... I would appreciate that (any *init maintainers going to DebConf?) - but I won't be around. I missed the DebConf sponsorship deadline (which was end of January; since I'm currently devoted to getting my diploma done, I don't have an income, so sponsorship would be good); and even now (they're currently asking for reconfirmation) I don't plan that far ahead. I have no idea what the state of my diploma thesis will be back then in June. Probably not yet stressful, but I just don't know. So I can't commit to DebConf.A pity, I'd really like to go to a DebConf again, the last (and only) one I was at was in Oslo in 2003. I don't think we needed to sign up that early back then; the school building we could sleep in (and use the showers) was fine with me.And of course I'd also love to contribute some swing dancing 'course' to the social dancing event...

Looking for Earths: The Race to Find New Solar Systems is an excellent introduction book, as a scientific story of exploration and summary of the science of planetary discovery. Alan Boss is a planetary scientist and adviser to NASA on the search for extrasolar planets. He has had a front-row seat in the revolution over the last two decades that has led to the discovery planets outside our Solar system for the first time, leading to 215 known planets at last counting. The book is written in an first-person style that reflects the race to discover the first exoplanets in the 1990s. He describes historical searches for planets in the early 20th Century: the hunt for evidence of planets around Barnards Stara and the meticulous work over decades of Peter Van de Kamp, a good summary of the challenges in proving the case for planets in Astronomy, and explains the techniques used to determine other planets. The heartbreaking difficulties of proving the discovery are well expressed, as well as documenting the leaders of the field at the time. Along the way, he describes the discovery of the first Brown Dwarfs, the border cases between Stars and Planets, and the bureaucratic and other challenges involved in setting up large observatories such as the Keck interferometers capable of doing this work. This is ironic, as the first discoveries were actually made by ground-based observatories. Boss describes the race between the main teams, Geoffrey Marcy and Paul Butler of Lick observatory. The race was finally won by Michel Mayor and Didier Queloz of Geneva Observatory, who discovered the first extrasolar planet around a sun-like star, 51 Pegasi, by looking at radial velocity measurements of nearby stars. This turned out to be a close race, as the planet they had found had a short period of 4.23 days, implying the planet was what we now call a "hot Jupiter", orbiting very close into the Sun. Most teams had been looking for copies of our Solar system, looking for large planets such as Jupiter with orbits of around a decade, and had hence not started to analyse the data they had in hand, expecting to need years of measurements: examining the data showed that, had they analysed data in hand, they could have won. Looking for Earths does a good job of explaining the field of exoplanet research as it was evolving over Boss's careeer and particularly 1995-2005, with theoretical and computer models evolving as data arrived with new puzzles. In some places, the need to give a clear explanation of a topic such as the formation of planets from solar disks slows the pace of the biography, but the book does an excellent job of describing both the science and the life lived by those doing the work. Few books I've read have offered such a good summary of the field to date, along with a good bibliography and I would heartily recommend it both as an introduction to the field and as a model for science writing.

Yesterday afternoon, we started our information meetings with employees about our Linux on the desktop project. We're underway on our migration.

But before I talk about that, I need to back up and describe what the project is.

We are converting approximately 80% of our 150 or so PC users to Linux desktops. They're Debian etch (4.0) running Gnome, Firefox (Iceweasel), Evolution, NFSv4, and SystemImager. Over the coming days and weeks, I'll be writing about why we're doing this, how we're making it happen, things we've run into along the way, and the technology behind it.

Today I'd like to start with a high-level overview of the reasons we started investigating this option.

It became apparent that Vista was going to be a problem for us. Most of our desktop PCs are not very old, but Vista meant a significant degradation in performance from the Windows XP Pro that most people were running. A performance dip so significant, in fact, that it would have created a significant negative impact on employee productivity.

We tend to buy PCs with Windows licenses from the vendor (Windows preinstalled). As such, we knew it wouldn't be long before XP-based machines would be hard to find. If we stuck with Windows, we'd be running a mixed-OS network -- which we knew from experience we did NOT want to do. The other option would be to replace all those old PCs. The direct costs of doing that, with the associated Vista and Office licenses, would have been more than $200,000.

So we started to look at other options -- changing the way we license Windows, sticking with XP for awhile, or switching away from Windows. This last option sounded the most promising.

I took a spare desktop-class machine, representative of the hardware most end users would have, and installed etch (then testing) on it. I spent a bit of time tweaking the desktop settings, making things as transparent to the user as possible. We liked what we saw and started pursuing it a bit more. We knew we had some Windows apps we couldn't discard, so we tested running them off a Windows terminal server with the Linux rdesktop client. That worked well -- and the appropriate Server 2003 licenses plus CALs would still be far cheaper than a mass migration to Vista.

To make a long story short, we are getting quite a few benefits out of all this. One of the most important is a single unified system image. Excepting a few files like /etc/fstab, every system gets a bit-for-bit identical installation from the server, updated using rsync. /home is mounted from the network using NFS (v4). So our users can sit down at any PC, log in, and have all their programs, settings, email, etc. available. A side benefit is that hardware problems become minor annoyances rather than major inconveniences; if your hard disk dies, we can just bring up a different PC. We had tried numerous times to make roaming profiles work in Windows, but never really achieved a reliable setup there -- perhaps because it seemed virtually impossible to assure that each Windows PC had the exact same set of software, in the exact same versions, installed.

More to come.

OpenedHand have announced Pimlico, an umbrella project for our PIM applications: Contacts, Dates, Tasks and Sync (in progress). Released at the same time was Dates 0.4: this release is a vast improvement on the previous release and now available in three flavours: desktop, Maemo, and OpenMoko. At the same time we sneaked out an updated set of evolution-data-server packages for Maemo 3.0. As far as the user is concerned the only changes are that addressbook syncing will work (using OpenSync or SyncEvolution), and that WebCal is supported (as used by Dates). NP: Urban Biology, Machine Drum

Had a great time at DemoCampMontreal2 tonight. There were a ton of people there, the demos were great, and the bar at the SAT was open for business, so it was possible to drink beer and watch demos. There were all very solid projects with lots of interesting stuff going on. My favorite aha! moment came from Hugh McGuire showing off Collectik, his new social-podcast-aggregation platform, when he demo'd how he uses the site, and I realized that that's how I want to organize my podcast listening, too. I also liked Kakiloc, a location-oriented social networking site. They let you tell your friends what you're doing and where you are, and the friends can see it on the Web, by SMS, or through IM. Sound familiar? Yeah. Kakiloc's advantage is that they have more geo-oriented interface, and some extremely powerful rules that trigger activity when you (say) get close to someone in your circle of friends. However, I think in a world of Worse Is Better Kakiloc is going to have a hard time making a sale. Twitter already has the mindshare in this market, and the network effect makes it more valuable for people to stay with the popular platform. I also really dug the films from OpenSourceCinema.org, although they skirted the "demo" concept pretty scarcely. One thing that was neat was that the OSC Web site was built by a real-life barn-raising: Sylvain Carle put out the call for some help, and people convened on his house to build the Web site. Cool idea. All in all I had a really good time. DemoCampMontreal2 worked out well. tags: DemoCampMontreal2 kakiloc collectik opensourcecinema

Bait and switch So, on the way out the door to DemoCamp, I grabbed a handful of loonies out of my bedside change basket for the parking meters downtown. When I got to SAT, though, I realized that the "loonies" I'd brought were in fact Sacagawea dollars. I'd gotten them as change from the ticket machines on the Las Vegas monorail. Doh! Fortunately, downtown Montreal parking meters take credit cards, so I was OK. tags: loonie sacagawea parking meter monorail

Feisty Upgraded to FeistyFawn on Wednesday. Worked fine, nice smooth upgrade (who expects that?). Nothing revolutionary, but the software works well. tags: feistyfawn ubuntu upgrade

A relatively recent addition to the Google range is Google Docs. I'll be testing it shortly, but I see it has already suffered google's usual security/privacy bugs Apart from encouraging the larger Atom feed format, dropping RDF support and unreliable alternatives to its eyetests, Blogger is one of Google's best services. The basic service seems to work in a half-decent manner. Of course, it still has bugs and that let someone post a hoax Google news release Google's search results are still unstable: here's a consultant spotting lots of turbulance in the results. If Google's actions were unfair and harmed your performance, you can't touch them, as kinderstart discovered (but that ruling might be an interesting reference for other ratings sites, so there's a silver lining). The site complains constantly that I don't let it rampage through my browser and I haven't downloaded the latest from Adobe. It's a bit less annoying now that ytplay is available, but it shows that Google doesn't care much for free software support. An interesting twist has been Viacom suing Google for a billion dollars and calling them all sorts of names. (Beware bias in the BBC reporting on this, as BBC just signed up for Google-YouTube [BBC] - is there a monopoly that the BBC won't befriend?) Adwords and adsense looks like some of Google's top mass-market money-makers. I have mixed reports about them, including some of my customers that are happy to use them, and others that get results like this commenter at Problogger which suggests that adsense referrals maybe don't always report accurately. There is also a privacy/trust problem with having one company seeing so much of the world's searches. This was the basis for a recent Ask.com ad campaign (nice idea, shame about the microsite's poor accessibility and various other things - it gave one Google-worker a good laugh and got better commentary from Susan Hallam Communications). Privacy bodies backed Google's step towards allowing user privacy [BBC] but there's more that should be done. That's enough for now. I've got some more positive news which I'll post along with the Docs review.

Yesterday I went to bed too late because I was captivated by the last episode of The Trap: What Happened to Our Dream of Freedom, a series by Adam Curtis. Even since I saw Pandora's Box I've been an avid viewer of his work. The Trap talks about what freedom is, and this morning I realised that many things he talked about can be seen in the OSS world, and more specifically in Debian. I'm certain Biella can write something much better (and shorter) and I'm still thinking about it, but I wanted to write some stuff down.
One of the main ideas is the modern western culture has been formed to appeal for people thinking like a model in the 'prisoners dilemma': they only case to further themselves. This lead to the idea that life (not only the economy) should be like a free market, and that people should be 'free' to choose what they liked. Of course in practice the rich are 'free' to send their kids to better schools then the poor who are 'free' but constrained to send their kids to worse schools. The program called this negative freedom: there is constrained freedom. Think of it as Microsoft's vision of freedom, their 'freedom to innovate' (which they don't), your freedom to select which of the N licences of vista is good enough for you. This limited freedom is more stable then the positive freedom that is actual seeking true freedom, without constraints. This positive freedom was then developed by Satre, Fanon and Shariati into the idea that true freedom could only be gained by armed struggle, to gain freedom but also an identity that transcends the simple individual.
The whole idea of the two freedoms was described by Isaiah Berlin and he also had the idea that freedom can only be gained by limiting the power of the state over the individual, otherwise both concepts of freedom would become tyrannical because the powers that be would decide what freedom is, and then suppress anybody that does not agree with that idea. Examples are the communists in the USSR, but also how the Americans turned to torture, imprisonment without tribunal to 'liberate the Iraqi people'. Or older still the Reign of Terror during the French revolution.
All of this has some relevance to OSS and Debian in particular. Don't we search freedom from constraints (licences, absence of source)? Don't we want a revolution in the use of computers? Are we not using disruptive means to get it? The introduction of a samba file-server in a pure MS environment by a disgruntled admin who just wants stuff to work could be seen as being almost a terrorist method of working. Not that we want to terrorise the population, but make them aware that an alternative exists. And this to chance the system. Sometimes the whole mindset does seem to be a little too much confrontational, almost towards having a real conflict. Just think about the many references that some disaster should wipe out the Seattle area. Are we not at risk of becoming tyrannical in many ways? Ignoring any Debian discussions, there is the whole FreeBSD/OpenBSD split, people complaining that wikipedia is removing contents the consider valuable, projects refusing to create howto's and introductions to keep the newbies away etc. OOS does seem to have a tendency to become tyrannical in some aspects. Not that this is always bad, see the benevolent dictators handling the Linux kernel or python.
If I understand the idea's correctly it means that even if we want freedom, from the moment we start using the powers of the project to limit somebody we start the slide towards being oppressive and tyrannical. Somehow I fear that all this will lead to a lot of reading and thinking...

Today is, of course, 4 Germinal, but it's also known in some circles as March 25. It's the Greek national holiday, ikosi-pente martiou, celebrating the beginning of the Greek War of Independence. The Greek revolution is one of my favorites -- rich in fiery spirit, insuperable odds, derring-do, and undying idealism. It also lent English the word eleutheria, what John Fowles in The Magus called "the most Greek of all words": in translation, roughly, freedom. It's also the traditional feast of the Annunciation, being exactly nine months before Christmas. Since the angel Gabriel gave the Virgin Mary the "good news" (of the virgin birth), in Greek evangelismos, it's also my name day, and the name day of all other Evangelo's out there. tags: 25 March name day greek greek revolution eleutheria annunciation

I abandoned paper calendars in 1997. For a few years I used various Palm devices, then Evolution. For the most part, this has worked fine. One of the drawbacks is that I have not had any info in my calendar about official holidays in Finland. That would be useful so that I would know when other people are going to be responding to e-mail slowly, and get annoyed if I call them on business. Evolution can deal with several calendars at the same time, and can import calendar files in various formats. A couple of years ago I found an iCal file with Finnish holidays, and imported that to Evolution, but it's out of date by now. This week I decided to look for a new one, but before I did, Droidy, the fastest interface to search engines, found one for me. Unfortunately, it was severly lacking, and did not even include Midsummer Eve, the biggest summer festivity in Finland. I then decided to make my own. I skimmed the web pages of The Almanac Office at University of Helsinki. They used to have the monopoly on making calendars in Finland (and what a silly anachronism that was), and they still have the copyright on name days, but that stuff doesn't interest me. The list of holidays is uncopyrightable, and that's the info I extracted from their pages. I also looked at the list of times when food stores are allowed to be open. That's actually more important to me than holidays. I ended up making two .ics files: aukiolot2007.ics for opening hours, and suomi2007.ics for the holidays. They're probably riddled with errors: if you find any, e-mail me and I'll fix and update. I hope they're of some use for someone. (I realize that someone is going to tell me about a complete and officially supported .ics file with all the above data as a response to this log entry. Good.)

Icedove, Iceape, Evolution, Sylpheed, Sylpheed-Claws and Mutt. Is your favorite mail client missing? Does your mail client accept URLs in mailto-format? If yes, please drop me a note containing the name of your mail client, if it needs a terminal (like mutt) and an example call which starts the client with address, subject an body already filled in. Examples:

• Icedove (needs no terminal)
  icedove "mailto:mail@example.com?subject=foosubject&body=foobody"
• Sylpheed (needs no terminal)
  sylpheed --compose "mailto:mail@example.com?subject=foosubject&body=foobody"

I’ll use this data to include more clients in Reportbug-NG. Please double-check if your mail client really supports mailto-URLs with subject and body. KMail for instance accepts such a parameter but silently drops subject and body.

My mail agent is Mutt again! (again mainly because it was my first MUA). Let’s fetchmail and procmail do the hard work while I happily browse my mailboxes! Good bye Pine, Evolution, Sylpheed Claws… and now, Kmail!. (note Evolution link…) BTW, xfmail2mbox.sh works fine, my mails moved smoothly to Mutt as well, so thanks to J rg Reinhardt.

The french presidential election (in april/may 2007) will use plurality voting with two rounds (voters will choose 1 amongst 11 or 12 candidates during the first round. The two candidates with the most votes will be qualified for the second round). The latest polls clearly show how this election method fails to satisfy the Condorcet criterion. Using the second round results from this poll (only considering the 3 main candidates, since the other don’t have any chance to win the presidential election), we get this: So Francois Bayrou is the Condorcet winner, and should win the election. However, the first round results, according to the same poll, could be:

1. Sarkozy 31%
2. Royal 24%
3. Bayrou 22%
4. Le Pen 12%

Since only the two first candidates are qualified to second round, Bayrou wouldn’t be elected. It will be interesting to see how those scores evolves until the first round (April 22nd).

I've started using Yahoo Pipes today, and it's pretty cool. I wouldn't go so far as to call it a "milestone in the history of the Internet", but there are a few interesting use cases. Say for example if you're an avid reader of Planet Debian and you don't like the French Revolutionary Calendar, then you can use Pipes to filter out entries whose title matches a French Revolutionary month and enjoy a 100% revolution-free Planet. Or you could split matching entries into a separate feed, or just use regexp replacement to translate them into something else, etc. The possibilities are endless.

There's also a handy Babelfish module, so you can create a pipe that takes Planet Debian, translates it to French, then back to English. Hours of fun!

• Blues Brothers: Ghost Riders in the Sky
• Irie Revoltes: Ska
• Dan Tyminski, Harley Allen, and Pat Enright: Man of constant sorrow
• Nancy McCallion: On we go
• The Coasters: Down in Mexico
• Nancy Sinatra: These boots are made for walking
• Aretha Franklin: Think
• Golden Earring: Radar love
• War: Low Rider
• Juanes: Camisa Negra
• Steve Miller Band: Magic Carpet Ride

*doing* *doing* *doing* *doing*

I've started using Yahoo Pipes today, and it's pretty cool. I wouldn't go so far as to call it a "milestone in the history of the Internet", but there are a few interesting use cases. Say for example if you're an avid reader of Planet Debian and you don't like the French Revolutionary Calendar, then you can use Pipes to filter out entries whose title matches a French Revolutionary month and enjoy a 100% revolution-free Planet. Or you could split matching entries into a separate feed, or just use regexp replacement to translate them into something else, etc. The possibilities are endless.

There's also a handy Babelfish module, so you can create a pipe that takes Planet Debian, translates it to French, then back to English. Hours of fun!

After asking for useable CA Software, I have finally settled on using EasyRSA. This is what I did to come across the packaging shortcomings of EasyRSA in Debian. Storing your CA Be sure that your CA is stored in a secure place. Don’t store it online, and make it accessible only to yourself. In my opinion, storing the the CA in a cryptoloop container file on a small 32 MB USB stick is a good idea. Cryptloop is rather easy today and available in the stock Linux kernel. I commonly use grml-crypt to manage the crypto loopback stuff:

sudo grml-crypt start /media/usb4/cryptoloop $MOUNTPOINT

Gotcha: don’t confuse sudo’s “password” prompt with grml-crypt’s “Enter LUKS passphrase” prompt, the cryptoloop password won’t bring you anywhere on the sudo prompt. Preparing the CA directory For the CA, create a dedicated directory in the mounted cryptoloop file system. You’re originally supposed to copy the entire EasyRSA directory tree in there, but I’d recommend to only link the files from your system’s EasyRSA directory to automatically take advantage of distribution updates. You’ll need at least these links:

lrwxrwxrwx 1 mh mh   56 Dec 25 23:23 openssl.cnf -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf
lrwxrwxrwx 1 mh mh   52 Dec 25 23:22 pkitool -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool
lrwxrwxrwx 1 mh mh   60 Dec 25 23:23 whichopensslcnf -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/whichopensslcnf

ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf .
ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool .
ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/whichopensslcnf .

Configuring your CA The only thing you cannot link is the vars file which contains your CA’s local settings:

export EASY_RSA=“$(pwd)”
export OPENSSL=“openssl”
export PKCS11TOOL=“pkcs11-tool”
export GREP=“grep”
export KEY_CONFIG=$($EASY_RSA/whichopensslcnf $EASY_RSA)
export KEY_DIR=“$EASY_RSA/keys”
# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
export KEY_SIZE=1024
export CA_EXPIRE=3650
export KEY_EXPIRE=3650
export KEY_COUNTRY=“DE”
export KEY_PROVINCE=“”
export KEY_CITY=“”
export KEY_ORG=“Zugschlus.de”
export KEY_EMAIL=“mh+easyrsa-mh-openvpn@zugschlus.de”
export PKCS11_MODULE_PATH=“dummy”
export PKCS11_PIN=“dummy”

Comments have been removed from this file. Better copy the file from /usr/share/doc/openvpn/examples/easy-rsa/2.0/vars and edit it to your needs. I added the two PKCS11 variables since you won’t otherwise be able to issue certificate requests. Creating the CA Next, decide on a shell instance where you will do most operations, and source vars in there. Next, run /usr/share/doc/openvpn/examples/easy-rsa/2.0/clean-all. If you do this in a directory of an already-in-use EasyRSA CA, you’ll need to restore your backup. To actually initialize the CA, run pkitool --initca --pass. If you do not give the --pass parameter, you’ll create a CA that can issue certificates without asking for a passphrase, which might not be a brilliant idea. Choose a reasonably secure pass phrase. Creating Certificates - the simple and suboptimal way You can now simply proceed to create an arbitrary number of pairs of “private” keys and associated certificate by simply calling pkitool <clientname> and/or pkitool --server <servername>. Depending on your security policy, you can mandate the private keys to be protected by a passphrase (adding --pass to the command lines), but you’ll have the expense of being asked for the passphrase every time you start a new openvpn daemon. Creating Certificates the Right Way I have put the “private” in quotes since the keys created this way are not really private: The key was created on the box hosting the CA, was stored on the local (crypted) file system and needs to be moved to the target system via a secure channel. Doing so the right way is harder than expected, so it is usually the better way to keep the private key really private by creating it directly on the target system. On the target system, you need OpenVPN installed, and openssl. After the certificate was created, you can remove openssl again. Creating a private key is part of a key-pair generation process that also leaves a certificate request. The contents of the certificate request is public, and you can safely move it to the CA box and convert it to a certificate by signing the request. You only need to make sure that nobody exchanges your target system’s certificate request for her own before you sign it as you might end up certifying a wrong identity. For the rest of this document we’re going to assume that you have ssh access to the target system and have verified the ssh host key, so that you can be reasonably sure to be connected to the right system. To create a certificate request, you can use this script, which I have called create-easyrsa-cert-req:

#!/bin/bash
set -u
TMPDIR=“/tmp”
export OPENSSL=“openssl”
export PKCS11TOOL=“pkcs11-tool”
export GREP=“grep”
export KEY_CONFIG=“/usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf”
export KEY_DIR=“$TMPDIR/keys.$$”
mkdir -p $KEY_DIR
export KEY_SIZE=1024
export KEY_EXPIRE=3650
export KEY_COUNTRY=“DE”
export KEY_PROVINCE=“”
export KEY_CITY=“”
export KEY_ORG=“Zugschlus”
export KEY_OU=“$(hostname --fqdn)”
export KEY_EMAIL=“mh+$(hostname)-ovpn-cert@zugschlus.de”
export DEBUG=1
umask 077
if [ “$ 1:-foo ” != “server” ]; then
  /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool --csr $(hostname)
else
  /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool --csr --server $(hostname)
fi
mv $TMPDIR/keys.$$/* .
rm -rf $TMPDIR/keys.$$

When called without parameters, it creates a certificate request for an OpenVPN client certificate, and when you call it with “server” as parameter, it will create a server certificate request. In any case, it will leave two files in the current directory. They are named after the current host name, and have the extensions .csr and .key. The .key file is your private key. keep it private! The .csr file is the certificate request which you can now move to the keys subdirectory of your CA directory via scp or other means such as an USB stick. To do the actual signing, invoke pkitool --sign <hostname> and enter the CA passphrase. You can ignore the error message that there was no .key file to chmod. Gotcha, when signing a server certificate, use pkitool --server --sign <hostname>. Move Certificate to the target host You can now move the certificate to the target system. Since you’re probably going to need the root certificate and the certificate revocation list as well, you can move the .key file (if created on the CA system), the .crt file, and ca.crt to the target system. These files are public, so there is no need for a secure channel. Revoking Certificates Since an OpenVPN server’s only means of authentication is to check whether the certificate presented by a client is signed by the “right” CA, the only way to revoke VPN access is to revoke the certificate. This is also done on the CA system by calling /usr/share/doc/openvpn/examples/easy-rsa/2.0/revoke-full <client-name>. This creates a crl.pem file which contains a list of all revoked certificates. You need to have a mechanism to distribute that list to all systems that might need it, and it is recommended to have this automated. Remember, if you do not distribute the .crl file, the systems are not going to know about revoked certificates.

• Wouter Verhelst: No idea of what he’d do once elected. Asking for carte blanche?
• Aigars Mahinovs: Half of his platform has nothing to do with Debian. The other half is on crack.
• Gustavo Franco: Some good ideas, but looks like he had trouble thinking his platform through.
• Sven Luther: Should have published his platform on time.
• Sam Hocevar: Lots of good ideas, competent, brilliant and funny. Couple of ideas I am not entirely comfortable with, but I can probably live with that.
• Steve McIntyre: Current 2IC. Nothing new. Unimpressed.
• Rapha l Hertzog: I fear he could rm -rf the Project. Definitely needs a DPL hand-holding team. Doesn’t like ponies.
• Anthony Towns: No ambition for Debian. Lots of ambition for himself and money. Go away.
• Simon Richter: Empty platform. One more candidate, triggers interesting issues in devotee.
• NOTA: Great platform! Would make a perfect DPL.

We had one of the biggest snows of the year today in Montreal. The storm, which happened overnight and was supposed to let up around noon, still hasn't stopped. It's a practical white-out outside -- big fluffy flakes everywhere. The radio said we had more than 40 cm of snow, which is just amazing. I headed over to La ka this afternoon for an interview with Steve Faguy of the Montreal Gazette. I was pretty worried about going out, but as usual I was pleasantly surprised when I was outside. Snowy weather is pretty gentle, and although I was cold and wet when I got to La ka, it wasn't all that bad. I had a good talk with Steve about Wikitravel, Montreal tech scene, and the French Revolutionary Calendar. I'm looking forward to seeing the article when it comes out. tags: steve faguy la ka snow interview gazette

certifi.ca doing well I was glad to see a post about certifi.ca in the Solution Media Blog of Thomas Huhn. Thomas set up the extremely useful OpenID Directory, so his opinion is pretty valuable. I'm glad he's as enthused about certifi.ca as I am. tags: thomas huhn certifi.ca openiddirectory openid

Registration and privacy I think I have an account on every free OpenID service on the Web. I need lots of accounts for debugging purposes, and I also like to have an idea of what people are doing with the protocol. I checked out prooveme.com a few days ago. prooveme.com gives out OpenIDs with SSL cert authentication, like certifi.ca. It seems like an OK service, but I don't think they use SSL and certs the right way. I tested the prooveme ID on a couple of services, had a couple of errors, and that was that. So I was surprised to see this posting in the proovemeblog today:

• certifi.ca is another site doing certificated OpenID. Evan, the creator of certifi.ca is a subscriber of ours. We'll obviously be pleased if he carries on using us!

Now, I've been in wikis long enough to know that you have to AssumeGoodFaith when people post things in public forums, so I'll take this comment as nothing more than clumsy but good-natured ribbing. Ha ha ha. But: I haven't publicly said that I'd tested out the prooveme server. I'm not particularly embarrassed about it, but I hadn't had any reason to mention it to anybody, either. So the only way the poster could know that I'd registered for their service was to check their database records for my registration information. Publishing users' registration info without their consent steps over an important privacy line for me and, I think, for a lot of people. I'm not sure making a joke really justifies that kind of privacy invasion. I don't feel fairly treated, here. I partly blame myself: after all, I submitted personally-identifying information (PII) into a Web form on a site without an explicit privacy policy. I've gotten so used to OpenID providers being experienced with security and privacy issues that I made assumptions that turned out not to be the case. I've taken the incident as a wake-up call to put a privacy policy on certifi.ca. I hope that will communicate to users what I consider acceptable use of their data. And I'll make sure to check carefully for privacy policies whenever creating a new account in the future. For clarity: if I have an account on a Web service, that is not any kind of endorsement of their service, and doesn't necessarily suggest that I use that service regularly (or at all). I'm going to see what I can do to get my account deleted from the prooveme servers to avoid any misunderstanding in the future. tags: prooveme privacy openid

