(From a debian-devel@ post arguing against support for 2.4 kernels.) The problem with supporting old kernels is not just the need to maintain a few packages like initrd-tools or modutils, but that every important package cannot rely on features of modern kernels: inotify, sysfs, etc. This means that Debian as a whole will either lack support for features relying on these kernel features or will become more and more complex due to compatibility code. Please consider carefully the effects of advocating support for old kernels.

First of all: If you have somewhere my snailmail address, just s/B ndengasse 10/Bielstrasse 19/, because from tomorrow I will officially live there. I never thought that moving to a new appartement is so complicated. You have to change all your bankaccounts, you have to carry yourself about all the changes. But there’s also a good point: Our new appartement is much nicer than this house here, we painted some walls blue, red or green, sounds strange but looks nice. Then in the same time I migrate my IT, because in the new appartement we have a little room (2×2m) and I will put a rack or whatever inside for all my servers. I ordered new ADSL with 16 IP’s, so I will use one box as a router, setup OpenVPN and route my subnet to dev tap0. Maybe I will put once some pictures here. Of my new room with the new table and the new frame. Then I will also have my own bathroom with a very nice shower curtain, it has a picture with ice, water and penguins on it. So, I just wanted to tell you this, I will only sometimes read my mails during work in this time. If there is an urgent bug in one of my Debian packages, feel free to NMU.

Yesterday, i have learned that Rob Levin, also known as lilo, has died. And together with him have died his little dreams. I know it is now too late, but i wanted to say thanks for what you have made possible. I will miss you.

[RV Heraclitus SE Asia voyage: blog photos] So, I've been on the ship for a week or so now, learning knots and nautical stuff, cooking, cleaning, making inventories and otherwise preparing for the voyage. So far, we're just sitting in the harbour in Cairns, learning and working until the 24th. It feels weird to be away from the Internet for so long and the communities with whom my main contact has been Internet based; Debian, Perth/Indymedia & Cat@lyst. Kinda like being shipwrecked on an island, cut off from the outside world; no access to communication networks or ability to move around. However, the ship has an SSB (single sideband) radio (as well as VHF), I'm hoping that will satisfy my communications addiction. I've been learning about the SSB radio; if anyone knows of any information about, or free software (gratis and/or libre, preferably Windows based as there is only Windows - and a Mac and a Knoppix CD on board) that can access WEFAX (weatherfax) or the Internet via SSB, please email me about it. argh! damn German keYboards have the Y and the Z in the wrong places!!!

1.0.7184 legacy drivers have just been uploaded in amd64 and i386 forms to ftp-master. They also support xorg 7.1 so they will be in experimental for now.


R.I.P. lilo.

Finally, after too long, I can indulge in the glory that is the internet and Debian infighting from the privacy of my own home.

You may have noticed that Drew Parsons has been delivering swift kicks to the junk of the idea that Debian ships old X software. Thanks to his tireless efforts, we've got all the X libs for 7.1 in unstable right now. The server is basically ready to go, and Steve "OMG I GOT A HACKERGOTCHI FINALLY!!!" Langasek is attacking the terrifying task of a mesa update to lay the final bit of groundwork for the server and drivers. We should be able to get the new server and drivers in unstable within a week, at which point the XSF enters the home stretch of cleaning and polishing for the release. There's tons of this that we have to do, but to be honest I'm amazed at how far we've come over the past year or two, and I'm sure that people will be happy with the packages we ship with etch.

For post-etch, there's bigger things (like World Peace) in store, but the whole XSF has worked really hard on this and I believe the effort shows.

