Suppposedly, card number five in the Tarot is the Hierophant, described as “someone who interprets secret knowledge” and representing concepts such as “conformity” and “group identification”. Not that any of that is related to this “five things you don’t know about me” meme, for which I’ve apparently been tagged by both Pia and Tony. And since I wouldn’t want to be accused of being either cool or vanity lacking here’s some from me.

• I used to be a regular bit-part actor in school plays and musicals; I was in the school choir for four years in high school too. I tried getting back into it once during uni, but didn’t really have the time or interest, so I’m just left with going to the occassional show and watching these days. Of course, when they’re as spectacular as Woman in White that’s not much of a problem…
• For quite a while, my favourite food was lamb’s brains, crumbed and fried with a white sauce. I’m quite fond of offal, also known as “variety meats” apparently, in general really – I’m not really persuaded by the “it’s morally wrong to eat animals” thing, but I figure if you’re going to anyway, it makes sense to not be wasteful about it. Kidneys are pretty awesome too; though liver seems to get boring before you’ve finished eating it. I’ve never tried haggis; but I suspect that’ll change before the next DebConf is over…
• Prior to getting an 486sx33 that eventually ran Linux, I used to be an Amiga geek. As an Aussie Amigoid, that meant reading the Australian Commodore and Amiga Review (edited by Andy Farrell), and eventually when I became really elite, subscribing to Megadisc, a monthly magazine on floppy disk, which included useful programs, reviews, letters, and all sorts of interesting things. My first published C progream was included on one of the issues – it was a teensy little app for people with hard disks that would see if you had a Megadisc in the drive, then open up a dialog box so you could choose a directory to copy the disk too, and not have to worry about seek times and such. Unfortunately I was new enough at the whole “C” thing that I wasn’t sure how to make a new directory myself, and decided to just expect the user to use the “New Dir” button in the standard Amiga dialog box for that. Which would have been fine if I hadn’t also gone to the trouble of helpfully emptying the selected directory so the user wouldn’t end up with two Megadiscs in the same place. Put the two together, and evidently you end up with Megadisc’s editor, Tim Strachan, calling you at 9am the morning after publication and telling you how someone had tried it out and it had started deleting all the files on the hard drive. Ooops. With the Amiga dying out and the rise of the internet, it looks like Tim’s now more into alternative health products than computers.
• On the Friday before flying down to Canberra to be Rusty’s wingman for a meeting with the Attorney-General’s department I had my first motorbike accident – not making a turn on a wet road at night just near home, hitting the asphalt and the gutter. I came out of it with some torn jeans and a grazed knee, a banged hand that needed icing, a nice bruise on my side, and a bike that ended up taking aaaages to get fixed and ridable again. Happily it’s gotten another couple of thousand k’s on the odometer since then.
• In the couple of days before I head to Sydney for the 2007 edition of the fantabulous linux.conf.au I’ll be moving from my unit in Toowong to a house in Highgate Hill. Clinton and I will be sharing the upstairs, while the downstairs will be turned into a granny-flat for my parents for when they decide to stay in the city. The theory is it’ll be an investment over the longer term, with the idea being to try building some townhouses in the rather large backyard and sub-dividing. Should be fun!

Let’s see, I’ll tag: vocalist extraordinaire James, companionable carnivore Pat, sometime C hacker David, fellow motorcyclist Sez, and future housemate Clinton.

The upcomming linux-2.6 release will introduce some changes in the Xen support.

* The GE Soft White electric 60 bulbs are CFLs that are much more pleasant than the other's we've tried. Sometimes it's surprising that name-brand can be better. =) We've now got 6 of them in the house. We'll have more as soon as I find a brand that works in a dimmer. I've read that they exist, and this brand doesn't say "not for use in dimmers" like the other ones do. We'll see. =)

The weather in Montr al is supposed to be a high of 16 C on Saturday. In January. C'mon people, it's time to do more than we have been. I don't care if you don't believe using less electricity, less gas, eating less meat, etc. will help fix global warming. Doing nothing certainly *won't* help and until you have a better plan, put down your cheese burger, get out of your SUV and bloody well go for a walk to buy some CFLs.

