sure we will see more plugins/packages (XtraBackup from Percona is another well known candidate) making use of the new binary package in Debian soon.

Wouter Verhelst: PMW uploaded

Earlier today (or, well, last night, since it's fairly late alrady) I uploaded pmw (about which I blogged previously). In preparation for that, I've also uploaded aspic, which is required to build pmw's documentation. While I'm quite fond of pmw already, and intend to maintain it inside Debian for quite some time, my interest in aspic is limited to the fact that I need it for pmw. So if anyone seems interested in adopting it... be my guest. But do talk to me, first. In my previous blog post, I've raved about how I like pmw much more than I do lilypond. I had two reasons for that, at the time: Now, I have a third:
wouter@celtic:~$ grep-available --eregex -FPackage -sInstalled-Size -sPackage '(pmw lilypond)'
Installed-Size: 1916
Package: pmw
Installed-Size: 7048
Package: lilypond-data
Installed-Size: 392344
Package: lilypond-doc
Installed-Size: 896
Package: pmw-doc
Installed-Size: 4184
Package: lilypond
Less than two megs for pmw, versus over ten for lilypond and lilypond-data combined; and less than a megabyte for complete documentation plus examples for pmw, versus several hundred megs for lilypond-doc. And it's not because pmw is less flexible, or has less features, or is less well documented, or anything of the sorts. It does have less output options; but then it's not like it's hard to convert PostScript into something else or anything.

Thorsten Glaser: FOSDEM was a blast!

I just need to work more on bilocality. While I did find two geocaches, one at the South/Noon Train Station (taalverwarringen ), one in the buurt of the University, I did manage to miss the AW building completely and utterly. Wow. Except, that Haiku guy came over to talk for a bit (nice). And I drew. An Atari logo with swirl, for that weird stuff I recently have been found doing. More mksh-current news coming soon, stay tuned. In the meanwhile, I met bonsaikitten IRL (at FOSDEM, yes, too) who kindly made a live ebuild , i.e. a source package building -current. Finally let s say a big thank you to the person mostly manning our booth, gecko2, and to Benny for talking to people, getting That Other Packaging Thingy working, and pimping the website a bit.

12 February 2011

Tim Retout: Gnash and cookies

A new release of Gnash, version 0.8.9, is due in the near future. Plenty of bugs have been fixed, but some users are still going to have problems playing YouTube videos. Here's a short explanation. At some point last year, YouTube started setting HTTP cookies in your web browser, to keep track of which of their video servers is nearest to your machine. This lets them provide a better experience for you (I guess). Here's a diagram of what goes on in your browser: Diagram showing browser fetching HTML and SWF files, and Gnash core fetching FLV video independently. As of Gnash 0.8.8, a workaround was added, calling an NPAPI function NPN_GetValueForURL to ask the web browser for the relevant cookies. New diagram: Diagram showing Gnash core asking browser for cookies, and still fetching FLV video independently. The downside is that this function was only added in NPAPI version 1.9. This means: What does Adobe's plugin do? I imagine it's something like the following: Diagram showing browser making all HTTP requests, and Gnash core requesting data through the Gnash plugin So, the good news is, this problem should almost certainly get fixed over the coming Debian release cycle, if only because all the browsers will get updated. In the meantime, disabling cookies (and removing stale ones from YouTube) is a workaround.

Joerg Jaspert: Daily comic strips

I ve been using dailystrips since April 2006 to get a daily overview page of all the various daily web comics I (and a few friends) like to see. It makes it much simpler than having to browse dozens of various webpages, with all their useless webbugs integrated, to see stuff. That had some drawbacks: So about two or three weeks ago I took a look at dailystrips code to figure out where I need to stuff some lines in to get the additional information. Yuck. No. I don t like it. Not because it is perl, that alone would be fine. So, instead I went and did a little rewrite of it. In a simple and pure bash script. I duplicated the functionality of the daily mode (fetch images per day and put them into a daily subdirectory, create html files for them) and didn t bother with the fetch a random strip one as I never used that. Turned out at 276 lines of shell script that can even fetch alt/title and not break on funny characters in them, yay. Even better, as the search terms for the additional information is just a regex using bashs capability there run over the html file, one can have anything from it put as alt/title onto the final page. When I had that working I asked a colleague to provide a bit of CSS, so it also looks better now. An example output is available (note that the Previous/Archive links are not available there), and if you want you can take a look at the code too. There is no Debian package and I m not sure there should ever be one. If you want to get me patches feel free to mail me, be it for the CSS or the script, whatever.

