A reasonably common design for applications that want to run code at a specific time is something like:

time_t wakeup_time = get_next_event_time();
time_t now = time(NULL);
sleep(wakeup_time-now);

This works absolutely fine, except that sleep() ignores time spent with a suspended system. If you sleep(3600) and then immediately suspend for 45 minutes you'll wake up after 105 minutes, not 60. Which probably isn't what you want. If you want a timer that'll expire at a specific time (or immediately after resume if that time passed during suspend), use the POSIX timer family (timer_create, timer_settime and friends) with CLOCK_REALTIME. It's a signal-driven interface rather than a blocking one, so implementation may be a little more complicated, but it has the advantage of actually working.

comments

I probably don t have to present Mark Shuttleworth he was already a Debian developer when he became millionaire after having sold Thawte to Verisign in 1999. Then in 2002 he became the first African (and first Debian developer) in space. 2 years later, he found another grandiose project to pursue: bring the Microsoft monopoly to an end with a new alternative operating system named Ubuntu (see bug #1). I have met Mark during Debconf 6 in Oaxtepec (Mexico), we were both trying to find ways to enhance the collaboration between Debian and Ubuntu. The least I can say is that Mark is opinionated but any leader usually is, and in particular the self-appointed ones! Read on to discover his view on the Ubuntu-Debian relationship and much more. Raphael: Who are you? Mark: At heart I m an explorer, inventor and strategist. Change in technology, society and business is what fascinates me, and I devote almost all of my time and wealth to the catalysis of change in a direction that I hope improves society and the environment. I m 38, studied information systems and finance at the University of Cape Town. My hearts home is Cape Town, and I ve lived there and in Star City and in London, now I live in the Isle of Man with my girlfriend Claire and 14 precocious ducks. I joined Debian in around 1995 because I was helping to setup web servers for as many groups as possible, and I thought Debian s approach to packaging was very sensible but there was no package for Apache. In those days, the NM process was a little easier Raphael: What was your initial motivation when you decided to create Ubuntu 7 years ago? Mark: Ubuntu is designed to fulfill a dream of change; a belief that the potential of free software was to have a profound impact on the economics of software as well as its technology. It s obvious that the technology world is enormously influenced by Linux, GNU and the free software ecosystem, but the economics of software are still essentially unchanged. Before Ubuntu, we have a two-tier world of Linux: there s the community world (Debian, Fedora, Arch, Gentoo) where you support yourself, and the restricted, commercial world of RHEL and SLES/SLED. While the community distributions are wonderful in many regards, they don t and can t meet the needs of the whole of society; one can t find them pre-installed, one can t get certified and build a career around them, one can t expect a school to deploy at scale a platform which is not blessed by a wide range of institutions. And the community distributions cannot create the institutions that would fix that. Ubuntu brings those two worlds together, into one whole, with a commercial-grade release (inheriting the goodness of Debian) that is freely available but also backed by an institution. The key to that dream is economics, and as always, a change in economics; it was clear to me that the flow of money around personal software would change from licensing ( buying Windows ) to services ( paying for your Ubuntu ONE storage ). If that change was coming, then there might be room for a truly free, free software distribution, with an institution that could make all the commitments needed to match the commercial Linux world. And that would be the achievement of a lifetime. So I decided to dedicate a chunk of my lifetime to the attempt, and found a number of wonderful people who shared that vision to help with the attempt. It made sense to me to include Debian in that vision; I knew it well as both a user and insider, and believed that it would always be the most rigorous of the community distributions. I share Debian s values and those values are compatible with those we set for Ubuntu.

Debian would always be the most rigorous of the community distributions.

Debian on its own, as an institution, could not be a partner for industry or enterprise. The bits are brilliant, but the design of an institution for independence implies making it difficult to be decisive counterparty, or contractual provider. It would be essentially impossible to achieve the goals of pre-installation, certification and support for third-party hardware and software inside an institution that is designed for neutrality, impartiality and independence. However, two complementary institutions could cover both sides of this coin. So Ubuntu is the second half of a complete Debian-Ubuntu ecosystem. Debian s strengths complement Ubuntu s, Ubuntu can achieve things that Debian cannot (not because its members are not capable, but because the institution has chosen other priorities) and conversely, Debian delivers things which Ubuntu cannot, not because its members are not capable, but because it chooses other priorities as an institution. Many people are starting to understand this: Ubuntu is Debian s arrow, Debian is Ubuntu s bow. Neither instrument is particularly useful on its own, except in a museum of anthropology

Ubuntu is Debian s arrow, Debian is Ubuntu s bow.

So the worst and most frustrating attitude comes from those who think Debian and Ubuntu compete. If you care about Debian, and want it to compete on every level with Ubuntu, you are going to be rather miserable; you will want Debian to lose some of its best qualities and change some of its most important practices. However, if you see the Ubuntu-Debian ecosystem as a coherent whole, you will celebrate the strengths and accomplishments of both, and more importantly, work to make Debian a better Debian and Ubuntu a better Ubuntu, as opposed to wishing Ubuntu was more like Debian and vice versa. Raphael: The Ubuntu-Debian relationship was rather hectic at the start, it took several years to mature . If you had to start over, would you do some things differently? Mark: Yes, there are lessons learned, but none of them are fundamental. Some of the tension was based on human factors that cannot really be altered: some of the harshest DD critics of Canonical and Ubuntu are folk who applied for but were not selected for positions at Canonical. I can t change that, and wouldn t change that, and would understand the consequences are, emotionally, what they are. Nevertheless, it would have been good to be wiser about the way people would react to some approaches. We famously went to DebConf 5 in Porto Allegre and hacked in a room at the conference. It had an open door, and many people popped a head in, but I think the not-a-cabal collection of people in there was intimidating and the story became one of exclusion. If we d wanted to be exclusive, we would have gone somewhere else! So I would have worked harder to make that clear at the time if I d known how many times that story would be used to paint Canonical in a bad light. As for engagement with Debian, I think the situation is one of highs and lows. As a high, it is generally possible to collaborate with any given maintainer in Debian on a problem in which there is mutual interest. There are exceptions, but those exceptions are as problematic within Debian as between Debian and outsiders. As a low, it is impossible to collaborate with Debian as an institution, because of the design of the institution.

It is generally possible to collaborate with any given maintainer [ ] [but] it is impossible to collaborate with Debian as an institution.