* auzure_skies is 33 weeks pregnant today! =)

* PHP 5 sucks far less than I thought it would. The object model seems to actually match what I expect for umpteen years of other programming. Further, the Eclipse PHP editor has already helped me catch some mistakes. I did wind up installing IBM's JDK for PPC in order to get the speed to where I needed it to be, though. Java 7 should rock. =) I've been hacking on a project for the church called 'ConnectUU', and the code had crufted pretty badly over a handful of maintainers and upgrades from what looks like early php3. One file in particular was special:

-rwxr-xr-x 1 jbailey users 623863 Dec 17 02:37 events.php

And that's been split nicely now into 37 classes.

* Various friends, family etc have asked to be notified when the child is born. The best I can say is 'well, alright'. If seeing it here on the LJ isn't good enough, let me know and I'll add you to the super-secret-mailing-list. But don't expect anything exciting. Probably something along the lines of 'Showtime, Synergy'.

* Oh: Happy New Year! For this year I've made no resolutions. I can't predict my future more than about 6 weeks out, and I'd be totally fooling myself if I claimed otherwise. But hey. =)

* We've totally finished moving now. Pictures are coming soon, but I'm trying to get ones without boxes and mess in the background. I've put a few up so far at http://www.flickr.com/photos/jbailey/tags/4537/

As demonstrated by the gmail contacts list hijack attack, web 2.0 technologies are quite vulnerable for attacks. And while GMail has a rather good security record, cross-site-scripting is the security issue to watch out for. Especially since many web2.0 sites deal with sensitive data (especially data you probably shouldn't have given them in the first place...) this is rather interesting. It's not new (mind you, the whole web 2.0 thing is not new), but it's being used heavily now, and a lot by people who don't pay enough attention to security. The whole web 2.0 thing is quite naive, mind you. I expect to see more attacks of this type to surface. And in the long run I think we'll either need to use some web interface specification language (so the browser only allows whitelisted access; think robots.txt) or new security filters in browsers will break most (if not all) mashups. Maybe it would be best to add some real WSDL/SOAP code to the Javascript core (and in this process add all the stuff the monster javascript libraries around have been adding, effects, event queues, sane callback handling, getElementById shortcuts etc. - it just doesn't make sense to download the same 200k Javascript from a dozen sites. Dojo, Mochikit, Prototype, ...).

I've set up some simple RDF export (gzip only, please add caching yourself!) for the Debtags data. The export is using the DOAP ("Description of a project") vocabulary, though it isn't optimal (we're not talking about separate projects, but multiple packages may belong to the same). The format of the RDF file may (and will!) still change, for example I'd like to have some explicit URIs for the packages instead of just storing it in the name tag. Suggestions for a matching vocabulary / serialization are welcome. But if you want to play around with some real-life data, just grab a copy. There is a couple of interesting things you can do with it, such as my folding tag cloud. So go ahead, and play around with it a bit.

Note: This post grew larger than originally intended. It drifted away from Vista to general rants about Microsoft and the content industry towards the end of the post, so just skip the rest if this is not of interest to you.
The latest thing I heard about Vista is that Microsoft bribes bloggers with Vista notebooks. As the article points out, this is plain wrong. Apart from crossing the line by not only giving away their own product to reviewers for free, but by actually providing an additional benefit (in the form of the notebook), they also did it wrong because - as the article on tech.blorge.com linked above points out - they don’t understand the way blogging “works”. Too many will be more or less angry because they didn’t get a free notebook (if anything at all).