Evgeni Golov: Privacy-over-IP does not exist

Did not exist.Will never exist.There was quite a lot of buzz about privacy with that new IPv6 thingy. Some say it is bad, as you will have a static address. Some say the privacy extensions will fix everything. I say: lemme rant ;)First of all, that was the internet, when I started using it back in 1999:

 [  New Yorker Magazine, March 1993] On the Internet nobody knows that you are a dog'
[ New Yorker Magazine, March 1993] On the Internet nobody knows that you are a dog And that s the internet today:

robcottingham.ca - How the hell does Facebook know I'm a dog?
[ robcottingham.ca] How the hell does Facebook know I m a dog?

Well, I d say that s not correct. Even in 1999 facebook could know you are a dog (if you ignore the fact, that there was no facebook in 1999), it s just noone really cared about it. But let s start from the beginning :)An IP-address is a 32-bit integer

An IP-address is technically a 32-bit integer, formatted into 4 8-bit parts (you can read more about IPv4 at Wikipedia), which makes a total of 4,294,967,296 possible IP-addresses. Your ISP has a range in this address-space it can give to its customers (you). My ISP (Unitymedia) owns about 300,000 IP-addresses (based on the RIPE database), which is about 0.007% of the whole address-space. If you look at the RIPE page, you see two common netname prefixes (DE-KNRW and DE-IESY-HFC) which match two regions of Germany where my ISP has its customers (Unitymedia is a merge of ish and iesy). What does that mean? It means one can map a Unitymedia customer into one of these regions, even if he would change his IP-address (Unitymedia uses DHCP with high lease-times, so this does not happen actually). It does not map the customer to a dog yet, but I bet real GeoIP databases can map them correctly to a city (I didn t try much, but this site suggests it works: http://www.ip-adress.com/?lc=en at least they map me correctly to Duesseldorf).Dynamic IP-addresses do not improve privacy

Given the above facts, even if Unitymedia would give me a new IP-address every X hours (many DSL-providers have X=24), it is still possible to map me into a set of about 150,000 users (here user means customer, there still may be multiple computers connected via the same line). I would even go further and say the set is much smaller, as I think I am not able to get every free IP-address from DE-KNRW-*, as these should be bound to cities/regions (GeoIP databases exist, you rememember?) and I do not move with my line.Routers and reverse DNS kill privacy

Currently, my IP-address is 62.143.232.104, which has a reverse DNS entry ip-62-143-232-104.unitymediagroup.de and does not say anything about me or my location, besides of the obvious Unitymedia customer . But look at the traceroute:

4  7111A-MX960-01-ae5.frankfurt.unity-media.net (80.81.192.181)
5  13NOC-MX960-01-ae8.kerpen.unity-media.net (80.69.107.26)
6  1411G-MX960-01-ae9.neuss.unity-media.net (80.69.107.2)
7  1411J-MX960-01-ae1.bilk.unity-media.net (80.69.107.70)
8  PH-1411J-uBR10k-06-Te-1-2-0.bilk.unity-media.net (80.69.102.106)
Frankfurt is about 250km from here, Kerpen about 60, Neuss about 10 and Bilk is a part of the city I live in, about 4km away from my home. I guess you get the idea :)Browsers kill privacy tooDo I have to say more than a link to https://panopticlick.eff.org/? My Chromium scores one in 1,400,000. How much IP-addresses did I have to hide in again?We are at the dog level now, dogs use BoneOS with FireBark, not Linux with Chromium :)IPv6 kills cute kittensOh, and privacy, because with IPv6, there are 2^128 IPv6-addresses out there, of which your provider will maybe own a /32 (2^96 addresses) and give you a /48 (2^80 addresses) or (more likely) /64 (2^64 addresses). Then you enable the great IPv6 privacy extensions (RFC4941) and happily hide in your own assigned subnet, still being a customer of your ISP, still living in the same city and using your old browser It s just about mapping subnets instead of individual IP-addresses then. And we can t get lower as the dog levelPeople can annoy meI did not write all this to teach you, you can do yourself with Wikipedia and RFCs. There is a person out there, who thinks using a random name, mail address and twitter account could fool me into thinking that s a new, yet unknown, person to me. Well, I am not stupid, sorry. When you comment on my blog, your IP-address is logged, when I approve the comment, I often look at the reverse DNS and the whois entry of that IP-address (sorry, I AM paranoid). I even might check my webserver logs (or Piwik) where did you come from (Google etc), writing accidentally in your comment does not help :) Also, if you are trying to fool me, don t use your own computer, running Windows 7 and Firefox which I installed. Oh, and probably do not use your home line which I used to login into my admin-area using my unique Chromium ;)Sorry Hanna Lena, the chicken has just eaten her own eggs And yes, one can track down a single person on this big thing called internet, IPv6 will not change this (in any direction).

Dominique Dumont: FOSDEM video of config-model talks are available

Hello The Cross-Distro video team was very fast this year: All videos of the cross-distro talks are available. Among them, you can find the 2 config-model related talks I gave: If you re interested in the subject of collaboration between distribution, you can also view Vincent Untz s talk: Example of cross-distro collaboration: Application Installer All the best.

Joey Hess: d-i is ten

I just realized that the Debian Installer is ten years old! It actually got started ten years ago last summer, but now is also an apt anniversary -- ten years ago, I successfully booted d-i for the first time. It's amazing that d-i has been around as long as Debian Developers who have "been with the project longer than most". (Many of whom have been long-time contributors to d-i themselves.) Astonishing that my basic design has held up and remains relevant. And every time I boot up the Debian kFreeBSD installer, or run the graphical installer, or hear someone raving about how easy Ubuntu was for them to install (and know d-i was underneath), I'm amazed at the places people have taken d-i. The code has recently moved to git. As changes like ext4 by default start to flow in to d-i, with Wheezy development starting up, I hope to see more people enticed into working on d-i. Anyone can do like Matthew Palmer has done with netcfg -- pick a component of d-i that interests you, check out its git repository, and take it from being reasonably well team-maintained to awesomely you-maintained. In five or ten years Matthew will be able to look back at all the people who have used d-i to install over IPv6, and on WPA wireless, and with his other netcfg improvements. Trust me, it's a great feeling. Previously: d-i retrospective (better written than the above & well worth a re-read)

Julien Blache: forked-daapd: future directions

I ve got a few mails lately enquiring about the lack of visible activity on forked-daapd in recent times. Well, for one, I ve been busy with other things, but there s also been some non-public activity. So, here s what should happen in the next few months, in no particular order: The database overhaul will bring a much-needed speedup on small devices and big libraries. It s being worked on, but it ground to a halt with new year and all. Hopefully it ll resume soon. I m also giving up on ffmpeg for metadata extraction. It doesn t work well at all (as everybody knows by now) and it s actually getting worse and worse. With the ffmpeg takeover/fork (call it whatever you want) it s unclear what s going to happen on this front. So I m giving up and the metadata scanner will probably switch to using TagLib (one more dependency, yay). Last, but definitely not least, the libdispatch codebase should finally see the light at the end of the tunnel in the coming months. I ve been working on this since July last year, moving away from libevent. If you never heard about libdispatch, or Grand Central Dispatch, read my previous post on the subject. I ll talk about it in more details at a later date. Finally, as far as Squeeze is concerned, I plan to provide forked-daapd backports as long as it ll be practical to do so. This is it for now. I don t have a one more thing in my sleeve, sorry. Time is at a premium right now, so big things have to wait.

