Erich blogged that most TV these days is still shot in 4:3 rather than 16:9. At least in the English speaking world this is normally the case, especially for things intended for export. 4:3 would be a deliberate choice rather than the path of least resistance. TV stations can choose to buy and screen 4:3 versions (and will usually do this where they can’t broadcast 16:9) but that doesn’t mean that the production wasn’t done in 16:9. Of course, if there’s no sign that your national broadcasters are going to go to 16:9 this makes very little difference to you. As far as computers go I’ve been using a 16:9 screen for years - I find it useful in much the same way that people find multi-headed displays useful. You can get a bit more on screen at once than you would otherwise which makes it easier to keep an eye on some extra terminals, an IM client or web browser windows. Besides, my glasses mean that the world tends to have a definite widescreen frame to it for me.

ScatterChat is a new cross-platform IM client announced by the Cult of the Dead Cow / Hacktivismo (during the HOPE conference, it seems). From the website:

ScatterChat is a HACKTIVIST WEAPON designed to allow non-technical human rights activists and political dissidents to communicate securely and anonymously while operating in hostile territory. It is also useful in corporate settings, or in other situations where privacy is desired. It is a secure instant messaging client (based upon the Gaim software) that provides end-to-end encryption, integrated onion-routing with Tor, secure file transfers, and easy-to-read documentation. Its security features include resiliency against partial compromise through perfect forward secrecy, immunity from replay attacks, and limited resistance to traffic analysis... all reinforced through a pro-actively secure design.

So the client is a "friendly-fork" of Gaim, it uses Tor to achieve anonymity, and for the crypto parts (secure messaging, secure file transfer) ScatterChat uses libgcrypt. It's a cross-platform application available for Linux, Windows; support for other OSes is planned (Mac OS X, others). You can always download the source code, of course, as it's free software. Actually, not quite. While ScatterChat itself is based on the GPL'd Gaim, it has to be GPL'd, too. However, the scatterchat-module package, which seems to contain the crypto-parts, is licensed under a custom "Hacktivismo Enhanced-Source Software License Agreement" (HESSLA) right now, which is so horribly long I didn't even bother reading it. However, the README says:

I am open to the possibility of re-licensing parts of this library to GPL, BSD, public domain, or some other license. I cannot make any promises, but I will try to accomodate reasonable requests.

I'm going to do just that, email the author and ask him nicely to change the license to some sane, well-known free software license. If you feel similar, please let the author know (hint, hint). Depending on what the HESSLA really says, it might prevent ScatterChat from entering Debian, for example. I haven't yet tried to use the application, but it sure looks like it has a lot of potential. It also seems do most security-related things right:

• it doesn't try to reinvent/reimplement its own crypto primitives (which would be doomed to fail), but rather uses libgcrypt
• it has a documented crypto protocol
• it's free software, which is a major requirement (see Kerckhoffs' principle)
• it doesn't reinvent the wheel, but rather uses Tor for anonymity (for example)
• etc. etc.

Of course that's no guarantee that it's secure; I hope some crypto-gurus look over it soon. But at least they didn't make obvious stupid mistakes we've all seen in many other pieces of software. Anyways, I feel this is a real important project which will help lots of people (activists, political dissidents, normal people like me and you who value their privacy). Go check it out! (via Boing Boing)

Today I did a new upload of Splashy to experimental. If all goes fine, I will upload a new package moving it to unstable. This version is basically a bugfixing version. There’s some issues to solve before it hits Etch but we’re doing a great job solving its bugs fast and I believe that we’ll be able to make it. Would be great if any artist might get our current Debian theme and improve it. There’s some small issues to solve there. Next upload will set it as default theme too.

So, some interesting things happened since I last reported. TurboGears finally entered experimental, and has received a bit of good feedback from some users; I became sqlobject co-maintainer, and packaged a svn snapshot to experimental to make that happen, too. TG 0.9a8 has just been uploaded, btw. Feedback would be great! I would welcome people willing to help on deciding the best way and doing packaging of TG add-on widgets. In other news, I've been doing some last feature aditions to libgksu and gksu. The former now ships a gksu-properties capplet that allows users to set up some of the behavior. The gconf options and this capplet surely need some love, but they'll get it in the future. After the "redesign" libgksu now holds almost all the code that does the gksu magic, and should be more secure in some ways. The application, gksu, ships a nautilus extension, which adds a 'open as administrator' item in the context menu for files and directories in Nautilus. I'd love to receive feedback and buf reports on this new feature. Right now the nautilus extension uses the gksu application, instead of the library, since there seems to be problems with doing async calls of libgksu inside of another main loop, or something, and I could not get it to work. The gksuexec application, which provided the 'Run as another user' menu item has been removed in these last versions. Will anyone miss it? I'm willing to have this functionality implemented in gksu itself, if needed, but I'm not sure it's that useful.

Following about a month of irregular activity, I just uploaded three source packages (along with related binary packages, of course) to Debian unstable: gforge (4.5.14-9), gforge-plugin-scmcvs (4.5.14-3), and gforge-plugin-scmsvn (4.5.14-2). I hope unstable will give them more exposure than experimental did. Plans for the future: I’ll focus on getting these packages into testing, without too many changes if possible. I haven’t managed to get dbconfig-common to work reliably (or at all) with PostgreSQL so far, so I’ll consider the migration to its infrastructure as a nice option, but not a blocker. The problem is that it would make the install scripts simpler and (hopefully) more reliable if it worked. Again, help would be very much appreciated. (And yes, I will be submitting bug reports when I get some time to do some more thorough testing of dbconfig-common.)

Ah, the classic DBus performance issue has reared it's head on Planet Gnome again. I'll chip in my thoughts on this, as I've done a fair bit of profiling on a large user of DBus. When I first ported of EDS to DBus, it didn't perform as fast as the original ORBit implementation. However when I dug out OProfile I discovered that the main bottle necks were deep in EDS itself, and DBus although in the profiles, wasn't anywhere near the top. We spent a few months optimising EDS-DBus (there was some serious low-hanging fruit) and by the time we'd done the obvious optimisations, EDS-DBus was faster than upstream EDS for the typical usage (running a book view, which happens every time you search in Evolution). For some methods EDS-DBus was still slower than EDS, and getContacts() is a perfect example. This method takes a query, builds the set of contacts that match, and sends it back to the client in a single list (compared to book views that do the same thing incrementally, and provide future updates). When profiled you discover that libdbus and libc are the top offenders, taking almost 70% of the runtime. The benchmark was asking for all contacts, so EDS-DBus was sending a 150 contacts as vCards over the bus in a single list, which amounts to about 100Kb of data. Now, this gets copied when it enters the library, copied again as it enters the sockets to the bus, which then sends it into another socket to the client, which then makes a copy. These copies really hurt, and are one of the things that ORBit does better than DBus: it copies less frequently and has generally had more optimisation time. There are several ways of making it better.

• Those nice people at Collobara have batshit insane cunning plans for a SHM-based transport, instead of sockets. This would reduce the number of copies, but does introduce some, well, interesting locking fun.
• Almost half of the copies could be removed by creating a private connection between the client and the server, missing out the bus entirely. I plan on doing this for the book views as they are heavily used and the bottleneck is, again, the copies.
• Obviously, heavily profiling and optimising libdbus to remove any redundant copies would help. There may be cunning ways to avoid some of the copies for certain situations, and allowing those to happen in the GLib bindings would be useful.

In conclusion, the DBus vs ORBit performance issue isn't a real one generally. It's a rare case where the cost of the transport is the bottleneck (generally only in fake benchmarks), and when the transport is the bottleneck, there are generally other ways of optimising the code: as Havoc says DBus makes doing true asynchronous method calls trivial, and if you are sending huge amounts of data down the bus a private connection should be used (which will also make you a nicer citizen on the bus, as sending huge messages will clog up the tubes). NP: Kind Of Blue, Miles Davis

Thanks to Faidon Liambotis for his nice patch, and Javier Fernandez-Sanguino Pen~a for accepting it we now have a cron which will no longer execute core files. Another small step towards improving security in Debian GNU/Linux!

So the flight to Sydney was relatively uneventful. I managed to get a reasonable amount of sleep, and with the assistance of some Coke, I've managed to stay awake and will probably last until a reasonable bed time for this time zone. The general suckiness is because they managed to lose my bag. I feel totally naked without a functional mobile phone. My work one isn't roaming for some reason (it seems to be the phone itself, and so I'm assuming it's a GSM900 thing), and my personal Australian one is in the lost bag. Then I discovered that United didn't take the I-94 out of my passport when I checked in, so that's probably going to cause me all sorts of immigration grief when I return to the United States.

If I were to purchase a USB (or PS/2) based barcode reader is there magical software which will read the ISBN and search Amazon for book + film + music details?
So far I've just seen alexandria which does only books.
Whilst I have a lot of books I'd be interested in scanning audio-cds and dvds too.
Update: maybe I'm wasting my time already. Alexandria fails to find both the following ISBN numbers: 1-85471-227-6 + 0-7088-1358-5.

Last night's CC Salon in Montreal went extremely well. I spent the time haranguing Marcus and Tina Pipers (the co-director of Creative Commons Canada) about the evils of anti-DRM clauses in licenses. (See Free content and DRM for my opinionated take on this matter.) Apparently there was a lot of talk about this at the iCommons summit in Brazil. Amita June enjoyed the noise and attention and spent an inordinate amount of time patting one hacker's very long beard. We'll see what kind of psychological symptoms that develops into later. tags: cc cc salon montreal marcus bornfreund tina pipers cc ca drm

Ben Macintyre on Wiki It was kind of tiring to see Ben Macintyre's note on How wiki-wiki can get sticky in The Times Online.

• Many years ago, I wrote a book about a Victorian crook called Adam Worth, a subject so obscure that no one had ever written a book about him before, or since. When I found an entry for Worth on Wikipedia, I was at first astonished, then flattered to find the book cited in the references, and then slightly infuriated: whoever had written the entry had plainly read my book and summarised it, but added several small but irritating errors.

Wikipedia isn't perfect and contains some errors? Oh, really? Boo hoo hoo. Yawn, turn the page. Wait, though; what's that last paragraph say?

• At first, I ignored the mistakes. This was only Wikipedia, after all. But the landscape of knowledge has changed since then, and I have joined the club. Wikipedia should always be taken with a pinch of salt. But the more we contribute and revise, the less salt we will need. We are all Wikipedists now.

Huh. A mainstream journalist who realized the way to deal with errors in Wikipedia is to fix them? Am I dreamin'? tags: wikipedia wiki media ben macintyre adam worth

Lately we are looking at groupware options, and have been looking at Scalix and Zimbra. We may need the features in the proprietary versions of these products, unfortunately.

So I downloaded an evaluation copy of Scalix.

They say they support RedHat and SuSE. Fine, I think, I'll just alien the RPMs to debs and be happy.

Not so fast. They have a whole proprietary install system. They check for /etc/redhat_release or /etc/SuSE_release (or something like that) and do different things depending on what is there. Ugh. Why can't these proprietary vendors just target LSB? The differences seem mostly related to init anyway.

So I touch /etc/SuSE_release into existence, run the installer again. It complains that DISPLAY is not set. UGH. I log in with ssh forwarding, to root (sigh), and run it again.

Now it complains that the SuSE_release file doesn't contain a valid release. I google a bit, but the file format doesn't seem to be documented anywhere. I extract it from an RPM somewhere, but no luck.

So, I figure at this point, let's try an actual RPM distro. I'm running this in a Xen domain anyway, so it should be no big deal, right?

I think CentOS will be a good choice. It's RHEL with the non-free stuff stripped out. And they support RHEL and don't need any non-free stuff. I google, and find instructions for installing via rpmstrap for Xen uses.

Let me say, rpmstrap is not nearly the nice tool that cdebootstrap is. rpmstrap totally hosed the networking on the Xen host machine, requiring me to reboot to get it back to proper state. The resulting install wouldn't boot, either -- I later found out that, even though I listed explicit devices in /etc/fstab like usual, it requires labels on all my partitions to boot. Ugh. There are a host of other problems with the rpmstrap-installed chroot, and it's broken beyond my ability to repair due to problems with the rpm database.

So then I downloaded the "Server" CD for CentOS, which is supposed to have just the stuff a person would need for a server, and leave off all the graphical tools, multimedia, etc. I fired up VMware and did an install. Then I booted Debian From Scratch in VMware and used tar and netcat to copy the installed image over to Xen.

I got it booting fairly easily. But now I start to remember why I had this instinctive gag reflex last time I used RHEL.

First off, the network configuration, by default, is tied to the MAC address of your ethernet card. So if you replace your Ethernet card, your network is broken by default.

Then, there's the way the network is brought up. It uses arping as part of its procedure to bring up a NIC. If it sees a reply anywhere on the network with the IP you're trying to assign, it leaves the NIC half-up -- it's been ifconfig'd up, but without an IP. So that's right, if somebody happens to have a rogue device plugged in at the moment your server boots, your server will come up without a network configured. This is *Enterprise* Linux and it's pulling this sort of thing. Terrible design.

Next, there's the way the network is *configured*. There are commands such as system-config-network-tui, -gui, -cmd, -druid, etc. I go for -tui. to start with. It's a dialog-like interface, and asks the basics like IP address, etc. It doesn't have any way to configure more than one Ethernet card that I can tell. And some of the settings -- like nameserver -- apparently require you to press F12 to visit. But the program doesn't recognize F12 as sent by an xterm, so it doesn't work.

All the other options require X. So, I reluctantly ssh -X into it as root and run system-config-network-gui. It doesn't work -- complains it can't find DISPLAY. Strange, I think; DISPLAY is set properly to localhost:whatever. It turns out that /etc/hosts is empty by default, so the thing can't resolve localhost! Argh. I add a line to /etc/hosts and it fires up.

This tool works decently. I save, uncheck the tie to a MAC address box, and exit. I then think it might be good to fire it up again and see what it did. I try running it again, and get the same error about DISPLAY. The stupid tool blew away /etc/hosts and replaced it with an empty file! This is NOT what I would expect from an Enterprise Linux. You don't blow away a config file the administrator touched without asking, EVER.

Next, I figure, let's try installing the XFS tools so I can switch the root filesystem to xfs. I start with "yum update", which doesn't quite do what I expect. (It is more like apt-get update && apt-get -u dist-upgrade) So I hit Ctrl-C, but -- surprise -- IT DOESN'T WORK. I press it a few more times, and it seems to just make the downloader cycle through mirrors because of a "download error". So I hit Ctrl-Z and kill %1. I have my prompt, but it's STILL DOWNLOADING STUFF and spewing all over my console. Ugh.

I finally use ps and kill -9 and eventually get it killed off. Stupid thing.

I don't understand why anybody would want to use RedHat Enterprise Linux in an enterprise. It seems more suited to a hobbyist system at home. From reading some forums, it seems there are quite a few people out there using Debian for enterprise systems for similar reasons.

So now, maybe I'll have the chance to actually try Scalix.

(BTW, our intern got Zimbra installed on Debian just fine, so that's a plus for it.)

At home I run an Ubuntu server which I unfortunately upgraded to the sigh Edgy Eft. Damn, I used to think Debian unstable was unstable! On the couple of occasions the machine wasn’t broken, I stupidly did a dist-upgrade. When will I learn? Perhaps I like to “repair” a broken system to learn more about my system. Who knows. Anyway the last dist-upgrade with X failing to start with some “fixed font” error, had me thinking about rolling back updates. As far as I know, downgrading to dapper requires some precarious apt pinning and some praying. I should try that. Rolling back and comparing with old versions could be easier. Of course there is the great resource of Debian snapshot though I usually just download the package I require by hand. I could try set it up with apt, but I highly doubt down grades work with wild inter-dependencies like the X server suite. Anyway it could be better integrated. Like a version control system, without the conflicts. ;) I can’t help but think why should my box ever be broken? If an upgrade b0rked, why doesn’t it just go back to the last working snapshot? Oh well, we’re still miles ahead of Windows update. Though having to restart firefox is almost as disruptive as rebooting the entire system.

Finally, after 6 month or so, new updated packages for tuxtype and tuxmath are available. Due to the much appreciated summer heat, I will not go into more detail, especially as I already announced this to the debian-edu mailinglist. Instead I'm going out in the even more appreciated rain now ;-)

Dear etch-a-sketch-lovers. Or basically, anyone who cares about etch hopefully being released in december. If you aren't busy with fixing RC bugs, probably because you don't trust your own skills enough (or don't have upload privileges, or are taking a break of your favourite BSP) - how about working on Debian artwork? Ubuntu is working on their artwork for Edgy. I'd love Debian to have (optionally) some cool Debian look. I mean, we'll probably be never as polished as Ubuntu artwork-wise, but we sure could do a lot better than now. That is, do at least something... You don't need to be a DD to work on this. You can just use the existing linux theming web pages such as art.gnome.org, Gnome-look.org and KDE-look.org to share your artwork, and maybe use the Debian Wiki to coordinate your efforts. If enough people are interested, you probably can organize a mailing list, too. P.S. Although the release will be codenamed "etch", there is no need to make the default desktop look like an etch-a-sketch. Just make it something smooth... ;-) [Update: The EtchGNOME status page lists "update desktop-base" as work in progress. This is where the artwork will be "deployed". However, KDE and XFCE integration is still a bit lacking apparently.]

I have made it to South Africa and the official part of the Law and Society conference has come, sadly, to an end. It has been an amazing experience for reasons that deserve a lot more attention than I have right now so I will wait to write some about it when I have more time. But before I forget, Lars has been thoughtful enough to put the Debian History Roundtable Discussion on the Debian Wiki. I organized this roundtable at Debconf4 and while there is a good chunk of information from the discussion, there is a lot missing and perhaps even wrong, so please make changes and additions.

If I were to purchase a USB (or PS/2) based barcode reader is there magical software which will read the ISBN and search Amazon for book + film + music details? So far I’ve just seen alexandria which does only books. Whilst I have a lot of books I’d be interested in scanning audio-cds and dvds too. Update: maybe I’m wasting my time already. Alexandria fails to find both the following ISBN numbers: 1-85471-227-6 + 0-7088-1358-5.

It’s strange to follow state of minds of big companies about open source (they rarely speak about Free Software but that’s another story;-)). Dalibor Topic, Mark Wielaard and all friends from GNU Classpath spent a lot of time talking with Sun to try to open source Java (or even just be able to get the tools to make open source java virtual machines and API). They are some moves in that direction and people like Tom Marble is working hard to make Sun’s JDK license DFSG compatible and integrate Sun’s JDK in the Debian distribution. Robert Brewin, co-CTO of Sun Microsystems’ software group, said: “I believe that we will have components of Java released into open source within the year,” meaning by next June, Brewin said. “I think [release of] the whole thing will take a little bit longer.” One more step. Another amazing interview is the one of David Kaefer, director of Business Development, Intellectual Property and Licensing at Microsoft who called the open source software movement a “very powerful force in the industry.” He also wants us to believe that Microsoft will be more and more open… Wait and See

Happy 1 Thermidor to everyone -- I'm sure you're all busy meditating on the virtues of epeautre (wp:einkorn wheat), the wild grain to which this day is dedicated on the French Revolutionary Calendar. Thermidor is best known for wp:Lobster Thermidor, but also for the so-called wp:Thermidorian Reaction, a revolt by moderate revolutionaries during the French Revolution against the bloody excesses of the Committee for Public Safety. I think about this because I've just been reading Bob Sutton's blog today based on the reference in Ross Mayfield's blog. Sutton is the author of an upcoming book called the No Asshole Rule (pardon my French, but that's just the name of the book). It's about how poisonous, unhealthy personalities can ruin a workplace, and how beneficial it is to support your reasonable, human employees by kicking out the jerks. They're happier, more productive, and more loyal if you show some compassion and get rid of the a-holes. Coincidentally, I also saw the Top 5 reasons why The Customer Is Always Right is wrong on reddit. It also recommends against allowing unpleasant people to ruin your workplace environment -- but here, the culprits are the customer, not other employees. I especially liked the stories from Southwest Airlines. I think I'm going to have to pick up this Nuts! book about SWA business theories. Why all the thoughtifying about jerks and meanies in business? Because I think the same principles might be applicable to Open Source and Open Content projects. Specifically, with Debian, we've had a few personalities who generate a lot of discussion and attract a lot of attention, causing some real Excedrin headaches. The project as a whole has tended to bend over backwards to respect these individual's rights and personal values and blah blah blah, but maybe it's best to just say, "You're causing more conflict that you are providing value and no matter whose fault it is, we as a group will do our job better if you leave." In another realm -- that of wikis -- I know that I personally lean on longtime Wikitravel administrators, experienced users, etc. to be "the bigger person" and treat obnoxious personalities with respect and decorum. The theory is that every user counts, and any contribution is worthwhile. But maybe it's better sometimes to show some loyalty to the established contributors with a proven track record, and let the occasional mouth-foaming weirdo go wander off and bother someone else. We've got a real conflict-averse culture at WT, but sometimes it might be good to say, "We welcome everyone's input -- except yours." tags: thermidor wiki ross mayfield no assholes rule bob sutton the customer is always right southwest airlines debian wikitravel conflict