In order to collaborate, two parties must make and keep commitments. So while one Debian developer and one Ubuntu developer can make personal commitments to each other, Debian cannot make commitments to Ubuntu, because there is no person or body that can make such commitments on behalf of the institution, on any sort of agile basis. A GR is not agile . I don t say this as a critique of Debian; remember, I think Debian has made some very important choices, one of those is the complete independence of its developers, which means they are under no obligation to follow a decision made by anyone else. It s also important to understand the difference between collaboration and teamwork. When two people have exactly the same goal and produce the same output, that s just teamwork. When two people have different goals and produce different product, but still find ways to improve one anothers product, that s collaboration. So in order to have great collaboration between Ubuntu and Debian, we need to start with mutual recognition of the value and importance of the differences in our approach. When someone criticises Ubuntu because it exists, or because it does not do things the same way as Debian, or because it does not structure every process with the primary goal of improving Debian, it s sad. The differences between us are valuable: Ubuntu can take Debian places Debian cannot go, and Debian s debianness brings a whole raft of goodness for Ubuntu. Raphael: What s the biggest problem of Debian? Mark: Internal tension about the vision and goals of Debian make it difficult to create a harmonious environment, which is compounded by an unwillingness to censure destructive behaviour. Does Debian measure its success by the number of installs? The number of maintainers? The number of flamewars? The number of packages? The number of messages to mailing lists? The quality of Debian Policy? The quality of packages? The freshness of packages? The length and quality of maintenance of releases? The frequency or infrequency of releases? The breadth of derivatives? Many of these metrics are in direct tension with one another; as a consequence, the fact that different DD s prioritise all of these (and other goals) differently makes for interesting debate. The sort of debate that goes on and on because there is no way to choose between the goals when everyone has different ones. You know the sort of debate I mean Raphael: Do you think that the Debian community improved in the last 7 years? If yes, do you think that the coopetition with Ubuntu partly explains it? Mark: Yes, I think some of the areas that concern me have improved. Much of this is to do with time giving people the opportunity to consider a thought from different perspectives, perhaps with the benefit of maturity. Time also allows ideas to flow and and of course introduces new people into the mix. There are plenty of DD s now who became DD s after Ubuntu existed, so it s not as if this new supernova has suddenly gone off in their galactic neighbourhood. And many of them became DD s because of Ubuntu. So at least from the perspective of the Ubuntu-Debian relationship, things are much healthier. We could do much better. Now that we are on track for four consecutive Ubuntu LTS releases, on a two-year cadence, it s clear we could collaborate beautifully if we shared a freeze date. Canonical offered to help with Squeeze on that basis, but institutional commitment phobia reared its head and scotched it. And with the proposal to put Debian s first planned freeze exactly in the middle of Ubuntu s LTS cycle, our alignment in interests will be at a minimum, not a maximum. Pure <facepalm />. Raphael: What would you suggest to people (like me) who do not feel like joining Canonical and would like to be paid to work on improving Debian? Mark: We share the problem; I would like to be paid to work on improving Ubuntu, but that s also a long term dream Raphael: What about using the earnings of the dormant Ubuntu Foundation to fund some Debian projects? Mark: The Foundation is there in the event of Canonical s failure to ensure that commitments, like LTS maintenance, are met. It will hopefully be dormant for good Raphael: The crowdfunding campaign for the Debian Administrator s Handbook is still going on and I briefly envisioned the possibility to create the Ubuntu Administrator s Handbook. What do you think of this project? Mark: Crowdfunding is a great match for free software and open content, so I hope this works out very well for you. I also think you d find a bigger market for an Ubuntu book, not because Ubuntu is any more important than Debian but because it is likely to appeal to people who are more inclined to buy or download a book than to dive into the source. Again, this is about understanding the difference in audiences, not judging the projects or the products. Raphael: Is there someone in Debian that you admire for their contributions? Mark: Zack is the best DPL since 1995; it s an impossible job which he handles with grace and distinction. I hope praise from me doesn t tarnish his reputation in the project!

---

Thank you to Mark for the time spent answering my questions. I hope you enjoyed reading his answers as I did.

Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Google+, Twitter and Facebook .

32 comments Liked this article? Click here. My blog is Flattr-enabled.

Since I think I just summarized a few thoughts of mine well at LWN, I'll copy-paste it here:

I can grumble about Android from time to time, but I do not say that it sucks. Extreme views are what are annoying. Android is what it is and it's great as it is, even though it could be different as well.

When it comes to discussing about free software and mobile phones, I'm especially annoyed by two types of comments:

1. People essentially saying that there is no value in an open project, ie. free software code dumps should be enough for everybody. I'm interested in the long term viability of free software projects, and it is hard to have successful projects without there being all sorts of factors that make up a good project - like transparency, inclusion, meritocracy. Even though the mobile projects have had little resources and a hard road, it's not useful to forget about these goal in the longer term. For example Debian, Mer, SHR, KDE Plasma Active have some of these in the mobile sector. I hope the best for them (and participate).

2. People complaining about something being not 100% free software, while not themselves actually even interested in it for other sake than complaining. When I've been talking about free software mobile phones, from time to time there is someone complaining about eg. not open GSM stack, wlan firmwares etc.. and to put it sharply probably writing the message from iPhone, while I'm reading it on Neo FreeRunner. If the complainer would be Harald Welte, I'd probably listen and agree with him.

So there. For more civilized discussion.