Norbert Tretkowski: MySQL 5.5 and Debian

Since MySQL 5.5 was declared stable in December last year, I regulary receive e-mails from people asking when it will get uploaded to Debian. The good thing is that the initial conversion from automake to cmake has already been done by Clint Byrum from Ubuntu, and we are going to use his work as a basis for our packages. The not so good thing is bug #59078, an issue in libmysqlclient which breaks ABI compatibility. According to Lenz Grimmer from Oracle the MySQL upstream developers are already looking at it.

I am still not sure if it is a good idea to upload MySQL 5.5 in the current state to experimental, but I am definitely not going to upload it to unstable until this issue is fixed.

David Welton: Book Review: Start Small, Stay Small, A Developer's Guide to Launching a Startup

<iframe frameborder="0" marginheight="0" marginwidth="0" scrolling="no" src="http://rcm.amazon.com/e/cm?lt1=_blank&amp;bc1=000000&amp;IS2=1&amp;bg1=FFFFFF&amp;fc1=000000&amp;lc1=0000FF&amp;t=dedasys-20&amp;o=1&amp;p=8&amp;l=as4&amp;m=amazon&amp;f=ifr&amp;asins=B003YH9MMI" style="width: 120px; height: 240px; float: left; margin-right: 10px;"></iframe> I tend to be a sucker for business books, to the point where I created (and later sold) a site to discuss them. Part of the motivation for creating that site was that a lot of them tend to contain one good idea, and an inordinate amount of fluff. This book does not - it's good material that could not easily be summarized because it's full of information. I think it's actually one of the more relevant books I've ever read in that, for my situation, the idea behind it really speaks to me. I work as a consultant during the days, and I like it a lot. Rather than working on the same old thing year after year, I get to meet new people, new clients, new situations, and help them out, which is motivating. However, consulting has its downsides too, in that it doesn't create a great deal of long-term value. Once you've finished up a project, it's on to the next one, or no money comes in. I'm also a bit older and more set in my ways: I did my time in the California Bay Area, and I don't relish going back and working like mad on a "Real Startup" with VC backing, crazy hours, and having the thing consume my life. The idea behind "Start Small, Stay Small" is to find and create really niche products: stuff that will earn you some extra money as a developer, but also niches that are small enough to not really be interesting to larger companies that need a lot of income to justify a forray into a particular market segment. This, then, becomes your 'competitive advantage': Microsoft, or even 37 Signals, simply isn't going to chase after a market that is worth 20,000 dollars a year. And yet for someone working on their own, if you manage to set up something that brings in that money, and mostly automate it so that it's not a second job, it's a tidy extra bit of money. Several projects like that might even be enough to live on, depending on your lifestyle. With that in mind, the authors, Rob Walling and Mike Taper, delve into the details of how to go about doing so. The whole thing is done under the assumption that you don't have a lot of time or money to throw at things that don't bring in concrete results in relatively short order. Various subjects discussed in detail include how to find a niche, how to create a sales web site, how to measure market demand, conversion rates, how to productively outsource less critical portions of your business, and much more. They also discuss what sorts of numbers to look at for various aspects of the business, and anchor the discussion with real numbers for many things, rather than just giving you a hand-wavy phrase that's not that useful in the real world. It's not a 'timeless' book as all the concrete numbers and techniques reference technologies, sites, and the market dynamics of 2011, but after all, that's part of what makes it good. Other things I didn't like so much were being sold on their for-pay "micropreneur community", and the relatively high price of the book but I think it's worth it given the real advice you get. If you don't like marketing, and think that products succeed or fail on their merits alone, of course the book will leave you cold, but of course you're wrong about that anyway!

