Is it possible to secure Internet banking with SMS? As secure tokens are too expensive ($10 or more in bulk) and considered to be too difficult to use by many (most?) customers banks have sought out other options. One option that has been implemented by the National Australia Bank and will soon be available from the Commonwealth Bank is SMS authentication of transfers. The idea is that when you issue an online banking request you receive an SMS with a password and then have to enter that password to authenticate it. If you receive an unexpected password then you know you have been attacked. I wonder how much information is in the SMS, does it include the amount and where the money is to be transferred (in the case of a funds transfer - the operation most likely to be used by attackers)? If the full details are not included then an attacker could hijack an active session, get the user to enter the password, and then act as if the user entered the password incorrectly. The user would then request a new SMS and complete their desired transfer without realising that they just authorised a transfer to Russia… If the full details are recorded will the user look at them? Online banking fraud often involves transferring the funds to an idiot in the same country as the victim. Then the idiot sends the money to the attacker in some other manner which is more difficult to track. I wonder whether an attacker could divert the funds transfer to one of the idiots in question and have the victim not realise that the wrong account number was used. Another issue is that of SMS interception. Anyone who can hack the network of a phone company could steal money from any bank account in the country! For wealthy people there is also the possibility of stealing their mobile phone and making funds transfers before they report the theft. Another possibility is to register for a new phone company. Last time I changed phone companies it took about an hour for the new company to have the phone number and I don’t recall the phone company doing anything to verify that I owned the number in question. If an attacker had a credit card with the same name as the victim (names are not unique so this is not impossible or even inherently illegal) they could open a new phone service and steal the number. Someone who’s mobile phone stops working probably wouldn’t assume that it was part of a bank fraud scheme and act accordingly, in fact if they don’t use their mobile phone later it might be several days before someone contacts them in some other manner and mentions that they weren’t answering their mobile phone. A final possibility is the situation where a mobile phone is connected to a computer. Devices that combine mobile phone and PDA functionality are becoming common. A trojan horse program that offered to do something useful when a mobile phone was connected to the PC via a USB cable might fool some users. All that would be required is a few minutes of the phone being connected if the attacker already has the password for online banking. Maybe they could even make it appear that the bank was demanding that the phone be connected to the PC - that should fool users who don’t understand how SMS authentication works. It seems to me that SMS authentication is an improvement (it adds an external device which usually can’t be directly manipulated by the attacker) but is far from perfect security. I previously wrote about the bad idea that you can bank with an infected computer [1]. SMS authentication is a good step towards making things more difficult for attackers (which is always a good idea) but doesn’t really secure the system. Also it costs 5 cents for each SMS, I expect that the banks will want their customers to pay for this - I would rather pay for a $10 token up-front.

• [1] http://etbe.coker.com.au/2007/10/19/banking-with-an-infected-computer/

Share This

I was viewing one of my most favorite speakers today, Lawrence Lessig, talk about copyright, giving a speech that is very similar to one that I have heard a few times online, but Lessig presents it so well that I end up watching it over and over again. This particular speech was given at TED. The nice thing about coming across a TED talk is that it is almost always enlightening in some way. Lessig's speech is enlightening enough, and it reminded me that I should watch something of his since he has switched to fighting corruption instead of copyright.