It seems that in theory cruises can make for quite economical vacations. The cheapest prices tend to be around $100 per person per night for an inside cabin (IE no window) with two people (there is a significant extra fee for having a cabin with only one person). If you book a room in a half-decent hotel with a pool in some moderately desirable place then you will probably pay about $200 per night which might get you free breakfast but won t include lunch or dinner. Cruises include all the free food you can eat for at least 16 hours of the day with maybe an extra fee for getting food in the middle of the night. When a cruise ship stops at the port you can pay for an expensive shore trip arranged by the cruise company or have a cheap trip that involves walking on the beach or taking a taxi to somewhere local. Of course there are lots of extras that can make a cruise really expensive, but if you don t plan to eat at speciality restaurants or drink much alcohol then that shouldn t be a problem. I ve just booked a short luxury cruise, mostly as a trial of the cruise concept. The process of doing so was difficult enough that even if I hadn t previously needed a holiday then I d probably need one now. It would be interesting to compare the amount of time that a reasonable person would be likely to spend choosing a holiday and purchasing it for the different types of holiday, I expect that cruising would be a long way behind everything that involves flying to a foreign city and staying in a hotel. The Issues of Booking When booking a regular holiday you choose where to visit, then choose the time of year, the accommodation, and travel. While the order can vary it s generally a sequential process without too many variables at any stage. With a cruise one of the first decisions is to choose the cruise line, different lines cater to various market segments it s clear what Disney cruises aim for but often not so clear for others. Apart from Disney the other cruise lines don t seem to make clear statements about who they are and aren t targeting. Then there are a variety of ships run by each cruise line which in many cases offer different features, do you want 1 pool or 4? Do you want ice skating? The cruise lines that I have investigated don t offer clear comparisons of their ships. As a cruise ship is essentially a hotel, a collection of restaurants, and some other entertainment you can t just arbitrarily choose one the way you might choose a random hotel with a suitable price and rating. Now while you can choose a hotel and generally get a room when you want a cruise booking has to be made when the ship is in a convenient port. So your holiday needs to be scheduled around the availability of the ship. CruiseCritic.com is an excellent source of information on cruises and has a very active and useful advice forum [1]. The forum appears to be dominated by retirees, presumably because retirees have time to just wait for a ship they like to visit their local port while people who have to schedule holidays around work projects etc. When booking a hotel I have found that Wotif.com is really good for comparing hotels and finding a reasonably cheap one and they also have periodic mail-outs about special deals. I have made a couple of short vacations based on Wotif offering me unusually good prices on a hotel in a place that I was mildly interested in visiting. There are also special deals on cruises, but it s a lot more difficult to take them. Firstly as cruises aren t as interchangeable as hotels it s not as appealing to take an offer of a cruise you didn t previously consider because it s going cheap. The second factor is that according to cruise reviews there is more variation among cabins than there is among hotel rooms. The design of the ship that is needed to cram everything in the available space means that some cabins apparently have noise pollution from various activities on the ship while others are considered to have problems for people prone to sea-sickness. Discounts probably only apply after people who pay non-discount rates have had a chance to book what might be considered the better cabins. Of course it could be a good thing to have most of the ship booked out, CruiseCritic.com has some reviews of individual cabins and presumably there are people who compare hundreds of cabins to discover what is ideal for them. The Problem with Princess I have booked a Princess cruise. I chose it because it was going cheap, but the first two travel agents that advertised it were unable to take my order because Princess only allows US based agencies (which means the discount agents on the net) to sell to US customers I don t think that the people who run the Princess cruise company know what the Internet is about. So I booked the cruise through the Princess web site, they took my money, told me that a good chunk of that money would never be returned if I cancelled, and then sent me to the web page for providing all the information that they need which is a lot. The big problem was when their web site absolutely demanded a passport number and said that I would not be allowed to board without one even though their FAQ (and common sense) indicated that a cruise which doesn t involve any international travel has no need of a passport. Taking someone s money and then telling them that they can t attend due to not having a valid passport is one way of making a future passenger very unhappy. I called the support people (which was Carnival) and had to listen to some really strange hold music it was difficult to determine if the music was produced by someone with unusual tastes in electronic music vastly different from my own preference or whether the computer which manages the phone calls was producing noise instead of music. Eventually I got through to an operator who was very helpful and stored my drivers license number which was adequate. While on the topic of their web site, when booking a cruise with Princess they list which types of cabin (interior, balcony, etc) are available and list the price for the cheapest category of cabin in each price. However if the cheapest category is all sold out then it will still list that cheapest price and thus be advertising a price that can t be booked. This is misleading and annoying. Further Hassle But the difficulty doesn t end here. On a cruise you have to book in advance for which dinner seating you desire which is usually only early or late but some ships offer anytime . Then if you happen to be travelling with people who are in a separate cabin and paying separately (which one would expect to be fairly common) there is no obvious way of synchronising dinner preferences the ship people might assign people to different tables. I admit that I haven t fully explored the post-booking part of the Princess web site, maybe I can arrange a shared table but for the moment my pain threshold for the cruise booking process has been exceeded. Other Cruising Stuff Insight Cruises (formerly Geek Cruises) offers a variety of educational cruises including science, astronomy, chess, art, history, and some other things [2]. From a casual inspection of their web site it seems that the cruise prices are around $300 per night for a 2 person cabin and the registration fees for the conferences are between $1200 and $1500. Most readers of my blog will consider this to be unreasonably expensive as registration for a Linux conference tends to be a lot less than $1000. But when compared to typical for-profit conferences $1500 isn t anywhere near the high end of the range. Also while someone who is choosing a cruise holiday can easily get a cruise that costs less than $200 per day for a 2 person cabin, for commercial conferences it s not uncommon to spend more than $300 per night for two people on accommodation and food. So the only noteworthy part about the cost is that accommodation will be quite expensive if you aren t sharing a room. If you want to run a conference on a cruise there are companies which specialise in such things, Landry and Kling is one company that specialises in planning corporate events [3]. They do seem to aim for the high end of the market, including chartering a small cruise ship or half a large cruise ship that means ~1000 passengers. While there are some conferences with more than 1000 delegates it seems that most conferences top out at about 500 delegates. However I know that some conferences have limited the number of delegates to the maximum capacity of the biggest lecture hall available as some cruise ships have a theater with more than 1000 seats it seems that similar conferences could potentially arrange a half ship charter. A half ship charter apparently allows exclusive access to one of the theaters (at least when it s not needed for evening entertainment) and exclusive seating at the main dining room. It s a standard feature that cruise ships have all the equipment you might need to run a conference. Autism on the Seas is a brand used by the Alumni Cruise company for their holiday packages for special needs children [4]. They sell cruise tickets at the regular list price and the commission that they receive when acting as a travel agency is enough to hire staff to look after the kids while presumably still running at a profit. It seems to me that a similar model could be used for a computer conference, make a profit on cruise ticket sales and then have no extra costs for the conference for people sharing a room that would be cheaper than most Linux conferences I ve attended. For smaller conferences and un-conferences there is no minimum reservation size. One down-side for a computer conference is the cost of Internet access, according to Wikipedia a personal installation of satellite net access costs $5 per megabyte and ship pricing for their Internet access is up around $30-$100 per hour per person! But in the old days when attending a conference meant a week of no net access we survived somehow. It also seems to me that if a company had a small development team it could be productive to put everyone on a cruise ship with a server for testing and version control. They could do 9 hour days on board and still have lots of time for relaxation as it s only a few minutes walk to the pool. Of course this wouldn t work if some members of the team wanted to stay home due to slow and expensive net access.

• [1] http://www.cruisecritic.com/
• [2] http://insightcruises.com/
• [3] http://landrykling.com/
• [4] http://alumnicruises.org/Autism/Autism_Home.htm

Bosnian, Hindi, Marathi complete level 1. Slovak completes level 3. Full stats are here Status for D-I level 1 (core D-I files):

• 24 languages 100% for all sublevels: bg bscs de eo es fa fr gu hi it ja ko mr nl pl pt ru si sk ta te th zh_CN
• 1 language 98%: sv
• 1 language 97%: eu
• 1 languages 96%: tr
• 6 languages 95%: be bn dz he kk uk
• 4 langauges 94%: ar ast ga ro
• 5 languages 93%: el hu km lo nb
• 2 languages 92%: id sl
• 4 languages 91%: et pa vi zh_TW
• others are 90% or below

Status for D-I level 2 (packages that have localized material that may appear during default installs, such as iso-codes, tasksel, etc.):

• 8 languages 100%: de es fa fr pt ru si zh_CN
• 14 languages 99%: be cs da eo id it ja kk nl sk sl sv th uk
• 5 languages 98%: bg ca eu pt_BR ro
• 4 langauges 95%: el fi he nb
• 7 languages 94%: ar ast dz gl hr vi zh_TW
• 1 language 93%: is
• 7 languages 92%: bn bs hu ko ne pl tr
• 10 languages 91%: ga gu ka km lt mk mr sr ta te
• others are 90% or below

Status for D-I level 3 (packages that have localized material that may appear during non-default installs, such as win32-loader)

• 9 languages 100%: cs de fa fr nl pt ru sk sv
• 16 languages 99%: be bg bs ca el eo es fi ga gl he is ja th tr zh_CN
• 2 languages 97%: hu uk
• others are 90% or below

So, full 100% completeness (hall of fame) for: German (de), Persian (fa), French (fr), Portuguese (pt, Russian (ru)

I'm working on a personal pet project and wanted to get some feedback on the best apps to use in a touch only environment. I know that there are a few people who use Debian or Ubuntu on a tablet, and I was hoping to get suggestions on the best desktop environment and apps available. Please leave some comments with suggestions, and with a little luck, I'll have something to demo on this blog in a few weeks.

