Don't forget:
After the release is before the release!
Who decided that we are *close* to the release?
potato got released at 14th of August, 2000
Woody got released at 19th of July, 2002
Sarge got released at 6th of June, 2005
I for my part will upload until i am only allowed to upload bugfixes.
The release will be ready when its ready and this is not a decision of people,
the only thing that counts are bugcounts so thanks goes to beer-tanc
and to dunc-bank that i will still able to upload my packages with new upstream releases.

One of the benefits of following the various web standards and guidelines is that most browsers will show something on the screen before the page has finished loading. Avoiding unnecessary rubbish in your html and optimising graphic files can make it look like your site loads faster. This may be getting more important as networks get busier and more sites place more demands on computers. Web users may be finally getting fed up. Today's news reports: "Shoppers are likely to abandon a website if it takes longer than four seconds to load, a survey suggests" (from Websites face four-second cut-off [BBC], Akamai/Jupiter Research full report).

Forum on Civic Information No. 2 (UCLondon 2006-11-28 18:45) "will focus on open 'civic' information. Civic information is material produced by government or other groups which is relevant to political activity by citizens." I had some experience tracking this down through the Walks Action Group and I really should write up my notes on the Freedom of Information Act (FoIA or fire) and the Access to Environmental Information Regulations (AEIR, or air) before I forget it all.

I m still at the school in Ghana, and although I have quit, there are another five weeks to make use of. Linux is installed on quite a few machines, but it is not used very often, partly because the studentds don t know about it. I was instructed to boot to Windows by default, so they don t stumble over it either. To raise a more interest, I announced a Linux Gaming Tournament, and put up some posters. The participating students will compete in Frozen Bubble, the game formally known as Tuxracer and Tetrinet.As it turned out I got the permission to do so based on a misunderstanding: The principal thought I would create a game that itself would teach students to use Linux (maybe some kind of rally with hidden hints in various applications and folders, and whoever finds them wins). My original plan would not have been allowed, as there is a officially strict school policy against computer games, and because it is a boarding school, it is also a life policy for the students for four years.Because the tournament was already announced and students signed up for it, I will still be able to hold it, as an explicit exception to the rule. But what the administration would like to see, also to keep the interest in Linux up even after I will have removed the games again, is a longer lasting competition in a game with a more educational purpose. An old Mac game was named where the player has to run a business and in the process learns about spreadsheets.So, dear lazyweb, do you know of a game that

• runs on Linux. (i.e. no web based game)
• takes a while to complete. (i.e. several hours during the course of one or two weeks)
• has an educational purpose. (e.g. a economical simulation, maybe a simulation of evolution)
• maybe even is realtime in the sense that certain events happen after a certain amount of real world day, not just gaming hours.
• maybe even interacts with other people playing the game, over the network.

I know that the last two wishes would point to a web based game, but that defies the purpose to lure the people to start Linux.

On Thursday, I did lots of "small" items that needed be done done for quite some time: I checked the new hosting location for volatile (thanks to the physics department of the Ludwig-Maximilians-Universität München for sponsoring), (hopefully) fixed the wanna-build setup for debian-edu (and are now hung at uploading), and so on. Also, I had a short look at the apache2-bugs count, and noticed this package needs serious QA activities. All "good" activities, but obviously not really "working on the release", so I mark Thursday as day off, and will add another day at the end of my schedule.

One issue that is rarely considered is how to deal with office break-ins for the purpose of espionage. I believe that this issue has been solved reasonably well for military systems, but many of the military solutions do not apply well to civilian systems - particularly the use of scary dudes with guns. Also most office environments don't have the budget for any serious security, so we want to improve things a bit without extra cost. Finally the police aren't interested in crimes where an office is burgled for small amounts of cash and items of minor value, it gets lost in the noise of junky burglaries, so prevention is the only option.

Having heard more information about such break-ins than I can report, I'll note a few things that can be done to improve the situation - some of which I've implemented in production.