Today I'm travelling to Belgium to take my part in the orgy of elitist conspiracy that is O'Reilly's European Foo Camp and open source convention. I've elected to undertake the journey by train.It is difficult to overemphasize how magnificent a thing the Eurostar service is. Were it left to our drab and utilitarian government alone, such a thing would never exist.Instead, in two and a half hours of clean, comfortable carriages and more than tolerable coffee I will be in Brussels, just a short tram ride away from my hotel. With the increasing difficulty and odiousness of air travel, things could hardly be more of a contrast.The price seems to me insanely cheap. My journey to Brussels and back costs under £60, less than my journey down to London from York in the first place.It almost makes you wish for the heady days of the Major government's flirtation with Europe. Life seemed simpler then. (We even had a prime minister who understood cricket, but that's another story.)EuroFOOFoo Camp is an event where O'Reilly Media invite a bunch of people to create an ad-hoc conference. For O'Reilly, it's a great way to take the pulse of earlier-than-thou early adopters and mad inventors, which in turn feeds their business. For the invitees, it's a great way to meet others, put your ideas out there, and get your mind expanded. For those outside the fold, exclusion has taken on an importance far out of proportion to its actual significance, which appears sadly inevitable.Although I was present at the US Foo a few weeks ago, illness meant I missed the bulk of it while recovering in a darkened room. So, I'm looking forward this time to playing a bigger part.One of the themes I'm seeing developing, and for which we intend to focus on at XTech 2007, is that of the increasing connectivity and blurring of distinction between the web and the world. Things to watch include Second Life, Thinglink, mobile, geotagging, ubiquitous computing.I'm also looking forward to hearing the low-down on Railsconf Europe from those who went. Sadly pressure of time meant I couldn't go, but the write-ups I've been seeing make it sound like an excellent event, and a great progression from the Chicago one.

To a certain extend, SELinux is like TPM. On one hand, it can be used to increase security of your system a lot. On the other hand, it can be used to lock you out some more. Like from your Linux-running Motorola phone. (Note: this phone is not running SELinux, but some other LSM) The combination of both of course increases security even more. I was wondering if I should maybe starting using these on the next server I install. Make a mini boot system with an SSHD and use the TPM module to secure this boot system. Then whenever the system is booted, I connect via SSH to type in the passphrase to unlock the encrypted disks. So when some police decides to seize a TOR server, they'll not be able to read any of the data, even when they seize the complete hardware. The only attack vector (apart from breaking crypto) I see is that they use the TPM to decrypt the boot systems sshd key, and then setup a modified boot system to capture my passphrase. They'll probably need more time to set that up than me to be informed the server was seized (or wonder why it's down). They're not exactly prepared for such defensive measures, I guess. OTOH, I'm not planning to setup any server anytime soon, and for a laptop using an encrypted harddrive should be enough. Maybe add some extra SELinux policy to defend against software bugs and maybe keyloggers. Uwe Hermann just measured the overhead and to me this doesn't look very bad. I mean... it will still be much faster than my current laptop, and this laptop is fast enough for me 99.9% of the time.

From the debian changelogs:

thunderbird (1.5.0.5-2) unstable; urgency=low
  * new package: thunderbird-dbg
    + enable svg

Whoa, when will we start seeing SVG spam?

I'm going to set up a new laptop system soonish (more on that later) which shall have a completely encrypted hard drive. Hence, I'm testing a few setups wrt security, performance, manageability and fault-tolerance. Here's a few performance tests I did on an 80 GB laptop hard drive (in an Intel Celeron based laptop, 1.7 GHz, 256 MB RAM, Linux 2.6.17, Debian unstable).
I ran bonnie++ (with no options) and hdparm as hdparm -tT /dev/hda each time. I haven't put too much thought into the test setup, so if I made some stupid mistakes, please let me know. Unencrypted plain ext3 partitions:

• Extra partitions for /, /boot, /usr, /var, /tmp, /home, and swap (no LVM).
• Optionally, SELinux enabled on that system (targeted policy in permissive mode).