Dear Lazyweb, I recently switched from KDE to Gnome 3 and I am so far very happy with the decision. One thing that bothers me since then is that the sound does not work when restarting the computer or waking it up from suspend. After a while I figured that a simple sudo killall pulseaudio fixes the problem but only until the next reboot. Has anyone a hint what the problem could be/ I found quite a few similar problem descriptions on the internet but with no satisfying solutions so far.

A few snippets so far from our train trip from Kansas to Portland. Terah, Jacob, Oliver, and I are on the trip, which is about 2.5 days on the train. The Parenting Dilemma So, if you are eating dinner, and your 5-year-old falls asleep with his head on the table, and you know he had been excitedly waiting for raspberry sorbet for dessert, and know there will be tears when he later realizes he missed it, what do you do? Let him sleep, or wake him up (with possible tears right then in the dining car?) As it turned out, I tried to quietly ask him if he wanted dessert. He woke up with a start, banged his head on the table, and then, yes, there were tears. I asked him if he wanted dessert or if he wanted to keep sleeping, and he gave a pathetic, sniffling, dessert. But by the time dessert arrived, he had fallen asleep again. I finally woke him up again, asked if he wanted to eat, and he just ignored me. I asked twice more and then he all of a sudden realized what he was being asked, sat bolt upright, and dug in. Graffiti Jacob noticed graffiti in Los Angeles. He called it silly words and kept commenting about it as we passed it. Bears Oliver always sleeps with a stuffed bear, which is his favorite comfort animal. But Oliver is 2, and when he says bear , it sounds more like beer . Plus, the boys still seem to be operating on Central Time. So at 4:15AM yesterday, Oliver awakened us saying: Beer! Beer! Beer! Where s beer? Where s beer? Need beer! Beeeeeer! Butterflies Jacob always sleeps with a stuffed butterfly, which he likes just like Oliver likes his bear. Jacob had this conversation with me this morning: Jacob: My butterfly knows all the people in the world. And all the animals, too! Me: Does butterfly even know Nash? (our cat) Jacob: Yeah, and he knows Sam and Edna too! (the cats across the road) Me: Wow. I think butterfly knows a lot more people and animals than I do. Jacob: *brief pause, then* Oh, silly dad! *collapses laughing*

There's been a lot of noise with Microsoft requiring Secure Boot for Windows 8 OEMs. For those of you unfamiliar with it, Secure Boot requires that the boot chain is signed, and this 'feature' must be enabled by default. Although I have been unable to find specific details, it appears that the chain of trust needs to extend from BIOS/UEFI all the way down to the kernel. Obviously, requiring a signed boot chain makes using FOSS platforms like Ubuntu or Debian an impossibility short of having the UEFI Platform Key and resigning the entire chain.

Steven Sinofsky's MSDN blog has a fairly good overview how it works. Canonical and Red Hat also have a good white paper on why secure boot is a serious problem for Linux distributions. Even if secure boot itself can be disabled, it *greatly* rises the bar for general end-users to successfully install Ubuntu on their machine. In addition, it is the responsibility of OEM and BIOS manufacturers to provide the option to disable it.

There already has been a long history of OEMs removing BIOS options or introducing DRM; for instance, locking out VTx on Sony laptops, or restricting laptops to only accept 'branded' wifi and 3G cards. Given this track record, can OEMs realistically be trusted to have this option available?

What most people don't realize is that secure boot itself is not a new concept; its simply part of the Trusted Computing initiative, and has been implemented on embedded platforms for many years. If you own any iPhone, or one of the vast majority of Android devices, you are using a device that either has the secure boot feature, or something very close. This especially painful in Android as Google's security system restricts users to a *very* limited shell and subset of utilities which can be used on non-rooted devices. WebOS, Maemo, and to my knowledge Meego give the end-user full unrestricted access to the boot chain and you can swap kernels and even the entire OS out if one was so motivated.

Although it is still an ongoing problem, several vendors such as HTC, Samsung, Motorola (kinda), and even Sony. In the Android community, having unlockable bootloaders has been a welcome middle ground in the traditionally restrictive and locked-down world of cellular devices.

While some may argue that such locks are necessary to protect consumers, it is perfectly feasible to create devices with unlocked bootloaders that are still secure. The Nook Color's is an Android powered eReader. It's stock firmware doesn't allow sideloaded applications or even access to a user shell via adb, but the BootROM on the device attempts to boot from the microSD card before eMMC, making it possible for enterprising users to easily modify the underlying OS (as well as making it physically impossible to brick the device due to a bad flash). Barnes and Nobles even sells a book on rooting the Nook Color; it was right next to the devices on display at the time. In addition, they've continued the tradition of easily modifiable devices with both the Nook Simple Touch, and the Nook Tablet.

One of the most impressive attributes is the possibility of running Ubuntu on it. The absolute poster child for this is the Toshiba AC100. For those of you unfamiliar, it ultralight netbook that shipped with Android 2.1/2.2 with easy access to the built in flash via the mini-USB port on the side of the device. Due to the valiant efforts of the AC100 community, Ubuntu was ported to this device, and became a supported platform with images available on cdimages.ubuntu.com. If you were an attendee at UDS, you likely saw several AC100s all running Ubuntu.

This brings me to the point that motivated me to write this post in the first place. One of the most impressive tablets I've seen to date is the ASUS eeePad Transformer, an Android tablet with fully dockable keyboard. I have one of these devices, and its one of the most impressive and usable Android tablets I own. Sadly, such a powerful device was hobbled from its true potential due to ASUS's decision to ship the device with a locked and encrypted bootloader. Surprisingly, the Secure Boot Key (SBK) was acquired and released to the wild, making it possible to reflash the device. Sadly, even with the SBK, the device's bootloader is still extremely hobbled compared to the AC100 making flashing a slow and difficult process.

In response, ASUS refreshed the eeePad's hardware to the new B70 SKU, which has a new Secure Boot. Despite this, a root exploit was recently found to allow people to circumvent these restrictions and install customs ROMs. It is however only a manor of time before ASUS responds and releases a new update that fixes this bug.

Steven Barker (lilstevie) on xda-developers successfully created a port of Ubuntu to the Transformer. Currently, installing Ubuntu on the Transformer requires nvflash access, so its not possible to use his image on the newly liberated B70 devices. I am certain that a new method of installing via an update.zip will be developed for those of us with hobbled devices.

It is a showcase of what is possible when you have open hardware, and also proves one indisputable point: any 'trusted boot' or DRM scheme can and will be defeated; at best you piss off your userbase, and at worst, you force users to exploit bugs to gain control of their device. As it is impossible to reflash these devices from the bootloader, a failed kernel flash WILL brick these devices, increasing warranty and support costs as users try to return their now broken devices.

In closing, while there have been some victories in ongoing war of open hardware vs. trusted comptuing, the road ahead still remains very murky. Victories in the mobile market have shown that there is a market for open devices. Google's own Nexus One was sold as a developers phone and as a way to encourage manufacturers to raise the bar. It sold well enough to recoup its development costs.. While there is no official statements, the Nokia N900 is suspected to have broken all sales expectations, backed up by the fact that Angry Birds sold extremely well on the Ovi Store for the N900.