The most obvious threat model is theft of hard drives. The solution to this is to encrypt all data on the drives. The first level of this is to simply encrypt the partitions used for data, support for this is available in Fedora Core 6 and has been in Debian for some time. The more difficult feature is encrypting the root filesystem, encrypting root means that important system files such as /etc/shadow are encrypted. Also if the root filesystem is encrypted then an attacker can't trivially subvert the system by replacing binaries. An unencrypted root filesystem on a machine that is left turned off overnight (or for which an unexpected reboot won't be treated seriously) allows an attacker to remove the drive, replace important system files and then re-install it. If the machine is booted from removable media (EG USB key) which contains the kernel and the key for decrypting the root filesystem then such attacks are not possible. Debian/unstable supports an encrypted root filesystem, but last time I tried the installer there did not appear to be any good support for booting from USB (but given the flexibility of the installer I think it's within the range of the available configuration options). I have run Fedora systems with an encrypted root filesystem for a few years, but I had to do some gross hacks that were not of a quality that would be accepted. With the recent addition of support for encrypted filesystems in Fedora it seems likely that some such patches could be accepted - I would be happy to share my work with anyone who wants to do the extra work to make it acceptable for Fedora.

Once the data is encrypted on disk the next thing you want to do is to make the machines as secure as possible. This means keeping up to date with security patches even on internal networks. I think that a viable attack method is to install a small VIA based system in the switch cabinet (no-one looks for new equipment appearing without explanation) that sniffs an internal (and therefore trusted) network and proxies it to a public network. This isn't just an issue of securing applications, it also means avoiding insecure protocols such as NFS and AoE for data that is important for your secrecy or system integrity.

An option for using NFS is to encrypt it with IPSEC or similar technology. AoE can be encrypted with cryptsetup in the same way as you encrypt hard drive partitions, it doesn't use IP so IPSEC won't work but it is a regular block device so anything that encrypts block devices will work. I have been wondering about how well replay attacks might work on an encrypted AoE or iSCSI device.

Security technologies such as SE Linux are good to have as well. An attacker who knows that a server has encrypted hard drives might try cracking it instead. A thief who has stolen a laptop and knows that it has an encrypted drive can keep it running until future vulnerabilities are discovered in any daemons that accept data from the network (of course if you have enough technology you could sniff the necessary data from the system bus and from RAM while it's running - but most attackers won't have such resources). I have considered running a program on my laptop that would shut it down if for a period of 48 hours I didn't login or un-blank the screen, that would mean that if it was stolen then the thief would have 48 hours to try and crack it.

Prevent access to some hardware that you don't need. If you allow the system to load all USB drivers then maybe a bug in such a driver could be exploited to crack it. Remember that in a default configuration USB drivers will be loaded when a device is inserted (which is under control of an attacker) and the device will use data from the attacker's hardware (data of low integrity being accessed by code that has ultimate privilege). Turning off all USB access is an option that I have implemented in the past. I have not figured out a convenient way of disabling all USB modules other than the few that I need, I have considered writing a shell script to delete the unwanted modules that I can run after upgrading my kernel package.

Once these things have been done the next issue is securing hardware. Devices to monitor keyboard presses have been used to steal passwords. The only solution I can imagine for this is to use laptops on people's desks and then store them in a safe overnight, unfortunately laptops are still quite a bit more expensive than desktop machines and consequently they are mostly used as status symbols in offices. Please let me know if you have a better idea for solving the key-logging problem.

For servers there is also a problem with keyboard sniffing. Maybe storing the server's keyboard in a safe would be a good idea.

Security monitoring systems are a good idea, unfortunately they can be extremely expensive. There has already been at least one recorded case of a webcam being used to catch a burglar. I believe that this has a lot of potential. Get a webcam server setup with some USB hubs and cameras and you can monitor a small office from all angles. When the office is empty you can have it GPG encrypt pictures and send them off-site for review in the case of burglary. You could also brick the server into a wall (or make it extremely physically secure in other ways) so that the full photo record would be available in the case of damaged phone lines, and to give more pictures than the upload bandwidth of an ADSL link would allow (512Kb/s doesn't allow uploading many pictures - no-where near the capacity of a few high-resolution web-cams).

This is just a few random thoughts, some things I've done, some things I plan to do, and some that just sound like fun. I expect comments telling me that I have missed some things. I may end up writing a series of articles on this topic.

PS I've uploaded day 32 of the beard (which was taken yesterday). Last night at a LUV meeting I was asked to stand in front of the audience to show them my beard. I had imagined that they might have seen it enough through my blog, but apparently not.

I always associated fake teeth with uninteresting pensioners, but as of today I'm in the proud posession of one artifical molar (events leading up to this). The dentist, assisted by some glue and a screw, put it in place where it should stay for the rest of my life. It has even been matched to my natural teeth colour, so I doubt anyone will notice. Big plus: it's totally immune to caries!

The 5th International GPLv3 Conference will hold in Akihabara, Tokyo, Japan, Nov 21-22, 2006. I am a board member of FSIJ (The Free Software Initiative of Japan), and the organization is hosting the conference. I'm also working to prepare the conference. The most major usage of GNU/Linux is for embedded system in Japan. I think many people know "Zaurus", a linux-based PDA. And other many embedded systems are here and there in Japan. So we will discuss about embedded system and Free Software. I consider to broadcast the conference by Ogg/Vorbis and Theora, XCAST6 with vic and rat, and IRC. I hope that many people see the conference via network and directly. BTW, the blog's category is not match to the subject. I need to make other category...

I m a fan of statistics, so I created a small perl script that reads your gaim message history and, for the top 10 contacts, creates graphs: One for the total bytes chatted, one for the bytes chatted on each day, and two with weighted averages, over one week and one month timespan. You need the perl modules in libgd-graph-perl and libxml-xpath-perl, and my script. Run it and it will output the four png s in the current directory.I don t have examples, as the output is far too private to put up here, and I m too lazy to create interesting test data. There is a lot you can discover in these graphs: When you got to know someone (or when he started IMing), when you were not good terms with someone etc.

The day that Bruce Perens gets to tell me that Novell is the new SCO is the day that I willingly accept an offer to be sodomised with a pneumatic drill.

Novell have contributed more code to Linux than pretty much any other single commercial entity other than Red Hat. Without the Novell kernel developers, Linux would be in a much worse state than it currently is. However, I'd expect that everyone in Novell knows that they're also entirely dependent upon the developers working for other distributions. Killing every other distribution isn't advantageous to Novell. And, perhaps more importantly, the death of Novell would be a (short-term?) disaster for every other distribution. Debian may have a larger market share than Novell, but if Novell dies then that's going to be a share of a very small market.

The Linux community doesn't need to eat its own. And one very basic fact does still remain - if Microsoft couldn't sue you before, they still can't sue you. If you're legal, nothing Novell can do will alter that.

(It's sort of touching that Bruce has time to comment on this sort of thing, but didn't seem to find time to make Linuxworldexpocontinentconferencecountymeeting last month. Thanks, Bruce. Thruce. But hey, you're in the credits for A Bug's Life and Toy Story II!)

