With this weeks lawless governmental attacks on Wikileak and free speech, it has become obvious that PayPal, visa and mastercard can not be trusted to handle money transactions. A blog post from Simon Phipps on bitcoin reminded me about a project that a friend of mine mentioned earlier. I decided to follow Simon's example, and get involved with BitCoin. I got some help from my friend to get it all running, and he even handed me some bitcoins to get started. I even donated a few bitcoins to Simon for helping me remember BitCoin. So, what is bitcoins, you probably wonder? It is a digital crypto-currency, decentralised and handled using peer-to-peer networks. It allows anonymous transactions and prohibits central control over the transactions, making it impossible for governments and companies alike to block donations and other transactions. The source is free software, and while the key dependency wxWidgets 2.9 for the graphical user interface is missing in Debian, the command line client builds just fine. Hopefully Jonas will get the package into Debian soon. Bitcoins can be converted to other currencies, like USD and EUR. There are companies accepting bitcoins when selling services and goods, and there are even currency "stock" markets where the exchange rate is decided. There are not many users so far, but the concept seems promising. If you want to get started and lack a friend with any bitcoins to spare, you can even get some for free (0.05 bitcoin at the time of writing). Use BitcoinWatch to keep an eye on the current exchange rates. As an experiment, I have decided to set up bitcoind on one of my machines. If you want to support my activity, please send Bitcoin donations to the address 15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b. Thank you!

As a follow up to my previous post on the same topic, now DuckDuckGo supports what I wanted:

• !dpkg %s goes to http://packages.debian.org/%s
• !dpts %s goes to http://packages.qa.debian.org/%s
• !dbugs %s goes to http://bugs.debian.org/%s

Someone rightly pointed out in my last post that anyone can have these customizations in any good browser. That is correct, but often, I use a browser in a machine where my custom quick-searches are not available, but a quick access to my search engine is. In such situations, I find this useful. I thought some others might like it too. :-)

I'm using WebDAV on Lenny and on Squeeze now for some time for syncing my bookmarks and calendars which is working just fine. But now I want to extend my WebDAV in order to use it as an external storage. The only problem is: it doesn't workon OSX! D'oh! Basically I followed several HowTos on the Net, so I ended with this configuration so far:

DavLockDB /path/to/DAVLockDB/DAVLockDB
<Directory /path/to/webdav/>
DAV On
AuthType Digest
AuthName "realm"
AuthUserFile /path/tot/.htdigest
Require valid-user
Options +Indexes
AllowOverride None
Order allow,deny
Allow from all
<LimitExcept GET PUT POST OPTIONS DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
RewriteEngine Off
</LimitExcept>
</Directory>

I can connect to and browse the WebDAV directory, but I can't upload new files - neither with Finder on OSX nor with cp on command line in OSX. When using Finder I get the following errors:

For non-Germans: it says that the process couldn't be completed because the object is still in use.

Error -36 seems to be a generic I/O error in OSX and you can find many hits when you do a search in your favorite search engine. The Apache logs report lots of these lines:

==> /var/log/apache2/domain-ssl-error.log <==
[Thu Dec 09 21:23:35 2010] [error] [client 2001:6f8:90e:900::2] client denied by server configuration: /var/www/net/domain/path/to/Files/._Cam-EG_20101113015900_MD 3.avi ==> /var/log/apache2/domain-ssl-access.log <==
[09/Dec/2010:21:23:35 +0100] rostock.ip6.windfluechter.net 2001:6f8:90e:900::2 - "GET /path/to/Files/._Cam-EG_20101113015900_MD%203.avi HTTP/1.1" 403 250 "-" "WebDAVFS/1.8.1 (01818000) Darwin/10.5.0 (i386)"

When copying some files with cp on OSXs command line I get these kind of errors:

$ cp -r Desktop/AIDAluna_KameraArchiv_Geiranger /Volumes/ij/Files/
cp: /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/PRIVATE/AVCHD: Operation not permitted
cp: Desktop/AIDAluna_KameraArchiv_Geiranger/PRIVATE/AVCHD: unable to copy extended attributes to /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/PRIVATE/AVCHD: Operation not permitted
cp: /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/PRIVATE/AVCHD/.DS_Store: No such file or directory
cp: /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/PRIVATE/AVCHD/AVCHDTN: No such file or directory

Funny enough directories were created and some files were copying although OSX complains about "Operation not permitted":

$ du -sch /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/*
10M /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/DCIM
2,5K /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/MISC
2,0K /Volumes/ij/Files/AIDAluna_KameraArchiv_Geiranger/PRIVATE
10M total

Of course the directory on the webserver has sufficient permissions and copying files to it is working just fine with Windows as well as Debian Sid. But anyway, is there something I'm missing in WebDAV configuration or can I do something in OSX to make it work? Using a third party application on OSX is something I would like to avoid, but when nothing else will help, I'm open for suggestions.

A few days ago, I was introduces to some students in the robot student assosiation Robotica Osloensis at the University of Oslo where I work, who planned to get their own 3D printer. They wanted to learn from me based on my work in the area. After having a short lunch meeting with them, I offered them to borrow my reprap kit, as I never had time to complete the build and this seem unlike to change any time soon. I look forward to see how this goes. This monday their volunteer driver picked up my kit and drove it to their lab, and tomorrow I am told the last exam is over so they can start work on getting the 3D printer operational. The robotic group have already build several robots on their own, and seem capable of getting the reprap operational. I really look forward to being able to print all the cool 3D designs published on Thingiverse. I even got some 3D scans I got made during Dagen@IFI when one of the groups at the computer science department at the university demonstrated their very cool 3D scanner.

Last week I was too busy for the triaging work, so I did more this week Anyway there are still some 871 bug candidate for triaging, so again, any help would be appreciated ! Also I d like to thank again people giving me cheers and advices when they receive my pings The buglist now:

• #419986 ping & close server lockups related to dri.
• #415588 ping modelines are ignored.
• #417601 ping & close mga dri issue.
• #439357 closed 3 year old install issue Not relevant anymore
• #377847 ping nv driver: No way to set 1600 1200, apparently it works with nouveau.
• #449039 ping crash with too many remote clients.
• #440880 closed 3 year old, user never replied.
• #457440 ping ctrl-alt keyboard combinations ceased working after prompts by ratpoison.
• #413691 ping & closed arrow keys sometimes produce repeated digits.
• #451537 ping then closed by submitter Can no longer scroll up/down with edge of touchpad.
• #437254 ping touchpad issue, at first the reported tried to hack out a patch
• #444183 ping macbook xserver-xorg-input-mouse: Vertical scrolling doesn t work anymore.
• #445625 ping: try nouveau? crash with nv driver and dual head configuration.
• #428091 ping Display has wrong colours and is offset (in 16bpp only).

The X Strike Force (still) needs you ! You can have a look at the X Strike Force Bug Closing Procedure and check XSF unstable bugs sorted by date.

As part of my work for EDF, I ve had to package and integrate a set of tools for performance measurement and profiling of HPC code. This toolbox comprises tools for analysis of both sequential and parallel codes, MPI communications profiling and, of course, visualization frontends. Without going into too much details, here s the list:

• OpenSpeedShop: a complete performance and profiling workbench, including I/O and MPI
• PerfSuite: a relatively simple and easy to use performance analysis toolkit
• TAU: a complete performance analysis framework including automatic instrumentation with PDT
• Scalasca: a tool for performance optimization of parallel codes, including MPI communications
• a number of dependencies: slog2, Open Trace Format libraries, VampirTrace, dyninst, monitor, perfctr, pfmon, PAPI,
• visualization frontends: paraprof, jumpshot4, cube3,