From the article in question:

What reaction have you had in terms of sales and customer feedback?

Angry Birds had already been launched on App Store before it came out on Ovi Store, and it had a great review average from iPhone reviewers and users alike, so we expected a good reception from N900 users as well.

Even so, we were quite surprised by just how the N900 community immediately took the game to heart. The game obviously made many people very happy, and that is really the greatest achievement that anyone who creates entertainment for a living can hope for. Well, maybe the greatest achievement is huge bundles of cash, but making people happy comes a close second.

In the first week that Angry Birds has been on the Ovi Store, it has been downloaded almost as many times as the iPhone version in six weeks. Given that most N900 users have not even used Ovi Store yet, we are confident that there will be many more downloads in the months to come, and are sure that the N900 version will be very profitable.

That being said, with Microsoft pushing secure boot and trusted computing down everyone's throats with Windows 8, it is hard to say what the future might hold for those of us who want to own our devices.

Yesterday, I finally took closer look at long standing GePeS bug on displaying speed and altitude wrongly (which I've mentioned in very first posts). For some reason I believed it is not my bug, but in QML bindings and let it be there. Receiving complain from Maarten ter Huurne, that this does not work made me look into it more deeply. Of course I found out it was caused by stupid typo and quickly fixed it. New release is now available on GePeS homepage and will be available shortly in Nokia store.

Filed under: English Meego 0 comments Flattr this!

#Occupy Oakland evicted but .. &quot;Bam. We&#39;re back at Oscar Grant Plaza. They spent half a milion dollars to evict us, only to figure out that we won&#39;t quit. 2500 people here. Holding General Assembly.&quot;

We just released a sample chapter of the Debian Administrator s Handbook. It covers the APT family of tools: apt-get, aptitude, synaptic, update-manager, etc.

Click here to get your free sample chapter I m sure you will enjoy it. There are many interesting things to learn:

• How to customize the sources.list file
• The various APT repositories that Debian offers (Security Updates, Stable Updates, Proposed Updates, Backports, Experimental, etc.)
• How to select the best Debian mirror for you
• How to find old package versions
• How to install the same selection of packages on multiple computers
• How to install and remove a package on a single command-line
• How to reinstall packages and how to install a specific version of a package
• How to pass options to dpkg via APT
• How to configure a proxy for APT
• How to set priorities to various package sources (APT pinning)
• How to safely mix packages from several distributions on a single system
• How to use aptitude s text-mode graphical interface
• How to use the tracking of automatically installed packages to keep a clean system
• How APT checks the authenticity of packages that it downloads
• How to add supplementary GnuPG keys to APT s trusted keyring
• How to upgrade from one stable distribution to the next
• How to handles problems after an upgrade
• How to keep a system up-to-date
• How to automate upgrades
• How to find the package that you re looking for

If you liked this chapter, click here to contribute a few euros towards the liberation of the whole book. That way you ll get a copy of the ebook as soon as it s available. Thank you! I also invite you to share this sample chapter as widely as possible. We re only at 40% of the liberation fund and there s less than 2 weeks left. I hope this book extract will convince enough people that the book is going to be great, and that it really deserves to be liberated and bundled with Debian!

8 comments Liked this article? Click here. My blog is Flattr-enabled.

Recently my installation of Qt SDK I use for development of applications for Nokia N950 (N9) got broken. It happened by update some postinst script failed what caused almost no part of Harmattan SDK to be installed. I hoped this to be temporary error which will get fixed by later updates, but it turned out to persist even for 1.1.4 which has been released week ago. Yesterday I finally got time to look into it and after some debugging I found out that it was trying to install x86_64 version, which was not downloaded because I was using 32bit installer. I quickly realized this was caused by using 64-bit kernel, while running 32-bit userspace, for which the installer somehow was not prepared. Fortunately there is easy workaround for that:

linux32 ./Qt_SDK_Lin32_online_v1_1_4_en.run

What will run the binary in 32-bit personality and make kernel pretend it is compiled for 32-bit.

Filed under: English Meego 2 comments Flattr this!

Last Friday (11 November 2011), I was at the Cooperatives-SW annual conference at the Cube Cinema in Bristol, titled Growing Your Co-operative and sponsored by the Co-operative Membership South and West. It was another sold-out event, featuring headline talks from Co-op Party member and Labour MP Kerry McCarthy, Eli Sarre of Essential Trading worker co-op (pictured), Carole Theyer of Sparks Inc and Jim Pettipher from Co-operative Futures. There were also some great workshops I went to a finance workshop led by Ian Rothwell from Co-operative and Community Finance and a regulations one with Paul Martin of Kabin (details may appear on their event page) and a brilliant lunch from Runcible Spoon (and those of you who know me will know I have been livid with some co-op event lunches!) with some time to chat and network, although I also went to a fringe meeting about the RISE problems. The event concluded with the formal AGM of Co-operatives SW (electing a new chairperson and approving transfer to a new co-op corporation) as well as a bit more chat afterwards. I felt it was a great event and well worth my time being there. I m glad that some people from outside the co-op movement, from community businesses like the Strawberry Line Cafe and a few people considering joining or forming co-ops, were there and I hope it was good for them too.

After recently reading a number of SSL/TLS-related articles, I decided to experiment and look for the ideal OpenSSL configuration for Apache (using mod_ssl since I haven't tried mod_gnutls yet) and nginx.

By "ideal" I mean that this configuration needs to be compatible with most user agents likely to interact with my website as well as being fast and secure.

Here is what I came up with for Apache:

SSLProtocol TLSv1
SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!kEDH

and for nginx:

ssl_protocols  TLSv1;
ssl_ciphers  RC4-SHA:HIGH:!kEDH;
ssl_prefer_server_ciphers   on;

Cipher and protocol selectionIn terms of choosing a cipher to use, this configuration does three things:

• disables all weak ciphers and protocols
• disables very slow ciphers that use ephemeral Diffie-Hellman exchanges
• gives priority to the RC4 cipher to minimize CPU usage and defend against the BEAST attack

Testing toolsThe main tool I used while testing various configurations was the SSL labs online tool. The CipherFox extension for Firefox was also quite useful to quickly identify the selected cipher.

Of course, you'll want to make sure that your configuration works in common browsers, but you should also test with tools like wget, curl and httping. Many of the online monitoring services are based on these.

