The following selected bibliography showcases only a small portion of the academics who have demonstrated that while it may take two to tango, it only takes one to give a scholarly paper a silly cliche title: There are also a few hundred groups who have demonstrated that larger groups can so as well.

With no clear plans for Hackweek this year, I decided to play even more with N950. As I quite lack some GPS application I decided to write it :-). The feature set will be based on things I would use, though I still think it will be useful for others:

• Display basic GPS info (coordinates, speed, etc.)
• Compass
• Moon and sun rise and set calculations for current location

I've named the application as GePeS and you can find sources on Gitorious: https://gitorious.org/gepes During first day I've managed to implement basic things, check screenshots:

Filed under: English Meego Suse 0 comments Flattr this!

So one my favorite fieldwork photos is the one above and I would love to include it in my book but I have no idea where I got it from much less who took it. The photo was taken during a San Francisco protest against the DMCA, and more urgently at the time, also calling for the release of Dimitry Sklyrov (and we were all listening to Richard Stallman who was giving a small speech and I am on the right hand side of the photo, furiously scribbling notes) I am looking for a high quality photo from one of the many Dmitry Sklyarov protests that were held in San Francisco or San Jose a photo that is either under CC license or given to me with formal permission to publish (I have forms to get official permissions). As I mentioned in my previous post, the book will be published with Princeton University Press with a CC license.

So my first book, Coding Freedom: The Ethics and Aesthetics of Hacking is mostly sort of done. All the arguments are in place and I am doing the final, very annoying, seemingly endless work of adding a few final citations, hunting for permissions, and tweaking about 10 paragraphs that I feel can be slightly improved (down from about 20 last week). The book is based on the dissertation but re-framed significantly with lots of new material and best of all a lot of the cruft has been zapped away, I think. The book will include two published pieces, although slightly revised. One of them is one of my all time favorite pieces on the hacker conference (which is the least academic/jargony of the peer reviewed articles). I thought it might be fun to change some of the photos for my book: so if you have some awesome, high quality photos that exude the joy of conferencing from past Debconfs or ANY hacker conference (preferably with computers in the background) please share. I am open to anything although I am looking for a high quality/sharp photo of people hacking away in the hack lab. The photo I have is good but I would like one with better lighting/sharper focus. The book will be published under a CC license (the most restrictive one, but heck as a junior scholar, I took what I could get and it is the first book that Princeton University Press is releasing under such a license). If you hold the copyright, I will need more official permission, otherwise, if it is under a CC or copyleft license, I will be adding the correct attribution/notice in the book.

I finally finished a thing I was really missing: accessing my Google Contacts from Emacs. That's now possible, thanks to my new google-contacts.el package.

<video controls="controls"> <source src="http://julien.danjou.info/images/emacs-google-contacts.ogv" type="video/ogg"> </video> It includes searching for any contact and displaying the result in a window. You can also jump to a contact from Gnus by pressing a key, and complete e-mail addresses while composing a mail.
Flattr me!