bonnie++:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         432M 19857  84 21831  10  9536   4 16355  58 22165   3 148.8   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1650  98 +++++ +++ +++++ +++  1734  98 +++++ +++  3820  96
forest,432M,19857,84,21831,10,9536,4,16355,58,22165,3,148.8,0,16,1650,98,+++++,+++,+++++,+++,1734,98,+++++,+++,3820,96

bonnie++ with SELinux:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         432M 20321  90 21036  13  9473   5 16742  61 21978   4 148.1   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1398  98 +++++ +++ +++++ +++  1473  98 +++++ +++  3305  98
forest,432M,20321,90,21036,13,9473,5,16742,61,21978,4,148.1,0,16,1398,98,+++++,+++,+++++,+++,1473,98,+++++,+++,3305,98

hdparm:

 Timing cached reads:   1416 MB in  2.00 seconds = 707.48 MB/sec
 Timing buffered disk reads:   82 MB in  3.06 seconds =  26.80 MB/sec

hdparm with SELinux:

 Timing cached reads:   1404 MB in  2.00 seconds = 700.59 MB/sec
 Timing buffered disk reads:   80 MB in  3.02 seconds =  26.53 MB/sec

Ext3 partitions on top of LVM on top of dm-crypt:

• One partition which is encrypted using dm-crypt (aes-cbc-essiv:sha256 mode, AES, 256 bit key size)
• On top of that an LVM2 system, with extra partitions for /, /boot, /usr, /var, /tmp, /home, and swap.
• Optionally, SELinux enabled on that system (targeted policy in permissive mode).

bonnie++:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         464M 11149  54 16660  20  6461   5  7472  58 11129   5 136.4   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1564  98 +++++ +++ +++++ +++  1650  98 +++++ +++  2640  97
forest,464M,11149,54,16660,20,6461,5,7472,58,11129,5,136.4,0,16,1564,98,+++++,+++,+++++,+++,1650,98,+++++,+++,2640,97

bonnie++ with SELinux:

Version  1.03       ------Sequential Output------ --Sequential Input- --Random-
                    -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
Machine        Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP  /sec %CP
forest         464M  9878  52 12138  11  5457   6  6834  56 11037   5 137.2   0
                    ------Sequential Create------ --------Random Create--------
                    -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
              files  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP  /sec %CP
                 16  1426  97 +++++ +++ +++++ +++  1451  98 +++++ +++  2433  97
forest,464M,9878,52,12138,11,5457,6,6834,56,11037,5,137.2,0,16,1426,97,+++++,+++,+++++,+++,1451,98,+++++,+++,2433,97

hdparm:

 Timing cached reads:   1408 MB in  2.00 seconds = 704.01 MB/sec
 Timing buffered disk reads:   80 MB in  3.02 seconds =  26.53 MB/sec

hdparm with SELinux:

 Timing cached reads:   1396 MB in  2.00 seconds = 698.06 MB/sec
 Timing buffered disk reads:   82 MB in  3.07 seconds =  26.69 MB/sec

So yes, there is some overhead, but it's nothing too serious, IMHO. And quite honestly, I don't care too much about performance here — security is more important than performance. I think you'll agree; if you don't agree now, you will agree with me on the very day someone steals your laptop ;-)

For the next upcoming stable update, which should happen around October, 16th, is just sent the first preparation mail. Procedure is as usual, intervene if you think, we do something completely wrong here. An up-to-date version of my mail can allways be found here. Next update on that mail will follow in about 10-15 days. release

Yesterday was my turn as "primary care giver" (PCG) with Amita June, so I took the opportunity to do some shopping. I was on Autoroute 40 on my way out to the Ikea on rue Cavendish around 1PM when they had a breaking bulletin on the CBC. Yes, the Dawson C gep shooting -- they were sending a reporter to the scene. For those of you outside Montreal, yes, I and my family are fine, and we don't have any friends who were affected by the shooting. It's been strange in town, but we're physically safe and sound. Thanks to everyone who's asked. tags: montreal dawson shooting

Piknic Electronik On a more cheery note, this upcoming Sunday is the last Piknic Electronik for 2006. The last picnik is always quite sweet, and as usual Ninja Tune will be closing out the season. Smart, fun Kid Koala and, my personal fave, Ghostbeard, are on the lineup. Should be a great time, and it's supposed to be sunny on Sunday, so a nice day to be in Parc Jean Drapeau. tags: piknic electronik ninjatune montreal music