Other considerationsTo increase the performance and security of your connections, you should ensure that the following features are enabled:

• SSL session caching with a session store shared between all of your web servers
• HSTS headers to let browsers know that they should always visit your site over HTTPS

We've had sporadic Altus Metrum customer reports about RF susceptibility issues with their TeleMetrum installations. In almost every case, these problems have been completely resolved by either making sure the system battery has sufficient charge before launch, or through the application of standard engineering techniques such as twisting wire pairs to reduce differential coupling. However, even when every technique we could think of had been applied, once in a while someone still had issues. Around the time of LDRS this year, the incidence of such reports seemed to increase. One customer, in particular, had an installation in which he virtually always saw continuous resets of the board once his 54mm airframe was put on a launch rail, and several customers reported seeing board resets during ejection charge firing. Keith and I saw a board reset during main charge firing happen in person at NCR's Oktoberfest, and with a couple days available to work together after that launch, we decided it was time to figure out what was really going on. Here's what we've learned. In bench testing, it quickly became clear that the problem was the 3.3 volt power supply rail getting pulled down far enough to reset the CPU. This most frequently happened during ejection charge firing, when the input of the LDO regulator is pulled down by the near-short presented by the e-match when a pyro FET is turned on. To keep the 3.3 volt rail voltage up during firing, we include a 100uF bulk capacitor on the regulator's output. In all of our prior bench testing, we never saw the 3.3 volt rail droop significantly. Clearly something had changed... or maybe several things had changed? The first thing I wondered about was whether the new Kalman filtering code, which requires more compute cycles from the processor, might be consuming enough more power to pull the rail down faster during charge firing. After poking around at it, though, we have no data to suggest the new code makes a measurable difference in power consumption. The next thing we pondered was that at least some of the e-matches we and others are using in the hobby now come from the fireworks industry, where it is apparently considered a feature for the match to retain continuity after firing. This means the input of the LDO gets held down for longer than with the e-matches we used to use and Quest Q2G2 igniters that open when fired. But that still didn't make sense as the root cause, as we chose the FET firing time such that even with a dead short across the igniter terminals, the 3.3 volt rail wouldn't be pulled down far enough to cause trouble during firing. One of the big changes between v1.0 and v1.1 on TeleMetrum was that the newer boards incorporate a better reset circuit. This helps ensure the GPS chip always comes up running at power on, which was a problem at temperature extremes with older boards. However, a side-effect of this change is that a v1.1 board will reset any time the 3.3 volt rail drops below 3.15 volts, whereas older boards didn't trip until a much lower voltage. So the recent increase in reports might just be related to more v1.1 boards being placed in service? While experimenting on the bench, we observed that injecting RF energy into the input of the LDO regulator had the effect of pulling down the output voltage, presumably because the internal reference source accumulates charge and is fooled into thinking the output is too high. Since our designs all have the power switch contacts ahead of the LDO, the wires going out to the switch and back are effectively an antenna... as are, to a lesser extent, the wires going to the e-matches. There is some variability from part to part in just how badly the LDO reacts. But by attaching a tuned length of wire as an antenna to the LDO input and playing around, we were finally able to reproduce the problem reliably on a test board at my bench! On further analysis, we realized that the output of the USB battery charger chip and the input of the LDO both expect a 1uF bypass cap to ground. At some point, those looked redundant and we eliminated one of the two. Unfortunately, we weren't internalizing the fact that the switch leads were between the two caps, and the one we left was on the output of the charger and not at the input of the LDO. Placing a suitable bypass cap right at the input of the LDO turns out to have a truly dramatic effect on RF immunity! Once we realized that RF getting into the LDO input was the problem, Keith pointed out that we used to see "noise" in the accelerometer data on earlier boards that was caused by the 3.3 volt rail moving slightly during radio transmit, which we fixed with a hardware change on v1.1. We are now convinced that this was at least partly related to RF coupling to the LDO input, not just the change in power consumption on the LDO output. We didn't realize what was going on in earlier testing because we often didn't have ematches wired up, so RF coupling was minimal. But going back to flights logged with v1.0 boards that included deployment, and studying the magnitude of the "steps" in acceleration data observed when the transmitter was on, Keith was able to compute the amount the 3.3 volt rail must have sagged if the real acceleration wasn't changing... which in some cases was as much as 180mV! We think this proves that RFI could cause the LDO to drop its output voltage below the reset controller set point on v1.1 boards. Based on these observations, I'm making two hardware changes for the next version of TeleMetrum (version 1.2), and Keith is also making a software change. We have tested all of these changes on real boards both on the bench and in test flights, and the net effect is a major improvement in the RF immunity of TeleMetrum. The first hardware change is moving to a slightly lower trip voltage on the reset controller. Instead of 3.15, the new part trips at 3.00 volts nominal. This gives us more "headroom" to tolerate 3.3 volt rail droop during charge firing, and will allow the board to operate longer on a given battery charge. This change is not relevant for v1.0 and prior. The second hardware change is adding an appropriate bypass capacitor right at the LDO input. This requires a PCB update, but it's possible for me to update existing production boards by adding an 0402 cap right across the appropriate pins on the regulator chip. The software change prevents our altimeters from turning on the radio transmitter while an ejection charge is firing. Since the RF transmitter draws substantial additional power, this should help keep the 3.3 volt rail from drooping. This may not really matter, but it feels like the right thing to do. This change will be part of our next stable firmware release. We think most TeleMetrum customers need not worry about these updates. But if you have seen odd resets on the rail or during ejection charge firing in flight with a TeleMetrum v1.1, feel free to contact me about updating your existing board to include these improvements.

Back in the dark ages of the web, before the introduction of CSS 3, browsers could only display fonts available on the client system. Thanks to the introduction of @font-face and its now widespread support, this is over. Now, Web designers have access to a large selection of fonts and most users will be able to appreciate them. Typekit provides a subscription-based library of hosted, high-quality fonts to use on websites. I expose here my own, mostly uneducated¹ on the typographic side, look on this service.

Fonts embedding 101 There are several ways to embed fonts for the Web. Let s have a look at the most common ones.

Self-hosting and @font-face A first possibility is to host fonts yourself and provide a CSS file with the appropriate @font-face declarations. There are five important things to know:

1. There is no common format. You will need to host different versions of the same font to support most browsers.
2. Of course, Internet Explorer comes with its own quirks that you need to work around.
3. Most browsers enforce a same origin policy. You need to serve your fonts from the same domain as the requesting page. You can circumvent such a limitation by enabling cross-origin resource sharing: add an Access-Control-Allow-Origin header when serving fonts.
4. Fonts are unlikely to change. To leverage caching, configure an explicit expiration date far in the future. Something like 30 days.
5. There is no MIME types registered for fonts. Don t bother setting one, even if Google Chrome likes to complain about them in the console.

One great resource is Font Squirrel which provides kits with fonts and the appropriate CSS declarations. You choose your font family (or upload one of your own), the formats that you want to use (check them all) and you will get a ZIP archive with all fonts and a CSS file. You may want to tweak it a bit to enable automatic use of the bold variant when needed and to use a local copy if available. For example, if you choose Crimson, an oldstyle typeface, you may want to declare the bold version with font-weight: bold and add local names:

@font-face  
    font-family: 'Crimson';
    src: url('Crimson-Bold-webfont.eot');
    src: local('Crimson Bold'), local('Crimson Text Bold'),
         url('Crimson-Bold-webfont.eot?#iefix') format('embedded-opentype'),
         url('Crimson-Bold-webfont.woff') format('woff'),
         url('Crimson-Bold-webfont.ttf') format('truetype'),
         url('Crimson-Bold-webfont.svg#CrimsonBold') format('svg');
    font-weight: bold;
    font-style: normal;
 

Google Web Fonts For open-source fonts, you can also use Google Web Fonts instead of hosting the files yourself. Build a collection of fonts and choose the variants that you want to use for each of them. You will then be provided with a code snippet to paste in the <head> element of your page. For example, for Crimson:

<link href='http://fonts.googleapis.com/css?family=Crimson+Text:400,700,400italic'
      rel='stylesheet' type='text/css'>

Why choose this solution over self-hosting?

1. You don t use your own bandwith to serve fonts. This may be important if you pay for it.
2. Google uses its own CDN to serve fonts. If you don t use a CDN yourself, this can be a major performance improvement.
3. Caching is more efficient since many sites will use the same font.
4. It s easier to do it right.

Unless you are concerned about Google tracking your users², I think this is a better solution than self-hosting. Quick delivery of fonts is pretty important since content rendering can be delayed by them.

Paid services If you would like to use commercial fonts, like Adobe Minion Pro or Paratype Futura PT, a convenient option is to rent them. Typekit is service providing such an option. Pricing depends on volume and the number of fonts you want to have access to. There is a free plan and the first paid plan is US$24.99 per year. Other similar services exist. Feel free to compare. Once registered, the workflow is similar to Google Web Fonts. You choose your fonts, assemble them in a kit and publish it. Instead of directly providing a CSS file, Typekit provides some Javascript which will in turn download a CSS file containing all fonts in the appropriate format for the browser (on most browsers, fonts are inlined).

<script type="text/javascript"
        src="//use.typekit.com/tyt0atd.js"></script>
<script type="text/javascript">
  try Typekit.load(); catch(e) 
</script>

Typekit: the good parts So, why choose Typekit? First, there is the very large choice of fonts. The first paid plan comes with more than 500 fonts from about 80 foundries. There are about a hundred serif fonts and a couple hundred sans serif ones. Typekit provides a convenient interface to browse fonts. You can either search fonts by name or by characteristics. In the last case, you can filter on properties like the classification (serif, sans serif, decorative, etc.), weight, width, contrast, x-height, recommended use or language support. Once a font is selected and added to your kit, you can easily choose what variants you want. The kit total size is displayed. If you happen to meet any problem or have some questions, Typekit support is very responsive. I got clear and crisp answers in less than a few hours in the week-end.

and the bad ones Unfortunately, Typekit has also some shortcomings. One of the most commonly cited is that Javascript is mandatory. No Javascript, no fonts. If you want to display the appropriate fonts for users without Javascript, you should just not use Typekit.

Not free, nor free While Typekit offers some open-source fonts, most of them are not. Moreover, only a few of them are available in the free plan. While I would prefer to use open-source fonts, I don t consider this a strong requirement: if you are dissatisfied for some reason, switching back to open-source fonts (or another service) is fast and easy. I like serif fonts a lot and they get less attention from the FLOSS world: it is difficult to find one whose readability on screen is excellent. Droid Serif is a nice font but is a bit too black for me. Maybe Cardo would be a good match. You may disagree and in this case, Google Web Fonts or self-hosting seem the perfect match.

Difficulty to choose and test fonts While browsing fonts is easy and smooth, choosing and testing them is another matter. For example, Typekit is missing some interface to compare font rendering for whole paragraphs at a given size. It also misses a way to check how two fonts render together, one for headings and one for paragraphs. Here, Google Web Fonts is more versatile. Things become really difficult when you want to test your selected fonts for real. Except if you have invested into one of the expensive plans, you can only include a limited number of fonts in your kit. Each time you want to try another set of fonts, you need to modify your kit and wait for it to be distributed across Typekit network. You may have to wait five or ten minutes between each change! Another inconvenient thing is that once you publish your site, any change to the kit will affect the published version. Therefore, you need to use a second kit for development and play back and forth with those two kits. What would be convenient here is a special kit with all fonts from the library with restricted access to some IP to avoid abuse. This is something done by Fontdeck, a competitor.

Poor subset support Because you want to keep the font size small (about 30 kB for each variant), Typekit usually proposes two subsets: the default one contains only latin characters and the complete one with all glyphs. If some glyph is absent from the default subset, you need to use the complete one which is roughly two to four times the size of the default one. This is a bit huge for only one character. What would be nice is to have subsets for each language. In my case, I would take a French subset because I need the glyph which appears in French in words like c ur (heart or core) or il (eye). I don t want to select the complete subset just for this character. When a glyph is absent, the next font in the CSS stack is used. For example, if the selected font is FF Tisa Web Pro and the next font in the stack is Droid Serif, here is how the word c ur may be rendered. On the first line, FF Tisa Web Pro contains the appropriate glyph. On the second line, the glyph is absent and taken from Droid Serif. Since x-height and contrast are a bit different, the replaced glyph seems out of tone. At small sizes, the difference accounts for more than 10%. I have also added a third line where the ligature is built from o and e and the following style is applied to e :

.lf-ligature  
    margin-left: -0.172em;
    zoom: 1; /* Here to trigger hasLayout on IE7 */
 

As you can see, the result seems good. I have a piece of Javascript turning a ligature into the appropriate markup. It can be extended to handle more ligatures and could be adapted to handle other composed characters (like the ones in Anton n Dvo k ).

Defective caching Because a document can only be rendered after the fonts have been loaded³, it is pretty important to deliver fonts as fast as possible. Typekit uses Edgecast as a CDN and DynECT for DNS hosting. Two files are downloaded. Both of them are hosted on use.typekit.com. The first one is a script that will act as a loader. Based on the characteristics of your browser, it will choose how to download the requested fonts for best rendering. The second file is generally a big CSS file containing the fonts. Here are the headers returned for the first file:

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=300
Content-Encoding: gzip
Content-Type: text/javascript
Date: Tue, 08 Nov 2011 18:34:16 GMT
ETag: "388467610+gzip"
Expires: Tue, 08 Nov 2011 18:39:16 GMT
Last-Modified: Sat, 05 Nov 2011 09:31:57 GMT
Server: ECS (cdg/D624)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 7440

First, notice that the content is served compressed. Good point. The next headers to look at are Cache-Control, Date, ETag and Expires: the server requests the content to be cached for 5 minutes. When the browser notices that its copy is out-of-date, it will issue a new request including a If-None-Match: 388467610+gzip header. Unless the kit has been modified, the server will answer with 304 Not Modified and no content. The copy of the browser will be valid for another 5 minutes. This means that after 5 minutes, at least 3 round-trips are needed to check if our fonts are up-to-date. Worse, sometimes, Typekit servers may be just slow. They can wait one second before answering, just to send a 304. Since the first file is a script embedded in <head>, the whole page is blocked until you get the answer. Here is an illustrative example with Chromium 14 where a page using Typekit is loaded while all static assets are in the navigator cache and things have gone wrong (which is pretty rare): Since fonts are needed, the rendering has been paused for 3.5 seconds until Typekit was fully loaded. If we look more closely, we may also notice we got a status 200 from the server instead of 304. Here is an excerpt of the browser request:

GET /tyt0atd.js HTTP/1.1
Host: use.typekit.com
Connection: keep-alive
Accept-Encoding: gzip,deflate,sdch
If-None-Match: "2200251225+gzip"
If-Modified-Since: Thu, 10 Nov 2011 11:38:11 GMT

