---

If you're not using ssh-agent to authenticate yourself to SSH servers, you should be. (i'm assuming you're already using PubkeyAuthentication; if you're still using PasswordAuthentication, ChallengeResponseAuthentication or KbdInteractiveAuthentication, fix that please). You should use ssh-agent for a number of reasons, actually, but the simplest is this: when you authenticate to a text-based channel on a remote server, you should never have to type anything about that authentication into the channel that will eventually be controlled by the remote server. That's because a malicious server could simply accept your connection as an anonymous connection and print out the exact prompt you're expecting. Then, whatever you're typing goes into the remote server instead of into your authentication scheme. and congrats, you just gave away the passphrase for your key. With ssh-agent, you talk first to your agent. Then, you talk to the server and your ssh client talks to the agent. Your keys and your passphrase are never exposed. the second reason is that the agent is a much smaller piece of code than the ssh client, and it doesn't talk to the network at all (unless you force it to). It holds your key and never releases it to querying processes; It even runs in a protected memory space so other processes can't peek at it. So if this protected, isolated agent is what holds your key, you're in much better shape than if a non-protected, larger, network-active process (the ssh client) has direct access to your secret key material. The third reason is that it's just more convenient -- you can put a key in your agent, and ask it to prompt you when its use is requested. you don't actually need to re-type your passphrase each time. you can just hit enter or type "yes". And if that scares you security-wise then you can put the key in for a limited period of time, as well. (btw, you should be using the ssh-agent that ships with OpenSSH, probably not the implementation offered by gnome, which doesn't offer a confirmation prompt, doesn't run in protected memory space, and links in a ton more libraries) So how do you use the agent? It's probably already installed and running on your computer if you run a desktop with debian or another reasonable free operating system. Query what keys are in your agent:

0 dkg@pip:~$ ssh-add -l
The agent has no identities.
1 dkg@pip:~$ 

Add a standard OpenSSH secret key to your agent, prompting for confirmation after each use:

0 dkg@pip:~$ ssh-add -c ~/.ssh/id_rsa
Enter passphrase for /home/dkg/.ssh/id_rsa: your nice long passphrase here
Identity added: /home/dkg/.ssh/id_rsa (/home/dkg/.ssh/id_rsa)
The user must confirm each use of the key
0 dkg@pip:~$ 

(if you drop the -c, you will not be prompted at each use) Add a standard OpenSSH secret key to your agent, with a lifespan of one hour (3600 seconds)

0 dkg@pip:~$ ssh-add -t 3600 ~/.ssh/id_rsa
Enter passphrase for /home/dkg/.ssh/id_rsa: your nice long passphrase here
Identity added: /home/dkg/.ssh/id_rsa (/home/dkg/.ssh/id_rsa)
Lifetime set to 3600 seconds
0 dkg@pip:~$ 

(note that you can combine the -t $SECONDS and -c flags to get key that is time-constrained and requires a confirmation prompt at each use) Add a monkeysphere-style key (an authentication-capable subkey from your GnuPG secret keyring) to the ssh-agent (this will prompt you for your GnuPG passphrase with a graphical ssh-askpass program during this keyload, if such a program is available), for one hour:

0 dkg@pip:~$ monkeysphere subkey-to-ssh-agent -t 3600
Identity added: Daniel Kahn Gillmor <dkg@fifthhorseman.net> (Daniel Kahn Gillmor <dkg@fifthhorseman.net>)
Lifetime set to 3600 seconds
0 dkg@pip:~$ 

If you don't already have such a subkey, but you want to use the monkeysphere, you'll need to run monkeysphere gen-subkey to create one first. Note also that you can use both -c and -t $SECONDS with monkeysphere subkey-to-ssh-agent, just like they are used with ssh-add. Remove all keys from your running agent:

0 dkg@pip:~$ ssh-add -D
All identities removed.
0 dkg@pip:~$ 

I hope this is helpful to people! Tags: security, ssh, ssh-agent, tip

There are situations in which a given package needs to have different dependencies in Debian and in Ubuntu. Despite this difference it s possible to keep a single source package that will build both variants of the package. Continue reading to discover a step-by-step explanation. 1. When is that needed? While it is possible to have different dependencies depending on the distribution on which the package is built, it should be usually avoided when possible. This infrastructure should only be used as a last resort when there are no better alternatives. Here are some examples of when it might be needed:

• Ubuntu has some packages that Debian does not have (or vice-versa), and the resulting package would benefit from having them installed.
• The package names differ between Ubuntu and Debian and it s on purpose (i.e. the difference is a justified choice and not a mistake because both distributions failed to coordinate).
• The packages are built differently in both distributions, and the run time dependencies are not the same due to this. Maybe some associated patches are only applied in Ubuntu.

2. Using substitution variables in debian/control The dependency that varies between both distributions can t be hardcoded in debian/control, instead you should put a substitution variable (substvar) that will be replaced at build time by dpkg-gencontrol. You can name it $ dist:Depends for example:

[...]
Depends: bzip2, $ shlibs:Depends , $ misc:Depends , $ dist:Depends 
[...]

Note that you typically already have other substitution variables ($ shlibs:Depends comes from dpkg-shlibdeps and $ misc:Depends from debhelper and its dh_* scripts). 3. dpkg-gencontrol needs a -V option The value used to replace this new variable needs to be communicated to dpkg-gencontrol. You can use the -V option for this, the syntax would be something like this:

dpkg-gencontrol [...] -Vdist:Depends="foo (>= 2), bar"

If you use debhelper, you have to pass the option to dh_gencontrol after two dashes (--):

dh_gencontrol -- -Vdist:Depends="foo (>= 2), bar"

If you use CDBS, you can set the DEB_DH_GENCONTROL_ARGS_ALL make variable:

include /usr/share/cdbs/1/rules/debhelper.mk
DEB_DH_GENCONTROL_ARGS_ALL = -Vdist:Depends="foo (>= 2), bar"

The value given to dpkg-gencontrol is static in all those examples, now let s see how we can use give a different value depending on the distribution that we re targetting. 4. Using dpkg-vendor in debian/rules dpkg-vendor is a small tool (provided by the dpkg-dev package) that parses the /etc/dpkg/origins/default file (provided by the base-files package) to know the current distribution and its ancestry. It can be used in debian/rules to adjust the behavior depending on the current distribution. You can check its man-page to learn about the various options supported but we re only going to use --derives-from <vendor> in this sample. With this option the script exits with zero if the current distribution is or derives from the indicated distribution, or with 1 otherwise. Now combining all together, we can use dpkg-vendor to dynamically define the content of the substitution variable in debian/rules. Let s suppose that you want $ dist:Depends to be foo (>= 2) on Ubuntu (and its derivatives) and bar everywhere else. Using debhelper s 7 tiny rules file, this example could be:

ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes)
	SUBSTVARS = -Vdist:Depends="foo (>= 2)"
else
	SUBSTVARS = -Vdist:Depends="bar"
endif
%:
	dh $@
override_dh_gencontrol:
	dh_gencontrol -- $(SUBSTVARS)

If you use CDBS, it could be this:

include /usr/share/cdbs/1/rules/debhelper.mk
ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes)
	DEB_DH_GENCONTROL_ARGS_ALL = -Vdist:Depends="foo (>= 2)"
else
	DEB_DH_GENCONTROL_ARGS_ALL = -Vdist:Depends="bar"
endif

Do you want to read more tutorials like this one? Click here to subscribe to my free newsletter, you can opt to receive future articles by email.

9 comments Support my work

This year, I have moved to a new country two times. This sharply brings to attention the pain and cost of owning things. It is not just when carrying maximally filled suitcases across airports that things are bothersome. The more things you have, the bigger a home you need, and the more effort you need to spend on cleaning things and home. A meme of sorts in recent years has been surviving on 100 things only. That sounds like very little, but it looks doable, if a bit extreme. I am sorely tempted to try this, but, well, I am not like Joey, living in yurts, and using only a miniature netbook for my computing needs. But perhaps that's the problem? I am too accustomed to my stuff, and it is hard to give up things, even when I don't really need them much. Like, USB hard disks. I like to have a Debian mirror locally, so I have a disk which has a couple of hundred gigabytes of Debian packages. However, I don't actually use that much. Would it make more sense to rely on servers hosted elsewhere? While those might be part of the 100 things count, at least I wouldn't have to carry them, ever. But then I'd need to have Internet access, and that's also difficult, especially in the early months of living in a new country. Things would be so much easier if I could just buy a Scottish island, with a castle, fix that up with some broadband and weekly grocery deliveries, and never go anywhere again.

One of the nice things that I've been involved with since starting to work at ARM in Cambridge is setting up newer, faster machines to help with the armel port. We have six machines hosted in the machine room here now:

• abel is a porter box
• arnold, alain, alwyn and antheil are running buildd software
• arne is a hot spare (currently on my desk, but ready to go back in the rack any minute now)

All of these machines are Marvell DB-78x00-BP development boards, each configured with a 1GHz Feroceon processor (ARM v5t), 1.5GB of RAM and a 250GB drive attached via SATA. They're nice machines, reasonably powerful yet (as with many ARM-based machines) they draw very very little electrical power even when working hard. These very boards were used for a while by the folks at Canonical to help build the Ubuntu armel port, but now we've got them. In terms of configuration, these machines are not quite fully supported in Debian yet, though. The kernels we're using are locally-built, based on the Debian linux-source-2.6.32 package but with a .config (marvell.config) that's tweaked slightly to add the support for these boards. There aren't any source changes needed, so I'm hoping to get support added directly in Debian, either as a new kernel flavour or (preferred) as a patch to an existing flavour. I've had conflicting advice about whether the latter is possible, so I'm going to have to experiment and find out for myself. UPDATE 2010-09-28: I've tested, and it seems that the boards will need a new flavour after all, as the config is incompatible with the closest other config (kirkwood). Ah well... I had no end of trouble trying to get make-kpkg do the right thing, so on advice from Ben I built the kernel using "make deb-pkg", a standard target in the Linux kernel's build system: fakeroot make -j2 deb-pkg DEBEMAIL=93sam@debian.org DEBFULLNAME="Steve McIntyre" KDEB_PKGVERSION=buildd23 Annoyingly, that wouldn't work when cross-compiling either so I had to build the kernel natively. To make the resulting kernel image package install properly (and, just as importantly, allow for future easy upgrades for the DSA folks), I also needed the following tweaks to the Debian system:

• depmod:
  • Need to make sure that depmod is run so the new kernel can find and load modules at boot. Added trivial script in /etc/kernel/postinst.d/depmod to do this.
• initramfs-tools:
  • Needed to copy the file /etc/kernel/postinst.d/initramfs-tools into place from my amd64 machine; I'm guessing this would be there automatically on a new-enough version of initramfs-tools on the armel machines, but we're still using Lenny as a base system for now even if I'm using a Squeeze-based kernel.
• flash-kernel:
  • #594878: support for these boards. Hector did most of the work, and I've worked on it a little more.
  • #550584: kernel postinst hook script (/etc/kernel/postinst.d/zz-flash-kernel) to create uImage and uInitrd files from the kernel zImage and the initramfs.

Finally, I've tweaked the uboot config on the machines to use the uImage and uInitrd files that are generated:

Marvell>> setenv IDE ide reset
Marvell>> setenv loadkernel ext2load ide 0:1 0x2000000 /uImage
Marvell>> setenv loadinitramfs ext2load ide 0:1 0x3000000 /uInitrd
Marvell>> setenv bootboth bootm 0x2000000 0x3000000
Marvell>> setenv bootcmd setenv bootargs \$\(bootargs\)\;$(IDE)\;$(loadkernel)\;$(loadinitramfs)\;$(bootboth)
Marvell>> saveenv

And that's it, as far as I can see. I'll now wait for people to tell me what I've got wrong above... :-)

I use to take my (company) notebook with me on business travels.
Two times I now had the unlucky situation that something bad happened to it on such an occassion. Whenever you get in the situation that you need to reinstall your system in a hotel room you'll might have the same wish that I got: A way to quickly bring the system in a state where I could work with it.

Well, I used FAI a while back for a customer. Its a real great tool for automated installations and I really prefer it over debian-installer preseeding. Apart from the fact that the partitioning is way easier it also gives me the power to complete the whole installation up to a point where I've got almost nothing to do anymore. It also features an installation completely from CD or USB-Stick which makes it suitable for me.

However, my notebook installation has a little "caveat" which made that a little bit more harder as previously thought. As it is a notebook and I carry company data on it it has to be encrypted. Disk encryption at a whole.
The stable FAI version does not support this.
The problem is: The current support for crypto in setup-storage (FAIs disk setup tool) is not very far. Supported is the creating of a LUKS container with a keyfile, saving this keyfile to the FAI $LOGDIR and creating a crypttab.
Unfortunately for a root filesystem this would leave us with an unbootable system, because this requires manual interaction. And on the other hand using a keyfile for a cryptoroot is a no-go anyway. We want a passphrase.
On a side-note: cryptoroot support with a keyfile is more complex than with a passphrase, as you have to provide a script that knows how to get to the key.

So I started experiments with scripts in the FAI-configuration that added a passphrase, changed the crypttab and recreated the crypttab. That worked, although it was very ugly.
But due to a good coorperation with Michael Tautschnig, a FAI- and Debian-Developer, on this, the FAI experimental version 4.0~beta2+experimental18
now supports LUKS-volumes with a passphrase that can be specified in the disk_config.

Now its actually possible to setup a system like mine with FAI out-of-the-box. One thing (apart from the FAI configuration and setup as you want and need it) has to be done, anyway:
The initrd support of cryptsetup requires busybox (otherwise you will see a lot of "command not found" errors and you system won't boot) and it requires initramfs-tools, which is standard nowadays.
So you have to make sure that these packages are in your package config!

So now I can define a FAI-profile for my notebook, create a partial fai mirror with the packages it needs and put all this together on an USB stick with fai-cd (don't worry about the name, it can be used to create ISO images as well). I can carry this with me and if I need it I stick it into my notebook and let FAI automatically reinstall my system. Nice :)

Update: Somebody asked me, weither he understood me right, that I'd put my LUKS passphrase on a FAI usbstick clear-text. Obviously, the answer is and should be NO. What I do and what I'd suggest to others: Use a default passphrase in the FAI configuration, install with it - after all on a fresh installation there is not much to protect - and once it is finished *change* the passphrase to something secure by adding a new keyslot and removing the old.

Just so I don t forget it for a second time: esmtp can be pretty obscure when it comes to error messages.
When it encounters an .authenticate/ca.pem file with public permissions it connects to the server and only after seeing the extensions list does it tell you StartTLS extension not supported by MTA . Not exactly straightforward.

Version 0.2.7 of RcppArmadillo is now on CRAN. This updates the includes Armadillo template library to version 0.9.80 which Conrad released a few days ago. RcppArmadillo makes it easy to write highly efficient and highly readable C++ code for linear algebra (based on Armadillo) in R extensions (using Rcpp for the interface). The short NEWS file extract follows, also containing Conrad's entry for 0.9.80::

0.2.7   2010-09-25
    o   Upgraded to Armadillo 0.9.80 "Chihuahua Muncher":
         * Added join_slices(), insert_slices(), shed_slices()
         * Added in-place operations on diagonals
         * Various speedups due to internal architecture improvements

More information is on the RcppArmadillo page. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page.

First alpha version of Cupt version 2 is available here: http://people.debian.org/~jackyf/cupt2/.

Notable changes since 1.y series:
- rewrite in C++(0x)
- improved speed;
- improved RAM usage;
- less dependencies.

All other technical details, including not yet implemented things, are described in http://people.debian.org/~jackyf/cupt2/README.

Since I'm in a GnuPG rekeying sort of mood, I've generated a new eyrie.org archive key that's a 4096-bit RSA key (overkill, I know) and is sign-only. I've updated the eyrie-keyring package available from my personal archive to install it. I haven't changed the archive signatures over yet, to give people who may be using that archive a chance to update. I'll probably do that after squeeze releases. The new package still uses the old apt-key methods, since I wanted to update the key in lenny as well. I will probably eventually switch to using /etc/apt/trusted.gpg.d as supported by the current version of apt. It's rather hard to tell from apt's changelog when that support was added, but I think it will be in squeeze; the squeeze apt-key man page at least makes that sound plausible. While I was cleaning things up, I also purged from my personal archive all the packages that have since been uploaded to Debian, and also dropped the etch repository since all the Debian infrastructure is dropping it. You can get the current information about how to add my archive and what packages to expect in it, as well as now-updated links to the Debian packages that I help maintain, on my Debian package page.

After the famous Facebook outage a few days ago, Facebook Engineering made a to be fair, reasonably detailed statement on what went wrong and how it affected the service. One particular comment attached to it drew my attention:

It s great to hear and see that big companies like Facebook are so open with what they do. That s rare, very rare. Thanks!

Huh? Did I miss some announcement of openness and freedom?
<script type="text/javascript"> var flattr_wp_ver = '0.9.16'; var flattr_uid = '32970'; var flattr_url = 'http://www.jwiltshire.org.uk/content'; var flattr_lng = 'en_GB'; var flattr_cat = 'text'; var flattr_tag = 'blog,wordpress,rss,feed'; var flattr_btn = 'large'; var flattr_tle = 'jwiltshire.org.uk'; var flattr_dsc = 'The public face of jwiltshire'; </script> <script src="https://api.flattr.com/js/0.5.0/load.js?mode=auto" type="text/javascript"></script>

Working on a new feature for eSpeak GUI I started looking into language identification. Forcing users to manually choose the text s language is a botheration, so trying to guess it by checking which system dictionary contains the most words from the text or some other method would surely be beneficial. After a quick search I learned that it s much easier than this: it s possible to reliably determine the language based on statistic n-gram information. Ignoring the fact that now I officially hate Firefox, Chromium, OpenOffice.org and everyone else there for not implementing this and having me spend the day changing the spell-checker s language, I was left with the choice on how to use this in eSpeak GUI. The first option I found was TextCat, which is also the only library I ve found to be packaged for Debian. However, ignoring the fact that upstream isn t maintaining it any more (such a library shouldn t need too much maintainance, after all), the package declares incorrect dependencies (bug filled a month ago, no response yet) and the API is also pretty crappy (it requires a physical file indicating the location of the statistic models). Unrelated to that, I ve also found that the Catalan text samples it includes are incorrect, so the same may be true for other languages. I guess it d make sense to work on a new (and completely Unicode) language samples collection. I ve thought of using something like the Universal Declaration of Human Rights since this way all languages can have the same text, but being more of a legal thing it may be biased by some words being too repetitive. Looking for other alternatives to the TextCat library I ve only found the following:

• TextCat (same name, different code): PHP licensed, so incompatible with GPL projects.
• Mguesser (part of mnogosearch-mysql): it s a standalone executable and not a library.
• SpamAssassin s TextCat.pm: also a standalone executable, this time written in Perl. Apparently they were using a fork of TextCat (the original library, not the PHP licensed one) before that.

So it looks like I ll have to start by getting a good collection of text samples I can use to generate the statistic data. Then I have several options on how to actually use it. As I see it, those are my possibilities:

1. Fixing libtextcat s packaging and just using that.
2. Taking it over as new upstream maintainer. Not my preferred option as I don t really feel like maintaining a C library at this point.
3. Trying to convince the maintainer of the new TextCat (with last commit January this year and a more sane API) to re-license it in a GPL-compatible way, packaging that and seeing how that one works (haven t tried it out yet).
4. Writing my own implementation in Python, maybe based upon this example or TextCat.pm.

Any other ideas, pointers to some library I may have missed or offers to collaborate are very welcome. Please also note that my intention in writing this post is not only to rant about there being no well-maintained ready-to-use library being available, but especially raising awareness on the topic of language identification. I d love to see this feature all around the desktop, just like (and in combination with) spell-checking, which is already omnipresent. Related posts:

1. espeak-gui 0.2
2. Introducing espeak-gui

---

11 comments
Siegfried-Angel Gevatter Pujals, 2010. Permalink License Post tags: language identification, Programari lliure, text categorization

I recently started using btrfs, in both raid0 and raid1 setups, and migrated some data there. Once all the data was copied, I wanted to check how much overhead moving to btrfs meant, space-wise.

# df -h /mnt/share
Filesystem Size Used Avail Use% Mounted on
/dev/sdb3 932G 682G 250G 74% /mnt/share # btrfs-show /dev/sdb3
Label: none uuid: e06484de-fb18-4564-b6e6-adbaed8bebec
Total devices 2 FS bytes used 681.61GB
devid 2 size 465.66GB used 427.13GB path /dev/sdb3
devid 1 size 465.66GB used 427.15GB path /dev/sda3


The filesystem was freshly created, in a raid0 fashion, so both 465GB partitions are used to form (roughly) a 930GB volume.
So, I had filled it with 682GB of data, and df was telling me 250GB were left, which is not unexpected. What I didn t expect, though, is btrfs-show telling me 427GB were used on each partition. Again, the filesystem was freshly created and the data had just been copied over, so I wasn t expecting these numbers to be off. Which meant 854GB were being allocated on disk for 681GB of data, 25% overhead ! Curious to know how much left that really meant, I just tried a stupid thing: filling as much as btrfs permits:

# dd if=/dev/zero of=/mnt/share/zero bs=1M
dd: writing /mnt/share/zero': No space left on device
253359+0 records in
253358+0 records out
265665118208 bytes (266 GB) copied, 1144.41 s, 232 MB/s
# du -sh /mnt/share/zero
248G /mnt/share/zero


It turns out I actually could write for the amount of free space df was claiming was free (modulo GiB-GB conversions).

# df -h /mnt/share
Filesystem Size Used Avail Use% Mounted on
/dev/sdb3 932G 930G 2.0G 100% /mnt/share # btrfs-show /dev/sdb3
Label: none uuid: e06484de-fb18-4564-b6e6-adbaed8bebec
Total devices 2 FS bytes used 929.36GB
devid 2 size 465.66GB used 465.13GB path /dev/sdb3
devid 1 size 465.66GB used 465.15GB path /dev/sda3


So, this time df is slightly off, and btrfs-show somehow agrees the filesystem is full. But surprises don t stop there:

# rm /mnt/share/zero # df -h /mnt/share
Filesystem Size Used Avail Use% Mounted on
/dev/sdb3 932G 682G 250G 74% /mnt/share # btrfs-show /dev/sda3
Label: none uuid: e06484de-fb18-4564-b6e6-adbaed8bebec
Total devices 2 FS bytes used 929.36GB
devid 2 size 465.66GB used 465.13GB path /dev/sdb3
devid 1 size 465.66GB used 465.15GB path /dev/sda3


That s right, even after the file removal, for btrfs-show, everything is still in use. Even after several sync or several hours later. All in all, just don t trust what btrfs-show says. NB: one also needs to know that df reports wrong sizes for raid1 setups, but that s another story.

This last couple of days I've been dedicated making Gnus fresher. I've decided to give a whirl on Gravatar support. I already tried the gravatar.el lying on the Interweb, but well, it was crap: it used wget to fetch pictures, therefore was totally synchronous. Reading each mail was slower. The cache did not even have TTL, as far as I recall. So, I've now wrote gravatar.el implementing the Gravatar API. Asynchronously of course. With cache, TTL, etc. Perfect. :-) Then I've composed gnus-gravatar.el, implementing a washing function adding Gravatar for From field and/or Cc/To fields, like done for picons. As I was expecting, the patch was badly received by the GNU guys, which start talking about thinks like external resources, privacy, non-free software, etc. Boring. Fortunately, Lars allowed me to push the patch in git so everybody can give it a try. I'm now waiting for feedbacks in order to know if I will have to maintain this patch outside Gnus, or not. Here's the mandatory screen-shot.

I finally found the time to port the scripts generating these statistics to use the Ultimate Debian Database (and especially its bugs webinterface). Parsing the HTML output of bts.turmzimmer.net was quite insane and slow, but it worked... kind of. However it's now done: The script now uses not that insane SQL queries and UDD, of which I have been told has more accurate numbers as bts.turmzimmer.net, which uses to the best of my knowledge the obsoleted ldap gateway. Well, so much for the talk, here are the actual numbers, created with the new script:

In Total:	799
Affecting Squeeze:	429
Squeeze only:	110
Remaining to be fixed in Squeeze:	319

Of these 319 bugs, the following tags are set:

Pending in Squeeze:	22
Patched in Squeeze:	57
Duplicates in Squeeze:	35
Can be fixed in a security Update:	12
Contrib or non-free in Squeeze:	18
Otherwise fixed in Squeeze:	40

Ignoring all the above (multiple tags possible), 193 bugs need to be fixed by Debian Contributors to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 260 need to be dealt with for the release to happen. You'll note, that the numbers got quite higher. Sorry, for that, but bts.turmzimmer.net seems to be kind of buggy :( You'll also note, that there is no longer a row for claimed and fixed in delayed bugs, as UDD doesn't support these numbers as of now. But I think you'll agree with me, that having more accurate numbers is better than having these rows.

Brian announced it on r-help and r-sig-finance and I have since updated the R/Finance website and Call for Papers page. And as David Smith already outblogged me about it, without further ado our Call for Paper for next spring's R/Finance conference:

Call for Papers: R/Finance 2011: Applied Finance with R
April 29 and 30, 2011
Chicago, IL, USA
The third annual R/Finance conference for applied finance using R will be held this spring in Chicago, IL, USA on April 29 and 30, 2011. The two-day conference will cover topics including portfolio management, time series analysis, advanced risk tools, high-performance computing, market microstructure and econometrics. All will be discussed within the context of using R as a primary tool for financial risk management, portfolio construction, and trading. One-page abstracts or complete papers (in txt or pdf format) are invited to be submitted for consideration. Academic and practitioner proposals related to R are encouraged. We welcome submissions for full talks, abbreviated "lightning talks", and for a limited number of pre-conference (longer) seminar sessions. Presenters are strongly encouraged to provide working R code to accompany the presentation/paper. Data sets should also be made public for the purposes of reproducibility (though we realize this may be limited due to contracts with data vendors). Preference may be given to presenters who have released R packages. Please send submissions to: committee at RinFinance.com. The submission deadline is February 15th, 2011. Early submissions may receive early acceptance and scheduling. Submissions will be evaluated and submitters notified via email on a rolling basis. Determination of whether a presentation will be a long presentation or a lightning talk will be made once the full list of presenters is known. R/Finance 2009 and 2010 included attendees from around the world and featured keynote presentations from prominent academics and practitioners. 2009-2010 presenters names and presentations are online at the conference website. We anticipate another exciting line-up for 2011 including keynote presentations from John Bollinger, Mebane Faber, Stefano Iacus, and Louis Kates. Additional details will be announced via the conference website as they become available. For the program committee:

Gib Bassett, Peter Carl, Dirk Eddelbuettel, Brian Peterson,
Dale Rosenthal, Jeffrey Ryan, Joshua Ulrich

So see you in Chicago in April!

The unofficial rc bug tracker currently knows about the following bugs:

In Total:	371
Affecting Squeeze:	281
Squeeze only:	66
Remaining to be fixed in Squeeze:	215

Of these 215 bugs, the following tags are set:

Pending in Squeeze:	14
Patched in Squeeze:	40
Duplicates in Squeeze:	23
Contrib or non-free in Squeeze:	7
Claimed in Squeeze:	1
Delayed in Squeeze:	3
Can fixed in a security Update:	12
Otherwise fixed in Squeeze:	14

Ignoring all the above (multiple tags possible), 132 bugs need to be fixed by Debian Contributers to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 235 need to be dealt with for the release to happen. Please see my older post for an explanation of the different numbers.

As I'm currently attending the EUgridPMA meeting in Zagreb I thought I'd share a bit of this project I've been working on for the past year: the TCS eScience project. In the scientific world lots of calculations are performed on distributed computing platforms known as grid. Because users of other institutions will be using your hardware, authentication is needed and this problem has been solved with x.509 personal certificates. The problem however, is that these certificates of course have to be issued by some CA. Currently in Europe alone there are over 40 active CA's, even multiple per country, dedicated to this job. They are accredited through the EUgridPMA which meets regularly. For scientists, it's often cumbersome to obtain a certificate: find your local CA, present an ID (probably in person), and sometime later receive your certificate. The process can take days or even weeks. Scientists are not interested in CA's but just want to practice science. Our solution is a central web portal where users can request a certificate and have it delivered in minutes. This leverages the fact that identities of scientists normally have already been vetted at their home institution: users log in to the portal via federated login. Their home institution passes a special attribute that declares "Yes, we have really seen photo ID of this person and the name is correct". This attribute must of course not be passed for guests or test users or role accounts. However, it may still be easy to mass-provision it. In the Netherlands for example, the employer is required by law to verify the identity of each employee, so all employees can be automatically assigned the attribute. After logging in and uploading (or generating) a csr, the request is passed in the back end to the Comodo API. This also means that we do not need to perform the complex operations of running an online CA (with hardware crypto devices, crl's, etc.). The use of Comodo is part of the same deal as the TERENA Certificate Service for host SSL certificates. The Comodo API responds within two minutes with the certificate which the user can download. Currently 10 European countries are involved with the project (nl no se fi dk at cz it fr be), and more have shown interest. The certificates we issue have been accredited by the EUgridPMA so can be used on the grid. A separate but similar service is being set up for 'regular' personal certificates for the academic community, e.g. for s/mime usage. More details are in the presentation and paper by portal software developers Henrik and Thomas at the most recent TNC.

I guess it's time again to push for another band. This time I present you Garbage. I love them, but one has to be careful in what mood one is when listening to them; it's possible that they move you in a direction you don't feel comfortable with at that time.

• Bleed Like Me: If you listen closely to the lyrics of the second verse you might get an idea why had to love that song.
• The World Is Not Enough: One might argue that a band has made it when they do a James Bond title song. This is it.
• Only Happy When It Rains: Probably the best known song from Garbage. Damn fine, great tune and groove for the message it contains.

Enjoy!

/music permanent link Comments: 0

My comment form on my blog contains the following, right above the <textarea> element where the text can be entered:

<!-- To any spammers out there: Any submission to this form is
moderated: this means that only I will see your URLs, and I will not
visit them nor link to them. Thus, you can stop wasting our collective
time. -->

That, combined with the fact that my blog comment system is a home-grown thing, has meant that I haven't seen a single spammy comment anymore in months. The same comment form has shown the same thing since ages in a <p> element right above the <form> element, but that apparently was missed by some spammers. Since adding the above comment, however, I've not received a single spam submission to that form in over a year. Who says spammers are stupid?