Ignition 2006 Burning Man just finished up last week, and here in Montreal the local Burning Man community is having a campout and bonfire to celebrate. The so-called "regional burn", called Ignition, is going to happen 22-24 September in the wt:Eastern Townships; more info on the Br leurs wiki. Maj and I are the regional coordinators for Burning Man activities, and we've been busy the last few weeks lining up the basics (tickets, toilets, insurance... check, check, check). Now we're looking forward to seeing what folks will be doing this time around. Our local Burning Man community is fabuloso -- the people are extra cool. tags: burning man montreal regional burn bruleurs ignition

After doing the last 4 rounds mostly by hand, I've started automating a lot of the process with a make system. Essentially, make will find an appropriate machine, use pbuilder to perform the build, then bring all the results back locally. Considering I've had to restart builds 3 times this round, the extra time spent automating it has already made up for itself. Of course, I already see a number of places that need refactoring... I need help testing! Please checkout the wiki for details.

I am nearly done with the marathon move. After a small hold-up in Canadian customs (for no apparent reason except I got a border official who had incorporated the role, a full 110%), my stuff is here, unpacked, and in decent order. In between unpacking, I have been able to experience some of Edmonton–from the nightlife to its administrative face (signing up for health insurance and a Social Insurance Numbers, for example, both of which were easy as cake) and I have to say E-town gets a far far far worse rap than it deserves. Ok, the weather is nothing to swoon over, and it is already getting far colder than I am used to but bracketing that detail, it is a pretty neat city. Now I tend to like the mid-size cities (Minneapolis, Madison, Philadelphia, Portland are some of my favorites in the U.S) over the mega-gargantuan-city and Edmonton fits this bill with just under a million people. And perhaps it is also just that I am digging some Canada-wide features (affordable and immediate health care, licensed cafes, a saner pace of life, the pleasant and earnest character of many folks) but there are Edmonton-specific attributes that are pretty nice too. Before I get to them, it is worth noting that every time I have told people that I was going to Edmonton, they would either: 1) admit that they did not know exactly where it was and thus could offer no opinion whatsoever (and I was one of those folks until I looked on a map) or 2) blurted some negative reaction like: “do you really have to go there!” though most of those people had never been, but had a sense of its northernly location. Perhaps my favorite reaction came from a blackberry forum where we posted a question about good data plans in Edmonton/Canada. Most of the replies stuck to the topic, but one person decided to spew his unadulterated thoughts on Edmonton:

i feel sorry for u going from NYC to Edmonton “Edmonton sucks” you’ll be happy to go back to NY..
You go from a city that has life to a dead one.. from having good bb plans to sh*ty ones.. hope your getting paid good

Ok, admittedly, the data/cell phone plans are lackluster but I think this person either has had some terrible times in Edmonton (and holds an unhealthy grudge), has never lived in NYC or has a warped sense of what the good life in a city means. Sure NYC is an amazing place, and is my likely future home, so I am not going to trash it but, like any city, it has its shortcomings.. like unfordable housing But time will tell as to how I feel about Edmonton after the winter. Perhaps when it reaches freezing temperatures, it does turn a leaf, and become dead but then you hit the mountains, no? But for now I am digging the HUGE pine trees, rivers, and ample sun of E-town.

Just a quick update for SELinux in etch. With Manoj picking up work on it again (you might have noticed the large influx of new SELinux related packages these days, bringing our toolchain up to date again), and rjc having setup a SELinux development box for me, we're actually making some progress on SELinux for etch now. Uwe Hermann also blogged about SELinux on Debian recently. There are tons of small nuisances with SELinux on Debian left. I've started filing bugs and tagging them with the "selinux" usertag. It's in the details. For example mawk and gawk both try to ioctl any file they read as if it were a serial terminal. Which of course causes SELinux to log an audit error, since the init script or whichever was calling awk didn't have the permissions to ioctl a config file. Then there is /dev/xconsole - it's created by the syslogd init script (shouldn't maybe this be handled by udev), it's barely used by anyone, and SELinux policy upstream wants to keep it in the xserver policy, and claims its main use is to be able to feed it the output from programs started by the window manager (instead of .xsession-errors). Which is a seriously broken design, since it's not multiuser capable. Anyway, our current options are to