In my opinion though, this is by far the least important mistake they made with Vista. All their content protection stuff is far worse. It basically does what current copy protection mechanisms already do, but to a much larger extend: Bother the legitimate users while users of pirated copies are uneffected. I don’t think they can avoid pirated copies for a minute. A friend already has a nice HD video player (HDDVD IIRC) and a nice HDCP capable TFT-display, both bought in december. Problem is that the HDCP protected connection resets every few minutes, causing a dropout in both video and sound for a few seconds each time. Seems HDCP compatible player and HDCP compatible display doesn’t necessarily mean that the two work together. Fortunately, in this case, there is some “secret” code you can enter on the players remote to disable HDCP completely. Of course, technically, this is not legal use, but if he didn’t use that hack, he wouldn’t be able to watch his legitimately bought video with his legitimate player and display. Given this problem, I can only shudder when thinking what will happen on Windows Vista with all those encrypted and signed communication channels (drive->memory->videocard->display, just to name the most obvious ones). And there is also the degradation of totally unrelated audio and video stuff while some “premium content” is played. Assume that I play some premium audio stuff. According to the hardware and driver specs for Vista, the availability of any premium content means that any non-encrypted channels need to be turned off or artificially degraded (like downsampling video from 1080p to VGA and upsampling it again since the display might be limited to only display 1080p). This is oh-so-stupid.
And there is also their EULA, as reviewed by Ed Foster. I won’t go into details here, but let’s just say that the EULA is the final nail in Vista’s coffin for me. I’ve been a Windows user since Windows for Workgroups came out (though I’ve used Linux on my machines since 1993 - and almost exclusively since 1998), but I won’t buy Vista, not even when it would be included with a new PC. By the way: This also most likely means that I won’t buy any HD video stuff at all, since the Vista content protection stuff was mostly dictated by the big Hollywood studios. Seems like I will be saving quite some money over the next years. (Which I actually need to do anyway.) Other interesting links regarding Vista:

• The Inquirer - Charlie Demerjian: Microsoft Vista is not an option
• The Register - Scott Granneman: Surprises inside Microsoft Vista’s EULA
• Juha Saarinen: DRM behind lack of Windows Vista drivers… and fear the new content protection
• Techworld.com - Chris Mellor: Vista crippled by content protection
• The Register - Andrew Orlowski: Vista’s Suicide Bomb: Who gets hurt?

I said they did it all wrong because they forgot that they are selling Windows not to the content industry but to the consumers. Sure, the consumers want to see what Microsoft calls premium content, but I’m also sure that they don’t want all that content protection nonsense Microsoft built into Vista for the sake of the content providers. They lost the balance between avoiding pirated copies (which I think the content protection stuff will have no big effect on) and bothering users of legitimate copies. Heck, I already use “pirate” copies of most of the (Windows-based) games I play because I don’t want to be bothered by their original-CD-checks, even though I own at least one legal copy of all the games I play. Would I need to download pirate copies of the HD movies I want to watch because I don’t want to be bothered by whatever side-effects VCP will have, even if I own legal copies of the same movies? Dear Microsoft, dear Content-Industry (TimeWarner, Disney, whoever), please re-think who you want to sell your content to. I already avoid DVDs which carry additional copy protection (apart from CSS), and if they were available at all, I would prefer to buy DVDs without even CSS. The same is true for CDs (except that they obviously don’t have CSS). Consequently, I’m likely to avoid buying HD videos which impose unpleasant restrictions on me, including those that disable the S/PDIF output of my player (no matter wether PC or standalone) since I paid a lot of money for decent HIFI equipment two years ago and I sure as hell won’t want to by new equipment within the next few years. Luckily, I didn’t yet buy any HD video gear, though my notebook, when equipped with a HDDVD or Blueray drive should be capable of playing HD video - if MS and the content industry wouldn’t impose stupid restrictions.

I'm not going to make any New Year's resolutions this year. I will, however, use the New Year as an excuse to re-think many things in my life. To start with, I have re-subscribed to several Debian mailing lists, even debian-private. A second new thing is that I have a new toy, an iRobot Roomba GR. In other words, an automatic vacuum cleaner. I used it for the first time today, and it was hilariously funny. Not excessively expensive, either. A third new thing is that I re-installed my laptop, with the Debian-Installer daily build from 2006-12-31. It worked like a charm. The old installation on this laptop had deteriorated over several months, as I did unspeakably evil things to it, so starting from fresh was a bit of a relief. Now I have an encrypted hard disk, and a working suspend and hibernation (suspend-to-ram and suspend-to-disk), apart from the backlight not coming back on automatically after resume. Yay! Etch is going to totally rock. A fourth new thing is that I switched over my web log from CVS to Bazaar (bzr). It was the last vestige of my youth. When I was a child, I used RCS. When I was young, I used CVS. Now in my old age, I use Bazaar, because it is comfortable. Incidentally, Notetak is up to version 0.4, and I'm getting comfortable with it, too. I'm going to experiment with adding tags to notes. I don't yet have an idea what would be a good UI design for that, but it will come to me eventually. New things are good, even for neophobic luddites like myself.

It seems that no-one has documented what needs to be done to correctly run multiple Ethernet devices (with one always being eth0 and the other always being eth1) in a Linux Xen configuration (or if it is documented then google wouldn't find it for me).

vif = [ 'mac=00:16:3e:00:01:01', 'mac=00:16:3e:00:02:01, bridge=xenbr1' ]

Firstly I use a vif line such as the above in the Xen configuration. This means that there is one ethernet device with the hardware address of 00:16:3e:00:01:01 and another with the address of 00:16:3e:00:02:01. I just updated this section, the 00:16:3e prefix has officially been allocated to the Xen project for virtual machines. Therefore on your Xen installation you can do whatever you like with MAC addresses in that range without risk of competing with real hardware. The Xen code uses random MAC addresses in that range if you let it.

I have two bridge devices, xenbr0 and xenbr1. I only need to specify one as Xen can figure the other out.

Now when my domU's boot they assign ethernet device names from the range eth0 to eth8. If there is only one virtual Ethernet device then it is always eth0 and things are easy. But for multiple devices I need to rename the interfaces.

eth0 mac 00:16:3e:00:01:01
eth1 mac 00:16:3e:00:02:01

This is done through the ifrename program (package name ifrename in Debian). I create a file named /etc/iftab with the above contents and then early in the boot process (before the interfaces are brought up) the devices will be renamed.

In the Red Hat model you edit the files such as /etc/sysconfig/networking/devices/ifcfg-eth0 and change the line that starts with HWADDR to cause a device rename on boot.

Update: the original version of this post used MAC addresses with a prefix of 00:00:00, the officially allocated prefix for Xen is 00:16:3e which I now use. Thanks to the person who commented about this.

Another problematic meme is the idea that no-one need tolerate anyone - even those who are tolerant (known as the Rabid Right meme). When someone has no tolerance for others (for example, flaming people who expect any attempt at fairness, or who follow different social interaction patterns) then they have no place in a community such as Debian. They should clear off to some hard-hierarchy project - it's not like there's any shortage of Rabid Right hackers in this world. </sarcasm> For what it's worth, I believe life should be fair (idealism) and life is not fair (pragmatism). It is possible for those two beliefs to coexist. Expulsion could be fair, but (IIRC) every expulsion proposed so far would have been unfair and based on personal issues, rather than repeated offences: we may be reaching the point where a fair expulsion could happen. It seems a shame none of those who hold them are willing to use the smaller penalties in a Non-Discriminatory way. The "can't take their job away" meme seems more myth than meme, but it does need sorting out in the few places where it occurs. I doubt it will happen under this DPL.

Web applications suffer from a lot of security issues. This may be attributed in part to the ease of use of the most popular web scripting language, but I think the most important cause is that it's inherently easier to exploit web applications. They run in a browser that will run JavaScript code that has access to login data when any small piece of information hasn't been explicitly sanitised. While one would not recognise copy-pasting rm -rf / from a web page into a terminal as a security issue, when a web application user clicks a malicious link it is, because these links can be obscured in various ways. A relatively new issue is the Cross Site Request Forgery (CSRF/XSRF). In short: a malicious site has a hidden form that POSTs to the web application. If the user presses some harmless-looking button, it will be submitted to the original web application which then accepts it because the user has the right cookie. There have been lots of web applications that have introduced some kind of shield against CSRF, mostly it boils down to the form having a random string inserted which is checked upon form submission. I do not think that this is sufficient: it will fend off the most simple attacks, but an attacker investing a little more time can use things like AJAX to request the form from the remote website, get the random string out of it and put it into the malicious form. Won't this kind of "protection" only provide a false sense of security? Is there a technique that web application developers can use to to thoroughly prevent CSRF with their app?

I have just been installing a Xen domU on Debian Etch. I'll blog about installing dom0 later when I have a test system that I can re-install on (my production Xen machines have the dom0 set up already). The following documents a basic Xen domU (virtual machine) installation that has an IP address in the 10.0.0.0/8 private network address space and masquerades outbound network data. It is as general as possible.

lvcreate -n xen1 -L 2G /dev/vg

Firstly use the above command to create a block device for the domU, this can be a regular file but a LVM block device gives better performance. The above command is for a LV named xen1 on an LVM Volume Group named vg.

mke2fs -j /dev/vg/xen1

Then create the filesystem with the above command.

mount /dev/vg/xen1 /mnt/tmp
mount -o loop /tmp/debian-testing-i386-netinst.iso /mnt/cd
cd /mnt/tmp
debootstrap etch . file:///mnt/cd/
chroot . bin/bash
vi /etc/apt/sources.list /etc/hosts /etc/hostname
apt-get update
apt-get install libc6-xen linux-image-xen-686 openssh-server
apt-get dist-upgrade

Then perform the basic Debian install with the above commands. Make sure that you change to the correct directory before running the debootstrap command. The /etc/hosts and /etc/hostname files need to be edited to have the correct contents for the Xen image (the default is an empty /etc/hosts and /etc/hostname has the name of the parent machine). The file /etc/apt/sources.list needs to have the appropriate configuration for the version of Debian you use and for your preferred mirror. libc6-xen is needed to stop a large number of kernel warning messages on boot. It's a little bit of work before you get the virtual machine working on the network so it's best to do these commands (and other package installs) before the following steps. After the above type exit to leave the chroot and run umount /mnt/tmp.

lvcreate -n xen1-swap -L 128M /dev/vg
mkswap /dev/vg/xen1-swap

Create a swap device with the above commands.

auto xenbr0
iface xenbr0 inet static
pre-up brctl addbr xenbr0
post-down brctl delbr xenbr0
post-up iptables -t nat -F
post-up iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/24 -j MASQUERADE
address 10.1.0.1
netmask 255.255.255.0
bridge_fd 0
bridge_hello 0
bridge_stp off

Add the above to /etc/network/interfaces and use the command ifup xenbr0 to enable it. Note that this masquerades all outbound data from the machine that has a source address in the 10.1.0.0/24 range.

net.ipv4.conf.default.forwarding=1

Put the above in /etc/sysctl.conf, run sysctl -p and echo 1 > /proc/sys/net/ipv4/conf/all/forwarding to enable it.

cp /boot/initrd.img-2.6.18-3-xen-686 /boot/xen-initrd-18-3.gz

Set up an initial initrd (actually initramfs) for the domU with a command such as the above. Once the Xen domU is working you can create the initrd from within it which gives a smaller image.

kernel = "/boot/vmlinuz-2.6.18-3-xen-686"
ramdisk = "/boot/xen-initrd-18-3.gz"
memory = 64
name = "xen1"
vif = [ '' ]
disk = [ 'phy:/dev/vg/xen1,hda,w', 'phy:/dev/vg/xen1-swap,hdb,w' ]
root = "/dev/hda ro"
extra = "2 selinux=1 enforcing=0"

The above is a sample Xen config file that can go in /etc/xen/xen1. Note that this will discover an appropriate bridge device by default, if you only plan to have one bridge then it's quite safe, if you want multiple bridges then things will be a little more complex. Also note that there are two block devices created as /dev/hda and /dev/hdb, obviously if we wanted to have a dozen block devices then we would want to make them separate partitions with a virtual partition table. But in most cases a domU will be a simple install and won't need more than two block devices.

xm create -c xen1

Now start the Xen domU with the above command. The -c option means to take the Xen console (use ^] to detach). After that you can login as root at the Xen console with no password, now is a good time to set the password.

Run the command apt-get install udev, this could not be done in the chroot before as it might mess up the dom0 environment. Edit /etc/inittab and disable gettys on tty2 to tty6, I don't know if it's possible to use them (the default and only option for xen console commands is tty1) and in any case you would not want 6, saving a few getty processes will save some memory.

Now you should have a basically functional Xen domU. Of course a pre-requisite for this is having a machine with a working dom0 installation. But the dom0 part is easier (and I will document it in a future blog post).

I've been using Rails for about a year, and I am, in general, quite satisfied. It really is a big step forward in terms of web programming, and I've found the whole experience very enjoyable. In a year I've managed to crank out a number of sites in my spare time (in between various other activities such as the occasional bike ride and Hecl hacking):

• linuxsi.com - a site in Italian helping people to locate Linux-friendly computer retailers.
• builder.hecl.org - lets you create Hecl mobile phone applications from your web browser.
• libreriaminerva.it - a small bookstore in the center of Padova, specializing in rare and antique books and prints.
• stufftodo.dedasys.com - my own vision of an ajaxy todo list that plays nicely in a business environment, where it's important to be able to share tasks.

As promised, one of my goals is to shift a bit towards producing open source software as a side effect of revenue generating work. The first small result of that is the on_idle plugin I packaged up for Rails. It's the code that Stuff To Do uses to tell whether people are active or not. Installing it should be as simple as:

./script/plugin install http://svn.dedasys.com/public/on_idle

It's just a few lines of Javascript code that are wrapped up in a way that makes it trivial to use from Rails views:

def on_idle(timeout, options, wakeoptions)
<%= on_idle(600,  :url =>   :action => 'notify_idle'  ,
                  :url =>   :action => 'notify_wake'  ) %>

• timeout: the number of seconds before the user is considered 'timed out'.
• options: the action to perform when the user goes idle.
• wakeoptions: what to do when the user 'wakes up'.

Let me know if there is anything I should fix/change/improve. If this plugin works out, I will post, in short order, a plugin that improves the default Rails drag and drop functionality.

Then I look at the destruction these cats have caused. I look at the damage to the really nice dining suite we bought shortly before moving over here. The leather chairs are scratched terribly. The nice wooden table top has scratches in it as well, because they liked to use it as a playground. I was setting the table tonight because we ve got people coming round for dinner (it s been a while), and I saw first hand the extent of the damage. I was so pissed off I could have cried.

If you have a little patience, you can cut their nails either with a cat nail trimmer (5 euros I paid, and that s the best money I ever spent on these cats, aside from neutering) or plain normal human nail clippers.

I have been doing it for Vi and Emacs since they were kittens, and then for Jazz when he replaced Emacs and who had never had his nails trimmed. I even do it for Lola, who is declawed and a very alpha female cat, on her back paw's nails.

Sure, it takes patience, it is best not to do it by force, so wait until they are happily asleep and pet them, then cut one. Get them used to you touching their nails, by making them go out of their claw when you pet them. Do one nail at a time, until they are all used to it and will just let you go through the whole 4 paws at once.

You can google around for techniques, but start reading this. The whole about.com site is filled with great advice for cat owners.

My furniture is still in good shape after two years of cats at home, yes, they love to bite the curtains, they scratch my favourite chair, they drop stuff on the floor and break it, they help me in whatever I am doing (painting, sawing, making the bed...), and they steal cat toys away from me and hide them in secret cat hiding places.

But things are just things, stuff is just stuff, curtains are replaceable, so is furniture. Start trimming their nails the sooner the better, and do not regret these three furry friends found you.

In my previous work as a sys-admin I have worked for a number of companies that depend heavily on free software. If you use a commercially supported distribution such as Red Hat Enterprise Linux then you get high quality technical support (much higher than you expect from closed-source companies), but this still doesn't provide as much as you might desire as it is reactive support (once you notice a problem you report it). Red Hat has a Technical Account Manager offering that provides a higher level of support and there is also a Professional Services organization that can provide customised versions of the software. But the TAM and GPS offerings are mostly aimed at the larger customers (they are quite expensive).

It seems to me that a viable option for companies with smaller budgets is to have an employee dedicated to enhancing free software and getting changes accepted upstream. For a company that has a team of 5+ sys-admins the cost of a developer dedicated to such software development tasks should be saved many times over by the greater productivity of the sys-admins and the greater reliability of the servers.

This is not to criticise commercial offerings such as Red Hat's TAM and GPS services, a dedicated free software developer could work with the Red Hat TAM and GPS people thus allowing the company to get the most value for money from the Red Hat consultants.

If using a free distribution such as Debian the case for a dedicated liason with the free software community is even stronger, as there is no formal support organization that compares to the Red Hat support (there are a variety of small companies that provide commercial support, but I am not aware of a 24*7 help desk or anything similar). If you have someone employed full-time as a free software developer then they can provide most of your support. It would probably make sense for a company that has mission critical servers running Debian to employ a Debian developer, a large number of Debian developers already work as sys-admins and finding one who is looking for a new job should not be difficult. There are more companies that would benefit from having DDs as employees than there are DDs, this isn't an obstacle to hiring them as most hiring managers don't realise the technical issues involved.

This is not to say that a company which can't hire a DD should use a different distribution, merely that their operations will not be as efficient as they might be.

I am the psychotherapist. Please, describe your problems. Each time
you are finished talking, type RET twice. I am worried about Debian. Are you worried often? Yes! I see... Well, why do you say this is so? The Debian project seems to be quite dysfunctional. What makes you believe the debian project seems to be quite dysfunctional? We keep having these massive flame wars. Earlier you said you felt worried? What causes you to be worried? It doesn't seem right that a group of people who ostensibly have the same goal should bicker so much. And its the same topics over and over again. Is it because a group of people who ostensibly have the same goal should bicker so much that you came to me? Yes. You are a very cheap^wgood therapist. It has been suggested that Debian could profit from therapy. Does it bother you that debian could profit from therapy? I would hope that a group of mature, intelligent, professionals could settle their differences on their own. Maybe your plans have something to do with this? I have no plans really. I just want to work on a great Linux distribution. How does it feel to want? What we have built is so great but sometimes it seems that Debian doesn't get taken seriously when outsiders see all this infighting. What happens when outsiders see all this infighting? They think we are just amateurs and they wonder why they should make their future endeavors dependant on a bunch of flighty narcissists. Do you really think that?

No of course I don't. Debian is just as good if not better than most "serious" operating systems and most of the time Debian developers do work together well and settle their differences amicably. But there are a few people who can't and they really hurt our image. I see... Tell me more.

There are some people who just can't work with each other and our current way of dealing with such conflicts is at a dead end. As long as issues are left unresolved and they are forced together, these negative people will just keep bickering and bringing the rest of us down. What are your feelings towards bickering and bringing the rest of us down? I feel that at this point only answer is for the people who can't alter their behavior to be asked to leave or to remove themselves. What do you think? Speaking as a trained psychiatrist I think you are all bonkers and I'm switching to gNewSense.

With 2006 almost finished, I can look back at a succesful year for the Debian/Ruby Extras team. The infrastructure was set up and we gained 12 new team members and a lot of packages. With Etch frozen, I can now almost certainly say what Etch will bring Ruby-wise:

• 35 new libraries and applications.
• A meta-package libruby-extras to extend the Ruby Standard Library with some more useful libs.
• Consistent packaging of the 44 team-packaged apps and libs.
• RubyGem support (courtesy of Daigo Moriwaki)

I am proud of what we have accomplished, good work everyone! Not team related is the change that the whole Ruby stdlib is now bundled in libruby(1.8) and is no longer split up! So you all can remove those Debian-specific messages about having to “do extras things when using Debian”. ;) Future plans for Lenny Future plans for Lenny include updating and extending the Ruby Policy. Focus points will be package versioning, improving documentation. Also we intend to package even more Ruby libraries and applications and ask current Ruby lib/app developers to join us. A third matter I’d like to address is Gem support.

The Debian project is afflicted with several damaging memes. One that is causing problems at the moment is the idea that life should be fair. Unfortunately life is inherently unfair, it's not fair that those of us who were born in first-world countries (the majority of Debian developers) have so many more opportunities than most people who are born in "developing" countries, and things just continue to be unfair as you go through life. Unfair things will happen to you, deal with it and do what is necessary to have a productive life!

When one developer has regular long-term disputes with many other developers the conclusion is that the one person who can't get along is at fault. We can debate about whether one or two significant disputes are a criteria for this or whether having a dozen developers disagreeing with them is the final point. But the fact is that if there is a large group of people who work together well and an individual who can't work with any of them then there is only one realistic option, the individual needs to go find some people that they can work with - they can resign or be expelled. The fact that something slightly unfair might have happened a year ago is no reason for pandering to an anti-social developer. The fact that expelling a developer for being anti-social is unfair to them is no reason for damaging the productivity of all Debian developers.

Another problemmatic meme is the idea that we have to tolerate everyone - even those who are intolerant (known as the Limp Liberal meme). When someone has no tolerance for others (EG being racist or practicing sexual discrimination) then they have no place in a community such as Debian. They need to be removed sooner rather than later. All Debian developers know the problems caused by deferring such expulsion.

The final damaging meme that I have observed is you can't force a volunteer to do any work. On it's own that statement is OK, but the interpretation commonly used in Debian is you can't take their job away from them either. The most common example of this is when a developer is not maintaining a package and someone else does an NMU (non-maintainer upload) to fix a bug, the developer then flames the person who did this (usually to fix a severe bug). It seems to be believed that a Debian developer owns their packages and has a right to prevent other people from working on them. This attitude also extends to all other aspects of Debian, there are many positions of responsibility in Debian that are not being adequately performed and for which volunteers are offering to help out but being refused.

The idea of the GPL is that when a program is not being developed adequately it can be taken over by another person. However when that program is in a Debian package the developer who owns it can refuse to allow this.

While reading the discussion of Vista security on Bruce Schneier's blog it occurred to me that comparing the issues of DRM that face MS with the issues faced by SE Linux developers provides some benefits.

SE Linux is designed to enable the owner of a computer to effectively enforce security policies to protect their system integrity and the confidentiality of their data. Some of the SE Linux users (military users) use all the available features, but most people only use the targeted policy which provides a sub-set of the system integrity and data confidentiality protections that are available to give a greater ease of use.

Fedora and Red Hat Enterprise Linux ship with the SE Linux targeted policy enabled by default. This policy is not something that most users notice. The main program that is commonly used which might have an issue with the default SE Linux policy is Apache. Fedora and RHEL systems that do not run Apache (which is most of them) can run SE Linux with almost no costs.

setsebool -P httpd_disable_trans 1
/etc/init.d/httpd restart

It seems clear to me that there is no good reason for disabling SE Linux by default. There are reasons for running a particular daemon in the unconfined_t domain via the FOO_disable_trans boolean. EG to run Apache without restrictions you would type the above commands.

In spite of the SE Linux targeted policy being so easy to use, the fact that it prevents certain daemon compromises from allowing immediate control of the system, and also prevents some kernel exploits from working, there are still some people who turn it off when installing Fedora and RHEL systems and advise others to do so.

Given this great fear of some people to use a technology that is specifically designed for their own benefit I find it difficult to imagine that any users will be inclined to accept the MS DRM technology that is specifically designed to go against their interests.

ESR claims that the 64bit transition is the critical period for Linux to move on the desktop. While he makes many interesting observations I don't find his argument convincing. Firstly current P4 CPUs with PAE can handle significantly more than 4G of RAM (64G is possible now). Secondly it's quite possible to run a 64bit kernel with 32bit applications, this means that you can use a 64bit kernel to access >64G of RAM with each 32bit application getting direct access to something slightly less than 4G of virtual memory. As ESR's point seems based on total system memory the 4G per application doesn't seem to be an issue. As an aside the only applications I've used which could benefit from >4G are database servers (in the broadest interpretation - consider an LDAP server as a database) and JVM environments. Again it would not be difficult to ship an OS with mostly 32bit code that has a 64bit kernel, JVM, and database servers.

I hope that Vista will be a good opportunity for mass transition to Linux. Vista offers little that users desire, many things that will hurt them, and is expensive too!

With Vista you pay more for the OS and more for the hardware (Vista has the usual excessive Windows hardware requirements plus the extra hardware for TPM encryption) without providing anything substantial in return.

What I want to see next is support for Security Enhanced X to protect desktop environments against hostile X clients. This will make a significant difference to the security of Linux desktop environments and provide another significant benefit for choosing Linux over Windows. While MS is spending their effort in making their OS act against the best interests of the users we will keep making Linux enforce the access controls that users need to protect their systems. Hopefully Linux users will choose to use SE-X, but if they don't they are given the freedom to make that choice - unlike the poor sods who use Windows.