If you ve been anywhere near HPC code, the names probably ring a bell; they re the best tools out there in their category, developed and used by the top laboratories. Over the past year, all the tools have received some level of testing, meaning we know they do work at the very least to some extent. As you can imagine, testing such tools is no easy task and takes an insane amount of time and resources of all kinds. Testing is all the more important that I had to produce a number of patches to integrate the tools properly in the distribution and, in some cases, to even get them to build. Now, we would like to share this work with the HPC community in and around Debian. How exactly we are going to do that isn t clear just yet; most probably, we ll end up building a team with other interested parties and offer our packages as a base to build upon. There are a number of challenges with these tools: they re not easy to build, they re not easy to maintain, they re not easy to use, they re not easy to understand. Basically, nothing is easy. Some of those tools were never meant to be packaged and integrated in a distribution and no sane amount of patching will fix that, so we have to live with packages that aren t quite as polished as we like them to be. And then, there are licenses. Some tools are non-free due to usage restrictions. Others rely on non-free dependencies. Although I ve been looking at the licenses, a thorough license check will be required and decisions will need to be made. It s not for the faint of heart! If you are interested in these tools and in bringing them to Debian, please get in touch. I ve also had to package the Apache Derby database (Java); if someone out there cares about Derby, I d be more than happy to provide my packages as a start base for getting Derby into Debian. The packages need some work by someone who knows a thing or two about Derby and who can test and enhance the packaging of the server part.

As I said more than a week ago I was about to undergo an operation.

Now, 10 days after the operation I must say I am still not 100% recovered and I experience a weird sensation as if the nose is way too empty, especially the left nostril. During this period since the operation I have been experiencing head aches, and an almost continuous sensation of an empty left maxilar sinus, the side on which the cyst was before. This sensation is amplified after a nose blow or after the regular nose post-op cleanings.

I hope this is not Empty Nose Syndrome.

One of the problems we have in Ireland is that the Da l is unrepresentative: in particular it lacks scientists and engineers, or any representation from the high-tech Smart Economy we are supposedly trying to create. This is largely down to the challenges of a political career, especially in as clientelist a system as ours (that also needs to be fixed). Basically the Da l is stuffed with teachers, lawyers, publicans and the like: those who can postpone a career, run for office knowing that they can safely move back into their old job. Teachers in particular find their posts held open for them until they return. Scientists and Engineers, on the other hand, would effectively be committing career suicide: 5 years out of the industry and your day-to-day knowledge is stale. You are effectively unemployable. So Mike O'Keeffe from Ircona suggests that we create a retraining fund; basically make the promise to engineers and the like running for office that 'your job is open for you when you return'. The fund would go to their employer to help retrain them back into work for several years after they return. This fund would be set up by the high-tech industries in Ireland, who could do with people who actually understand those industries (ICT, biotech, etc.), and even just science in the Da l. How about it? [Note: this is not to say this is the only, or even most important, fix needed to Irish politics; but it should be straightforward compared to reforming the constitution.] Tags politics, science, ireland

Wow, it's been 3 months since I stopped using flash.

dpkg.log.3.gz:2010-09-14 11:24:35 purge flashplugin-nonfree 1:2.8.1 1:2.8.1

At the time, there were known, open security holes in flash, and Adobe had announced a fix date -- rather far in the future. It made a lot of sense to remove flash at least temporarily. I never found a compelling reason to reinstall it. I've missed out on a small amount of content, and had to do a little more to get at other content. But it's been worth it to not need to worry about flash slowing pages to a crawl, being insecure, bypassing cookie management, and being generally nasty, proprietary software. Between youtube's html5 beta and Vimeo's easy link on every page to switch to html5, I have no trouble seeing most videos. One annoyance is when someone embeds a video somewhere using only the flash player, and also doesn't link to its page -- but I am seeing more youtube embeds being done with html5 recently. Youtube is also still inconsistent with some videos not yet being encoded in html5, and so I have to pull out youtube-dl occasionally to download and watch something. On the audio side, links to sound files are everywhere, and use of html5 <audio> is also very common. The only thing I ever miss is Super Mario Bros. Crossover. I look forward to the day when the only use of flash is to play such historical roms in MAME.