• diverge from upstream in policy, putting xconsole into logging policy
• make xserver an mandatory policy module
• convince the syslogd maintainer to disable xconsole by default
• convince upstream to at least split it out from the xserver module into a separate xconsole module and make that mandatory

Of course I was quickly flamed for filing a bug against exim stating that there currently is no SELinux policy for it, and people thus will have to use postfix or sendmail instead. But heck: people trying out SELinux on Debian will run into this problem, you know. I'd certainly prefer people to use exim instead of sendmail (I'm more of a postfix guy), but unless someone writes a policy for exim, people can't use it with SELinux. I have no idea how exim works (where its queues live, expected behaviour and so on), so I can't write a policy. Now to start a real flamewar - how about making postfix the new default MTA for Debian with etch? /me runs and hides.

I'm delighted to announce that registration is open for XTech WebDev London. This is a one-day training event for web developers, to be held on 31 October 2006. Our first event covers web standards, Ajax, REST and Rails, with a super-duper keynote from Tom Coates of Yahoo! You can find out more about the event on its website: speakers, schedule and benefits. What I want to do here is talk a bit about the backstory of XTech WebDev. I've been chairing the XTech web technologies conference, and before that, XML Europe, for five years. If you've ever been, you'll know it's an intense four days where the latest web and standards-based technologies are discussed. We typically hold the show in a European capital: we'll be in Paris in 2007. However, the full XTech show can be out of scope either in expense, location or duration for many. So, the idea for XTech WebDev was born. Take some of the best speakers and experience from the XTech conference, figure out what's most relevant to web developers at the coalface, and create a one-day event that's easy to get to and at the right cost. For our first event, we're featuring standards-based development, best practices for Ajax development, the REST style of developing web services, and Ruby on Rails. Along with that we'll have a keynote from Tom Coates challenging the way we think about our web applications. What we're aiming for is a convenient orientation day for web developers, which will enable you get a fix on the most important trends in web development happening right now. Although we'll be in London, we're not starting until 10am, which should leave plenty of time for people coming from further afar to be able to do the show in a day trip. I reckon it should be possible from as far away as Paris or Amsterdam, and even the north of England.... Registration is 275 if you sign up before 23 September, and space is limited, so be sure to sign up you and your team quickly. I really appreciate everybody's support as we branch out into this new event, and welcome all and any feedback and requests for future events.

A lot of people outside Germany, including here in Ghana, can't pronounce my name right (whereas right is what I'm used to...). So I looked through the German wikipedia and tried to figure out how to write my name in the IPA. The result is:If you don't have unicode available, this will probably look strange to you. All these sounds have strange names, here they are:

• j: palatal approximant / Stimmhafter palataler Approximant
• : open-mid back rounded vowel / Gerundeter halboffener Hinterzungenvokal
• a: open front unrounded vowel / Ungerundeter offener Vorderzungenvokal
• : voiceless uvular fricative / Stimmloser uvularer Frikativ
• : near-close near-front unrounded vowel / Ungerundeter zentralisierter fast geschlossener Vorderzungenvokal
• m: bilabial nasal / Stimmhafter bilabialer Nasal

And yes, it is the same letter as in Te , but not the same pronounciation, which is t x. Update: I had to convert my serendipity blog to UTF8 to make this entry right. Did so by mysqladmin dump'ing the whole database and running it through iconv, and then re-inputting it. Sorry to any planets that had a broken entry for a while. Maybe this update paragraph makes these planets update the entry :-)Update 2: As I'm already showing of with unicode characters: The name Joachim is derived from Jehoiakim (Jojakim in German), which is Hebrew and looks like this: