X11R7.6 got released on the 20th of December 2010. There were several status updates about XServer 1.9 in experimental on this blog previously, but here s a more thorough review of this katamari. Terminology: that s how upstream calls a badged annual rollup release. In other words, the server, drivers, client libraries, protocols, fonts, and basic applications are all individually released, and a rollup of all those is released from time to time, with a version for all of those components. The term comes from a series of video games. (Explanations taken from a message by Alan Coopersmith.) Katamaris are released with a consolidated changelog, where all components and versions are listed. There s also a git shortlog available for each component, pointing back to freedesktop s git web interface for each and every commit. I modified the table of versions to get the following table, dropping the X11R7.5 column, and adding a distribution one, so as to mention where each component for X11R7.6 can be found. It boils down mostly to:

• almost all drivers are available in experimental, built against XServer 1.9.
• libraries with heavy changes went to experimental while those with fixes and low-impact changes went to unstable.
• protocols went to unstable, they can t really break anything.
• applications don t matter too much anyway, most of them could be considered like toys. Some went to experimental, others went to unstable.
• fonts were skipped in this table, they are pretty much boring.

So there s the summary:

Type	Component	Version	Distribution
	xserver	1.9.3	experimental
app	bdftopcf	1.0.3	unstable
app	iceauth	1.0.4	experimental
app	luit	1.1.0	experimental
app	mkfontdir	1.0.6	unstable
app	mkfontscale	1.0.8	unstable
app	sessreg	1.0.6	unstable
app	setxkbmap	1.2.0	experimental
app	smproxy	1.0.4	experimental
app	x11perf	1.5.2	experimental
app	xauth	1.0.5	unstable
app	xbacklight	1.1.2	will be dropped
app	xcmsdb	1.0.3	experimental
app	xcursorgen	1.0.4	experimental
app	xdpyinfo	1.2.0	experimental
app	xdriinfo	1.0.4	experimental
app	xev	1.1.0	experimental
app	xgamma	1.0.4	experimental
app	xhost	1.0.4	experimental
app	xinput	1.5.3	unstable
app	xkbcomp	1.2.0	experimental
app	xkbevd	1.1.2	experimental
app	xkbutils	1.0.3	experimental
app	xkill	1.0.3	experimental
app	xlsatoms	1.1.0	unstable
app	xlsclients	1.1.1	experimental
app	xmodmap	1.0.5	experimental
app	xpr	1.0.3	will be dropped
app	xprop	1.2.0	experimental
app	xrandr	1.3.4	experimental
app	xrdb	1.0.7	experimental
app	xrefresh	1.0.4	experimental
app	xset	1.2.1	experimental
app	xsetroot	1.1.0	experimental
app	xvinfo	1.1.1	experimental
app	xwd	1.0.4	experimental
app	xwininfo	1.1.1	experimental
app	xwud	1.0.3	experimental
data	bitmaps	1.1.1	unstable
data	cursors	1.0.3	unstable
doc	xorg-docs	1.6	unstable
doc	xorg-sgml-doctools	1.6	unstable
driver	xf86-input-acecad	1.4.0	experimental
driver	xf86-input-aiptek	1.3.1	experimental
driver	xf86-input-evdev	2.5.0	experimental
driver	xf86-input-joystick	1.5.0	experimental
driver	xf86-input-keyboard	1.5.0	experimental
driver	xf86-input-mouse	1.6.0	experimental
driver	xf86-input-synaptics	1.3.0	experimental
driver	xf86-input-vmmouse	12.6.10	experimental
driver	xf86-input-void	1.3.1	experimental
driver	xf86-video-apm	1.2.3	experimental
driver	xf86-video-ark	0.7.3	experimental
driver	xf86-video-ast	0.91.10	dropped
driver	xf86-video-ati	6.13.2	experimental
driver	xf86-video-chips	1.2.3	experimental
driver	xf86-video-cirrus	1.3.2	experimental
driver	xf86-video-dummy	0.3.4	experimental
driver	xf86-video-fbdev	0.4.2	experimental
driver	xf86-video-geode	2.11.10	todo: needs upload
driver	xf86-video-glide	1.1.0	experimental
driver	xf86-video-glint	1.2.5	experimental
driver	xf86-video-i128	1.3.4	experimental
driver	xf86-video-i740	1.3.2	experimental
driver	xf86-video-intel	2.13.0	experimental
driver	xf86-video-mach64	6.8.2	experimental
driver	xf86-video-mga	1.4.13	experimental
driver	xf86-video-neomagic	1.2.5	experimental
driver	xf86-video-newport	0.2.3	todo: needs upload
driver	xf86-video-nv	2.1.18	will be dropped
driver	xf86-video-r128	6.8.1	experimental
driver	xf86-video-rendition	4.2.4	experimental
driver	xf86-video-s3	0.6.3	experimental
driver	xf86-video-s3virge	1.10.4	experimental
driver	xf86-video-savage	2.3.1	experimental
driver	xf86-video-siliconmotion	1.7.4	experimental
driver	xf86-video-sis	0.10.3	experimental
driver	xf86-video-sisusb	0.9.4	experimental
driver	xf86-video-suncg14	1.1.1	experimental
driver	xf86-video-suncg3	1.1.1	experimental
driver	xf86-video-suncg6	1.1.1	experimental
driver	xf86-video-sunffb	1.2.1	experimental
driver	xf86-video-sunleo	1.2.0	experimental
driver	xf86-video-suntcx	1.1.1	experimental
driver	xf86-video-tdfx	1.4.3	experimental
driver	xf86-video-tga	1.2.1	experimental
driver	xf86-video-trident	1.3.4	experimental
driver	xf86-video-tseng	1.2.4	experimental
driver	xf86-video-v4l	0.2.0	dropped
driver	xf86-video-vesa	2.3.0	experimental
driver	xf86-video-vmware	11.0.3	experimental
driver	xf86-video-voodoo	1.2.4	experimental
driver	xf86-video-wsfb	0.3.0	dropped
driver	xf86-video-xgi	1.6.0	dropped
driver	xf86-video-xgixp	1.8.0	dropped
font	fonts skipped
lib	libAppleWM	1.4.0	not for us
lib	libFS	1.0.3	unstable
lib	libICE	1.0.7	unstable
lib	libSM	1.2.0	unstable
lib	libWindowsWM	1.0.1	not for us
lib	libX11	1.4.0	experimental
lib	libXScrnSaver	1.2.1	unstable
lib	libXau	1.0.6	unstable
lib	libXaw	1.0.8	unstable
lib	libXcomposite	0.4.3	unstable
lib	libXcursor	1.1.11	unstable
lib	libXdamage	1.1.3	unstable
lib	libXdmcp	1.1.0	unstable
lib	libXext	1.2.0	experimental
lib	libXfixes	4.0.5	unstable
lib	libXfont	1.4.3	experimental
lib	libXft	2.2.0	experimental
lib	libXi	1.4.0	experimental
lib	libXinerama	1.1.1	unstable
lib	libXmu	1.1.0	unstable
lib	libXpm	3.5.9	unstable
lib	libXrandr	1.3.1	unstable
lib	libXrender	0.9.6	unstable
lib	libXRes	1.0.5	unstable
lib	libXt	1.0.9	experimental
lib	libXtst	1.2.0	unstable
lib	libXv	1.0.6	unstable
lib	libXvMC	1.0.6	unstable
lib	libXxf86dga	1.1.2	unstable
lib	libXxf86vm	1.1.1	unstable
lib	libdmx	1.1.1	unstable
lib	libfontenc	1.1.0	unstable
lib	libpciaccess	0.12.0	unstable
lib	libxkbfile	1.0.7	unstable
lib	libxtrans	1.2.6	unstable
proto	applewmproto	1.4.1	not for us
proto	bigreqsproto	1.1.1	unstable
proto	compositeproto	0.4.2	unstable
proto	damageproto	1.2.1	unstable
proto	dmxproto	2.3	unstable
proto	dri2proto	2.3	unstable
proto	fixesproto	4.1.2	unstable
proto	fontsproto	2.1.1	unstable
proto	glproto	1.4.12	unstable
proto	inputproto	2.0.1	unstable
proto	kbproto	1.0.5	unstable
proto	randrproto	1.3.2	unstable
proto	recordproto	1.14.1	unstable
proto	renderproto	0.11.1	unstable
proto	resourceproto	1.1.1	unstable
proto	scrnsaverproto	1.2.1	unstable
proto	videoproto	2.3.1	unstable
proto	windowswmproto	1.0.4	not for us
proto	xcmiscproto	1.2.1	unstable
proto	xextproto	7.1.2	unstable
proto	xf86bigfontproto	1.2.0	unstable
proto	xf86dgaproto	2.1	unstable
proto	xf86driproto	2.1.0	unstable
proto	xf86vidmodeproto	2.3	unstable
proto	xineramaproto	1.2	unstable
proto	x11proto	7.0.20	unstable
util	makedepend	1.0.3	unstable
util	macros	1.11.0	unstable
xcb	pthread-stubs	0.3	unstable
xcb	libxcb	1.7	experimental
xcb	proto	1.6	unstable

So David Watson and Michal iha are doing Project 52 this year? Well, lemme in ;)Actually, me and some friends were doing so the last year already and we will to continue this year too. We re calling it wir knipsen! which translates into English as we snap! .This week my contributions look like this:
Yepp, these are three images as these are our rules: three pictures every week :)Hope you enjoy them and don t forget to have a look at the other pictures at wirknipsen.de.

Otavio Salvador requested early testers for squeeze debian-installer rc1. (This paragraph will be edited once the official announcement is published.) Graphical installer snapshots A few snapshots follow, using various non-Latin languages to make sure rendering was doing fine.

• Sinhala, prompting for the root password:
• Thai, prompting for popularity-contest configuration:
• Traditional Chinese, prompting for the non-privileged user s name:
• Japanese, loading d-i components from the CD-ROM:
• Hindi, prompting for a hostname:

To avoid any manual drawing, tiny imagemagick magick for the snapshots cropped to 800x300:

convert cropped-snap.png -fill none -stroke black -draw \
    "stroke-dasharray 10 10 path 'M 0,299 L 800,299'" dashed-cropped-snap.png

X/experimental + g-i = ? Premises:

• Fetch libxfont1-udeb, xserver-xorg-core-udeb, xserver-xorg-input-evdev-udeb, xserver-xorg-video-fbdev-udeb from experimental.
• Store them under localudebs/ in a d-i build tree.
• Build a netboot-gtk image with: make rebuild_netboot-gtk
• [Optional: Be amused by the not so tiny CD image that boots the graphical netboot installer parameter to the update-manifest command.]

Result:

X/experimental + g-i = Win

Proof: Comments:

• It looks like we managed not to break the X-related udebs in experimental, even by jumping directly from 1.7 to 1.9. \o/
• Yes, Christian, I managed to highlight French in some way in this blog post. ;)

For some reason, I don t really know why, I decided to switch my keyboard layout over to something weird. No, not the french brainfuck :) that is actually possible to type on in a halfway acceptable speed (shutup Bubulle), but the Neo thing for german keyboards. Hell. I didn t know how slow one can be typing. About a letter in 3 seconds, or something like it. I think, we should add something to our mandantory set of rules for anyone on any Debian Mailinglist: Whenever a flamewar starts, everyone who participates has to switch their keyboard layout to a random new layout. For every paragraph of every mail they write. Would stop the thread before it really happens. Ohwell, lets see where I stand in a week/month from now. Maybe I can actually use it then. And maybe I really type with 10 fingers then, and not something like the 3 til 8 i currenly use (depends on moon phase how many, i think). I m not slow with my current system, far from it, but I do sometimes have pain in my hands. Maybe that goes away too if I adopt something better, with less weird hand/finger movings. Though the way over will be painful in itself.