Using zsh as default shell is perfect. Using grml-zsh stuff to configure it, even better. Using XTaran s config, way better. Using your own config, invaluable. Now, there is one thing that always bothered me: having all hosts I usually deal with in my ~/.ssh/config in order to have tab completion (and short names). I wanted to improve the situation and was kindly pointed in a different direction by Myon, namely to just use the ~/.ssh/known_hosts for tab completion. How about that? I started playing around with the config and, as it turns out, Axel already has something ready. Unfortunately, it didn t fulfill all my needs yet. That is because I have multiple known_hosts files. Martin already filed a bug to have ssh read ~/.ssh/known_hosts.d/* but that isn t resolved yet either, even though upstream is aware of it. I thus had to point tab completion and ssh to multiple files by hand. But that s not too bad for now. Let s have a look: Host *
HashKnownHosts no Host *.your-work.com
User that-is-what-they-call-me-at-work
UserKnownHostsFile ~/.ssh/known_hosts.work Host *.debian.org
UserKnownHostsFile ~/.ssh/known_hosts.debian
What am I doing? Well, we need to deactivate the hashing of known hosts. Otherwise your known_hosts files aren t readable as needed. Then you define your known_hosts files for the domains you care about. Pretty straight forward. Now, how about tab completion in zsh? Well, easy part actually: [ -f ~/.ssh/config ] && : $ (A)ssh_config_hosts:=$ $ $ $ (@M)$ (f)"$(<~/.ssh/config)" :#Host * #Host :#*\** :#*\?*
[ -f ~/.ssh/known_hosts ] && : $ (A)ssh_known_hosts:=$ $ $ (f)"$(<$HOME/.ssh/known_hosts)" %%\ * %%,*
[ -f ~/.ssh/known_hosts.work ] && : $ (A)ssh_known_hosts_work:=$ $ $ (f)"$(<$HOME/.ssh/known_hosts.work)" %%\ * %%,*
[ -f ~/.ssh/known_hosts.debian ] && : $ (A)ssh_known_hosts_debian:=$ $ $ (f)"$(<$HOME/.ssh/known_hosts.debian)" %%\ * %%,* zstyle ':completion:*:hosts' hosts $ssh_config_hosts $ssh_known_hosts $ssh_known_hosts_work $ssh_known_hosts_debian What's here? We read and parse your ~/.ssh/config for configured hosts, then we parse all your known_hosts files which are for me: ~/.ssh/known_hosts, ~/.ssh/known_hosts.work, and ~/.ssh/known_hosts.debian. And lastly, all is added to zsh completion for hosts. That actually works. :) Axel, that makes a diff for you looking like this: diff --git a/zsh.d/70-completion b/zsh.d/70-completion
index e92e068..5abf5cc 100644
--- a/zsh.d/70-completion
+++ b/zsh.d/70-completion
@@ -8,6 +8,8 @@ [ -f ~/.ssh/config ] && : $ (A)ssh_config_hosts:=$ $ $ $ (@M)$ (f)"$(<~/.ssh/config)" :#Host * #Host :#*\** :#*\?*
[ -f ~/.ssh/known_hosts ] && : $ (A)ssh_known_hosts:=$ $ $ (f)"$(<$HOME/.ssh/known_hosts)" %%\ * %%,*
+[ -f ~/.ssh/known_hosts.work ] && : $ (A)ssh_known_hosts_work:=$ $ $ (f)"$(<$HOME/.ssh/known_hosts.work)" %%\ * %%,*
+[ -f ~/.ssh/known_hosts.debian ] && : $ (A)ssh_known_hosts_debian:=$ $ $ (f)"$(<$HOME/.ssh/known_hosts.debian)" %%\ * %%,* -zstyle ':completion:*:*:*' hosts $ssh_config_hosts $ssh_known_hosts
+zstyle ':completion:*:hosts' hosts $ssh_config_hosts $ssh_known_hosts $ssh_known_hosts_work $ssh_known_hosts_debian Care to merge? Oh, and before I forget... Of course you don't need to check each and every host by yourself. Debian provides ssh keys for all hosts on master. Just do a scp master.debian.org:/etc/ssh/ssh_known_hosts ~/.ssh/known_hosts.debian and I'm sure, your security aware employer has such a file for you as well. Doesn't he? ;)

As Clint writes on his blog, we have now Yesod, a Haskell web framework, packaged in Debian. Despite his humble choice of words, it was mostly his work, and it is quite some work, given that Yesod has a huge number of dependencies that were not yet packaged. So if you want to use Yesod on Debian, and prefer pre-built libraries without dependency problems and clean installation/deinstallation with dpkg over having always latest and greatest, this should provide you with a solid base.

Flattr this post

quick overview over my RC bug activities during the last week:

• #594277 blm: "blm: non-standard gcc/g++ used for build (gcc-4.3)"
  drop explicit build dependency on g++-4.3 and do a QA upload (which was REJECTed because another DD uploaded it between me looking at the bug and uploading it)
• #616254 src:libcaca: "libcaca: replace doxygen and texlive-* build dependencies with doxygen-latex"
  update build dependencies as requested (more or less) and upload to DELAYED/2
• #635448 collabtive: "collabtive: sources file that was removed in postrm purge"
  check for existence of script in postrm before using it and upload to DELAYED/2
• #638252 chrony: "chrony refuses to start on kernel 3.x"
  forcemerge (and thereby close) with #628919
• #638589 libcaca: "libcaca: Missing build dependancies for documentation building."
  fixed in connection with #616254
• #640559 src:ircd-hybrid: "ircd-hybrid: FTBFS: make[2]: *** No rule to make target /usr/lib/libpcre.a', needed by ircd'. Stop."
  apply patch from Ubuntu / Colin Watson and upload to DELAYED/2
• #640565 src:scrollz: "scrollz: FTBFS: make[2]: *** No rule to make target /usr/include/sys/stat.h', needed by alias.o'. Stop."
  apply multiarch related patch from Ubuntu / Matthias Klose and upload to DELAYED/2
• #640568 src:cpqarrayd: "cpqarrayd: FTBFS: tar (child): /usr/src/.tar.bz2: Cannot open: No such file or directory"
  update packaging for 3.x kernels and upload to DELAYED/2
• #640625 src:scim-bridge: "scim-bridge: FTBFS: rm: cannot remove debian/tmp/usr/lib/gtk-2.0/*/immodules/im-scim-bridge.a': No such file or directory"
  apply multiarch changes from Ubuntu / Daniel T Chen and do a QA upload
• #642034 libjifty-plugin-oauth-perl: "FTBFS: Can't locate Test/Script/Run.pm in @INC"
  add missing build dependency (pkg-perl)
• #642166 src:libjifty-plugin-wikitoolbar-perl: "libjifty-plugin-wikitoolbar-perl: FTBFS: missing build-dep on libtest-script-run-perl"
  add missing build dependency (pkg-perl)
• #642167 src:libjifty-plugin-comment-perl: "libjifty-plugin-comment-perl: FTBFS: missing build-dep on libtest-script-run-perl"
  add missing build dependency (pkg-perl)
• #642237 src:libdbd-odbc-perl: "libdbd-odbc-perl: FTBFS: fails to configure"
  adjust build system to multi-arched odbc-dev (pkg-perl)

random notes:

• "look, mom, #RCBW and /me are mentioned in the recent debian project news!"
• looking at the ubuntu box in a package's PTS page sometimes shows valuable patches that have not yet been forwarded to the debian BTS & are just waiting to be applied.

...but I didn't break it myself. Still, Patrick Makau broke today Haile Gebresselassie's world record by 21 seconds, lowering it down to 2h03'38". This is an impressive performance, considering the quite "high" temporature today in Berlain (about 23 C). My own race was quite good, though not perfect. My goal was targeting 3h36', to break my own record (3h40'24"). However, my preparation was complicated by an hurted ankle in early August, then a very shaky September month at work with a lot of stress and work days up to 12 hours. Not the best way to prepare a marathon. Last two weeks were fairly good wrt running, with an half-marathon run in 1h43' two weeks ago. Still, we complicated this by speding a few days to do sightseeing in Berlin (you can't really be in such a nice city and not try to see it!). So, that means a lot of walking here or there, with museum visits and quite long days. Again, not the best way to prepare a marathon..:-) Still, my watch was set on a 5'07"/km pace. My goal was starting like this, work to avoid going faster over the first 20K ad see what happens. At the beginning, it worked fairly well. Contrary to Paris marathon, Berlin's start in Strasse des 17. Juni is very cool for the first 3 kilometers with an incredibly wide avenue, whilst Paris marathon shrinks in Rue de Rivoli after km 1.5, making it fairly complicated to pass. Also, runners in Germany are much more respectful of running principles and very few register for starting blocks that are nont their real performance (like registering for 3h30 while your best time if 4h). So less passing and a much more costant pace. Up to km15 in Kreuzbeg, everything went well, though the heat was growing, which already made me suspect that I would not make it (0-5K in 25'31", 5-10K in 25'54", 10-15K in 25'55") . From this point, I had to "fight" a bit more to keep the pace...and a few streets without shade had their effect. Moreover, I already had to refill my belt bottle after drinking 0,8l for the first 17KM. The pace thus went down to about 5'10-5'15" and I reached half-marathon in 1h50'28", already not really on time for less than 3h40). 15-20K in 26'41", including a bottle refill. Then 20-25 in 25'44", so small drop after all. However, the wall hit me on km28. For the first time in my marathon life, I think I considered abandoning because I was feeling without any energy and still 1/3 of a marathon to run. Well, that was only the 30K wall which they apparently moved 2K earlier..:-) After calming myself down, I decided to do what has to be done in such case: refill with energy. So long for the gels I had and particularly the hyper-glucidic "Coup de Fouet". Finally, around KM30, I found more motivation to complete the race. Anyway, we were then very very far away, at the end of Hohenzollendamm, so the only option was to come back anyway! Despite all this, I kept a very decent pace, after all: 26'45" for 25-30K. Each kilometer, my watch was beeping to remind me that I was not crawling on the street but more keeping about 5'20". Still, the last kilometers on these giants avenues (oh, endless Leipziger Strasse after Postdamer Platz!) needed a lot of motivation to be completed. It's indeed only at Gendarmenmarkt that I finally could be reliefed and know that I would not only finish, but also do it in a very decent time. 30-35K in 27'43", 35-40K in 27'38". Then we turned in Unter den Linden and, even better, at KM41, my beloved Elizabeth was there yelling. This, plus Brandenburder Tor not so far away....I could then "sprint" at 5'08" for the last kilometer. Finally, this marathon (my 6th official) was completed in 3h44'50", which is my second best. I'm really happy with this result, finally. OK, I didn't break my record as I was intending to (I think I can go down to 3h35 with a normal preparation and good conditions), but the way I managed the difficulty was finally good. So, now, let's prepare the next goal, a 67km night race in November, the longest distance I have ever run. Yet another different thing to prepare. And what about Berlin in all this? Well, in short, that city is *great*. What could I tell more?

Shell prompts are often designed to provide a reminder of useful context information such user name, host and current directory:

PS1="\u@\h:\w\$"
tanguy@muscat:~/public_html$

Such a prompt is sufficient to serve its original purpose, but it can be enhances in at least one useful way. Sometimes you have to copy the path of the current directory: with this prompt, it means selecting it by precisely dragging the mouse over it. Well, by adding spaces around the current directory you can become able to select it with a simple double click:

PS1="\u@\h: \w \$"
tanguy@muscat: ~/public_html $

Indeed, with such a prompt, you can now roughly point to the path, double click, and let your terminal emulator's word detection feature select the whole path for you. This simple modification may save you several tenths of seconds!

Thanks to the tireless efforts of the Debian Haskell Group, Yesod has been updated to version 0.9.2.2 in unstable. Yesod is a Haskell web framework for productive development of type-safe, RESTful, high performance web applications. It is the foundation for hledger-web. It is an alternative to Happstack, the framework used by gitit.

After some restless hours of debugging, here's Phong lighting

http://en.wikibooks.org/wiki/GLSL_Programming/GLUT/Smooth_Specular_Highlights

The code can be optimized, but should give you a clear understanding on how to make smooth OpenGL lighting. And you can admire the stunning results with a mere basic material and one lamp!

So much reporting on hacking is . so bad (no surprise to readers here). Worse is that term term was bandied out constantly during the News of the World Scandal. In contrast to this historical tradition, On the Media has curated a stellar Hack Week that provides depth, breath, and nuance; the producer of the show, Alex Goldman, poured an enormous amount of time, labor, and thought in compiling a rich set of materials to get at the term hackers, the many facets of hacking (from phreaking to hardware hacking) and best of all, interviewed the fantastic Marcia Hoffman from the EFF on one of the laws, the Computer and Fraud Abuse Act, whose massiveness (and vagueness) has the potential to do a lot of damage and which is often wielded against hackers (and many non-hackers as well). There is also an audio section on the term hacker, which I myself might have done slightly differently, emphasizing, that alongside the MIT hacker (covered so well by Steven Levy) phone phreaking (only called as such in 1973 but well and alive before then) fed into a transgressive tradition that was not simply about malicious hacking nor about the media portrayals that started to explode in the 1980s. The interview gets at the fact that there are differences and hackers can be quite sectarian but I might have pushed this fact a little further. All in all and after the ad nauseum use and abuse of the term hacking during the News of the World scandal (and its overabuse with Anonymous), this collection is the perfect antidote.

Despite being on sabbatical last academic year, life was hectic and chaotic leaving me with next to no time to write entries here. Anonymous, which I had worked on for a few years, exploded. I was excommunicated from my house (due to a flood/something likely mold making be very sick) and had to commute to Princeton from the far reaches of Manhattan where I crashed at a friends house for 5 months, while fighting my landlords. I then decided to go on a job hunt primarily as I did not know what would happen with my housing situation in NYC but I was also pursuing some interesting opportunities. Though the housing issue was eventually resolved, in May a rare and enticing opportunity arose. Come January 2012 I will be joining the Art History and Communication Department at McGill University as the Wolfe Chair in Scientific and Technological Literacy. The decision to leave MCC NYU was torturous. The faculty is stellar. The graduate students are top notch and cream of the crop. And the digital media faculty is a force of nature, perhaps one of the deepest and most dynamic departments when it comes to the study of digital media. They also know how to treat their junior faculty right, which made it a place I respected and am deeply indebted to. But this type of opportunity is rare and it helped that NYC as wonderful as it is, is not my cup of tea. I wanted to eventually settle in one of the large Canadian cities, and Montreal was on the top of my list. I get to join one of the best universities in the world and a department whose work on digital media, STS, and politics converges with much of my own. The position provides resources, time, and room to cultivate scholarly work, help build a program of some sort in Science Technology Studies at McGill, and also engage with the public about the ethics and politics of science and technology. I will be teaching a class to joint BA/BS majors on scientific and technological controversies, a topic close to my heart. I also hope to create an open courseware website for my hacker course, which I will teach sometime in the 2012-2013 academic year. It is all that I can ask for, well, except for the weather. I would be lying if I did not admit that the winter scares the heck out of me I know some days I will feel just like this .

I have just uploaded exim4 4.76-4 to experimental. Compared to 4.76-3 the only addition are the changes from upstream's gnutls_fixes branch, making exim4 advertise and use TLS1.1 or TLS1.2 if available. We would appreciate some testing.

For those who use CUPS-PDF on Ubuntu, I have pushed some updated packages into Lucid-proposed, Maverick-proposed and Natty-proposed, mainly to make the package's post-install actions bulletproof, so that automated installs and PPD updates take place in a flawless way. Comments from anyone who tested these package updates are welcome on Launchpad bug #805947. Once these updates have been approved, I'll go through the daunting task of reducing the debdiff down to its utmost essential components and attempt to submit a stable-update to Debian as well.

Thanks to Bruce Schneier security blog, I come across an interesting article about liability and software. The problem is well known

• if you impose liability on any software producer, then it's a dead sentence for free software
• but the current situation enable software dealer to sell faulty software with I can't audit, with liability for them if their software fail on a large scale.

Of course for better security, the solution could be to not use proprietary software, still a law as proposed on ACM could be useful to protect madam Michu.

This week, I've finished my OAuth 2.0 client implementation for GNU Emacs. I have imported it into GNU ELPA so Emacs 24 users will be soon able to install it using the new Emacs packaging system. OAuth 2.0 can be used to access, among others, Google APIs or the Facebook Graph API.
Flattr me!

An obvious question is why Linux doesn't support UEFI secure booting. Let's ignore the issues of key distribution and the GPL and all of those things, and instead just focus on what would be required. There's two components - the signed binary and the authenticated variables.

The UEFI 2.3.1 spec describes the modification to the binary format required to produce a signed binary. It's not especially difficult - you add an extra entry to the image directory, generate a hash of the entire binary other than the checksum, the certificate directory entry and the signatures themselves, encrypt that hash with your key and embed the encrypted hash in the binary. The problem has been that there was a disagreement between Microsoft and Intel over whether this signature was supposed to include the PKCS header or not, and until earlier this week the only widely available developer firmware (Intel's) was incompatible with the only widely available signed OS (Microsoft's). There's further hilarity in that the specification lists six supported hash algorithms, but the implementations will only accept two. So pretty normal, really. Developing towards a poorly defined target is a pain. Now that there's more clarity we'll probably have a signing tool before too long.

Authenticated variables are the other part of the puzzle. If a variable requires authentication, the operating system's attempt to write it will fail unless the new data is appropriately signed. The key databases (white and blacklists) are examples of authenticated variables. The signing actually takes place in userspace, and the handoff between the kernel and firmware is identical for both this case and the unauthenticated case. The only problem in Linux's support here is that our EFI variable support was written to a pre-1.0 version of the EFI specification which stated that variables had a maximum size of 1024 bytes, and this limitation ended up exposed to userspace. So all we really need to do there is add a new interface to let arbitrary sized variables be written.

Summary: We don't really support secure boot right now, but that's ok because you can't buy any hardware that supports it yet. Adding support is probably about a week's worth of effort at most.

comments

Microsoft have responded to suggestions that Windows 8 may make it difficult to boot alternative operating systems. What's interesting is that at no point do they contradict anything I've said. As things stand, Windows 8 certified systems will make it either more difficult or impossible to install alternative operating systems. But let's have some more background.

We became aware of this issue in early August. Since then, we at Red Hat have been discussing the problem with other Linux vendors, hardware vendors and BIOS vendors. We've been making sure that we understood the ramifications of the policy in order to avoid saying anything that wasn't backed up by facts. These are the facts:

• Windows 8 certification requires that hardware ship with UEFI secure boot enabled.
  
• Windows 8 certification does not require that the user be able to disable UEFI secure boot, and we've already been informed by hardware vendors that some hardware will not have this option.
  
• Windows 8 certification does not require that the system ship with any keys other than Microsoft's.
  
• A system that ships with UEFI secure boot enabled and only includes Microsoft's signing keys will only securely boot Microsoft operating systems.

Microsoft have a dominant position in the desktop operating system market. Despite Apple's huge comeback over the past decade, their worldwide share of the desktop market is below 5%. Linux is far below that. Microsoft own well over 90% of the market. Competition in that market is tough, and vendors will take every break they can get. That includes the Windows logo program, in which Microsoft give incentives to vendors to sell hardware that meets their certification requirements. Vendors who choose not to follow the certification requirements will be at a disadvantage in the marketplace. So while it's up to vendors to choose whether or not to follow the certification requirements, Microsoft's dominant position means that they'd be losing sales by doing so.

Why is this a problem? Because there's no central certification authority for UEFI signing keys. Microsoft can require that hardware vendors include their keys. Their competition can't. A system that ships with Microsoft's signing keys and no others will be unable to perform secure boot of any operating system other than Microsoft's. No other vendor has the same position of power over the hardware vendors. Red Hat is unable to ensure that every OEM carries their signing key. Nor is Canonical. Nor is Nvidia, or AMD or any other PC component manufacturer. Microsoft's influence here is greater than even Intel's.

What does this mean for the end user? Microsoft claim that the customer is in control of their PC. That's true, if by "customer" they mean "hardware manufacturer". The end user is not guaranteed the ability to install extra signing keys in order to securely boot the operating system of their choice. The end user is not guaranteed the ability to disable this functionality. The end user is not guaranteed that their system will include the signing keys that would be required for them to swap their graphics card for one from another vendor, or replace their network card and still be able to netboot, or install a newer SATA controller and have it recognise their hard drive in the firmware. The end user is no longer in control of their PC.

If Microsoft were serious about giving the end user control, they'd be mandating that systems ship without any keys installed. The user would then have the ability to make an informed and conscious decision to limit the flexibility of their system and install the keys. The user would be told what they'd be gaining and what they'd be giving up.

The final irony? If the user has no control over the installed keys, the user has no way to indicate that they don't trust Microsoft products. They can prevent their system booting malware. They can prevent their system booting Red Hat, Ubuntu, FreeBSD, OS X or any other operating system. But they can't prevent their system from running Windows 8.

Microsoft's rebuttal is entirely factually accurate. But it's also misleading. The truth is that Microsoft's move removes control from the end user and places it in the hands of Microsoft and the hardware vendors. The truth is that it makes it more difficult to run anything other than Windows. The truth is that UEFI secure boot is a valuable and worthwhile feature that Microsoft are misusing to gain tighter control over the market. And the truth is that Microsoft haven't even attempted to argue otherwise.

comments