Another nice thing about the TED talks is that they are all sitting on the same site - so they are all interlinked with similar topics and they also include the new videos which are being posted fairly often. Sometimes I don't have time to watch more than one talk, but today I was blessed with a surfeit of time, so I clicked on another link which interested me. This talk was from Dan Gilbert and was coarsely about happiness, and more importantly synthetic happiness and how our brains work. It started with talk about the foundation of our evolved brains, of which the most important fact was considered the Impact Bias. Gilbert talked about the Impact bias as a primary result of the evolution of the mind from earlier man to modern man - it is the ability of our mind to predict the future without actually trying it. It is the reason why you have an aversion to a food that you haven't even eaten or don't think you will like a movie that isn't even released, or the opposite. I believe that the impact bias is very important to the psychology of human beings - while it may not actually be very important to the state of the world that you eat a pastrami sandwich today instead of a salad, it must mean something to you, or your life will end up seeming meaningless and insignificant. Gilbert focuses on the impact bias in the dual - that choices that we are given to make ourselves will eventually have an effect on our overall happiness. The experiments explained in the video show that, if a choice has been made, the user is more likely to be happy with that choice later, especially if the choice is an irreversible decision. In the talk he talks about simulated happiness and actual happiness, and that the mind is incredible at simulating happiness when placed in a situation where it did not come out for the better - some famous examples include people who are in jail for long times feeling that they are better for their incarceration after being released (or even while incarcerated). One important part which I think wasn't really touched upon by Gilbert was the fact that while the mind can produce synthetic happiness, in the long run the difference between synthetic and "real" happiness is actually rather small - over the long run all the happiness produced tends to even out, and the mind doesn't distinguish about really being happy or not. For a third point, it is a very interesting conclusion (and probably a significant jump) that most people strive to be happy overall, and most people succeed. This means that even though there are people in many different levels of happiness from an outside perspective, it is worthless to look at someone who is rich and happy and someone who is poor and happy and say that one must be happier than the other because they have more of the "real" and less of the synthetic happiness. Happiness is not a zero-sum game - everyone can be happy all of the time, and noone loses out. This may be an interesting ideal to reach for and may seem impossible to achieve considering all of the hate and rage which exists in the world today, but I believe that it is even possible yet - especially considering this "Happiness Bias" which seems to exist within everyone.

Today I was reminded about a thought I was having earlier this year by a twitter from Garrick Van Buren about the new ultra-thin MacBooks. It seems altogether likely that the next laptop computer that I buy will have no moving parts. Currently the only moving parts in the MacBook that I have now are in the optical drive, the fan, and the hard drive. This is of course not counting the moving parts which I move myself - the buttons to actually interact with it and the lid. Apparently the optical drive in the laptop is going the way of the floppy drive in laptops, so there is only the fan for the CPU and the hard drive. Hard drives are also heading toward the realm of non-moving parts with solid state drives gaining acceptance and size. You can now get a 32GB solid state flash drive for pretty cheap, and they are sure to go in the direction all storage goes - faster, larger, and cheaper. That only leaves the fan which cools the CPU. It is not impossible to run a high-end computer without a fan nowadays, but unfortunately the heatsinks required in order to keep the most crucial part of the computer without burning up. The OLPC hardware is already in some ways the wave of the future - there are no moving parts at all. Unfortunately it is also completely underpowered and it's not possible to run a ton of programs on it. I'm not sure that a solid-state laptop for the general public will ever be possible with the general increase in computing power, but if it happens, I would bet it happens in the next 5 years.

People will be pointing out that the optical drive being missing is a new and novel concept and that Apple is pushing the boundaries of laptops, but they are hardly the first ones to ship a laptop without a optical drive. The world of sub notebooks have been taking out the optical drive in their smaller models for a while now. One model that I've seen around quite a bit is the Sony PictureBook which got quite a lot of press because it featured the Transmeta Crusoe chip. There are also a number of other sub notebooks which don't have a drive. However, I don't believe that the drives will be replaced by flash drives or network installs - there will always be a need for boot media for completely broken computers. The common solution in the sub notebook world is to just have a drive which attaches when it's needed, in the mode of the first drives. The solution which uses flash drives is not likely to happen anytime soon - software isn't getting any smaller, and the cost of flash media isn't falling quickly enough to catch up with the cost-effectiveness of pressing CDs.

Kicking ass in an unflat world is The Economist's take on recent efforts in the world of business books. As the creator of Squeezed Books, their opinion was of interest to me. As is often the case, they don't disappoint, with lines like

Things to bear in mind as you do, he says, include the need for your company to have purpose, to seek out ideas from the fringes, and to embrace the democratising power of the internet none of which will be news to anyone who has been in business for more than a few minutes.