Update: Ulrich mru Dangel suggested pdnsd as nice alternative to dnsmasq and Cyril KiBi Brulebois pointed out, that it s not necessary to invoke dnsmasq after fresh installation as it s running by default then I adjusted the text accordingly, thanks for the pointers! If /etc/resolv.conf doesn t provide any nameserver entries glibc[1] will automatically initialize the nameserver to the loopback address. This is nice for dealing with chroots without having to manually edit resolv.conf to get working DNS. Just install a basic DNS forwarder like dnsmasq ( apt-get install dnsmasq ) or if it s already on your box just start it ( /etc/init.d/dnsmasq start ). That s it. Now when chrooting into a system without an existing resolv.conf configuration it will give you a working DNS setup without any further work. PS: Grml ships dnsmasq by default and /etc/init.d/dnsmasq start or Start dnsmasq will work out-of-the box. In Ubuntu the dnsmasq package is available only through the universe repository but the dnsmasq-base package (providing e.g. the init script) is shipped by default, so replace the /etc/init.d/dnsmasq command with a simple dnsmasq there. [1] At least the [e]glibc versions provided on Debian and Ubuntu are known to provide this glibc extension. Other libc implementations like dietlibc and uclibc don t seem to provide it, so don t strictly rely on this feature but use it as the icing on the cake.

Assigning an IP address statically to a host with a given MAC address using ISC dhcpd is quite trivial, one host entry, a hardware ethernet entry and a fixed-address entry and you are up and running.
But what if you want to assign IP addresses from a pool to only a few hosts with specific MAC addresses?

Before you ask yourself why someone might want to do that, have a look at my (very real) use-case.
I am currently working on setting up an installation server for my employer, ANEXIA Internetdienstleistungs GmbH. The server itself uses PXE, TFTP and FAI for installing systems. To be able to do PXE booting one has to set up an DHCP server to provide configuration details, like the TFTP Server Address and the boot filename.

Now what one should consider is that this system is designed to provide automatic installations for internet-facing hosts, namely ones in public IP networks. Running a DHCP server in such a network is not a good idea. We neither want to dish out configurations to each and every hosts that asks for them, neither do not want to do a PXE boot each and every time one of our systems is restarted. Now the combination of FAI and pxelinux allows for default configurations which force local booting, but this still causes the (re-)boot time for those systems to increase and potentially also increases the load on the TFTP server. Also, let's not even consider thinking about whether this setup is "clean" or not. I personally believe that dishing out IP addresses in a public IP network is a bad thing(tm) and I guess a lot of people will be nodding when reading these lines.

What I was asking myself is how to get something like that set up in a cleaner way, and guess what, I found a solution.
The basic idea behind this is only providing IP configuration via DHCP to a specific set of hosts (with a specific set of MAC addresses) and not providing any information to all other hosts. The specific set of hosts are those that we want to do an install run on. This is a no-brainer and I guess the right way to do that, but implementing this approach is not as straight-forward as I initially thought.

Actually the implementation of that idea caused me a bit of a headache and cost me a few work-hours to get right, that's why I'd like to share the configuration details with you.



Let's have a look at how to get such a setup using ISC dhcpd. We are using the fact that ISC dhcpd allows you to not only configure a subnet, but rather also pools inside subnets, which can have allow and deny rules. Such rules can be in the form of "allow/deny member of <class>", where classes (and subclasses, keep on reading for details) can be defined inside the configuration file as well.</class>

What we first did was creating a subnet with a pool declaration, as follows:

subnet 10.0.0.0 netmask 255.255.255.0

option routers 10.0.0.254;

option broadcast-address 10.0.0.255;

filename "fai/pxelinux.0";

next-server 10.0.0.254;

server-name "10.0.0.254";

pool

allow members of "install";

range 10.0.0.10 10.0.0.230;

This one configures the subnet 10.0.0.0/24, with 10.0.0.254 being the network gateway, 10.0.0.254 being the TFTP server and "fai/pxelinux.0" being the TFTP filename. Additionally pool allows us to define a range of IP addresses we want to use, along with a line stating that only members of the "install" class should get a network configuration. If you do not have any other subnet defined in your config and a client that is not in this "install" class asks for an IP address you will see something like this in your syslog: "dhcpd: DHCPDISCOVER from 11:22:33:44:55:66 via eth1: network 10.0.0/24: no free leases". dhcpd will not even answer these requests and thus the client will not even know that there is a DHCP server running here. Exactly what we wanted.

I wrote about this giving me a headache, but so far things have been pretty straight-forward. Getting this far did not take very long, believe me.

Next thing we did was defining that "install" class as follows:

class "install" match hardware;

Again, not very hard to do. This tells dhcpd to look for subclasses of "install" with a matching hardware-address. So let's have a look at the subclass for, let's say the host with MAC address "11:22:33:44:55:66":

subclass "install" 1:11:22:33:44:55:66;

I intentionally highlighted the leading "1:" there. This means nothing more or less than "ethernet". Without that leading "1:" you won't get anywhere. Matching will fail, simple as that. It took me a while to find information about this in "man 5 dhcp-eval". Quoting parts of the interesting section:

The hardware operator returns a data string whose first element is

the type of network interface indicated in packet being considered,

and whose subsequent elements are client s link-layer address. [...] Hardware types include ethernet (1), token-ring (6), and fddi (8).

Now, with the combination of the subnet, pool, class and subclass directives we could get the setup we wanted: a DHCP server only providing IP configuration to a specific set of hosts and ignoring all other DHCP requests.

If you have any comments about this setup or ideas on how to get something similar set-up using another approach feel free to leave a comment.

Personal final note: accidentally typing 80 instead of 08 in a MAC address will cost you an additional two hours and will even have you re-compile ISC dhcpd with eval debugging turned on, believe me. :-)

Dear Lazyweb, Today I bought me a Canon IXUS 130 and was quite disappointed to see that it couldn t properly connect to my Debian/Sid machine via USB. Apparenty the camera is not recognized as a USB Mass Storage Device but utilizes PTP. I upgraded to libgphoto2 (2.4.10.1-3) from experimental and added a proper udev rule with vendor- and product-id but it did not help. Is there anything more I can try? Update: Accessing the camera actually works, even with ligbphoto2 (2.4.6) from unstable. I can access the camera with gphoto2 and download pictures (but not with KDE s filemanager). My problem was that I had rhythmbox running and the camera was automatically mounted by it as a media device. When KDE s filemanager or gphoto2 tried to access the camera I got an error like: ( Could not lock the device ): Camera is already in use., which is probably also a bug. Closing rhythmbox solved the issue and I was able to download images with gphoto2.

So yesterday I mentioned the mod_rewrite-compatible proxy server. Today I've spent several hours getting to grips with that. I've progressed far enough along that the trivial cases are handled, as the following test case shows:

void
TestParamteredMatch (CuTest * tc)
 
    /**
     * We pretend this came in via the network.
     */
    char *request = "GET /login/steve.kemp/secret#password HTTP/1.1\n\n";
    /**
     * This is the mod_rewrite rule we're going to test.
     */
    char *rule    = "RewriteRule
                       ^/login/(.*)/(.*)/*$
                         /cgi-bin/index.cgi?mode=login;lname=$1;lpass=$2";
    int res = 0;
    /* Parse the HTTP request */
    struct http_request *req = http_request_new (request);
    CuAssertPtrNotNull (tc, req);
    /* Ensure it looks sane. */
    CuAssertStrEquals(tc, "/login/steve.kemp/secret#password", req->path );
    /* Create the rewrite rule */
    struct rewrite_rule *r = rewrite_rule_new (rule);
    CuAssertPtrNotNull (tc, r);
    /* Assert it contains what we think it should. */
    CuAssertStrEquals(tc, "^/login/(.*)/(.*)/*$", r->pattern );
    /* Apply - expect success (==1) */
    res = rewrite_rule_apply( r, req );
    CuAssertIntEquals (tc, 1, res );
    /* Ensure path is updated. */
    CuAssertStrEquals(tc, "/cgi-bin/index.cgi?mode=login;lname=steve.kemp;lpass=secret#password", req->path );
    free_http_request (req);
    free_rewrite_rule (r);
 

So all is good? Sadly not. I was expecting to handle a linked list of simple rules, but I've now realised that this isn't sufficient. Consider the following two (real) examples:

#
#  If the path is /robots.txt and the hostname isn't repository.steve.org.uk
# then redirect to the master one.
#
RewriteCond % http_host  !^repository\.steve\.org\.uk
RewriteRule /robots.txt$  http://repository.steve.org.uk/robots.txt [R=permanent,L]
#
#  Request for :  http://foo.repository.steve.org.uk 
#  becomes:  http://repository.steve.org.uk/cgi-bin/hgwebdir.cgi/foo/file/tip
#
RewriteCond % http_host  .
RewriteCond % http_host  !^repository.steve.org.uk [NC]
RewriteCond % http_host  ^([^.]+)\.repository.steve.org.uk [NC]
RewriteRule ^/$ http://repository.steve.org.uk/cgi-bin/hgwebdir.cgi/%1/file/tip [QSA,L]

So rather than having a simple linked list of rules for each domain I need to have a list of rules - each of which might in turn contain sub-rules. In terms of parsing this is harder than I'd like because it means I need to maintain state to marry up the RewriteCond & RewriteRules. Still the problem isn't insurmountable and I'm pleased with the progress I've made. Currently I can implement enough of mod_rewrite that I could handle all of my existing sites except the single site I have with the complex rule demonstrated above. (In all honesty I guess I could simplify my setup by dropping the wildcard hostname handling for the repository.steve.org.uk name, but I do kinda like it, and it makes for simple canonical mercurial repositories.) ObQuote: - 300