Wouter Verhelst: Ten years of Debian

My first ever Linux installation was done in the late nineties 1998 or thereabouts but was a RedHat 4.5 installation rather than a Debian one. The reason for that was fairly simple: the Infomagick sixpack CD set that I'd bought contained RedHat, Debian, and Slackware, but the RedHat installation was the only one that could be installed directly from CD the other two required me to write floppies and boot from those to start the installation, and I wasn't very fond of that idea. It was only a few years and a few broken RedHat upgrades later that I saw the light and considered trying out this Debian thing that some of my classmates were talking about. The fact that I'd just bought my own computer (rather than having to compete for time with my siblings on my parents' computer) was a good reason to do a fresh Linux installation. I'd been planning to install Linux From Scratch, but as what was still known as the LFS HOWTO told me you'd need a working Linux installation to do that, I considered my options. Since I'd developed a strong dislike of RedHat, I wasn't interested in doing another RedHat anymore. So, I downloaded the most recent version of Debian at the time (Potato Test Cycle III), wrote it to a CD, and installed. I've probably still got the CD lying around somewhere. A few months later, I found these "Linux Gazette" packages in the archive, with the latest packaged issue being 47, but the latest upstream version being much higher. Trying to figure out what was going on, I mailed the maintainer, Adrian Bridgett, who encouraged me to take over maintenance. Thus began my life of actively contributing to Open Source software. In November 2000, I applied to become a Debian Developer. In January 2001, Martin Michlmayr was assigned to be my AM. And in early February 2001, now just over ten years ago, I'd become a Debian Developer. Yes, that was fast, and no, I probably wasn't really ready yet, at the time. Originally, I only cared much about these Linux Gazette packages. But, as time went on, I started looking around, too. A friend passed me an old Macintosh Centris 610. As I tried to install Debian on it, I found that it didn't actually run very well. This turned out to be due to it having a broken 68LC040 processor, so I bought me another m68k-based mac, one with a full 68040 processor (a Centris 650). Thus I became involved in the m68k port and buildd maintenance. As these old machines came with 80MB or 250MB SCSI hard disks of which I had none laying around, and a then-recent Debian installation had minimum requirements of about 200MB, I was in need of network storage to be able to do anything useful with the mac. NFS didn't work as expected; the RTC implementation on m68k mac hardware was reverse engineered and didn't work too well at the time, which meant that the clock would run slower if the machine was under load, and that in turn would mean that make would get confused about timestamps, since they would suddenly appear to originate from the future (in NFS, it's the server that assigns time stamps, not the client). There was a simple solution, however; Pavel Macheck had written this neat 'Network Block Device', which would let the client do its own filesystem on network storage. Only it wasn't packaged; but then, that was easy to fix. Thus I started maintaining the single piece of software that I've worked the most on, to date. A few years later, Pavel lost interest in maintaining NBD, and handed over upstream maintenance to me and maintenance of the kernel side to Paul Clements. Thus began my life in upstream work. And while I originally joined Debian with the intent of using it as a learning experience and stepping stone on my way to more "important" free software, I found that it wasn't as satisfying as was my work for Debian. Over the years, there's been this duality where I've felt like I was doing too much and not enough at the same time. Too much, because the things I was doing would eat up much of my spare time, leaving little time left for other hobbies. Not enough, because I witnessed other people doing much more for Debian than I did, and I wanted to make a difference. As the years passed by, many things have changed. Not only in Debian, but also besides it. I became an independent contractor, focusing mostly on supporting people in using Debian (although I support them with other distributions, too). The importance of a port went from 'something which these weird porter people are doing, and that we should probably help them with if it doesn't work, but is their problem really' to 'something that I really really really have to make sure works for my packages', and back for the port that I cared about most. After several years of trying, I finally managed to explain to my parents what this Debian thing is, why it matters, and what my role in the whole thing is. We did a few releases, some taking longer than I would've liked. People joined the project, and left again. Some of my friends died. My fame in the project rose, even though I wasn't aware of it initially; and thus I was rather surprised when someone asked me whether I was "the Wouter Verhelst" at a key signing party. Recently, I've started looking back, and considered the things which Debian has meant to me. Ten years ago, I was 22, still in college, and had way too much spare time on my hands. I'd recently gotten my first Internet installation, and all these online communities were very new to me. Yes, that was all probably rather late. Debian has changed my life in many ways; it has allowed me to meet various kinds of people, both online and in meatspace. I've been to Helsinki, Edinburgh, Mar del Plata, C ceres, and New York City, places that I might otherwise not have visited. Each of these trips was an incredible experience that I have fond memories of; and while the most fond ones originate from Helsinki, I cherish the memories of each of these trips as some of the best trips I've ever done. Working on Debian has forced me to learn about the inner workings of a Linux-based system, which is knowledge that has helped me tremendously professionally, too. And finally, working on Debian has given me a unique perspective on this whole FOSS community, which has helped shape my ethics and my view of the world. While I believe that I would've subscribed to most of that ideology at any rate, I'm not sure that the details of my beliefs and understanding would've been exactly the same. And while I don't agree on every position that the project subscribes to as a whole, I do believe that the philosophies that lie at the core of this project contain just the right mix of pragmatism and ideology that makes it possible for our project to thrive in a changing world of not only a growing group of people who subscribe unconditionally to the free software ideals, but also business people who care mostly about money. Over the years, somehow I moved from "one of the recent batch of new Debian Developers" to "someone who's been with the project longer than most". It still feels weird to see people shut up because you've built up a reputation in some area, and you give your gut opinion on some subject without researching it too much. I try not to let that happen too often. Today, ten years and just over a week ago, my life as a Debian Developer started, and it would change the way I looked at the world, the things I would do in my spare time, and the people I would meet. I wouldn't have it any other way. Thanks, Debian, for what's been a blast; may the next ten years be as inspiring to me and everyone as the past ten!