I ve been thinking a lot recently about information security and passwords. It s widely agreed that two-factor authentication, which combines something-you-know (a password) with something you have (eg. a smart card or some one-time-password) is superior to using a password by itself. Most solutions I ve seen, short of client-side certificates, both require a trusted third party and provide little auditability. I m working on a project which attempts to address those problems. Basically, the idea is that you attempt to perform an action on a website, like logging in, moving some money between accounts, or restarting a cluster. Then, your mobile device¹ (Android, iPhone, or some custom hardware) starts buzzing, displaying the text of the action. When you approve or deny the action, your device uses a locally stored private key to sign the text of the approval and send it back to the server. The server checks that you approved the same transaction number and text, then allows the action. The server can store the approval notice to allow auditors later to determine that somebody in possession of the private key signed the action request. So far, I ve written a small Django server application, and a Python CLI device and client. They re not yet ready for a public release; I need to write up installation instructions and test it a bit more, but I ll publish them soon on Launchpad. On the usability side of things, I plan to conduct some trials in January comparing it to things like Google Authenticator. This should be less susceptible to MITM attacks than one-time-passwords, since you can authenticate specific transactions, rather than entire sessions. On the other hand, I m no security researcher. Dear lazyweb, are there any problems with the above approach? Also, if I m going to release this (as I plan to once I get something working), I need a name. Ideas?

1. iPhone used in the graphic to the right because a SVG was handy. Image adapted from work by Virgile Pypaert [CC-BY-SA-3.0], via Wikimedia Commons

Dear Planet Debian readers, a significant number of people have expressed concerns over the presence of Flattr buttons on Planet Debian. The concerns were expressed in a thread on the debian-project mailing list and they were quite diverse. While the discussion brought some of the issues into light, it s not really possible to find out whether a specific concern is widely shared or not. That s why I set up a poll on selectricity.org. Please take a few minutes and rank the various options: put the most important concern first in the list, and sort the others by decreasing importance. If there are concerns that you do not agree with, put them below the entry named Special: I don t share the concerns quoted below . And to prove that you have read through all the options before voting, put the other special entry last (it s named Special: I know how condorcet voting works and thus I put this item last ). Click here to go to the poll. You need only one minute to vote and no login is required. PS: The discussion on debian-project is the reason why I changed the footer in my RSS feed to contain only plain text (in a smaller font). I also improved the wording to be more neutral.

27 comments Liked this article? Click here. My blog is Flattr-enabled.

<fb:share-button href="http://blog.jhr-online.de/169" type="button"></fb:share-button>Countless times already have I used Google s amazing feature called maps. Admittedly, if you know me, you might wonder how I can be advertising Google. At least as often as I used google maps, I have told people about google s evilness. They re making their users transparent in ways most people can t even imagine transparent to other users (just like Facebook does) but, more importantly, transparent to themselves and their advertising customers. Technically skilled people reading my blog probably just nod and scoll down now :) Well, there still is something about Google that makes me use their developments: they are good. I don t know any other online service to create own maps, get directions etc. with as much detail and huge amount of data as google delivers. Thus, Google maps became my main source for locations and directions world wide. As such, I wanted to use it to get directions between places in Berlin, Germany. Apparently, Google s software had some kind of hick up or whatever, though. They got the directions right but somehow I doubt the map is anyhow related to what I requested. See for yourself Yes, yes, no software is perfect but still :)

<iframe allowtransparency="true" frameborder="0" scrolling="no" src="http://www.facebook.com/plugins/like.php?href=http://blog.jhr-online.de/169&amp;layout=standard&amp;show_faces=true&amp;width=450&amp;action=like&amp;colorscheme=light" style="border:none; overflow:hidden; width:450px; height:65px"></iframe>

Romain pushed verion 0.3.8 of inline to CRAN earlier today, and I just updated the Debian package. This version adds an internal performance enhancement which is obtained by making due with fewer reads. The short NEWS file entry follows:

0.3.8   2010-12-07
    o   faster cfunction and cxxfunction by loading and resolving the routine
        at "compile" time

LWN has a recent article titled The dark side of open source conferences which concerns sexual assault at conferences [1].There are a significant number of comments with attempts to derail the discussion in ways that can really only be interpreted as attacks on Autistic people. The claims seem to be that the problem is not violent sexual assault at conferences, but guys on the Autism Spectrum who hit on girls when they don t want it. Naturally no supporting evidence was made for such claims. But that doesn t stop the discussion which has a logical end-point of excluding people like me from conferences.The IronyI think it s ironic that those who are making claims about what they call empathy disorders have failed to be Empathic by not realising the following things:

• Women who start a discussion about serious sexual assault probably aren t going to be happy if someone starts talking about chat-up attempts. While unwanted chat-up attempts are unpleasant they are in a different category and mixing them seems to be diminishing the significance of violent attack.
• Most members of a minority group (in this case women in the Free Software community) probably don t want discussions of how to help their group diverted by discussions that attack another minority group. What looks a lot like a divide and conquer attack against minority groups isn t going to be appreciated by members of either group and probably members of other minority groups who see what s happening aren t going to like it.
• There is no reason why people should require significant exposure to members of a minority group to treat them in a decent manner. The claim that we need more women at conferences so that men can get used to them and not treat them badly is ridiculous. Among the many stupid aspects of that idea is forgetting the fact that women comprise 52% of the population in first-world countries and we all deal with women every day. Women at IT conferences are not fundamentally different from women in the rest of society.
• When most people interpret your writing in a way other than what you intended it seems to be a reasonable assumption that you failed to explain things clearly. Telling everyone who disagrees to get therapy is unlikely to help convey your point. Telling people to get therapy is particularly likely to get a bad reaction if you are discussing something that actually involves dealing with psychologists.
• When there is an obvious resource on the Internet relating to a topic it s a good idea to read it instead of just making stuff up. Failing to do so will be taken as an indication that you aren t trying to be Empathic. The Wikipedia section on Autism Spectrum Disorders has a lot of useful information [2]. Please read it before making comments about Autism and Empathy.
• Having to be told how other people feel is not inherently a sign of a lack of Empathy. Asking people how they feel because you can t work it out is a sign of Empathy as it indicates an acknowledgement that other people have different emotions and you probably don t understand them all. The people who know that they can t understand other people and listen when told are probably better than average when it comes to Empathy.
• Finally what people say about themselves and their own experiences should be taken seriously.

Some Final PointsInstead of talking about how some other people should be more Empathic it seems that a better idea would be to try and demonstrate Empathy. Set a positive example.I did a Google search for Empathy Disorder and found this interesting article [3]. It s about how Neuro-Typical people (people who aren t on the Autism Spectrum) can learn to be more Empathic, it s probably more relevant to the issue of Empathy in the free software community than discussions of Autism.I think that the experience of a lot of people on the Autism Spectrum is similar to mine. It s not that we can t work things out it s just that it takes a lot longer. For things that can t be worked out in real time we have rules based on past experience. Naturally the rules include don t touch people and don t try to chat up women at conferences .Here is a link to my previous post on this topic [4].Update: I ve clarified some of the writing and added an extra point about having to be told how others feel.

• [1] https://lwn.net/Articles/417952/
• [2] http://en.wikipedia.org/wiki/Empathy#Autism_spectrum_disorders
• [3] http://articles.cnn.com/2008-06-18/living/o.empathy_1_empathy-friend-disorder
• [4] http://etbe.coker.com.au/2010/12/03/aspie-social-skills-free-software/

Uh... Holger just pointed me to an error I introduced, when I ported my script to create the rc stats from using the bts.turmzimmer.net interface to the UDD: The Number of bugs for the release managers view did not included bugs fixed in Debian's unstable branch, but still open in it's testing branch. Of course Release Managers are also interested in these bugs, as the packages fixing these bugs need to be migrated to testing (prefered solution) before the release can happen. I just fixed my script, and reviewed the other queries. Seems fine now, so that starting with next fridays stats, everything should be working again. Looking at it with repaired Release Team glasses, that brings us up from 110 bugs to 175 bugs. (And still 72 release critical bugs without known solution). Sorry.