Yahoo quietly released the del.icio.us Bookmarks Firefox extension the other day, which does something I’ve been wanting del.icio.us to do for a very long time, namely fully integrate with Firefox bookmarks. Like a lot of people, I gave up long ago on using bookmarks to keep track of interesting sites (del.icio.us fills that role quite nicely for me now). Still, the process of bookmarking something in del.icio.us had always been a bit tedious. The old del.icio.us extension helped a little (it would prefill the Notes field with whatever text was currently selected), but it was still missing some pretty important functionality (the popup didn’t display your existing bookmarks like the bookmarklet did). And even with del.icio.us, I still used browser bookmarks for quick access to the sites I frequent most via the bookmarks toolbar. The new extension integrates with browser bookmarks almost perfectly—with a few big exceptions. It’s easy to import your existing bookmarks (the extension even offers to give them a special tag and mark them “private” so as not to clutter your existing bookmarks, as well as mines existing tags to try to categorize what’s imported automatically). The tag button is much more functional now and offers to show your existing tags, my big complaint about the previous extension. And the new extension nicely replaces the bookmarks toolbar and allows you to specify and even order your favorite tags, effectively replacing the last useful vestiges of browser bookmarks with a del.icio.us backed equivalent that also allows you to give other tags to those bookmarks. That said, there are some pretty significant problems with the new extension, the biggest in my view being that there’s no way to change the sort order of the bookmarks within your favorite tags. Essentially, this makes the bookmarks toolbar far less useful—selecting “apps”, which used to contain a manually sorted list of web applications I frequently use, now contains a list of bookmarks in seemingly random order (it’s actually reverse chronological, but that’s not particularly useful for the bookmarks toolbar). The tags submenu under bookmarks doesn’t have any hierarchy to it—all tags are at the top level, making getting to a tag later in the alphabet quite tedious (I’d rather see a “tags starting with a”, “tags starting with b”, etc. structure). And, at least in my early experimentation, synchronization doesn’t always work as expected—changes to my local bookmarks seem to propagate back to del.icio.us, but the reverse doesn’t always seem to be true. Still, it’s a promising start, and I’m going to keep using it. If they don’t fix the sort problem soon, though, I’ll likely revert to Google Browser Sync. (Interestingly, Google Browser Sync is listed as incompatible and is disabled on installation of the del.icio.us extension, even though it technically does other things, like synchronize cookies and passwords. This would seem to be a smart move on Yahoo’s part—challenge Google’s foothold in the browser and create a foothold of its own.) A few parting thoughts: I’ve only installed this extension on my laptop thus far, and it’ll be interesting to see how well synchronization of my bookmarks works across machines (will it synchronize my favorite tags etc., allowing me to maintain a consistent browser toolbar? etc.). Finally, I’d like to see the “tag” function better integrated with the browser, perhaps the way Flock does it (a Google like star next to the address bar that reflects the current site’s del.icio.us state).

We are fortunate in Massachusetts to have fairly simple paper ballot voting machines (rather than electronic touch-screen voting machines, see, e.g. Ed Felten’s comprehensive critiques of electronic voting). When I voted this morning, however, the machines were not feeding the ballots. Instead, the poll workers were piling the ballots up on top of the machines, apparently to be fed into the machines when they figured out how to get them to work. When I left (about 90 minutes after the polls opened), they had gotten to the point of triple-checking whether the machine was plugged in. I felt a bit uneasy leaving my secret ballot in a big open pile. It was somewhat reassuring that a police officer seemed to be in charge of watching the ballots, but I still will always have a slight reservation as to whether or not my vote was actually counted. Don’t they get to work early to test the machines? Perhaps do a few dry runs, kick the tires, etc.? Other industries seem to have figured out most of these problems a long time ago — for example, I can’t remember a single instance in my entire life of encountering a paper jam (cash or receipt) with an ATM. (I’m sure it does happen, just rarely enough that it’s never effected me). If a system is mission critical, it should be possible to get the failure rate down to something more acceptable.

All mozilla-based browsers have a feature called "userContent.css". It was designed to allow you to override page CSS with your own, e.g. for accessibility reasons. It has mostly been used by people to remove ads, and I'll share two examples with you. Create ~/.gnome2/epiphany/mozilla/epiphany/chrome/userContent.css (you'll probably need to create the chrome directory, too; other browsers use similar path names) and put these two rules in there:

a[href$=".pdf"]:after  font-size: 10px; color: red; content: " [PDF]"; 
iframe[src*="devart.adbureau.net"]  display:none !important; height: 0;  
@-moz-document domain("mail.google.com")   button#ac_tr   color: red !important;   button#ac_dl   color: red !important;    

The first one will postfix a red [pdf] to any link going to a PDF file. This is very valueable especially with Google scholar. The second rule is an example on how to hide elements. This example hides some ads on deviantart. You can easily pick a wider term or grab some of the existing rulesets. The third rule will color the ">deviantart. You can easily pick a wider term or grab some of the existing rulesets. The third rule will color the ">deviantart. You can easily pick a wider term or grab some of the existing rulesets. The third rule will color the "delete" button in Gmail red, so you find it easier. Since it moves around (UI hazard; "delete forever" replaces "archive" button in spam and trash folders.) this is quite nice to have. But if you want to go for default ads filtering, I'd suggest to use some of the adblock extensions. These userContent tricks are mostly useful for adding rules that the extension didn't catch.