What really caught me eye, though, was this:

There is also growing demand from overloaded executives for shorter books. So in January Harvard will launch a new hardback series, Memo to the CEO , covering subjects such as lessons from private equity and the future of strategy. Each book will be about 100 pages long and will cost $20. In a similar vein, Harvard has adopted the approach taken by iTunes to pop albums, and has started to sell individual chapters of books online an idea that has been a hit with academics in particular.

A lot of good business books take a sensible central idea, and then proceed to fluff it up to a length where it can be published as a book. Often, this makes for a good read, as the anecdotes and case studies and whatnot are interesting, but for those in a hurry, or simply wanting to know what the basic point of the book is about, it's just padding. So, it looks as if the idea behind Squeezed Books is a good one, now I just need to get better at attracting more people to contribute summaries, and discuss the books on the site. One thing I've done to that end is stipulate that the summaries are available, unless otherwise noted, under a creative commons license.

Installed-Size?

zack@aquarium:~$ dpkg -s python-django grep Installed-Size
Installed-Size: 7776
zack@aquarium:~$ du -sh /usr/share/python-support/python-django/
7,2M    /usr/share/python-support/python-django/
zack@aquarium:~$ du -shc /var/lib/python-support/python2.*/django/
4,8M    /var/lib/python-support/python2.4/django/
5,0M    /var/lib/python-support/python2.5/django/
9,7M    total
zack@aquarium:~$

Disclaimer: I'm fine with python-support and friends, they've smart architectures. However it's a fact that currently a huge deal of packages in the archive are size-wise not faithfully represented by the Installed-Size field (and the ratio can be quite impressive!). I wasn't here when that field was designed, but I bet an intended use case was to give admins a way of knowing which packages were wasting disk space the most. For sure dpigs relies on Installed-Size and don't have the necessary info to identify stuff like the above.

Top posters in a few Debian-related Planets:

$ planet-scores.sh 
Planet Debian-FR :
     19 Rapha l Hertzog
      4 Roland Mas
      3 Jean-Christophe Dubacq
      2 Gr gory Colpart
      2 Alexis Sukrieh

Sometimes I think this should be renamed Planet Buxy.

Planet Debian-FR (utilisateurs) :
     10 Julien Candelier
      8 Emilien Macchi
      4 Guilhem Bonnefille
      3 Shams Fantar
      1 Rapha l Hertzog
      1 Olivier Berger (perso)
      1 Jean-Christophe Dubacq
      1 Jean-Baptiste H tier (djib)
      1 Eric Veiras Galisson

Newly added contributors to that planet have all their recent articles aggregated, not only the ones they wrote since they were added.

Planet Debian :
     40 Christian Perrier
      2 Russell Coker
      2 Raphael Geissert
      1 Wouter Verhelst
      1 Steve Kemp
      1 Romain Francoise
      1 NOKUBI Takatsugu
      1 Michal  iha 
      1 John Goerzen
      1 Joey Schulze
      1 Gerfried Fuchs
      1 Fathi Boudra
      1 Enrico Zini
      1 Emanuele Rocca
      1 Dirk Eddelbuettel
      1 David Welton
      1 Christine Spang
      1 Antti-Juhani Kaijanaho
      1 Adam Rosi-Kessel

Planet "Christian loves rugby".

debian-community.org :
      4 Holger Levsen
      3 Andrew Donnellan
      2 Evgeni Golov
      1 Wolfgang Lonien
      1 Rapha l Hertzog
      1 Martin Albisetti
      1 Marcos Marado
      1 Jean-Christophe Dubacq
      1 Cord Beermann
      1 Benjamin A'Lee
      1 Andreas Putzo
$

I know I have an encoding problem on some planets, but that script is a very basic curl+shell+sed+grep+recode+sort+uniq pipeline, and I only use it for the amusement value. Maybe I'll recode it with a proper RSS parser some day if I feel utterly bored.

I am a leader by default, only because nature does not allow a vacuum.

Edit: Turns out that’s a Desmond Tutu quote. Still, it’s interesting to see it as a spam subject line.