And here is an excerpt of the answer headers:

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=300
Content-Type: text/javascript
Date: Fri, 11 Nov 2011 17:10:03 GMT
ETag: "2200251225"
Expires: Fri, 11 Nov 2011 17:15:03 GMT
Last-Modified: Thu, 10 Nov 2011 11:38:11 GMT
Server: EOS (lax001/54E5)
Content-Length: 25755

What happened? For some unknown reason, the server denied the access to the compressed version of the resource: there is no Content-Encoding: gzip while the browser did send Accept-Encoding: gzip. The tag provided by the browser (2200251225+gzip) came obviously from the compressed resource and therefore does not match. RFC 2616 requests If-Modified-Since header to be ignored if the tag does not match. Consequently, the server answers with 200 OK and resend the whole file. The same problem happened with the CSS file. Let me stress again how important the problem is: we had to download again the two files but we also downloaded the non-compressed version. Now, let s suppose that we did not run into this problem and the server answered with 304 Not Modified. The result is still not satisfactory: we would have waited 1.3 seconds to get both answers from the server. Keep in mind that most of the time, Typekit is pretty fast. Here is how I think this should have been done: each time you modify your font kit, you get a new URL to use (containing the version of the font kit for example). This resource and the associated fonts (whose URL is also versioned) are requested to be cached for several days. As a sidenote, this also enables to modify a kit for your development environment without modifying the kit for your production site. I suspect that Typekit did not go this way to track kit usage more accurately and enforce the appropriate pricing. Having multiple versions of the same kit would also allow us to use more fonts that we are paying for. UPDATED: Typekit support knows the problem and is working on it:

You ve identified a small bug in our CDN provider that we re working with them to fix. Hopefully I can give an explanation of what s happening. The CDN edge servers have a cache of recently served kits on them. Any request that is served from that cache will be correctly Gzipped and handle ETags. Unfortunately, if the content isn t already in cache and needs to be fetched from the master origin server then the request won t be gzipped correctly which has the side effect of breaking ETags. [ ] We are working to on getting this bug fixed, but any change to a globally distributed CDN will take some time. We re also working on having our content cached longer than 5 minutes whilst still allowing people to quickly update their site.

Conclusion I have mixed feelings about Typekit. While the difficulty to test fonts and the lack of language-related subsets are annoying, I have been able to work around them. However, the caching problem is more annoying. I am still considering going back to Google Web Fonts just because of this.

---

1. While I have a high interest in typography, have my own copy of The Elements of Typographic Style by Robert Bringhurst and have throughly read The Elements of Typographic Style Applied to the Web , I am still fairly novice on this matter.
2. Google serves fonts from a cookie-less domain. Technically, they could still do some kind of tracking but I believe they don t.
3. In fact, browsers have different strategies on how to render before fonts availability. Paul Irish wrote a comprehensive article on FOUT. One common strategy is to render a blank space until downloaded fonts are available. If this takes too much time, fallback fonts may be used.

A few years ago, I ran into my friend Jay in the MIT Infinite Corridor. He was looking for volunteers to have their pictures taken and then added to the library of freely licensed and remixable media that would ship with every version of Scratch -- the graphical programming language built by Mitch Resnick's Lifelong Kindergarten group that is designed to let kids create animations and interactive games. Jay suggested I make some emotive faces and I posed for three images that made the final cut: But although I've spent quite a bit of time studying the Scratch community in the last few years as it is grown to include millions of participants and projects, I forgot about about Jay's photo shoot. A couple months ago, Acetarium resident Andres Lombana Bermudez pointed out that there was a mako tag on the Scratch website and that a whole bunch of users had been publishing projects using the pictures of me which, apparently, shipped in Scratch under my name. For example, in this project in which I dance in front of a enormous "MAKO" banner: That said, given the rather emotive nature of the pictures, I seem to usually end up being blown up shot, shrunk, set on fire by dragons, or meeting other similarly unfortunate ends. There's quite many more entertaining examples under the tag and many more elsewhere on the Scratch website although they are a little trickier to track down. Jonathan Zittrain likes to say that the best technologies are generative in the sense that they encourage their users to make things with them that the designer never forsaw or anticipated. I feel generative.

We have been working on adding build-arch support for about a week now and I figured a little status update would be in order. According to UDD, we had 506 packages to fix when we started and after todays update it has dropped to 485. It is a little less than the 4 packages a day needed to ensure that they are all fixed in Wheezy, but I think it has been a good start. On a related note, I am very pleased to see the progress on the general build-arch fixes. According to the statistics collected by Lintian on lintian.d.o[1], maintainers in Debian has fixed a total of 67 packages since we started. To put that into perspective, we fixed about 36 packages the week before that. [1] Currently only DD-accessible on lintian.debian.org /srv/lintian.debian.org/history/tags/debian-rules-missing-recommended-target.dat

& another mix of various RC bug fixes: applying patches from others, fixing stuff myself, closing obsolete bugs:

• #634650 src:xplanet: "xplanet: Please Build-Depends on libjpeg-dev, not libjpeg62-dev"
  do as the bug report requests, upload to DELAYED/2
• #637936 libtunepimp: "FTBFS: fatal error: curl/types.h: No such file or directory"
  add patch from peter green, upload to DELAYED/2
• #639152 src:csmash: "csmash: Please Build-Depends on libjpeg-dev, not libjpeg62-dev"
  fix build-deps, upload to DELAYED/2
• #639176 src:fdm: "fdm: FTBFS: unsatisfiable build-dependency: tdb-dev (>= 1.1.1~svn26294-1.1) (versioned dep on a virtual pkg?)"
  fix build-deps, upload to DELAYED/2, later sponsor maintainer upload
• #640588 roundup: "roundup: package purge (after dependencies removal) fails"
  apply patch from Ubuntu / Daniel T Chen, upload to DELAYED/2
• #640597 ekeyd: "ekeyd: installation fails"
  fix postinst (check for existence of init script), upload to DELAYED/2
• #640599 anon-proxy: "anon-proxy: installation fails: chown: cannot access /var/run/anon-proxy': No such file or directory"
  apply patch from Ubuntu / Daniel T Chen, upload to DELAYED/2
• #642689 src:mailsync: "mailsync: FTBFS: configure: error: a working c-client installation is required for building mailsync"
  apply patch from Ubuntu / Ilya Barygin, upload to DELAYED/2
• #642721 src:libcaca: "libcaca: FTBFS: make[4]: *** [refman.pdf] Error 1"
  unreproducible with the newest version neither locally nor on Grid'5000, do a versioned close
• #642793 src:tkgate: "tkgate: FTBFS: ERROR: Unable to find library X11"
  apply patch from Ubuntu / Andreas Moog, QA upload
• #647120 src:libgeo-proj4-perl: "libgeo-proj4-perl: FTBFS with perl 5.14: CCFLAGS should include $Config ccflags "
  add patch from Dominic Hargreaves, upload to DELAYED/2

in somehow related news: the perl 5.14 transition has begun. that also means that the severity of some bug reports was raised, & maybe we'll see some new ones. but it also means these bugs are easier to fix now that perl 5.14 is in unstable.