Erich Schubert: Joerg Schilling stilly spreading FUD

J rg Schilling is still spreading FUD (currently on an openSuSE list):
There is a social issue with Debian that attacks OSS projects _because_ they use the GPL. Please do not follow these attacks without asking a lawyer.
The removal of cdrecord has been the best reaction to these issues, since apparently working with him is impossible. In this thread, he again manages to accuse everybody else of lying and being incompetent. This clearly shows that you cannot work with him, and the only viable way is ignoring him as far as possible.
It also speaks of a hurt ego in a probably narcisstic person (after all, he seems to think everybody else is incompetent and lying - but I am not a psychologist, so this is not a diagnosis!).
Let me just point out one fact:
By not shipping his current cdrecord, we can obviously not violate any even just potentially invalid license. The way Debian is dealing with this issue is legally undoubtedly correct: obviously, we are not oblieged to include his software.
On the long run, I assume that Debian will also get rid of cdrkit/wodim. In my opinion, this is just a legacy code until we can switch to libburnia entirely, and we should now try to drop cdrkit/wodim as well in order to ship "wheezy" without it.
Since we cannot work with J rg, the only sane way is to try to completely remove any code he wrote from our systems so we have no reason whatsoever to communicate with him.
cdrecord is dead, long live libburnia.
I expect to see lots of FUD from him in the post comments any time soon ... but I do not care: I don't use his software. My current laptop doesn't even have a CD drive ... and despite his claims, the Debian versions of cdrecord and wodim worked perfectly for me when I was still burning CDs.
My only advice to you is to ignore him as far as possible. It will not get you anywhere, it is just a waste of time. In fact, I shouldn't have wasted the time it took me to write this blog post.

Yves-Alexis Perez: Xfce 4.8 and Debian

Now that Squeeze has been released, we (the pkg-xfce group) are in the process of uploading 4.8 to Debian. And we are uploading it to experimental for good reasons. Not that 4.8 is broken, but the packages are, and we're aware of it. Some packages are still in NEW, some are not uploaded because of some licensing issues, some have not been uploaded because we didn't yet have the time. What does this mean for you? That you should *not* upgrade to Xfce 4.8. Not all packages will be upgraded, and mixing 4.6 and 4.8 is a bad idea. We don't know yet what will happen (and that's the whole point of uploading to experimental), and it seems that there are issues indeed. So unless you're willing to fix the problems, don't upgrade to 4.8. It's not complete and it *will* break your install. I wouldn't recommend building and installing from our svn repository (for the sames reasons) nor from another (since upgrade path won't be guaranteed and we won't be able to fix them for you). So please be patient, we will upload 4.8 to unstable at one point, and there will still be polishing to be made if you want to help.

11 February 2011

Patrick Winnertz: A bunch of new versions

Today I started to package from nearly all packages which I maintain within debian the new upstream versions, as squeeze is finally released :) Have fun with powertop 2.0beta (1.97) and the new lmms versions, to name only a few! ;)

Kees Cook: shaping the direction of research

Other people have taken notice of the recent auto-run attack research against Linux. I was extremely excited to see Jon Larimer publishing this stuff, since it ultimately did not start with the words, first we disabled NX, ASLR, and (SELinux AppArmor) I was pretty disappointed with last year s Blackhat conference because so many of the presentations just rehashed ancient exploitation techniques, and very few actually showed new ideas. I got tired of seeing mitigation technologies disabled to accomplish an attack. That s kind of not the point. Anyway, Jon s research is a step in the right direction. He defeats ASLR via brute-force, side-steps NX with ret-to-libc, and finds policy holes in AppArmor to accomplish the goal. I was pleased to see protected by PIE and AppArmor in his slides Ubuntu s hardening of evince was very intentional. It has proven to be a dangerous piece of software, which Jon s research just further reinforces. He chose to attack the difficult target instead of going after what might have been the easier thumbnailers. So, because of this research, we can take a step back and think about what could be done to improve the situation from a proactive security perspective. A few things stand out: Trying to brute-force operational ASLR on a 64bit system, though, would probably not have worked. So, again, I stand by my main recommendation for security: use 64bit. :) Good stuff; thanks Jon!

Michal &#268;iha&#345;: Tightening too much

After recent attack on sf.net servers, some services have been unavailable for some time. Now things are returning to "normal" operations, CVS has been made available yesterday. But this has lead to other (quite unrelated) change, affecting all SCM services:
outbound email is not functional, so any script utilizing this will fail. If you need to send outbound email, a workaround would be to use curl and and external site or Project Web to send the email.
I think this is just wrong. If this is as a measure against spam, it will rather open dozens of other places where to send spam, because every project wanting commit notifications (or using CIA.vc), will need to deploy some script on web to send mail. And I guess it simply won't be much protected. Maybe it's time to consider changing service provider... PS: The bug I've reported on this topic is here.

Filed under: English Phpmyadmin 3 comments Flattr this!

Aigars Mahinovs: MorzeSMS

Quick post. In light of recent Nokia+Microsoft-MeeGo news, I have gone to learn more about Android in a hurry. And here is the first result MorzeSMS. Basically it is a tiny app that will play a morze code when you receive an SMS message. The morze code is the phone number of the sender in cut number morze form (to be shorter). The idea is that first of all morze is a cool sound and second is that each sender gets a unique sound that you can learn to identify over time so that you know who sent you a message as soon as you hear the beep. This is very early beta there is no UI, no configuration. You can download it here. Leave bug reports in the comments of this blog post. It does not disable the stock SMS-received sound.

Michal &#268;iha&#345;: Debian packages for sale

I've decided to try to get rid of some more Debian packages. The main reason being that I don't use MPD anymore so following packages are for sale: I will continue to upload new versions (should there be any) until somebody steps up, but that's pretty much all I can do. PS: And there is still gpointing-device-settings for sale as well.

Filed under: Debian English 2 comments Flattr this!

Julien Viard de Galbert: Triage X Bugs of the Week (TXBW12)

This report is 2 week late It was delayed by an important event, not the release of squeeze, but the birth of my first child: C lestine is born Monday the 31th of January. My wife and C lestine are both fine now but the firsts days were not that easy. I m starting to recover from the lack of sleep, but I m still very late on my debian tasks ;) So I guess I just drop Triaging for week 13, 14 and maybe 15 Now the bugs I triaged just before : The X Strike Force (still) needs you ! You can have a look at the X Strike Force Bug Closing Procedure and check XSF unstable bugs sorted by date.

Next.

Previous.