Ooops. It seems that while I worked on the script generating the release critical bug stats, I accidentally also published the stats, although it's not friday. Sorry for that, but while we are at it: I implemented two tiny changes:

1. The Ultimate Debian Database know about claimed bugs and uploads to deferred/delayed, too. So we can also take them into account.
2. Each number is now linked to the respective view of the UDDs web interface, making it easier to browse through the actual bugs.

I especially hope that the later change will make it easier to RC bug hunters to find something interesting. I also fixed the error naming UDD Universal Debian database instead of ultimate. Sorry, I know I was pointed to it quite some time ago, and I really thought I fixed it allready... Update: Don't missuse a quote symbol, but link the numbers directly.

The bug webinterface of the Ultimate Debian Database currently knows about the following release critical bugs:

In Total:	689
Affecting Squeeze:	240
Squeeze only:	87
Remaining to be fixed in Squeeze:	153

Of these 153 bugs, the following tags are set:

Pending in Squeeze:	14
Patched in Squeeze:	53
Duplicates in Squeeze:	20
Can be fixed in a security Update:	20
Contrib or non-free in Squeeze:	6
Claimed in Squeeze:	2
Delayed in Squeeze:	2
Otherwise fixed in Squeeze:	25

Ignoring all the above (multiple tags possible) 72 bugs need to be fixed by Debian Contributors to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 110 need to be dealt with for the release to happen. Please see Interpreting the release critical bug statistics for an explanation of the different numbers.

(This is a part of a series of posts on my recent experience with Windows; see Windows (I) and Windows (II): User Interface.)

Every GNU/Linux desktop distribution hangs on a package management system as a foundation, and as a result the packaging systems are quite advanced, while Windows is stuck with those pesky installation wizards. There have been several stabs to implement a package system for Windows (see here), but none seem to have caught on.

There are three main disadvantages on not having good package management: tedium of manual installation, no dependency resolution and no system-wide automatic updates. In practice they are less important than it might seem. Installation wizards are indeed tedious, but in terms of time I found them to be quick enough to get through. Moreover, apps tend to be less specialized and more encompassing than Linux utilities, and as a result you do not need to install as many things as in Linux. For the same reason dependency resolution is not as important: there are few dependencies in general. As for automatic updates, most high-profile apps have integrated mechanisms to deal with that, however, I found that those mechanisms tended to result in nagging the user with messages. After a while I started ignoring the update notifications. I suspect that happens to many users.

The one thing that Windows has going for it is simplicity. You download installation binaries and you run them, and that's it. Linux package systems tend to be very complicated, and if (when) they break, you will need serious sysadmin chops to deal with the problem. Also installing specific versions (either older ones, or newer ones not yet available in the distro) of specific apps/libraries can be unnecessarily complicated, and the dependency graph limits your actions. In my experience, Windows does well enough without all this complexity as long as you don't reinstall your system too often.

As for the other complaints, I frequently run into the restriction of moving/editing files opened by another application. Coming from Linux, that one is stupidly annoying. Furthermore, it is frustrating not to be able to move inactive (or stuck) background windows. I really miss my unified filesystem namespace. Also there's quite a bit of nagging in general on Windows which I would rather do without. In the end, these are not dealbreakers though.

In my next (and probably final) post I will discuss software development on Windows.