Perhaps I am not very imaginative. Or perhaps insufficiently adventurous. But when I woke up today, a day that would actually get a little bit above freezing, I didn t have a thought of riding without a coat in the bed of a pickup. Nor did I expect to be involved with moving a piano. I didn t have any thought of listening to piano music outdoors. And I certainly didn t anticipate the fun to be had doing all of these things simultaneously. Now, let me back up and set the scene. This was our annual Goerzen Christmas today. We already ate and exchanged gifts. Here s the thing about moving pianos, especially the old heavy ones with the cast iron frame inside: it s not something where a group of people just get together, count to 3, and that s that. No, you ve got to start the project out right. You have to break the news that people will be moving a piano gently. And then, of course, you get a room full of people usually mostly men and at this point, before any lifting happens, you ve got to plan. Tape measures must be produced, measurements taken, plans made for how to lift and who should lift where. Differing points of view have to be considered carefully. Then, of course, you have too many people for each one to actually help lift so each person not lifting has to find a job. And then when things actually start going, you realize that not one of the plans fully accounted for the unprecedented weight and maddening stubbornness of the piano, and you have to stop every few feet to plan anew. I don t think I ve ever seen a piano move happen in any other fashion. So, today, my uncle, whose house our gathering was at this year, said, Ahh good, lots of young backs. Just what I need. Mildly concerned glances pass between my brothers, my cousins, and I. One brother looks like he s pretending not to have heard. We have a few things to move. Anticipation. A small couch probably not too bad, right? An upholstered chair maybe a bit unruly but still not too bad. And an old piano is going to a neighbor. Full alert now more glances, a pause for a second, and then acceptance: Oh! Uhm great! My uncle s friend Ken teaches music at the local college, and on the side, Ken also teaches children how to play piano. One of Ken s students didn t have a piano at home, and my uncle and aunt had an old one they weren t using, which they would give to the family of the student just a couple of blocks away. All that remained was moving it. There was the inevitable measuring, planning, re-planning, until we got it out of the house and onto the back of my uncle s pickup. We have about 8 men involved, plus my aunt. Most of us rode in the back of the pickup with the piano. And of course, there came the inevitable request: Ken, play for us! So Ken sat on the edge of the pickup, at the piano, playing as we and the piano went through town in the open air. He started with Joplin s Entertainer, then broke out into some Christmas music We Wish You a Merry Christmas, followed by Nun Ist Sie Erschienen and a few others. It must be said that small towns in Kansas are probably not accustomed to their Christmas carolers having a piano with them, much less being played from the bed of a pickup. But there we were, mostly laughing too hard or enjoying the ride too much to sing. To add excitement, or perhaps embarrassment, my uncle was sounding the horn. Some thought that his intent was to have it in time with the piano music from the back, but I ll give him the benefit of the doubt and say that he meant to sound the horn in that rather random fashion. Eventually we got to the neighbor s house, and my dad and another uncle who hadn t been on the pickup came running up. We hopped down and asked them where they wanted the piano. Upstairs! That got repeated among everyone there, producing laughter each time. More tape measures were produced, as it was a narrow staircase. The conclusion was that the piano could make it with about an inch (2.54cm) to spare. So we got it out of the pickup and onto the porch, then into the house. Now, how to get it upstairs? This called for an extra helping of planning and calculating. Ken, the unofficial piano moving boss, kept reminding us in jest that I grew up on a farm . He said he could be alone at the top of the piano while we pushed. This quickly turned out to not be practical; due to the incline, the weight at the bottom was just too much to get it up over the stairs. Ken then went and picked up a wooden contraption they use to move pianos at the college. We tried that, but its supports underneath got stuck on the steps as well. Various ideas were tossed around at this point, until I pointed out that four of us on the bottom couldn t get it up over a step, so when we get it into the stairway only wide enough for 2 we won t be able to get it up anyhow. That being considered a good point, various other ideas were tossed around. They all seemed to be wanting either for practicality or, perhaps, safety. Though the idea of having a dozen Goerzens stand at the top of the staircase pulling it up by a rope did have some excellent humor value. In the end, perhaps wanting our group of free, highly ambitious, but somewhat less effective piano movers out of their house, the neighbors found a place for it on the ground floor. We all piled back into the pickup for the ride back, which was rather more quiet due to lack of horn and piano music. So there you have it. The most fun I have ever had moving a piano. (Really, the only fun I have ever had moving a piano.)

A few weeks ago I was lamenting the lack of of a reverse proxy that understood Apache's mod_rewrite syntax. On my server I have a bunch of thttpd processes, each running under their own UID, each listening on local ports. For example I have this running:

thttpd -C /etc/thttpd/sites.enabled/blog.steve.org.uk

This is running under the Unix-user "s-blog", with UID 1015, and thus is listening on 127.0.0.1:1015:

steve@steve:~$ id s-blog
uid=1015(s-blog) gid=1016(s-blog) groups=1016(s-blog)
steve@steve:~$ lsof -i :1015
COMMAND   PID   USER   FD   TYPE  DEVICE SIZE NODE NAME
thttpd  26293 s-blog    0u  IPv4 1072632       TCP localhost:1015 (LISTEN)

Anyway in front of these thttpd processes I have Apache. It does only two things:

• Expands mod_rewrite rules.
• Serves as a proxy to the back-end thttpd processes.

Yes other webservers could be run in front of these processes, and yes other webservers have their own rewrite-rule-syntax. I'm going to say "Lala lala can't hear you". Why? Because mod_rewrite is the defacto standard. It is assumed, documented, and included with a gazillion projects from wikipedia to wordpress to ... So this weekend I decided I'd see what I needed to do to put together a simple proxy that only worked for reverse HTTP, and understood Apache's mod_rewrite rules. I figure there are three main parts to such a beast:

Be a network server

Parse configuration file, accept connections, use fork(), libevevent(), or similar such that you ultimately receive HTTP requests..

Process HTTP Requests, rewriting as required

Once you have a parsed HTTP-request you need to test against each rule for the appropriate destination domain. Rewriting the request as appopriate.

Proxy

Send your (potentially modified) request to the back-end, and then send the response back to the client.

Thus far I've written code which takes this:

GET /etc/passwd?root=1 HTTP/1.0
Host: foo.example.com:80
Accept-Language: en-us,en-gb?q=0.5
Refer: http://foo.bar.com/
Keep-Alive: 300
Connection: keep-alive

Then turns it into this:

struct http_request
 
  /*
   * Path being requested. "/index.html", etc.
   */
  char *path;
  /*
   * Query string
   */
  char *qs;
  /**
   * Method being requested "GET/POST/PUT/DELETE/HEAD/etc".
   */
  char *method;
  /**
   * A linked list of headers such as "Referer: foo",
   * "Connection: close"
   */
  struct http_headers *headers;
 ;

There are methods for turning that back to a string, (so that you can send it on to the back-end), finding headers such as "Referer:", and so on. The parser is pretty minimal C and takes only a "char *buffer" to operate on. It has survived a lot of malicious input, as proved by a whole bunch of test cases. My next job is to code up the mod_rewrite rule-processor to apply a bunch of rules to one of these objects - updating the struct as we go. Assuming that I can get that part written cleanly over the next week or two then I'll be happy and can proceed to write the networking parts of the code - both the initial accepting, and the proxying to the back-end. In terms of configuration I'm going to assume something like:

/etc/proxy/global.conf                    : Global directives.
/etc/proxy/steve.org.uk/
/etc/proxy/steve.org.uk/back-end          : Will contain 127.0.0.1:1019
/etc/proxy/steve.org.uk/rewrite.conf      : Will contain the domain-wide rules
/etc/proxy/blog.steve.org.uk/
/etc/proxy/blog.steve.org.uk/back-end     : Will contain 127.0.0.1:1015
/etc/proxy/blog.steve.org.uk/rewrite.conf : Will contain the domain-wide rules
..

That seems both sane & logical to me. ObQuote: "I shall control the fate of the world... " - Day Watch. ObRandom: Coding in C is pleasant again.

Last night I made some changes to what I made for compiling pino0.3: patched CMakeLists.txt so uses rest-0.7 and rest-extras-0.7 and now the last issue is not a problem anymore, but now the error is that can t found them while compiling (here s in paste.debian if you can t see it nicely formatted):

/usr/bin/cmake -E cmake_progress_report "/tmp/buildd/pino-0.3+hg~20101225/obj-i486-linux-gnu/CMakeFiles" 47
[  2%] Generating src/stream_abstract.c, src/globals.c, src/twitter_favorites_stream.c, src/meta_row.c, src/search_interface.c, src/search_dialog.c, src/text_input.c, src/template.c, src/identica_create_dialog.c, src/updates_cell_renderer.c, src/stream_state.c, src/twitter_stream_mentions.c, src/accounts.c, src/accounts_types.c, src/main.c, src/hig_table.c, src/main_window.c, src/twitter_parser.c, src/twitter_recursive_reply.c, src/utils.c, src/identica_account.c, src/settings.c, src/visual_style.c, src/status_choose_bar.c, src/time_utils.c, src/status_box.c, src/menu_indicator.c, src/account_abstract.c, src/stream_meta.c, src/streams_types.c, src/content_view.c, src/img_cache.c, src/tree_widget.c, src/twitter_stream_public.c, src/icon_with_status_cell_renderer.c, src/account_state.c, src/create_dialog_generic.c, src/twitter_create_dialog.c, src/twitter_stream_abstract.c, src/status.c, src/twitter_stream_home.c, src/twitter_account.c, src/pino_enums.c, src/twitter_stream_search.c
/usr/bin/valac -C -b /tmp/buildd/pino-0.3+hg~20101225 -d /tmp/buildd/pino-0.3+hg~20101225/obj-i486-linux-gnu --pkg=glib-2.0 --pkg=gobject-2.0 --pkg=gtk+-2.0 --pkg=gee-1.0 --pkg=gio-2.0 --pkg=libnotify --pkg=libsoup-2.4 --pkg=libxml-2.0 --pkg=webkit-1.0 --pkg=unique-1.0 --pkg=rest-0.7 --pkg=rest-extras-0.7 --thread -g --save-temps -D LIBINDICATE /tmp/buildd/pino-0.3+hg~20101225/src/stream_abstract.vala /tmp/buildd/pino-0.3+hg~20101225/src/globals.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_favorites_stream.vala /tmp/buildd/pino-0.3+hg~20101225/src/meta_row.vala /tmp/buildd/pino-0.3+hg~20101225/src/search_interface.vala /tmp/buildd/pino-0.3+hg~20101225/src/search_dialog.vala /tmp/buildd/pino-0.3+hg~20101225/src/text_input.vala /tmp/buildd/pino-0.3+hg~20101225/src/template.vala /tmp/buildd/pino-0.3+hg~20101225/src/identica_create_dialog.vala /tmp/buildd/pino-0.3+hg~20101225/src/updates_cell_renderer.vala /tmp/buildd/pino-0.3+hg~20101225/src/stream_state.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_stream_mentions.vala /tmp/buildd/pino-0.3+hg~20101225/src/accounts.vala /tmp/buildd/pino-0.3+hg~20101225/src/accounts_types.vala /tmp/buildd/pino-0.3+hg~20101225/src/main.vala /tmp/buildd/pino-0.3+hg~20101225/src/hig_table.vala /tmp/buildd/pino-0.3+hg~20101225/src/main_window.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_parser.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_recursive_reply.vala /tmp/buildd/pino-0.3+hg~20101225/src/utils.vala /tmp/buildd/pino-0.3+hg~20101225/src/identica_account.vala /tmp/buildd/pino-0.3+hg~20101225/src/settings.vala /tmp/buildd/pino-0.3+hg~20101225/src/visual_style.vala /tmp/buildd/pino-0.3+hg~20101225/src/status_choose_bar.vala /tmp/buildd/pino-0.3+hg~20101225/src/time_utils.vala /tmp/buildd/pino-0.3+hg~20101225/src/status_box.vala /tmp/buildd/pino-0.3+hg~20101225/src/menu_indicator.vala /tmp/buildd/pino-0.3+hg~20101225/src/account_abstract.vala /tmp/buildd/pino-0.3+hg~20101225/src/stream_meta.vala /tmp/buildd/pino-0.3+hg~20101225/src/streams_types.vala /tmp/buildd/pino-0.3+hg~20101225/src/content_view.vala /tmp/buildd/pino-0.3+hg~20101225/src/img_cache.vala /tmp/buildd/pino-0.3+hg~20101225/src/tree_widget.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_stream_public.vala /tmp/buildd/pino-0.3+hg~20101225/src/icon_with_status_cell_renderer.vala /tmp/buildd/pino-0.3+hg~20101225/src/account_state.vala /tmp/buildd/pino-0.3+hg~20101225/src/create_dialog_generic.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_create_dialog.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_stream_abstract.vala /tmp/buildd/pino-0.3+hg~20101225/src/status.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_stream_home.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_account.vala /tmp/buildd/pino-0.3+hg~20101225/src/pino_enums.vala /tmp/buildd/pino-0.3+hg~20101225/src/twitter_stream_search.vala /tmp/buildd/pino-0.3+hg~20101225/src/vapi/config.vapi
error: rest-0.7 not found in specified Vala API directories or GObject-Introspection GIR directories
error: rest-extras-0.7 not found in specified Vala API directories or GObject-Introspection GIR directories
Compilation failed: 2 error(s), 0 warning(s)
make[3]: *** [src/stream_abstract.c] Error 1
make[3]: Leaving directory  /tmp/buildd/pino-0.3+hg~20101225/obj-i486-linux-gnu'
make[2]: *** [CMakeFiles/pino.dir/all] Error 2
make[2]: Leaving directory  /tmp/buildd/pino-0.3+hg~20101225/obj-i486-linux-gnu'
make[1]: *** [all] Error 2
make[1]: Leaving directory  /tmp/buildd/pino-0.3+hg~20101225/obj-i486-linux-gnu'
dh_auto_build: make -j1 returned exit code 2
make: *** [build] Error 2
dpkg-buildpackage: error: debian/rules build gave error exit status 2
E: Failed autobuilding of package
I: unmounting /var/cache/pbuilder/ccache filesystem

I checked and found out that librest doesn t ships the gir files so downloaded sources for librest and made a patched version that ships gir files (rest and rest-extras) but nothing changed. Any suggests, anyone?

A few days ago an article in the Norwegian Computerworld magazine about how version 2.0 of European Interoperability Framework has been successfully lobbied by the proprietary software industry to remove the focus on free software. Nothing very surprising there, given earlier reports on how Microsoft and others have stacked the committees in this work. But I find this very sad. The definition of an open standard from version 1 was very good, and something I believe should be used also in the future, alongside the definition from Digistan. Version 2 have removed the open standard definition from its content. Anyway, the news reminded me of the great reply sent by Dr. Edgar Villanueva, congressman in Peru at the time, to Microsoft as a reply to Microsofts attack on his proposal regarding the use of free software in the public sector in Peru. As the text was not available from a few of the URLs where it used to be available, I copy it here from my source to ensure it is available also in the future. Some background information about that story is available in an article from Linux Journal in 2002.

Lima, 8th of April, 2002
To: Se or JUAN ALBERTO GONZ LEZ
General Manager of Microsoft Per Dear Sir: First of all, I thank you for your letter of March 25, 2002 in which you state the official position of Microsoft relative to Bill Number 1609, Free Software in Public Administration, which is indubitably inspired by the desire for Peru to find a suitable place in the global technological context. In the same spirit, and convinced that we will find the best solutions through an exchange of clear and open ideas, I will take this opportunity to reply to the commentaries included in your letter. While acknowledging that opinions such as yours constitute a significant contribution, it would have been even more worthwhile for me if, rather than formulating objections of a general nature (which we will analyze in detail later) you had gathered solid arguments for the advantages that proprietary software could bring to the Peruvian State, and to its citizens in general, since this would have allowed a more enlightening exchange in respect of each of our positions. With the aim of creating an orderly debate, we will assume that what you call "open source software" is what the Bill defines as "free software", since there exists software for which the source code is distributed together with the program, but which does not fall within the definition established by the Bill; and that what you call "commercial software" is what the Bill defines as "proprietary" or "unfree", given that there exists free software which is sold in the market for a price like any other good or service. It is also necessary to make it clear that the aim of the Bill we are discussing is not directly related to the amount of direct savings that can by made by using free software in state institutions. That is in any case a marginal aggregate value, but in no way is it the chief focus of the Bill. The basic principles which inspire the Bill are linked to the basic guarantees of a state of law, such as:

• Free access to public information by the citizen.
• Permanence of public data.
• Security of the State and citizens.

To guarantee the free access of citizens to public information, it is indispensable that the encoding of data is not tied to a single provider. The use of standard and open formats gives a guarantee of this free access, if necessary through the creation of compatible free software. To guarantee the permanence of public data, it is necessary that the usability and maintenance of the software does not depend on the goodwill of the suppliers, or on the monopoly conditions imposed by them. For this reason the State needs systems the development of which can be guaranteed due to the availability of the source code. To guarantee national security or the security of the State, it is indispensable to be able to rely on systems without elements which allow control from a distance or the undesired transmission of information to third parties. Systems with source code freely accessible to the public are required to allow their inspection by the State itself, by the citizens, and by a large number of independent experts throughout the world. Our proposal brings further security, since the knowledge of the source code will eliminate the growing number of programs with *spy code*. In the same way, our proposal strengthens the security of the citizens, both in their role as legitimate owners of information managed by the state, and in their role as consumers. In this second case, by allowing the growth of a widespread availability of free software not containing *spy code* able to put at risk privacy and individual freedoms. In this sense, the Bill is limited to establishing the conditions under which the state bodies will obtain software in the future, that is, in a way compatible with these basic principles. From reading the Bill it will be clear that once passed:

the law does not forbid the production of proprietary software

the law does not forbid the sale of proprietary software

the law does not specify which concrete software to use

the law does not dictate the supplier from whom software will be bought

the law does not limit the terms under which a software product can be licensed.

What the Bill does express clearly, is that, for software to be acceptable for the state it is not enough that it is technically capable of fulfilling a task, but that further the contractual conditions must satisfy a series of requirements regarding the license, without which the State cannot guarantee the citizen adequate processing of his data, watching over its integrity, confidentiality, and accessibility throughout time, as these are very critical aspects for its normal functioning. We agree, Mr. Gonzalez, that information and communication technology have a significant impact on the quality of life of the citizens (whether it be positive or negative). We surely also agree that the basic values I have pointed out above are fundamental in a democratic state like Peru. So we are very interested to know of any other way of guaranteeing these principles, other than through the use of free software in the terms defined by the Bill. As for the observations you have made, we will now go on to analyze them in detail: Firstly, you point out that: "1. The bill makes it compulsory for all public bodies to use only free software, that is to say open source software, which breaches the principles of equality before the law, that of non-discrimination and the right of free private enterprise, freedom of industry and of contract, protected by the constitution." This understanding is in error. The Bill in no way affects the rights you list; it limits itself entirely to establishing conditions for the use of software on the part of state institutions, without in any way meddling in private sector transactions. It is a well established principle that the State does not enjoy the wide spectrum of contractual freedom of the private sector, as it is limited in its actions precisely by the requirement for transparency of public acts; and in this sense, the preservation of the greater common interest must prevail when legislating on the matter. The Bill protects equality under the law, since no natural or legal person is excluded from the right of offering these goods to the State under the conditions defined in the Bill and without more limitations than those established by the Law of State Contracts and Purchasing (T.U.O. by Supreme Decree No. 012-2001-PCM). The Bill does not introduce any discrimination whatever, since it only establishes *how* the goods have to be provided (which is a state power) and not *who* has to provide them (which would effectively be discriminatory, if restrictions based on national origin, race religion, ideology, sexual preference etc. were imposed). On the contrary, the Bill is decidedly antidiscriminatory. This is so because by defining with no room for doubt the conditions for the provision of software, it prevents state bodies from using software which has a license including discriminatory conditions. It should be obvious from the preceding two paragraphs that the Bill does not harm free private enterprise, since the latter can always choose under what conditions it will produce software; some of these will be acceptable to the State, and others will not be since they contradict the guarantee of the basic principles listed above. This free initiative is of course compatible with the freedom of industry and freedom of contract (in the limited form in which the State can exercise the latter). Any private subject can produce software under the conditions which the State requires, or can refrain from doing so. Nobody is forced to adopt a model of production, but if they wish to provide software to the State, they must provide the mechanisms which guarantee the basic principles, and which are those described in the Bill. By way of an example: nothing in the text of the Bill would prevent your company offering the State bodies an office "suite", under the conditions defined in the Bill and setting the price that you consider satisfactory. If you did not, it would not be due to restrictions imposed by the law, but to business decisions relative to the method of commercializing your products, decisions with which the State is not involved. To continue; you note that:" 2. The bill, by making the use of open source software compulsory, would establish discriminatory and non competitive practices in the contracting and purchasing by public bodies..." This statement is just a reiteration of the previous one, and so the response can be found above. However, let us concern ourselves for a moment with your comment regarding "non-competitive ... practices." Of course, in defining any kind of purchase, the buyer sets conditions which relate to the proposed use of the good or service. From the start, this excludes certain manufacturers from the possibility of competing, but does not exclude them "a priori", but rather based on a series of principles determined by the autonomous will of the purchaser, and so the process takes place in conformance with the law. And in the Bill it is established that *no one* is excluded from competing as far as he guarantees the fulfillment of the basic principles. Furthermore, the Bill *stimulates* competition, since it tends to generate a supply of software with better conditions of usability, and to better existing work, in a model of continuous improvement. On the other hand, the central aspect of competivity is the chance to provide better choices to the consumer. Now, it is impossible to ignore the fact that marketing does not play a neutral role when the product is offered on the market (since accepting the opposite would lead one to suppose that firms' expenses in marketing lack any sense), and that therefore a significant expense under this heading can influence the decisions of the purchaser. This influence of marketing is in large measure reduced by the bill that we are backing, since the choice within the framework proposed is based on the *technical merits* of the product and not on the effort put into commercialization by the producer; in this sense, competitiveness is increased, since the smallest software producer can compete on equal terms with the most powerful corporations. It is necessary to stress that there is no position more anti-competitive than that of the big software producers, which frequently abuse their dominant position, since in innumerable cases they propose as a solution to problems raised by users: "update your software to the new version" (at the user's expense, naturally); furthermore, it is common to find arbitrary cessation of technical help for products, which, in the provider's judgment alone, are "old"; and so, to receive any kind of technical assistance, the user finds himself forced to migrate to new versions (with non-trivial costs, especially as changes in hardware platform are often involved). And as the whole infrastructure is based on proprietary data formats, the user stays "trapped" in the need to continue using products from the same supplier, or to make the huge effort to change to another environment (probably also proprietary). You add: "3. So, by compelling the State to favor a business model based entirely on open source, the bill would only discourage the local and international manufacturing companies, which are the ones which really undertake important expenditures, create a significant number of direct and indirect jobs, as well as contributing to the GNP, as opposed to a model of open source software which tends to have an ever weaker economic impact, since it mainly creates jobs in the service sector." I do not agree with your statement. Partly because of what you yourself point out in paragraph 6 of your letter, regarding the relative weight of services in the context of software use. This contradiction alone would invalidate your position. The service model, adopted by a large number of companies in the software industry, is much larger in economic terms, and with a tendency to increase, than the licensing of programs. On the other hand, the private sector of the economy has the widest possible freedom to choose the economic model which best suits its interests, even if this freedom of choice is often obscured subliminally by the disproportionate expenditure on marketing by the producers of proprietary software. In addition, a reading of your opinion would lead to the conclusion that the State market is crucial and essential for the proprietary software industry, to such a point that the choice made by the State in this bill would completely eliminate the market for these firms. If that is true, we can deduce that the State must be subsidizing the proprietary software industry. In the unlikely event that this were true, the State would have the right to apply the subsidies in the area it considered of greatest social value; it is undeniable, in this improbable hypothesis, that if the State decided to subsidize software, it would have to do so choosing the free over the proprietary, considering its social effect and the rational use of taxpayers money. In respect of the jobs generated by proprietary software in countries like ours, these mainly concern technical tasks of little aggregate value; at the local level, the technicians who provide support for proprietary software produced by transnational companies do not have the possibility of fixing bugs, not necessarily for lack of technical capability or of talent, but because they do not have access to the source code to fix it. With free software one creates more technically qualified employment and a framework of free competence where success is only tied to the ability to offer good technical support and quality of service, one stimulates the market, and one increases the shared fund of knowledge, opening up alternatives to generate services of greater total value and a higher quality level, to the benefit of all involved: producers, service organizations, and consumers. It is a common phenomenon in developing countries that local software industries obtain the majority of their takings in the service sector, or in the creation of "ad hoc" software. Therefore, any negative impact that the application of the Bill might have in this sector will be more than compensated by a growth in demand for services (as long as these are carried out to high quality standards). If the transnational software companies decide not to compete under these new rules of the game, it is likely that they will undergo some decrease in takings in terms of payment for licenses; however, considering that these firms continue to allege that much of the software used by the State has been illegally copied, one can see that the impact will not be very serious. Certainly, in any case their fortune will be determined by market laws, changes in which cannot be avoided; many firms traditionally associated with proprietary software have already set out on the road (supported by copious expense) of providing services associated with free software, which shows that the models are not mutually exclusive. With this bill the State is deciding that it needs to preserve certain fundamental values. And it is deciding this based on its sovereign power, without affecting any of the constitutional guarantees. If these values could be guaranteed without having to choose a particular economic model, the effects of the law would be even more beneficial. In any case, it should be clear that the State does not choose an economic model; if it happens that there only exists one economic model capable of providing software which provides the basic guarantee of these principles, this is because of historical circumstances, not because of an arbitrary choice of a given model. Your letter continues: "4. The bill imposes the use of open source software without considering the dangers that this can bring from the point of view of security, guarantee, and possible violation of the intellectual property rights of third parties." Alluding in an abstract way to "the dangers this can bring", without specifically mentioning a single one of these supposed dangers, shows at the least some lack of knowledge of the topic. So, allow me to enlighten you on these points. On security: National security has already been mentioned in general terms in the initial discussion of the basic principles of the bill. In more specific terms, relative to the security of the software itself, it is well known that all software (whether proprietary or free) contains errors or "bugs" (in programmers' slang). But it is also well known that the bugs in free software are fewer, and are fixed much more quickly, than in proprietary software. It is not in vain that numerous public bodies responsible for the IT security of state systems in developed countries require the use of free software for the same conditions of security and efficiency. What is impossible to prove is that proprietary software is more secure than free, without the public and open inspection of the scientific community and users in general. This demonstration is impossible because the model of proprietary software itself prevents this analysis, so that any guarantee of security is based only on promises of good intentions (biased, by any reckoning) made by the producer itself, or its contractors. It should be remembered that in many cases, the licensing conditions include Non-Disclosure clauses which prevent the user from publicly revealing security flaws found in the licensed proprietary product. In respect of the guarantee: As you know perfectly well, or could find out by reading the "End User License Agreement" of the products you license, in the great majority of cases the guarantees are limited to replacement of the storage medium in case of defects, but in no case is compensation given for direct or indirect damages, loss of profits, etc... If as a result of a security bug in one of your products, not fixed in time by yourselves, an attacker managed to compromise crucial State systems, what guarantees, reparations and compensation would your company make in accordance with your licensing conditions? The guarantees of proprietary software, inasmuch as programs are delivered AS IS'', that is, in the state in which they are, with no additional responsibility of the provider in respect of function, in no way differ from those normal with free software. On Intellectual Property: Questions of intellectual property fall outside the scope of this bill, since they are covered by specific other laws. The model of free software in no way implies ignorance of these laws, and in fact the great majority of free software is covered by copyright. In reality, the inclusion of this question in your observations shows your confusion in respect of the legal framework in which free software is developed. The inclusion of the intellectual property of others in works claimed as one's own is not a practice that has been noted in the free software community; whereas, unfortunately, it has been in the area of proprietary software. As an example, the condemnation by the Commercial Court of Nanterre, France, on 27th September 2001 of Microsoft Corp. to a penalty of 3 million francs in damages and interest, for violation of intellectual property (piracy, to use the unfortunate term that your firm commonly uses in its publicity). You go on to say that: "The bill uses the concept of open source software incorrectly, since it does not necessarily imply that the software is free or of zero cost, and so arrives at mistaken conclusions regarding State savings, with no cost-benefit analysis to validate its position." This observation is wrong; in principle, freedom and lack of cost are orthogonal concepts: there is software which is proprietary and charged for (for example, MS Office), software which is proprietary and free of charge (MS Internet Explorer), software which is free and charged for (Red Hat, SuSE etc GNU/Linux distributions), software which is free and not charged for (Apache, Open Office, Mozilla), and even software which can be licensed in a range of combinations (MySQL). Certainly free software is not necessarily free of charge. And the text of the bill does not state that it has to be so, as you will have noted after reading it. The definitions included in the Bill state clearly *what* should be considered free software, at no point referring to freedom from charges. Although the possibility of savings in payments for proprietary software licenses are mentioned, the foundations of the bill clearly refer to the fundamental guarantees to be preserved and to the stimulus to local technological development. Given that a democratic State must support these principles, it has no other choice than to use software with publicly available source code, and to exchange information only in standard formats. If the State does not use software with these characteristics, it will be weakening basic republican principles. Luckily, free software also implies lower total costs; however, even given the hypothesis (easily disproved) that it was more expensive than proprietary software, the simple existence of an effective free software tool for a particular IT function would oblige the State to use it; not by command of this Bill, but because of the basic principles we enumerated at the start, and which arise from the very essence of the lawful democratic State. You continue: "6. It is wrong to think that Open Source Software is free of charge. Research by the Gartner Group (an important investigator of the technological market recognized at world level) has shown that the cost of purchase of software (operating system and applications) is only 8% of the total cost which firms and institutions take on for a rational and truly beneficial use of the technology. The other 92% consists of: installation costs, enabling, support, maintenance, administration, and down-time." This argument repeats that already given in paragraph 5 and partly contradicts paragraph 3. For the sake of brevity we refer to the comments on those paragraphs. However, allow me to point out that your conclusion is logically false: even if according to Gartner Group the cost of software is on average only 8% of the total cost of use, this does not in any way deny the existence of software which is free of charge, that is, with a licensing cost of zero. In addition, in this paragraph you correctly point out that the service components and losses due to down-time make up the largest part of the total cost of software use, which, as you will note, contradicts your statement regarding the small value of services suggested in paragraph 3. Now the use of free software contributes significantly to reduce the remaining life-cycle costs. This reduction in the costs of installation, support etc. can be noted in several areas: in the first place, the competitive service model of free software, support and maintenance for which can be freely contracted out to a range of suppliers competing on the grounds of quality and low cost. This is true for installation, enabling, and support, and in large part for maintenance. In the second place, due to the reproductive characteristics of the model, maintenance carried out for an application is easily replicable, without incurring large costs (that is, without paying more than once for the same thing) since modifications, if one wishes, can be incorporated in the common fund of knowledge. Thirdly, the huge costs caused by non-functioning software ("blue screens of death", malicious code such as virus, worms, and trojans, exceptions, general protection faults and other well-known problems) are reduced considerably by using more stable software; and it is well known that one of the most notable virtues of free software is its stability. You further state that: "7. One of the arguments behind the bill is the supposed freedom from costs of open-source software, compared with the costs of commercial software, without taking into account the fact that there exist types of volume licensing which can be highly advantageous for the State, as has happened in other countries." I have already pointed out that what is in question is not the cost of the software but the principles of freedom of information, accessibility, and security. These arguments have been covered extensively in the preceding paragraphs to which I would refer you. On the other hand, there certainly exist types of volume licensing (although unfortunately proprietary software does not satisfy the basic principles). But as you correctly pointed out in the immediately preceding paragraph of your letter, they only manage to reduce the impact of a component which makes up no more than 8% of the total. You continue: "8. In addition, the alternative adopted by the bill (I) is clearly more expensive, due to the high costs of software migration, and (II) puts at risk compatibility and interoperability of the IT platforms within the State, and between the State and the private sector, given the hundreds of versions of open source software on the market." Let us analyze your statement in two parts. Your first argument, that migration implies high costs, is in reality an argument in favor of the Bill. Because the more time goes by, the more difficult migration to another technology will become; and at the same time, the security risks associated with proprietary software will continue to increase. In this way, the use of proprietary systems and formats will make the State ever more dependent on specific suppliers. Once a policy of using free software has been established (which certainly, does imply some cost) then on the contrary migration from one system to another becomes very simple, since all data is stored in open formats. On the other hand, migration to an open software context implies no more costs than migration between two different proprietary software contexts, which invalidates your argument completely. The second argument refers to "problems in interoperability of the IT platforms within the State, and between the State and the private sector" This statement implies a certain lack of knowledge of the way in which free software is built, which does not maximize the dependence of the user on a particular platform, as normally happens in the realm of proprietary software. Even when there are multiple free software distributions, and numerous programs which can be used for the same function, interoperability is guaranteed as much by the use of standard formats, as required by the bill, as by the possibility of creating interoperable software given the availability of the source code. You then say that: "9. The majority of open source code does not offer adequate levels of service nor the guarantee from recognized manufacturers of high productivity on the part of the users, which has led various public organizations to retract their decision to go with an open source software solution and to use commercial software in its place." This observation is without foundation. In respect of the guarantee, your argument was rebutted in the response to paragraph 4. In respect of support services, it is possible to use free software without them (just as also happens with proprietary software), but anyone who does need them can obtain support separately, whether from local firms or from international corporations, again just as in the case of proprietary software. On the other hand, it would contribute greatly to our analysis if you could inform us about free software projects *established* in public bodies which have already been abandoned in favor of proprietary software. We know of a good number of cases where the opposite has taken place, but not know of any where what you describe has taken place. You continue by observing that: "10. The bill discourages the creativity of the Peruvian software industry, which invoices 40 million US$/year, exports 4 million US$ (10th in ranking among non-traditional exports, more than handicrafts) and is a source of highly qualified employment. With a law that encourages the use of open source, software programmers lose their intellectual property rights and their main source of payment." It is clear enough that nobody is forced to commercialize their code as free software. The only thing to take into account is that if it is not free software, it cannot be sold to the public sector. This is not in any case the main market for the national software industry. We covered some questions referring to the influence of the Bill on the generation of employment which would be both highly technically qualified and in better conditions for competition above, so it seems unnecessary to insist on this point. What follows in your statement is incorrect. On the one hand, no author of free software loses his intellectual property rights, unless he expressly wishes to place his work in the public domain. The free software movement has always been very respectful of intellectual property, and has generated widespread public recognition of its authors. Names like those of Richard Stallman, Linus Torvalds, Guido van Rossum, Larry Wall, Miguel de Icaza, Andrew Tridgell, Theo de Raadt, Andrea Arcangeli, Bruce Perens, Darren Reed, Alan Cox, Eric Raymond, and many others, are recognized world-wide for their contributions to the development of software that is used today by millions of people throughout the world. On the other hand, to say that the rewards for authors rights make up the main source of payment of Peruvian programmers is in any case a guess, in particular since there is no proof to this effect, nor a demonstration of how the use of free software by the State would influence these payments. You go on to say that: "11. Open source software, since it can be distributed without charge, does not allow the generation of income for its developers through exports. In this way, the multiplier effect of the sale of software to other countries is weakened, and so in turn is the growth of the industry, while Government rules ought on the contrary to stimulate local industry." This statement shows once again complete ignorance of the mechanisms of and market for free software. It tries to claim that the market of sale of non- exclusive rights for use (sale of licenses) is the only possible one for the software industry, when you yourself pointed out several paragraphs above that it is not even the most important one. The incentives that the bill offers for the growth of a supply of better qualified professionals, together with the increase in experience that working on a large scale with free software within the State will bring for Peruvian technicians, will place them in a highly competitive position to offer their services abroad. You then state that: "12. In the Forum, the use of open source software in education was discussed, without mentioning the complete collapse of this initiative in a country like Mexico, where precisely the State employees who founded the project now state that open source software did not make it possible to offer a learning experience to pupils in the schools, did not take into account the capability at a national level to give adequate support to the platform, and that the software did not and does not allow for the levels of platform integration that now exist in schools." In fact Mexico has gone into reverse with the Red Escolar (Schools Network) project. This is due precisely to the fact that the driving forces behind the Mexican project used license costs as their main argument, instead of the other reasons specified in our project, which are far more essential. Because of this conceptual mistake, and as a result of the lack of effective support from the SEP (Secretary of State for Public Education), the assumption was made that to implant free software in schools it would be enough to drop their software budget and send them a CD ROM with Gnu/Linux instead. Of course this failed, and it couldn't have been otherwise, just as school laboratories fail when they use proprietary software and have no budget for implementation and maintenance. That's exactly why our bill is not limited to making the use of free software mandatory, but recognizes the need to create a viable migration plan, in which the State undertakes the technical transition in an orderly way in order to then enjoy the advantages of free software. You end with a rhetorical question: "13. If open source software satisfies all the requirements of State bodies, why do you need a law to adopt it? Shouldn't it be the market which decides freely which products give most benefits or value?" We agree that in the private sector of the economy, it must be the market that decides which products to use, and no state interference is permissible there. However, in the case of the public sector, the reasoning is not the same: as we have already established, the state archives, handles, and transmits information which does not belong to it, but which is entrusted to it by citizens, who have no alternative under the rule of law. As a counterpart to this legal requirement, the State must take extreme measures to safeguard the integrity, confidentiality, and accessibility of this information. The use of proprietary software raises serious doubts as to whether these requirements can be fulfilled, lacks conclusive evidence in this respect, and so is not suitable for use in the public sector. The need for a law is based, firstly, on the realization of the fundamental principles listed above in the specific area of software; secondly, on the fact that the State is not an ideal homogeneous entity, but made up of multiple bodies with varying degrees of autonomy in decision making. Given that it is inappropriate to use proprietary software, the fact of establishing these rules in law will prevent the personal discretion of any state employee from putting at risk the information which belongs to citizens. And above all, because it constitutes an up-to-date reaffirmation in relation to the means of management and communication of information used today, it is based on the republican principle of openness to the public. In conformance with this universally accepted principle, the citizen has the right to know all information held by the State and not covered by well- founded declarations of secrecy based on law. Now, software deals with information and is itself information. Information in a special form, capable of being interpreted by a machine in order to execute actions, but crucial information all the same because the citizen has a legitimate right to know, for example, how his vote is computed or his taxes calculated. And for that he must have free access to the source code and be able to prove to his satisfaction the programs used for electoral computations or calculation of his taxes. I wish you the greatest respect, and would like to repeat that my office will always be open for you to expound your point of view to whatever level of detail you consider suitable. Cordially,
DR. EDGAR DAVID VILLANUEVA NU EZ
Congressman of the Republic of Per .

It seems the current trend is to use short-form dh. Some people have even thought that dh has superseded CDBS. Since I prefer CDBS for my own packaging, I will say that no, CDBS is not being deprecated and in fact has been active. Packaging with CDBS is very simple. I'll try to explain how it works, and how to package with it. This may turn into a blog post series, but I won't promise anything.

CDBS is a set of makefiles that do several tasks that are common while packaging software, so that you don't have to repeat them over and over on each package. The makefiles are classified into 2 groups: classes and rules. Classes implement the rules required for building and installing software. These are classes because they can and do inherit from others. For example, there is the makefile class, and the autotools, qmake and cmake classes inherit from it, and the gnome and kde (which is for kde 3) classes inherits from the autotools class. Rules implement several other general purpose rules that don't depend on the toolchain used to build the package. For example, there is the debhelper rules file, which takes care of creating the debian package using the usual dh_* commands. There are several rules files which do all sorts of useful stuff, from running license checks to downloading new upstream releases. If this post transforms into a series, we may look into some of them. For now, I'll demonstrate how to use CDBS to package some simple software (only the debian/rules file, of course).

The first task while running creating debian/rules is determining which build system the software uses. I will use qutecsound package as a guide. So, first things first, we start using CDBS!

#!/usr/bin/make -f



# Uncomment this to turn on verbose mode.

#export DH_VERBOSE=1



include /usr/share/cdbs/1/rules/debhelper.mk

include /usr/share/cdbs/1/class/qmake.mk

Now this would be all that is required if qutecsound where a standard qmake package where nothing needs to be customized. Alas, this is not the case. First, there are some variables that need to be passed to qmake to appropriately configure the build. Also, the projects .pro file is not standard-named. How do we fix this? The CDBS way of overriding this kind of behavior is through the use of variables. Since we are using the qmake class, we will be overriding variables named DEB_QMAKE_*:

DEB_QMAKE_CONFIG_VAL += build64

DEB_QMAKE_ARGS = qcs.pro

We add a configuration value (because CDBS is setting other config values), and we set the extra arguments to qmake.

Now, there is a problem: the resulting binary is not created with the name we want. How do we change that? We could patch the source to avoid that, but it is far easier to add a rule to the makefile to do that. We will modify the build to rename the file at the end (and then clean it up on clean because the upstream makefile will not spot it):

build/qutecsound::

	[ -f bin/qutecsound ]   mv bin/qutecsound-d bin/qutecsound



clean::

	rm -f bin/qutecsound

So what did we just do? We extended the build and clean rules with extra stuff to do. In CDBS each package listed in debian/control gets a build/package rule (and several others at different stages of the build) so that one can add stuff specific to each package (this will be much more useful when dpkg finally learns about build-arch and build-indep).

For the final touch, we want to do a few more things. First, we want to ensure that we are using QT4's qmake, because the build will fail if QT3's is used. Second, since I created a manpage for the command, I want to install it. Finally, we want to use parallel building when the user has specified it, to build the project faster. How to do that? Again, via variables:

QMAKE = qmake-qt4

DEB_BUILD_PARALLEL = 1

DEB_INSTALL_MANPAGES_qutecsound = debian/qutecsound.1

CDBS creates several variables for each of the packages listed in debian/control, so we can customize each package build. In our case, this variable is passed to dh_installman from the debhelper rules file (CDBS will invoke the debhelper tools once for each binary package).

After all this we now have the complete debian/rules of a relatively simple package. How does it look like? Like this:

#!/usr/bin/make -f



# Uncomment this to turn on verbose mode.

#export DH_VERBOSE=1



include /usr/share/cdbs/1/rules/debhelper.mk

include /usr/share/cdbs/1/class/qmake.mk



QMAKE = qmake-qt4

DEB_QMAKE_CONFIG_VAL += build64

DEB_QMAKE_ARGS = qcs.pro

DEB_BUILD_PARALLEL = 1



DEB_INSTALL_MANPAGES_qutecsound = debian/qutecsound.1



build/qutecsound::

        [ -f bin/qutecsound ]   mv bin/qutecsound-d bin/qutecsound



clean::

        rm -f bin/qutecsound

Tags: cdbs, packaging

This has been bugging me ever since we got our Sony Internet TV, and I think I've finally figured out what's going on. Pandora hasn't been working on the Google TV ever since we got it, it just spits out Unexpected HTTP error occurred code: 417 while StartupAsyncTask and that's the end of that. I have vague recollections seeing this on my phone in the past also, but this doesn't appear to be the case any longer. My phone has version 1.5.2 on it, and the TV has 1.0, so I think I see the problem here. I took a full packet capture while starting up Pandora, and it was a lot more revealing. I could see that it was my Squid proxy (I transparently run all HTTP traffic through Squid) was barfing. That'd explain the errors I was seeing in Squid's cache.log

parseHttpRequest: Unsupported method ''
clientTryParseRequest: FD 153 (172.16.1.5:55001) Invalid Request

Looking at the headers of the HTTP request that the Pandora client is sending out, I see Expect: 100-Continue, and the text that accompanies a HTTP 417 error is "Expectation Failed", so I think this is the culprit. Searching for Expect: 100-Continue squid turns up information for an ignore_expect_100 directive, but this appears to only be available if Squid is compiled with --enable-http-violations, which the Debian Squid package doesn't appear to be compiled with. I may have to adjust my transparent proxying rules to not transparently proxy the TV, but this makes me a bit sad. Update I tried adding ignore_expect_100 on anyway, and Squid took it, and now Pandora isn't barfing. Yay!

Recently gcc (4.5) improved its ability to see the size of various structures. As a result, the FORTIFY protections have suddenly gotten a bit stricter. In the past, you used to be able to do things like this:

struct thingy  
    int magic;
    char data[4];
 
void work(char *input)  
    char buffer[1000];
    int length;
    struct thingy *header;
    header = (struct thingy *)buffer;
    length = strlen(input);
    if (length > sizeof(buffer) - sizeof(*header) - 1) abort();
    strcpy(header->data, input);
    header->magic = 42;
    do_something_fun(header);
 

The problem here is that gcc thinks that header->data is only 4 bytes long. But gcc doesn t know we intentionally overruled this (and even did length checking), so due to -D_FORTIFY_SOURCE=2, the strcpy() checks kick in when input is more than 4 bytes. The fix, in this case, is to use memcpy() instead, since we actually know how long our destination is, we can replace the strcpy(...) line with:

    memcpy(header->data, input, length + 1); /* take 0-term too */

This kind of header and then data stuff is common for protocol handlers. So far, things like Wine, TFTP, and others have been experiencing problems with the change. Please keep an eye out for it when doing testing.

Being able to rebuild an existing Debian package is a very useful skill. It s a prerequisite for many tasks that an admin might want to perform at some point: enable a feature that is disabled in the official Debian package, rebuild a source package for another suite (for example build a Debian Testing package for use on Debian Stable, we call that backporting), include a bug fix that upstream developers prepared, etc. Discover the 4 steps to rebuild a Debian package. 1. Download the source package The preferred way to download source packages is to use APT. It can download them from the source repositories that you have configured in /etc/apt/sources.list, for example:

deb-src http://ftp.debian.org/debian unstable main contrib non-free
deb-src http://ftp.debian.org/debian testing main contrib non-free
deb-src http://ftp.debian.org/debian stable main contrib non-free

Note that the lines start with deb-src instead of the usual deb . This tells APT that we are interested in the source packages and not in the binary packages. After an apt-get update you can use apt-get source publican to retrieve the latest version of the source package publican . You can also indicate the distribution where the source package must be fetched with the syntax package/distribution . apt-get source publican/testing will grab the source package publican in the testing distribution and extract it in the current directory (with dpkg-source -x, thus you need to have installed the dpkg-dev package).

$ apt-get source publican/testing
Reading package lists... Done
Building dependency tree
Reading state information... Done
NOTICE: 'publican' packaging is maintained in the 'Git' version control system at:
git://git.debian.org/collab-maint/publican.git
Need to get 727 kB of source archives.
Get:1 http://nas/debian/ squeeze/main publican 2.1-2 (dsc) [2253 B]
Get:2 http://nas/debian/ squeeze/main publican 2.1-2 (tar) [720 kB]
Get:3 http://nas/debian/ squeeze/main publican 2.1-2 (diff) [4728 B]
Fetched 727 kB in 0s (2970 kB/s)
dpkg-source: info: extracting publican in publican-2.1
dpkg-source: info: unpacking publican_2.1.orig.tar.gz
dpkg-source: info: unpacking publican_2.1-2.debian.tar.gz
$ ls -dF publican*
publican-2.1/                 publican_2.1-2.dsc
publican_2.1-2.debian.tar.gz  publican_2.1.orig.tar.gz

If you don t want to use APT, or if the source package is not hosted in an APT source repository, you can download a complete source package with dget -u dsc-url where dsc-url is the URL of the .dsc file representing the source package. dget is provided by the devscripts package. Note that the -u option means that the origin of the source package is not verified before extraction. 2. Install the build-dependencies Again APT can do the grunt work for you, you just have to use apt-get build-dep foo to install the build-dependencies for the last version of the source package foo. It supports the same syntactic sugar than apt-get source so that you can run apt-get build-dep publican/testing to install the build-dependencies required to build the testing version of the publican source package. If you can t use APT for this, enter the directory where the source package has been unpacked and run dpkg-checkbuilddeps. It will spit out a list of unmet build dependencies (if there are any, otherwise it will print nothing and you can go ahead safely). With a bit of copy and paste and a apt-get install invocation, you ll install the required packages in a few seconds. 3. Do whatever changes you need I won t detail this step since it depends on your specific goal with the rebuild. You might have to edit debian/rules, or to apply a patch. But one thing is sure, if you have made any change or have recompiled the package in a different environment, you should really change its version number. You can do this with dch --local foo (again from the devscripts package), replace foo by a short name identifying you as the supplier of the updated version. It will update debian/changelog and invite you to write a small entry documenting your change. 4. Build the package The last step is also the simplest one now that everything is in place. You must be in the directory of the unpacked source package.
Now run either debuild -us -uc (recommended, requires the devscripts package) or directly dpkg-buildpackage -us -uc . The -us -uc options avoid the signature step in the build process that would generate a (harmless) failure at the end if you have no GPG key matching the name entered in the top entry of the Debian changelog.

$ cd publican-2.1
$ debuild -us -uc
 dpkg-buildpackage -rfakeroot -D -us -uc
dpkg-buildpackage: export CFLAGS from dpkg-buildflags (origin: vendor): -g -O2
dpkg-buildpackage: export CPPFLAGS from dpkg-buildflags (origin: vendor):
dpkg-buildpackage: export CXXFLAGS from dpkg-buildflags (origin: vendor): -g -O2
dpkg-buildpackage: export FFLAGS from dpkg-buildflags (origin: vendor): -g -O2
dpkg-buildpackage: export LDFLAGS from dpkg-buildflags (origin: vendor):
dpkg-buildpackage: source package publican
dpkg-buildpackage: source version 2.1-2rh1
dpkg-buildpackage: source changed by Rapha l Hertzog <hertzog>
 dpkg-source --before-build publican-2.1
dpkg-buildpackage: host architecture i386
[...]
dpkg-deb: building package  publican' in  ../publican_2.1-2rh1_all.deb'.
 dpkg-genchanges  >../publican_2.1-2rh1_i386.changes
dpkg-genchanges: not including original source code in upload
 dpkg-source --after-build publican-2.1
dpkg-buildpackage: binary and diff upload (original source NOT included)
Now running lintian...
Finished running lintian.

The build is over, the updated source and binary packages have been generated in the parent directory.

$ cd ..
$ ls -dF publican*
publican-2.1/                    publican_2.1-2rh1.dsc
publican_2.1-2.debian.tar.gz     publican_2.1-2rh1_i386.changes
publican_2.1-2.dsc               publican_2.1-2rh1_source.changes
publican_2.1-2rh1_all.deb        publican_2.1.orig.tar.gz
publican_2.1-2rh1.debian.tar.gz

Do you want to read more tutorials like this one? Click here to subscribe to my free newsletter, you can opt to receive future articles by email.

11 comments Liked this article? Click here. My blog is Flattr-enabled.

The two first interviews were dedicated to long-time Debian developers. This time I took the opposite approach, I interviewed David Kalnischkies who is not (yet) a Debian developer. But he s contributing to one of the most important software within Debian the APT package manager since 2009. You can already see him in many places in Debian sharing his APT knowledge when needed. English is not his native language and he s a bit shy, but he accepted the interview nevertheless. I would like to thank him for the efforts involved and I hope his story can inspire some people to take the leap and just start helping My questions are in bold, the rest is by David. Who are you? I am David Kalnischkies, 22 years old, living in the small town Erbach near Wiesbaden in Germany and I m studying computer science at the TU Darmstadt. Furthermore I am for more than half a decade now young group leader of my hometown. I never intended to get into this position, but it has similarities with my career in this internet-thingy here. I don t remember why, but in April 2009 I was at a stage that some simple bugs in APT annoyed me so much that I grabbed the source, and most importantly I don t know why I did it but I published my changes in Mai with #433007, a few more bugs and even a branch on launchpad. And this public branch got me into all this trouble in June: I got a mail from Mr. package managment Michael Vogt regarding this branch A few days later I joined an IRC session with him and closely after that my name appeared for the first time in a changelog entry. It s a strange but also addicting feeling to read your own name in an unfamiliar place. And even now after many IRC discussions, bugfixes and features, three Ubuntu Developer Summits and a Google Summer of Code in Debian, my name still appear in places I have never even thought about e.g. in an interview. What s your biggest achievement within Debian? I would like to answer MultiArch in APT as it was my Google Summer of Code project, but as it has (not much) use for the normal user at this point will hopefully change for wheezy I chose three smaller things in squeeze s APT that many people don t even know yet:

• MMap run out of room , the most famous error related to the APT::Cache-Limit option is gone. The DynamicMMap in APT now deserves its name
• Download and usage of multiple Translations of Descriptions
• crazy stuff like apt-cache show ^apt-.*$/experimental works

If your impression is now that I only do APT stuff: that s completely right, but that s already more than enough for me for now as the toolchain behind the short name APT contains so many tools and use cases that you always have something different. You re an active member of the APT development team. Are there plans for APT in Debian Wheezy? What features can we expect? That s very hard to answer, as the team is too small to be able to really plan something. I mean, you can have fancy plans and everything and half a second later someone arrives on the mailing list with a small question which eats days of development time just for debugging But right now the TODO list contains (in no particular order):

• MultiArch managing packages built for different architectures like i386 on amd64 to ease the usage of packages which only work on specific architectures or cross-compiling.
• rewriting the subsystem responsible for downloading files to e.g. enable tools like apt-file or debtags to reuse the infrastructure by plugging into it.
• splitting long descriptions out of the Packages file to possibly decrease the size to download on an apt-get update . Includes mostly pulling the button only to enable it by the archive masters
• backporting popular features of some frontends to enable all frontends to use them, e.g. apt-get changelog or apt-get download
• support research on resolver improvements by implementing support for a distribution independent upgrade problem format (CUDF).
• an additional single binary for users wrapping apt-get, apt-cache and co.
• getting in contact (again) with various forks like apt-rpm and derivatives like maemo or telesphoreo to join forces instead of splitting them by working on different (and possibily very old) heads of the dragon

We will see what will get real for wheezy and what is postponed, but one thing is sure: more will be done for wheezy if you help! If you could spend all your time on Debian, what would you work on? I would spend it on APT s debbugs count zero would be cool to look at! We make progress in this regard, but with the current velocity we will reach it in ten years or so. Reading more mailing lists would be interesting, as I am kind of an information junky. Maintaining a package could be interesting to share the annoyance of a maintainer with handcrafted dependencies just to notice that APT doesn t get it in the way I intended it to be. Through, to make it feel real I need to train a few new APT contributors before so they can point my mistake out, but this unfortunately doesn t depend so much on time but on victims Maybe I could even be working on getting an official status. Beside that, I would love to be able to apt-get dist-upgrade the increasing mass of systems I and many others carry around in their pockets. In regards to my phone, this is already fixed, but there is much room for improvements. What s the biggest problem of Debian? You need to be lucky. You need to talk at the right time to the right person. That s not really a debian-only problem as such, but in a global project full of volunteers you can see it clearly as there are plenty of opportunities to be unlucky. For example, it s unlikely that an interview would be made with me now if Michael had not contacted me in June 2009. In a big project like Debian, you are basically completely lost without a mentor guiding you, so things like the debian-mentors list are good projects, but I am pretty certain they could benefit from some more helping hands. The other thing which I consider a problem is that and I read from time to time some people don t care for translations. That s bad. Yes, a developer is able to read English, otherwise s/he couldn t write code or participate on the mailinglists. Still, I personally prefer to use a translated application if I have the chance as it s simply easier for me to read in my mother tongue, not only because I am dyslexic, but because my mind still thinks in German and not in English. Yes, I could personally fix that by thinking in English only from now on, but its a quite big problem to convince my family which is not really familiar with tech-stuff to use something if they can t understand what is written on screen. It was hard enough to tell my mother how to write an SMS in a German interface. My phone with English words all over the place would be completely unusable for her despite the fact that my phone is powered by Debian and better for the task from a technical point of view. You are not yet an official Debian developer/maintainer, but you re already perceived in the community as one the most knowledgeable person about APT. It s a great start! What s your advice to other people who want to start contributing to Debian in general, and to APT in particular? It was never a goal in my life to start contributing . My goal was and still is to make my life easier by letting the computer work for me. At some point APT hindered the success of this goal, so it needed to be fixed. I didn t expect to open pandora s box. So, my advice is simple: Just start. Ignore the warning signs telling you that this is not easy. They are just telling you that you do something useful. Only artificial problems are easy. Further more, contribution to APT, dpkg or any other existing package is in no way harder than opening an ITP and working on your own, and it s cooler as you have a similar minded team around you to talk to. APT didn t accept release codenames as target release was one of the first things I fixed. If I had asked someone if that would be a good starting point the answer would have been a clear no , but I didn t search for a good starting point As a kid I can start playing football by just walking on the field and play or I can sit near the field, watching the others play, while analyzing which position would be the best for me to start ruling out one by one as the technical requirements seem too high Oh bicycle kick that sounds complicated I can t do that Julian Andreas Klode is working on a APT replacement, there s also Cupt by Eugene V. Lyubimkin. Both projects started because their authors are not satisfied with APT, they find APT s code difficult to hack partly due to the usage of C++. Do you share their concerns and what s your opinion on those projects? I don t think C++ is a concern in this regard, after all cupt is currently rewritten to C++0x and APT2 started in vala and is now C + glib last time I checked at least. I personally think that something is wrong if we need to advertise an application by saying in which language it is written The major problem for APT is probably that the code is old : APT does its job for more than 12 years now, under different maintainers with an always changing environment around it: so there are lines in APT which date from a time when nobody knew what a Breaks dependency is, that packages can have long descriptions which can be translated or even that package archives can be signed with a gpg key! And yet we take all those for granted today. APT has proven to adapt to these changes in the environment and became in this process very popular. So I don t think the point is near (if it will come at all) that APT can go into retirement as it is completely replaced by something else. The competitors one the other hand have their first 12 years still to go. And it will be interesting to see how they will evolve and what will be the state of the art in 2022 But you asked what I think about the competitors: I prefer the revolution from inside simply because I can see effects faster as more users will profit from it now. Cupt and co. obviously prefer the normal revolution. The goal is the same, creating the best package manager tool, but the chosen way to the goal is different. aptitude and cupt have an interactive resolver for example: that s something I dislike personally, for others that is the ultimate killer feature. cupt reading the same preference file as APT will have a different pinning result, which we should consider each time someone mentions the word drop-in replacement . APT2 isn t much more than the name which I completely dislike currently from a user point of view, so I can t really comment on that. All of them make me sad as each line invested in boilerplate code like configuration file parsing would be in my eyes better be spent in a bugfix or new feature instead, but I am not here to tell anyone what they should do in their free time But frankly, I don t see them really as competitors: I use the tools I use, if other do that too that s good, if not that s their problem. The thing that annoys me really are claims like plan is to remove APT by 2014 as this generates a vi vs. emacs like atmosphere we don t need. If some people really think emacs is a good editor who cares? I really hope we all can drink a beer in 2022 in Milliways, the restaurant at the end of the package universe, remembering the good old 2010 Is there someone in Debian that you admire for his contributions? No, not one, many! Michael Vogt who has nearly the monopole of package manager maintainer by being upstream of APT, synaptics and software center to name only the biggest and still has the time to answer even the dumbest of my questions. Jason Gunthorpe for being one of the initial developers behind deity who I will probably never meet in person beside in old comments and commit logs. Christian Perrier for caring so much about translations. Obey Arthur Liu as a great admin for Debian s participation in Google s Summer of Code. Paul Wise for doing countless reviews on debian-mentors which are a good source of information not only for the maintainer of the package under review. I guess I need to stop here because you asked for just one. So let s end with some big words instead: I am just a little cog in the big debian wheel

---

Thank you to David Kalnischkies for the time spent answering my questions. I hope you enjoyed reading his answers as I did. Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Twitter and Facebook.

3 comments Liked this article? Click here. My blog is Flattr-enabled.

I attended a workshop sponsored by the IAB, W3C, ISOC and MIT on Internet Privacy. The workshop had much more of a web focus than it should have: the web is quite important should certainly cover a majority of the time, but backend issues, network issues, and mobile applications are certainly important too. For me this workshop was an excellent place to think about linkability and correlation of information. When people describe attacks such as using the ordered list of fonts installed in a web browser to distinguish one person from another, it s all too easy to dismiss people who want to solve that attack as the privacy fringe. Who cares if someone knows my IP address or what fonts I use? The problem is that computers are very good at putting data together. If you log into a web site once, and then later come back to that same website, it s relatively easy to fingerprint your browser and determine that it is the same computer. There s enough information that even if you use private browsing mode, clear your cookies and move IP addresses, it s relatively easy to perform this sort of linking. It s important to realize that partially fixing this sort of issue will make it take longer to link two things with certainty, but tends not to actually help in the long-run. Consider the font issue. If your browser returns the set of fonts it has in the order they are installed, then that provides a lot of information. Your fingerprint will look the same as people who took the same OS updates, browser updates and installed the same additional fonts in exactly the same order as you. Let s say that the probability that someone has the same font fingerprint as you is one in a million. For a lot of websites that s enough that you could very quickly be linked. Sorting the list of fonts reduces the information; in that case, let s say your probability of having the same font set as someone else is one in a hundred. The website gets much less information from the fonts. However it can combine that information with timing information etc. It can immediately rule out all the people who have a different font profile. However as all the other people who have the same font fingerprint access the website over time, differences between them and you will continue to rule them out until eventually you are left. Obviously this is at a high level. One important high-level note is that you can t fix these sorts of fingerprinting issues on your own; trying makes things far worse. If you re the only one whose browser doesn t give out a font list at all, then it s really easy to identify you. The big question in my mind now is how much do we care about this linking. Governments have the technology to do a lot with linking. We don t have anything we technical we can do to stop them, so we ll need to handle that with laws. Large companies like Google, Facebook and our ISPs are also in a good position to take significant advantage of linking. Again, though, these companies can be regulated; technology will play a part, especially in telling them what we re comfortable with and what we re not, but most users will not need to physically prevent Google and Facebook from linking their data. However smaller websites are under a lot less supervision than the large companies. Unless you take significant steps, such a website can link all your activities on that website. Also, if any group of websites in that space want to share information, they can link across the websites. I d like to run thought experiments to understand how bad this is. I d like to come up with examples of things that people share with small websites but don t want linked together or alternatively don t want linked back to their identity. Then look at how this information could be linked. However, I m having trouble with these thought experiments because I m just not very privacy minded. I can t think of something that I share on the web that I wouldn t link directly to my primary identity. I certainly can t find anything concrete enough to be able to evaluate how clearly I care to protect it. Helping me out here would be appreciated; if you can think of fairly specific examples. There s lots of important I prefer to keep private like credit card numbers, but there, it s not about linking at all. I can reasonably assume that the person I m giving my credit card number to has a desire to respect my privacy.a

LWN has a recent article titled The dark side of open source conferences which concerns sexual assault at conferences [1].There are a significant number of comments with attempts to derail the discussion in ways that can really only be interpreted as attacks on Autistic people. The claims seem to be that the problem is not violent sexual assault at conferences, but guys on the Autism Spectrum who hit on girls when they don t want it. Naturally no supporting evidence was made for such claims. But that doesn t stop the discussion which has a logical end-point of excluding people like me from conferences.The IronyI think it s ironic that those who are making claims about what they call empathy disorders have failed to be Empathic by not realising the following things:

• Women who start a discussion about serious sexual assault probably aren t going to be happy if someone starts talking about chat-up attempts. While unwanted chat-up attempts are unpleasant they are in a different category and mixing them seems to be diminishing the significance of violent attack.
• Most members of a minority group (in this case women in the Free Software community) probably don t want discussions of how to help their group diverted by discussions that attack another minority group. What looks a lot like a divide and conquer attack against minority groups isn t going to be appreciated by members of either group and probably members of other minority groups who see what s happening aren t going to like it.
• There is no reason why people should require significant exposure to members of a minority group to treat them in a decent manner. The claim that we need more women at conferences so that men can get used to them and not treat them badly is ridiculous. Among the many stupid aspects of that idea is forgetting the fact that women comprise 52% of the population in first-world countries and we all deal with women every day. Women at IT conferences are not fundamentally different from women in the rest of society.
• When most people interpret your writing in a way other than what you intended it seems to be a reasonable assumption that you failed to explain things clearly. Telling everyone who disagrees to get therapy is unlikely to help convey your point. Telling people to get therapy is particularly likely to get a bad reaction if you are discussing something that actually involves dealing with psychologists.
• When there is an obvious resource on the Internet relating to a topic it s a good idea to read it instead of just making stuff up. Failing to do so will be taken as an indication that you aren t trying to be Empathic. The Wikipedia section on Autism Spectrum Disorders has a lot of useful information [2]. Please read it before making comments about Autism and Empathy.
• Having to be told how other people feel is not inherently a sign of a lack of Empathy. Asking people how they feel because you can t work it out is a sign of Empathy as it indicates an acknowledgement that other people have different emotions and you probably don t understand them all. The people who know that they can t understand other people and listen when told are probably better than average when it comes to Empathy.
• Finally what people say about themselves and their own experiences should be taken seriously.

Some Final PointsInstead of talking about how some other people should be more Empathic it seems that a better idea would be to try and demonstrate Empathy. Set a positive example.I did a Google search for Empathy Disorder and found this interesting article [3]. It s about how Neuro-Typical people (people who aren t on the Autism Spectrum) can learn to be more Empathic, it s probably more relevant to the issue of Empathy in the free software community than discussions of Autism.I think that the experience of a lot of people on the Autism Spectrum is similar to mine. It s not that we can t work things out it s just that it takes a lot longer. For things that can t be worked out in real time we have rules based on past experience. Naturally the rules include don t touch people and don t try to chat up women at conferences .Here is a link to my previous post on this topic [4].Update: I ve clarified some of the writing and added an extra point about having to be told how others feel.

• [1] https://lwn.net/Articles/417952/
• [2] http://en.wikipedia.org/wiki/Empathy#Autism_spectrum_disorders
• [3] http://articles.cnn.com/2008-06-18/living/o.empathy_1_empathy-friend-disorder
• [4] http://etbe.coker.com.au/2010/12/03/aspie-social-skills-free-software/

LWN has an article by Valerie Aurora titled The dark side of open source conferences [1] which is about sexual harassment and sexual assault at Free Software conferences. Apparently some conferences create such a bad environment that some people won t attend, it s a well researched article that everyone in the community should read.The Autism DerailmentThe comments have the usual mix of insight, foolishness, and derailment that you expect from such discussions. One derailment thread that annoyed me is the discussion about men on the Autism Spectrum started by Joe Buck [2]. Joe seems to believe that the 1% of males on the Autism Spectrum (and something greater than 1% but a lot less than 50% in the Free Software community) are a serious part of the problem because they supposedly hit on women who aren t interested in them in spite of the fact that the article in question is about women who are being insulted, harassed, and groped at at open source conferences . The article had no mention of men who try to chat up women presumably this was a deliberate decision to focus on sexual assault and harassment rather than what Joe wanted to talk about.In response Mackenzie made the following insightful point:I don t think any autistic person who is high-functioning enough to A) contribute to open source B) want to be at an event with so many people and C) carry on any sort of conversation is low-functioning enough not to understand stop or no. If you can understand your patch has been rejected, you can likely understand don t do that again. Understanding how Other People FeelBruce Perens claimed What they [Aspies] don t understand is how the other person in the situation feels . Like many (possibly most) people Bruce doesn t seem to get the fact that no-one can really understand how other people feel. The best logical analysis of this seems to be the Changing Emotions article on Less Wrong [3]. While Less Wrong deals with Male to Female conversion as the example (which may be relevant to the discussion about the treatment of women) the same logic also applies to smaller changes. Anyone who even thinks that if they would always be able understand how their identical twin felt (if they had one) probably hasn t considered these issues much. As an aside, having a psychologist diagnose you as being on the Autism Spectrum and therefore by implication thinking differently to 99% of the population really makes you consider the ways in which other people might have different thought processes and experiences.Every time we have a discussion about issues related to sexism in the Free Software community we get a lot of documented evidence that there are many people who are apparently neuro-typical (IE not Autistic) who don t understand how other people think in many cases they go so far as to tell other people what their emotional state should be.What Really HappensNix said However, in that situation our natural reflex is to *get out of there*, not to jump on women like some sort of slobbering caveman which is a really good summary.In more detail, I think that the vast majority of guys who are on the Autism Spectrum and who are able to do things like attend computer conferences (*) realise that chatting up a random girl that they meet is something that just isn t going to work out. Generally people don t attempt things that they expect to fail so I don t think that Autistic guys are going to be hitting on girls at conferences.(*) Having never met any Autistic people who aren t capable of attending such conferences I can t speak for them. I really doubt that the Low Functioning Autistic guys are as much of a problem as some people claim, but lack evidence. In any case the actions of people who don t attend conferences aren t relevant to a discussion about things that happen at conferences.Update: It Keeps GoingDion claims that the misogyny at conferences is due to socially inept people, he also casually switches between discussing people who misunderstand when someone is flirting and people who hire almost-naked booth-babes (two very different classes of action) [4]. Several people asked for supporting evidence, naturally none was provided.In response njs posted a link to Marissa Lingen s blog post Don t blame autism, dammit [5]. Marissa points out that people who offend other people due to lacking social skills will tend to do so in times and places that are likely to get a bad reaction if you don t know that you are doing something wrong then there s no reason to hide it. If someone offends a senior manager at a corporate event then it could be because they are on the Autism Spectrum (I ve apparently done that). If someone offends junior people at a times and places where there are no witnesses but is always nice to managers and other powerful people then it s not related to Autism.One final note, I have little tolerance for anyone who claims to be an Aspie when they do something wrong. You are either on the Autism Spectrum all the time or none of it. Anyone who wants any sympathy for me for an occasion where they stuffed up due to being an Aspie can start by making a clear statement about where they are on the Autism Spectrum.Update2: Yet More from Bruce PerensBruce wrote IMO, the kind of men who go in to software engineering suffer a lack of healthy interaction with women who are their peers, and it may be that the high incidence of empathy disorders in our field is involved (which seems to be part of the inspiration for Joe Buck later in that thread) and now claims Nobody here was trying to connect Asperger s or autism with the touching incidents or violent crime .Matthew Garrett responded to that with If you weren t trying to say that the high incidence of empathy disorders in our field was related to a lack of healthy interaction with women who are their peers, and that that has something to do with incidents of sexual harassment or assault at conferences, what were you trying to say? Because that sounds awfully like We wouldn t have so many problems if it weren t for all the autists .Bruce s latest comment is If you choose to read something that nasty into my writing, that s your problem. Get therapy .Through this discussion I ve been unsure of whether to interpret the statements by Bruce et al the way Matthew does or whether I should consider them as merely a desperate attempt to derail the discussion. I can t imagine any possible way of interpreting such comments in connection with the discussion of sexual assault as anything other than either trivialising violent crimes against women (suggesting that they are no worse than asking out someone who s not interested) or claiming that anyone who lacks social skills should be treated as a violent sexual predator. It s just not reasonable to believe that every single person who wrote such comments referring to Autism was misunderstood and really meant something nice.As a general rule I don t think that it s the responsibility of other people to try and find a non-offensive interpretation of something that one might say. I don t think that all the people who strongly disagree with the most obvious and reasonable interpretations of Bruce s comments should get therapy. I think that Bruce should explain what he means clearly.

• [1] http://lwn.net/Articles/417952/
• [2] http://lwn.net/Articles/418209/
• [3] http://lesswrong.com/lw/xe/changing_emotions/
• [4] http://lwn.net/Articles/418281/
• [5] http://mrissa.livejournal.com/746160.html