David N. Welton writes about the word “blog”:

[…] to me it sounds more like something you have to call a plumber to deal with after having drained a couple of bottles of some caustic agent down the toilet, in an unsuccessful attempt to eliminate the “blog”

Dear Blogger, Your CAPTCHA (word verification or whatever) doesn't test whether someone is spamming. It tests whether someone has good eyesight, hearing, literacy, numeracy or browser-configuration, which is correlated in one way (few spambots include captcha-crackers yet, but there are some and they already have an 80% success rate IIRC) but it is not strongly correlated for humans (are blind people more likely to spam? I doubt it) and now some spammers are using porno-trojans to get humans to crack the eyetests for them - see http://www.schneier.com/blog/archives/2007/11/spammers_using.html http://news.bbc.co.uk/1/hi/technology/7067962.stm I block spam by premoderating all comments (they're well over 95% spam), but that does mean you need to check your site dashboard a lot to avoid cooling discussions too much. Other anti-spam tactics include OpenID, URL blacklists and so on - I don't use them because I've not added support for them to my site yet. I suspect Blogger.com users can't use them because Google hasn't added support for them. They've bought captcha's false sense of security. http://www.w3.org/TR/turingtest#security As for encouraging non-spam comments, I'll generally defer to this top 10 from Darren Rowse: http://www.problogger.net/archives/2006/10/12/10-techniques-to-get-more-comments-on-your-blog/ On my sites, I find that inviting questions doesn't make much difference, asking questions has limited use because readers are suffering from "question-fatigue" these days and I have difficulty appearing to be humble or gracious (people often read it as sarcasm! Hopefully that's just my audience), but the rest of the techniques seem to work for me and I use them when I can (not all of the sites I write are under my full control). Please let me know if you see other successful ways to reduce spam or encourage good comments. Hope that helps, MJR/slef

I'm pondering adding more RAM to my workstation. 128Mb is enough for most of my work, but OpenOffice swaps a lot. I couldn't remember what RAM is currently in it (one stick or two?) so I was very happy to find dmidecode in the comments on as days pass by, by Stuart Langridge: Memory scanner for Linux. dmidecode says I have a free slot and another 512Mb stick is surprisingly cheap. Actually, whole Ubuntu-ready-to-use computers are surprisingly cheap, according to lkcl. I hope they don't contain toxic e-waste. I must be getting old. [Antti-Juhani Kaijanaho]

I was born on the 2nd of November in the year 1977, thirty years ago today, at 20:18 +0200. Argh. I’m scared. Does it always feel like you’re about to die?

Luciano, you might be interested in how even good captchas can be processed automatically: just present them via some trojan to masses of unsuspecting users.

During the cleaning of my home office I came across an old notebook from a few years back, full of notes about the configuration of my PCs. In it I find things like this:

Linux Kernel Config
2.0.36
Loadable Modules Support
 [*] Enable loadable module support
Network device support
 [*] Ether express pro 100 (mice)
 [*] NE2000 support (rats)
/dev/cdrom => /dev/scd0

Most interesting to me is the mention of mice.my.flat and rats.my.flat - fun hostnames! A quick google suggests that 2.0.36 was current sometime in early January 1999 I remember buying a network card, at that time, meant going to the local computer shop, and picking two cards at random from their "network card bin". Each card cost £5 and my approach was to go in and buy two cards at random, then get home and modprobe every module until I found one of them at least. If there was no joy I'd return the next weekend and exchange them for two more! Funny how things change. Nowadays on my primary machine, vain.my.flat, I have autodetection of my current (onboard) NIC. I don't have to worry about ports or iobase for my (onboard) sound. Everything just works... (Except for the GNOME-panel volume control applet which crashes on startup. Hmmm.) Same local domain name, different flat.

… it’s a old, but matchs the actual complex of some discussions in the country where I actualy live.

It’s interesting to see how far, and yet how much more work we need to do on power management for Linux. I recently got a new laptop — a Lenovo Thinkpad X61s — and using the powertop tool, I was able to configure my system to the point where in what I can “airplane mail reading mode” (mailbox preloaded into memory, USB disabled, wireless and ethernet disabled, backlight down to 30% brightness, sloppily written power hogs like Firefox and Notes — every single application writer should be forced to run powertap and explain why their program feels it necessary to constantly wake up the CPU), I can get my usage down to about 9.8 watts. Using the 8 hours extended battery, that’s 8 hours of battery life, although granted doing very little. On the flip side, if I’m doing a major kernel compile, I can drive up utilization up to almost 30 watts, which means less than 3 hours of battery life. So that’s definitely the good news; Linux can sharply reduce its power consumption to the point where it is highly competitive with Windows. (And probably better than Vista, just because that OS is so heavy and bloated.) So thanks and and a tip of the hat to Intel and to Arjan van de Ven for making such a useful tool like Powertop available. So now for the bad news. Getting down to this level of power saving thriftness, where the laptop is carefully sipping only the minimal amounts of power from the battery, is definitely a work in progress. First of all, you can only get this level of power savings by unloading a specific USB driver, uhci_hcd. This will disable low speed devices (including unfortunately the fingerprint reader and the EVDO WWAN device if you were silly enough to buy one that was built into the laptop as opposed to a stand-alone card that you can swap between laptops and lend out to friends as necessary). But how many users are going to open up a terminal window, su to root and type the command “rmmod uhci_hcd”? And know how to reload the driver using “modprobe uhci_hcd” when they need to use the USB devices again? A similar problem exists for Network Manager; when the user disables the network by right-clicking on the applet, why doesn’t it automatically bring down the interface, instead of forcing the user to manually su to root and then type the command “ifconfig eth0 down; ifconfig wlan0 down”? A more serious problem is the Intel Wireless driver for the 4965. Even with the wlan0 interface configured down, and with the RF kill switch enabled, keeping the iwl4965 driver loaded will still cost you an extra full watt of power. When you’re down to 9.6 watts, that means that keeping the iwl4965 driver loaded when you don’t need it will cost you a 10% reduction in your battery life! That’s just sloppy, and hopefully it will be fixed in a future update to the iwl4965 driver, but as long as you don’t mind manually removing and reloading it, you can work around this power-saving oversight. A bigger issue, though, one for which no workaround exists, is that unlike the ipw3945 drivers, which at least had private, non-standard iwpriv commands to engage the 802.11’s power-saving features, the iwl4965 driver has neither the non-standard Intel iwpriv interfaces, nor the standard iwconfig interfaces for enabling any kind of powersaving features, including changing the transmit power of the card. So while powertop deserves plenty of kudos, iwl4965 deserves a wag of the finger from a power saving viewpoint. No doubt Intel just needs to allocate more money to its Open Source Technology Center so it get more of its crack developers to work improving Linux support for their processors and chipsets. Speaking of which, I’m still waiting for an Intel x.org 965GM driver that can support compiz/beryl and simultaneously show video clips at the same time… And being able turn off the 50 interrupts/second generated by the video card when they aren’t needed because 3-d graphics aren’t currently in use, without requiring a restart of the X server, would also be a nice touch. The bottom line is that Linux power savings and Linux support for laptops in general is much better than it was a year ago, and a lot of credit has to go to the efforts of Intel’s teams producing such good work as powertop, their wireless drivers, and their open X server drivers. We still have a lot of work left to be done, though!

I just love my city.
Mexico City, chaotic, unknowable, imposible to understand, so huge, so varied, so broken, so feared, complex, unique... I think few people realize how easy it is to fall in love with this city, to drink its beauty, which leaps up always when you least expect it. Today, it was a good day for loving it. For one thing or another, I've missed the five previous ciclotones, which are held on the last Sunday of each month, 7:00 to 14:00. Today, finally, I made it.
What is it? It is a 32 Km route circling roughly around the mid-South and Center of Mexico City:

The weather is abnormally cold lately in Mexico City - We have reached temperatures around 5 Celsius in the last two weeks, which is agreeable for December/January, but certaiunly not for October. Anyway, today it was quite chilly from the early morning. I did this ciclot n on my own, as Gaby is out of town - I left home at around 11:30, and headed North towards the nearest point of the route, ~5Km north from here (Circuito Interior and Universidad). The chosen circuit is quite good and varied. And quite enjoyable, too.
And how did I fare? Well, not bad at all, I think... I did the ~37Km (32Km of the Ciclot n, plus the ~5 to get there - I came back by metro, as I was already too tired to be alert while driving in the traffic) in 2hr 13 minutes. According to my trusty Polar watch, I used 1831 Kcal (which is a bit less than what I eat per day), averaging at 138 heartbeats per minute.
Very enjoyable. This is one of the ideas that I most like that have been promoted by our local government: As Mexico City citizens, we need to claim back our streets. Also, we have to be responsible and think about different ways of moving around than by burning gasoline - Biking is fun, and it is not riskier than driving or walking. Try it!

I request assistance with maintaining the dctrl-tools package. There are several tasks that could use more manpower (in no particular order):

• Writing test cases
  One could mine the BTS for past bug reports and create regression tests for them.
  One could use standard black-box and white-box testing techniques to generate general tests.
• Writing documentation
  The whole suite of tools could use a unified tutorial manual on how to best use it. The current documentation is reference material in the man pages.
• Internationalise the man pages
  Use po4a?
• Swatting the BTS wishlist entries
  I’ve kept the BTS clean of actual bugs pretty well, but there are a number of wishlist reports still outstanding.
• Take over maintaining the debian/ directory
  If you commit to maintaining it (and I trust your judgment), you’ll get last say in that part of the package (including deciding what helper to use).
• Whatever you wish
  Discuss on the dctrl-tools-devel mailing list first though.

Eventually I’d like to pass the package on to competent successors, but I have too much emotional attachment to the package to do that without a transitional period where I still retain a veto on what goes in the package. I also have some ideas for future tools that I’d like to be
able to concentrate on, and having co-maintainers might allow that. The package is now under Git in collab-maint. See the new README.Debian for information and a push-access code of conduct.

First the good thing: I updated wordpress to 2.3. Now the bad thing: I updated wordpress to 2.3. With 2.3 there where many infrastructure changes. For a complete list, see the Release Announcement. The most extensions breaking change was the implementation of native tag support. Referencing to Not working Plugin List Ultimate Tag Warrior and Extended Live Archives are problematic. Both caused troubles on update, but there is a fix for ELA and one for UTW. By reviewing the informations for writing this articel, I noticed that I’m running fine with the Ultimate Tag Warrior Bugfix Release provided by Christine from the Internet.
My theme K2 was needing also an update, which caused the style to be broken. So waiting for a fix did take little longer, but when reviewing it, I noticed that only a css class name did need an update.
This all teaches me, when using a project with much depencies, it will be a mess when updating, as long as isn’t all provided by one source. It’s some kind of using a project “still in development”.
Update: While we are at “still in development” .. I updated to 2.3.1-RC1 some seconds ago. :)

A short program I wrote has searched the web and revealed many names for frailty:

• Frailty, thy name is Abbey.
• Frailty, thy name is Astronaut
• Frailty, thy name is a Tag Cloud.
• Frailty, thy name is Bingles
• Frailty, thy name is Blog.
• Frailty, thy name is Brand Loyalty
• Frailty, thy name is Browser.
• Frailty, thy name is Carelessness.
• Frailty, thy name is Carl.
• Frailty, thy name is Doctor.
• Frailty, thy name is Eleanor
• Frailty, thy name is Emo.
• Frailty, thy name is English.
• Frailty, thy name is Facebook.
• Frailty, thy name is Falco.
• Frailty, thy name is Female.
• Frailty, thy name is Fide.
• Frailty, thy name is Filmmaker
• Frailty, thy name is Francine.
• Frailty, thy name is the Gaming Press.
• Frailty, thy name is Gates.
• Frailty, thy name is Genius.
• Frailty, thy name is the Global Laser Tag League Council.
• Frailty, thy name is Hamlet.
• Frailty, thy name is Harry.
• Frailty, thy name is Horse.
• Frailty, thy name is Human.
• Frailty, thy name is iPod.
• Frailty, thy name is the Love of Ready-Made Congregations, and Ready Built Churches.
• Frailty, thy name is Machine.
• Frailty, thy name is Man.
• Frailty, thy name is Mankind.
• Frailty, thy name is Marriage.
• Frailty, thy name is a Misnomer.
• Frailty, thy name is Old Age.
• Frailty, thy name is Outsourcing.
• Frailty, thy name is Phrailty.
• Frailty, thy name is Pigeon.
• Frailty, thy name is Ryan.
• Frailty, thy name is Sceptre.
• Frailty, thy name is Sci-Fi.
• Frailty, thy name is Solana.
• Frailty, thy name is Tehran.
• Frailty, thy name is This.
• Frailty, thy name is Typepad.
• Frailty, thy name is US.
• Frailty, thy name is Weakness.
• Frailty, thy name is Whining.
• Frailty, thy name is Woe.
• Frailty, thy name is Worm.

It eliminated a few as well:

• Frailty, thy name is certainly not SIRO.
• Frailty, thy name is not Jane.
• Frailty, thy name is not Me.
• Frailty, thy name is not necessarily Viola.
• Frailty, thy name is not Woman.

Yesterday I was going through the plugins and widgets, if there are any updates or such. I realized again, that updating of plugins (and maybe searching for the relocated download source) makes me mad. Also testing and switching back is annoying much.
So I decided to package plugins and widgets I use. Since some plugins and widgets are not maintained long enought for any debian release cycle or getting obsolet with new wordpress releases, I decided to maintain the packages outside of the debian project. Anyways … some people are also scared about the security situation of wordpress. I guess this isn’t much better for wordpress extensions. Next pity, some extensions or any equivalents aren’t available for wordpress 2.3 (yet). If you run multiple blogs via the stock debian package and wan’t to make use of the new wordpress version in any of your sites, you have update all at once … which maybe not a way you want to go. I decided to repackage wordpress 2.3.0 as wordpress23, which allows you to install wordpress (<<2.3.0) and wordpress23 at same time. If you want to use debian plugin, widget or theme packages or use these from your normal wordpress installation (/usr/share/wordpress) with wordpress23, you need to symlink the dirs. For example:

# mv /usr/share/wordpress23/wp-content/plugins/ /usr/share/wordpress23/wp-content/plugins.orig
# mv /usr/share/wordpress23/wp-content/themes/ /usr/share/wordpress23/wp-content/themes.orig
# ln -s /usr/share/wordpress23/wp-content/plugins /usr/share/wordpress/wp-content/plugins
# ln -s /usr/share/wordpress23/wp-content/themes /usr/share/wordpress/wp-content/themes Remember that package updates of wordpress or wordpress23 may overwrite parts of /usr/share/wordpress/wp-content/[plugins themes] in such situation. BE CAREFULL! You can get the stuff via apt-line:

deb ftp://ftp.cyconet.org/debian wordpress main non-free contrib Or directly from: http://ftp.cyconet.org/debian/archive/wordpress/ The actual package list is: wordpress-plugin-af-extended-live-archive
wordpress-plugin-ald-spa
wordpress-plugin-all-in-one-seo-pack
wordpress-plugin-exec-php
wordpress-plugin-google-sitemap-generator
wordpress-plugin-landingsites
wordpress-plugin-lightbox-2
wordpress-plugin-now-reading
wordpress-plugin-page-links-to
wordpress-plugin-photopress
wordpress-plugin-related-posts
wordpress-plugin-rolemanager
wordpress-plugin-sideblog
wordpress-plugin-spam-karma
wordpress-plugin-stats
wordpress-plugin-ubernyms
wordpress-plugin-utw
wordpress-plugin-utwgooglesitemaps
wordpress-plugins
wordpress-widget-category-cloud
wordpress-widget-samsarin-php
wordpress-widget-utw-cloud
wordpress-widgets
wordpress23 If you want a plugin or widget included and it makes sence to do so, drop me a mail, where to grab. Be aware that UTW isn’t supported since wordpress 2.3 anymore. A tag system was included into wordpress and you need to search replacements for all the nice UTW extension! Stay tuned! Debian, opensource, Packaging, planet, plugins, wordpress