A long time ago, 2006 according to git, I started helping out on the Pulseaudio packaging team. Didn't have much time back then, but that was fine as there was a quite active maintainer involved in the Team. Unfortunately for various reasons he no longer had time for his Debian work, since, oh around end of 2008. With myself not gaining more time (quite the contrary), that means the pulseaudio packaging hasn't had a lot of love for quite some time... Updating the packaging for the lastest Pulseaudio release last weekend reminded me (again) that some fresh blood in pkg-pulseaudio would really be quite welcome. So for anyone that's looking for some nice new challenges, is interested in how pulseaudio and audio on linux in general works, and would like to help integrating pulseaudio in Debian even better please let us know and come join the team

For my birthday back in October, my wonderful wife gave me a Kindle 3 from Amazon. I d been considering other e-book readers for quite some time, but I had mostly ignored the Kindle due to the lack of EPUB support and a general dislike of Amazon s DRM enforcement. In the end, the superior hardware and ecosystem of the Kindle overpowered those concerns and overall I m very pleased with the purchase. The screen is amazing, literally just like reading off a piece of paper and the selection of books is OK. I ve been buying almost all my books from Amazon to date since it s so easy (the Whispernet is amazingly quick!) but it s not terribly difficult to get EPUBs from elsewhere onto the device after a quick run through Calibre to turn them into a MOBI file, so I keep telling myself I ve still got some flexibility. Almost as much fun as reading on the device has been learning about how it works. The Mobile Read forums have lots of step by step posts on how to do specific tasks like replacing the screensaver image, but they don t give much background detail on how the Kindle is actually operating which is what really interests me. Luckily among all the step by step posts I also found a usbnetwork package which also adds an SSH server to the Kindle, so after installing that and then SSHing in to my Kindle I ve been poking around. Under the cover the Kindle reveals a fairly standard Linux installation. While the hardware and IO devices are obviously unique, compared to something like an Android phone, the Kindle is refreshingly normal . Hardware

• Freescale MX35 ARMv6 based CPU with Java specific instruction support.
• 256MB RAM
• 4GB of internal flash presented as an SDHC device with four partitions. A ~700MB root partition, a ~30MB /var/local partition, another roughly 30MB kernel partition and then the rest (~3.1G) as the writeable user partition where your books and other content are stored. The root and /var/local partitions are ext3! (not jffs or some other more traditional flash based file system) while the user partition is vfat for easy use with Windows, etc.
• The board is code-named luigi and there are lots of references to mario and fiona scattered around the device, and even in some URLs on Amazon s website. Someone was obviously a Super Mario fan.
• The wireless chipset is Atheros based using the ar6000 drivers.
• The WAN (3G) modem presents itself as a USB serial device and is controlled via a custom daemon named wand which uses the standard Linux pppd package to establish IP connections over a private APN Amazon (provided by Vodafone here in Ireland).
• The EInk display shows up as some special files under /proc rather than as a device. With a bit of digging I found some simple constants that when written to the proc files cause the screen to display the standard boot/progress/upgrading images. I haven t deciphered how to make more complex updates to the display yet.

Software

• The kernel is based on Linux 2.6.26, with a bunch of hardware specific patches and drivers from lab126.com, an Amazon subsidiary who appear to be responsible for much of the low-level driver and device development.
• Lots of familiar open source projects are present, e.g. syslog-ng, DBus, busybox, pppd, wpa_supplicant, gstreamer, pango, openssl and the list goes on. You can download all the sources from Amazon s website. I haven t spent any time to see what if anything has been modified.
• There were a few unexpected finds as well such as GDB and powertop! No doubt useful for the developers, but highly unlikely to actually be used on a shipping Kindle.
• Boot-up is controlled by a set of sysv style init scripts which setup the filesystems and then start a handful of daemons to look after the low-level subsystems (network, power, sound) as well as the standard syslog and cron daemons you d expect to see on any Linux box.
• Once the basic system is up and running the init scripts kick off the framework which lives under /opt/amazon/ebook and consists of lots of Java classes. The system uses the cvm Java environment from Sun/Oracle which is specialised for embedded low-memory devices like this. The framework appears to take over most of the co-ordination, management and interaction tasks once it has started up.

The application/framework code is heavily obfuscated apparently using the Allatori Java Obfuscator. The jrename and jd-gui utilities have proven very handy in helping to untangle the puzzle, although they still only leave you with a pile of Java source code with mostly single letter alphabetic variable and class names! I ve been using IntelliJ s support for refactoring/renaming Java code to slowly work through it (thanks in large part to error/log messages and string constants found through the code which can t be obfuscated easily and help to explain what is going on), and I m slowly beginning to piece together how the book reading functionality works. I ll maybe write more on this in a future post. In one of my initial tweets about the Kindle I mentioned that it seemed to be regularly uploading syslog data to Amazon based on some sendlogs scripts I d noticed and a few syslog lines containing GPS co-ordinates that had been pasted on the Mobile Read forums. I can t find any trace of GPS co-ordinates in any syslog messages I ve seen on my device, but there is definitely information about the cell sites that my Kindle can see, the books that I m opening and where I m up to in them:

101206:235431 wand[2515]: I dtp:diag: t=4cfd77b7,MCC MNC=272 01,Channel=10762,Band=WCDMA I IMT 2000,Cell ID=1362209,LAC=3021,RAC=1
,Network Time=0000/00/00 00.00.00,Local Time Offset=Not provided,Selection Mode=Automatic,Test Mode=0,Bars=4,Roaming=1,RSSI=-88,Tx
Power=6,System Mode=WCDMA,Data Service Mode=HSDPA,Service Status=Service,Reg Status=Success,Call Status=Conversation,MM Attach St
ate=Attach accept,MM LU State=LU update,GMM Attach State=Attach accept,GMM State=Registered,GMM RAU State=Not available,PDP State=
Active,Network Mode=CS PS separate attach mode,PMM Mode=Connected,SIM Status=Valid; PIN okay; R3,MM Attach Error=No error,MM LU Er
ror=No error,GMM Attach Error=No error,GMM RAU Error=Not available,PDP Rej Reason=No error,Active/Monitored Sets=0;39;-11 1;180;-1
5,RSCP=-111,DRX=64,HSDPA Status=Active,HSDPA Indication=HSDPA HSUPA unsupp,Neighbor Cells=,Best 6 Cells=,Pathloss=,MFRM=,EGPRS Ind
ication=,HPLMN=,RPLMN=272;01 ,FPLMN=234;33 234;30 234;20 272;05 ,n=1: 101206:235758 cvm[3426]: I Reader:BOOK INFO:book asin=B003IWZZ3Y,file size=233168,file last mod date=2010-11-27 19.18.22 +0000,con
tent type=ebook,length=MobiPosition_ 465747,access=2010-12-06 09.44.32 +0000,last read position=MobiPosition_ 464387,isEncrypted=f
alse,isSample=false,isNew=false,isTTSMetdataPresent=false,isTTSMetadataAllowed=true,fileExtn=azw: 101206:233416 udhcpc[5639]: Offer from server xxx.xxx.2.254 received
101206:233416 udhcpc[5639]: Sending select for xxx.xxx.2.10...
Interestingly you can see from the last two lines, that Amazon has taken some care to preserve privacy by not including the full IP address given to the device by my local Wifi network, so in light of that I find it interesting that they decided not to obfuscate the Cell and Book IDs in those respective log messages too. Seems rather inconsistent. As to how and when these logs are sent to Amazon, the picture is a little bit murky. Every 15 minutes tinyrot runs out of cron and rotates /var/log/messages if it is greater than 256k in size. Rotated logs are stored into /var/local/log under filenames like messages_00000044_20101207000006.gz and alongside the log files are a set of state files named nexttosendfile, messages_oldest, messages_youngest. Something regularly sweeps through this directory to update the state and remove the old logs (after sending them up to Amazon I assume). I suspect that something is buried in the Java application code mentioned above. On the whole the Kindle is a fascinating piece of technology. It delivers a wonderful reading experience on top of a familiar Linux system and is going to provide me with many more hours of entertainment as I unpack all the tricks and techniques that have gone into this device. I would recommended it as a present for geeks everywhere.