Apologies for the lame misquote of the Queen song, but I just couldn't resist it... (Steve commented: "Great film, and great song! I'm going to go find my soundtrack album now!" and Luis Villa added: "Anyone who likes that particular Queen owes it to themselves to check out the Kleptones Night at the Hip-Hopera, which I think I'm now going to run off and play myself." ) Flash is a bit of a problem for me in two ways:

1. Free software players don't handle very much of it;
2. Most Flash file authors make inaccessible rubbish;

It's not really surprising that free software players don't handle much of it, because Macromedia/Adobe have dragged their feet about open support for the format. That makes it a frustrating and difficult reverse-engineering task and most people who are good at reverse-engineering seem to concentrate on hardware drivers so far, which is A Good Thing in my opinion. On 7 November, Alex Hudson reported that Adobe make Flash scripting Free Software with Mozilla Foundation [FSFE Discussion via GMANE] - will this improve things? Ross Burton commented:

"The Adobe donation to Mozilla is just an EcmaScript 4 VM, which is a common language used by JavaScript, VBScript and whatever the Flash scripting language is called."

After the ambiguous MS-Novell deal (Received a lot of bad press, but I'm still not so sure in the long term. It might be bad for Novell and SuSE, but it might be good for Free Software as a whole), here's a piece of news that is hopefully less beset with snares: Flash becomes more open: Adobe donates some code to the Mozilla foundation. Now the only part that bothers me is that this likely means the Mozilla license will be used, which is AFAIK GPL-incompatible, which means that Konqueror will not get native flash in the foreseeable future now. Especially because I think that this move will cause work on the free flash player front (Gnash, and I believe there were others) to slow down. Update: MJ Ray corrects me, thanks - Mozilla code is multi-licensed MPL, GPL, LGPL. So integrating in Konqueror is, in theory, no license problem.

2.6.18-4 was uploaded on Sunday and should be soonest available after dinstall run for most archs. The ia64 build failure is fixed in svn thanks to Thiemo Seufer (ths). alpha is waiting for an updated gcc (see patch in #397139). s390 is currently broken by vserver, patch is awaited soon. linux-latest will be updated tomorrow and expect soon a 2.6.18-5, once those issues are cleared.
linux-image-2.6.18-2- is the Debian kernel team stabilized kernel. Please install it and report eventual bugs. If you know a patch from Linus git tree that fixes your problem even better name it. Thanks for your testing!
We had been quite busy to feed stable with patches that fit the Documentation/stable_kernel_rules.txt. Goodies like Xen, drm-i965 or ahci backport are shared with Fedora Core 6 release. Beyond that for example the r8169 patch series or ccisss support for 2 TB volumes got backported. Out of reach are destabilizing patches like the new 2.6.19 ACPI patches. Further backports are planed for the SUSE reiserfs 2.6.19 patches and vorlon has a fix in the pipe for the vga console driver on alpha.

One thing about being an m68k porter is that you get to play with hardware a lot. And I mean a lot. Ska, jazz, newwave, and barok had all died during the last few weeks to months; so I was back to two working m68k machines that I could somewhat work with (quickstep, a 25Mhz 040 that I own, and arrakis, a 50Mhz (or so) 060 owned by Ingo Juergensmann). Which was not enough. To make matters worse, arrakis had actually died last week, but that was fixed quickly enough (thanks, Ingo). Which had left me with non-working jazz, barok, ska, and newwave. It isn't the first time that newwave dies on me, and it isn't the first time that a simple power-on again fixes it, after a few weeks of downtime. I can only conclude that this isn't a box which likes being powered on all the time, and that I'll have to leave it powered off for a few weeks every now and then. That's not a big issue, since the machine isn't very high on RAM anyway, so not very useful (apart from testing EMILE on, and other similar things). Barok had died a few weeks ago with a kernel oops that it couldn't even print out entirely. If that sounds like hardware failure, that's because it is hardware failure. Luckily, it's nothing too bad; removing the expansion cards one by one and replacing them afterwards revealed that it's the cache RAM which is the culprit. That's good news and bad news at the same time; good, because a Macintosh IIci can work without this cache RAM (it was sold without those things after all; the cache expansion was an option); bad, because it already is the slowest machine I have, and losing the cache doesn't make it speed up. But at least that one works again—if any of you have some IIci cache lying around that you don't need anymore, feel free to send it my way. Jazz had only paniced, like it does every time. It's a Quadra 950, and those have never been very well supported by Debian. I just needed to reboot it, which I forgot about every time I got near it. It's working again now, compiling away at the next EMILE version, which will fix a few bugs and should make it into etch. Or, well, at least it would be, if not for the b0rken debian/rules file, which I will now have to fix, I guess. Not that this isn't anything I can't handle. Leaves Ska, which needs a new hard disk. That's not a big problem, I just need to get around to flinching me one out of the old unused RAID array at the office, low-levelling it, and placing it in ska. Which I have been planning to do for only, eh, three months or so. Whoops.

Having spent the better part of two days provisioning my new MacBook Pro’s OS X, Debian, and Windows XP instances, I am keenly aware of how much the Debian distribution’s package management system and its volume of packages have spoiled me. In that two days, the amount of time required to provision Debian was negligible, even though it is configured to completely match my Lifebook’s Debian Sid instance. In fact, the sum total of time to set up Debian, including every application I use, was about 45 minutes of my involvement. Those who know Debian (and Ubuntu, Linspire, Xandros, Mepis, or any other Debian derivative) are coolly nodding their heads, while others are probably thinking I am a lying, biased Linux zealot. It’s no lie; here are the steps I had to take:

• Run the Debian Installer business card image and perform a stock Sid installation, choosing Desktop and Standard System options in the task selection step. If you weren’t wanting to run Sid, the netinstall image would be fine as well.
• Generate a package list on the current Debian installation via # dpkg --get-selections > dpkg-selections.txt
• Copy the package list file to the new installation; I have copied it to my home directory in this example.
• Set the package selections for the new installation via # dpkg --set-selections ~/dpkg-selections.txt
• Run aptitude or synaptic and choose the install action, then go do something else. Thousands, literally thousands of software packages are being installed for you. Everything from your email client to your office suite to your software development tools are being pulled down from package mirrors. In my case, this was over 850MB of compressed package files.
• After the package download, answer any configuration questions aptitude (or synaptic) poses.
• Copy your /home directory contents to the new installation.

Compare that to what it takes with either Mac OS X or Windows XP to get all of your applications installed and configured. Even if you don’t know a thing about Linux or even the more technical side of those operating systems, you can tell from the brevity of that set of steps that the Debian setup is remarkably simple. Now, some will already be keying in their comment posts with exclamations of “Hey! There’s DarwinPorts/Fink/Cygwin!” Yeah, each of those is a nice start; however, they pale in comparison. Fink at least has the robust apt/dpkg foundation, but even it has a relatively meager package selection. I am sure I’ll be writing more on life with Fink and DarwinPorts in the near future. I still don’t have half the stuff installed on XP that I plan to use. I get tired just thinking about the installs. 8^)

… You have to provide a “people.debian.org” web page. So I took the time to write some stuff about my work for Debian. I’ll try to maintain that page as precisely as possible to reflect my work. It will be a good place to put some bits about apcahe-lingerd, as my inofficial packages of that patch are still used, even if the Debian Apache Team consider Apache 1.3 as an undead package. Mohammed, dear fellow NM-blood brother, I’m waiting for yours!