[ Yes, entry written for my Mexican fellows. My blog is in English. Don't rant about that, your pleads won't be listened ]
Damog just ranted (in Spanish) about too many people coming to Mexico City. I completely agree with him, but not with his conclusions. We are a ~25,000,000 people city, in a ~100,000,000 people country. The inequity we face every day is huge (Cd. Nezahualc yotl, among the poorest in the city, is the most densely populated region in the whole world, but you can easily spot over 2000 sq mt houses in Bosques de las Lomas or similar regions - And the whole Santa F region just scares me, it is an unknown planet I don't even want to think of). But what's really terrible is how living in this city changes our collective moods.
Sometimes it strikes me to understand how people in other countries can live in one town and work in another, over 40 minutes away. Well, for many years I worked at places over one hour away from home - and I didn't even cross the city. Mexico City is, or was last time I checked, 40x70km, and without enough adequate main ways. Of course, people get grumpy and aggressive while driving.
What's my answer?
Don't drive.
Seriously.
Yesterday, for example, I chaired three talks at Linuxworld Mexico. In friggin' Hip dromo de las Am ricas, a convention center located in one of the worst-connected pieces of land in Mexico. Usually, it would take me 40-90 minutes to get there by car, depending on the time of day and phase of Deimos against Fobos. Of course, it took me 70 minutes to go by metro+bus. I took two nice books (La regi n m s transparente, a beautiful book by Carlos Fuentes no Mexico City inhabitant should skip, and Laurence Rosen's Open Source Licensing). And I didn't get bored, and I didn't hate the people I was riding with. Even though I crossed the most crowded metro stations. Not only I saved a fair amount of money (MX$6.50 each way against probably something close to MX$120 between the gas and the parking fee of that unholy convention center), but I used my time much better. Some years ago, when I regularly travelled one hour back and forth to work, I learnt most of what I know today of Computer Science during the long time I spent sitting on small microb s seats. Not the most luxurious way of travelling, but still a very good way of moving around our messy city.
Of course, today I have learnt even more, and I want to advocate it: don't work far from your house, or at least, don't work far from a place reachable by Metro. Sometimes it sounds impossible, but really... How much do you value your time? Do you think that it's better to get MX$20,000 a month in a Santa F office than to get MX$15,000 in an office in Insurgentes? Do you think nobody will pay you decently if the offices are in Ermita Iztapalapa? Good work done brings a good salary. And seriously, the extra MX$5,000 in my first example is not worth the daily anger you will get by crossing the city to get to Nowhere Land and work for the corporate overlords.
I might be extremely lucky, but I work 3Km away from home. I come by bike every day. And yes, I was scared at first - Even in Ciudad Universitaria people drive aggressively. You have to take care where you drive. Taxi drivers are among the worst, as they are always in a hurry. And, yes, my elbow has an ugly scratch, as I prefered to stop and fall off my bike than to land over a car whose driver was in a hurry. I've just had my bike for ~6 weeks (after over 10 years of not riding one, and back then, just for a bit), but I'm confident enough to get off the safety of a protected University with no cafres driving their microb s as they damn well please. Last weekend I had a ~6km drive (Copilco-Miguel ngel de Quevedo-Loreto-Alta Vista-Copilco) using several high transit vialities (Universidad, Revoluci n, Insurgentes). I crossed three times the San ngel bus hub, which scared my ass as I approached - But it's perfectly doable, far easier than what I expected. It was fun. It is a decent excercise. And we need more people to take the streets with their bikes.
This morning I heard on the radio that Marcelo Ebrard (Mexico City mayor) is pushing a plan to boost bycicle usage in the city. Something similar to what has been done inside Ciudad Univeritaria, but -of course- in a larger scale: Useful ciclov as along the main roads, city-owned bike rental places (where you can rent your bike at one and drop it at another spot), all this well connected to the main Metro stations. In this interview (in this morning's 98.5 FM news program - sorry, I don't know who heads it... Mart n something IIRC) they said that today, ~0.7% of the trips outside home in Distrito Federal (where only 8 out of our 25 million people live) are carried out on bycicle, and they expect to raise it to 5% over the next six years. We will see about that, I can only wish this program best luck.
Damog complains that we drive like shit because dealing with too many people for too long pisses us off - Ok, Damog, here is the recipe: Don't get pissed off. Each of us will make a minor but tangible contribution. Don't drive so much. Quit your job so far away, get a decent (even worse paid) job closer to your house, closer to the university. You will be happier. Get a bike. Use it, you live close to UNAM as well. You will be happier. And we will be one step closer to total world domination. (yes, we the bikers, not we the Debianers ;-) )