Even if I recently stated I lost some of my faith in XCB, I still sometimes hack things to add support for it. These last days, I've worked on a D-Bus port from Xlib to XCB. The port was quite straight forward, since there's only a little piece of D-Bus using X, which is dbus-launch. I though D-Bus was a good candidate, since it's part of the Freedesktop initiative. Therefore, I was expecting a warm welcome and some enthusiasm from a fellow project. My contribution got one useful review, and a cold reply from Thiago Macieira (a KDE/Qt/Nokia developer):

No, sorry, I don't agree.. I've just checked and my Solaris machine doesn't have XCB. Please do not remove the X11 code. You may add the XCB code, but you cannot remove the X11 code.

This is not really the kind of answer I expected, actually. I then reworked the code to please Thiago, and added some #ifdef to add XCB support to D-Bus, with a fallback to libx11 where XCB would not be available. Havoc Pennington replied:

Given that libX11 now uses xcb as backend, I don't understand the value of porting to use libxcb directly when there isn't an issue of round trips or other stuff. It will just make #ifdef hell, while the X11 API is an API that works on both xcb and non-xcb platforms. Maybe people should be thinking about porting xcb to non-Linux platforms? The X protocol should be the same on other UNiX, so xcb in theory ought to work fine if you just compiled it on Solaris/BSD, same as GTK or dbus or Qt would work fine.

The last part "Maybe people should be thinking about porting xcb to non-Linux platforms?" is still unclear to me, even though I asked Havoc to explain what he meant. Finally, Thiago refused to merge the patch:

[ ] thanks for the patch, but like Havoc I am unsure of the value. We can't drop the X11 codepaths now because too many systems exist without XCB. Adding the XCB codepaths only made it more complex, even though you did a good job.

I can't disagree with that conclusion: using both XCB and X11 make the code unreadable for little gain. That's why I did replace libx11 by XCB directly in the first version of the patch. On the other hand, D-Bus people does not seems to really care about making their software evolve in the right direction, even if that requires users to upgrade their systems. I think D-Bus using and depending on XCB would have been a good point to push adoption of XCB. Unfortunately, it seems you can't even rely of projects of the same initiative (i.e. Freedesktop) to work together to make things a little bit better. After 5 years of existence, XCB is still not so obvious to people, and making it adopt is going to be a challenge for the next years. The upside is that new X.org 7.6 will bring XCB with it, as part of the katamari.

I guess we all have the challenge of how to easily get a link or a phone number or some other strings of data from the computer to the mobile phone. With the help of mobile barcodes and klipper, this is now possible in KDE Trunk to do easily. Place some data in clipboard, click on klipper and select Show barcode. To read it, open the barcode app in your phone (mBarcode on n900 for example) and point it to your monitor.

While I have made good progress on many of my Debian goals for this year, it s not the case for the goal number #1: translating my Debian book into English. The picture on the left is the cover of the current French version based on Debian Lenny (450 pages). But the translation would be based on the next edition that we re currently preparing and it s based on Debian Squeeze of course! We have already translated the table of contents so that you can get an idea of what s in the book. Note that many parts of the book apply to Ubuntu as well. It s quite difficult for Roland and me to allocate several months of our life to such a huge task without any income in that period and without knowing if our book will sell enough to cover for the time invested. For those reasons, we re considering using a service like kickstarter.com or ulule.com or yooook.net to get this project funded. If you don t know those services, they allow you to present your project and to collect pledges so that you can safely complete your project. The money pledged is distributed only if the total amount pledged exceeds the minimal funding level (set by the project creator). Furthermore you can select nice rewards depending on the amount of money pledged. To make things even more exciting we are ready to publish the book under a DFSG-compatible license at the sole condition that we reach 25 000 of donations. That might look like a lot but in fact it s only 5 donated by 5000 persons and then everybody benefits! And for the authors, you have to remove ~10% of fees taken by the funding service (including card processing fees), 16.4% VAT, 9% social taxes and if you consider that the project represents a minimum of 6 months of work, that ends up to at most 2850 /month. We believe this to be reasonable. The next step for us is to pick the service to use and setup the fundraising. We need your input. Please answer a few questions by filling this form. In all cases, we will have those rewards and probably more:

• the book in digital format (PDF, HTML, ePub) (between 5 and 10 , price not fixed yet)
• the book as paperback (between 35 and 50 , price not fixed yet)
• the paperback book with a dedication by (one of) the authors

A few considerations about the various services: Kickstarter.com is a great service but it s restricted to US-residents so it s complicated for us to use that service since we re French (and live in France) and the supporters need to have an Amazon (payments) account. Ulule.com is open to anyone for project creation but uses a paypal API to deal with the pledge mechanism and thus imposes that all supporters have a paypal account. Is that requirement likely to scare you away? Yooook.net is specialized in liberation fundraising but the interface is not very polished, they don t offer (many) social features nor do they give a public listing of the projects hosted. The choice is difficult and thus we re seeking your feedback to make the right one, take a few minutes and answer our questions: click here to go to the form. Thank you for your help and please spread the word so that we get enough answers to have meaningful results. Update: it has been brought to my attention that kickstarter requires an Amazon (payments) account. I fixed my article and the form to document this. I have also been asked what license we re going to use. It s likely to be dual-licensed GPL2+ / CC-BY-SA 3.0. 4 comments Support my work

It's been my intention to mention new Lintian and Debian Policy releases here as well, but I've not been doing very well with that (or with writing things here in general) for the last bit. But I'll see if I can change that up now. I wanted to get a new Policy release out before DebConf10 and got that out Sunday night. This doesn't have anything as dramatic as the Breaks/Conflicts or architecture wildcard changes in 3.9.0, but there are a lot of interesting improvements and updates. There's even more coming in the next release, which I'm hoping will include a long-overdue improvement to the summary of maintainer scripts. The Lintian release is mostly just adjustments for the new version of Policy, but I tried to take a quick pass through the open bugs and resolve as many as I could in a day as well. Major projects in Lintian are still on hold right now, since I just don't have enough time given the other things that I'm trying to do. The Policy changes of note are summarized in the upgrading checklist included in the debian-policy package and were all listed in the debian-devel-announce message.

In my previous post about the Yubikey I suggested that computer users groups should arrange bulk purchases to get the best prices [1]. I ran such a buying club for Linux users in Australia as well as members of SAGE-AU [2]. The keys have arrived and I now have to start posting them out. Above is a picture of two boxes that each contain 100 keys. Presumably if you buy a smaller number of keys then you get more fancy packing. Thanks to Yubico for giving us a greater discount than the usual discount rate for boxes of 100 keys!

• [1] http://etbe.coker.com.au/2010/03/15/yubikey/
• [2] http://www.sage-au.org.au/

I had planned long for this Debconf and with the experience from the previous times I did all I could to reach one goal minimise stress. I think I got it right this time. First of all I got my company (Accenture) pay for the whole thing, so I did not have to worry about sponsorship queue (but instead I must gather and deliver them back some knowledge gained from the conference should be easy). I also managed to get a direct flight there is a weekly flight Tashkent-Riga-New York on Sundays and I got a ticket for that both ways. This took many hours off the travel time and reduced the stress a ton. Then I also did all the prudent travelling things: mostly reading the New York page on Wikitravel. This told me (among other things) what metro line to take to get the best view of the city. And for luggage I took a backpack (for the laptop and walking around) and a roller (for the clothes). I learned a lot from the Up in the air movie, it really teaches one how to take stress out of travel. This went very well in the beginning I took a bus to the airport early, checked in, breezed trough security and then waited and waited. The boarding only started half an hour after we were scheduled to depart. But I can not complain, because the flight attendant called my name (among a few others) just before boarding and changed my ticket I was bumped up to business class . It has been many years since I ve flown a regular (non-budget) airline and now first time ever in the business class! We got regular class meals, but at least we got to sit in the big chairs with lots of leg room. It was great! I bought a paper book (from Charles Stross) to read during the flight, because that is the only thing you can do during take-off and landing and I had some stuff to listen to in my iPhone. I tried sleeping and I think I managed to kill a couple hours that way too. It sure helped combat jet lag later on. When I arrived, I had my immigration and customs forms filled out. Latvia is on the USA Visa Waiver program, so I just had to fill out a form online prior to the trip to get a permission to enter USA. I only had one printout of the Waiver confirmation page and my airline took that before giving me a boarding pass, so I had no paper copy to give to the guy at the USA border, but he did not even ask for it he only took the two forms I filled out, scanned my passport, took my fingerprints (all fingers) and a photo. Then he gave me back the customs for (stamped) and I could go get my luggage. After that it was just a matter of walking trough customs and giving the customs official the pre-filled and stamped customs form. I was not stopped further. The AirTrain was a bit confusing you just get on the AirTrain and go where you need to go, you actually pay at the place where AirTrain connects to metro, so when you are coming from the airport you are actually paying ($5) when you are exiting the AirTrain system. There are plenty of AirTrain people that will give you an AirTrain ticked for $5 cash right there or you can use a machine to get it (where you can also pay with a card). The machines also take AmEx, but you must know the PIN code, if your don t know the PIN of you AmEx card (like I don t know the PIN of my corporate AmEx) you can only buy MetroCards at news stands, but there you will not find the unlimited ride tickets only 5 or 10 ride tickets are available. Next I screwed up a bit and thus got a bit lost in the New York metro system. The Wikitravel recommends to take the AirTrain to Jamaica station and from there take J or Z line into the city for the best views. I went to Jamaica and got into the first metro train that came on to the platform. Unfortunately, that was the E line train and it does not cross with J or Z lines after that, so I was stuck. To complicate the situation E line is under repair, so after a few stops the trains diverted to the F line and I had to scramble to figure out where to get out to get to the 1 line where Columbia University is. I ended up spending more than an hour in the metro, but I got there in the end. So I emerge from the 116th street metro station directly in front of the campus entrance gate and it starts raining. A thunderstorm swept across New York as soon as I stepped outside the metro station, so I took shelter a the side of the building. It kept raining. After a few minutes decided that I don t want to wait any more, so I put all my electronics into my backpack and went towards the dorm where my room was. The rain was warm, people around me were playing and running around in the wet grass, it was fun. The guard showed me where to go to check in. It was really simple sign here, here is you magnetic stripe key, have fun. And the room was just as spartan bed, desk, chair, closet, bathroom and a large fan under the window. The first night I did not know that I could actually turn that fan down, so I slept to the sound of full fan blasting, much like on the airplane. The dorm looks ancient it looks like it was build in the 60s and never changed since then. I mean, I ve lived in worse places, but people would at least change wall sockets or faucets or ceiling paint every other decade or so. The newest things here were the magnetic locks on the doors and a TV and a mini fridge in the hallway. After dropping my things I went off to the Mudd building across the campus to check in with people in the hacklab. It was just starting to take shape, but many great and familiar people were already there. It was like walking into a family home same warm welcome smiles and that great feel of belonging to the group. After I quick chat I went off downtown. The plan was that I left my old Canon 400D camera back at home and that I would buy a new Canon 550D here in New York on arrival. Unfortunately I underestimated the travel time on subway and by the time I got back downtown most shops where already closed. I got to checking out a Best Buy and was told there that they don t have 550D in stock. Next morning I went for a full scale search B&H Photo Video store, J&R Express, another BestBuy none of them had the Canon 550D (aka T2i) in stock in a body-only configuration. BestBuy had a few sets with the kit lens, but I did not want paying 100$ extra for something I already have. The last option was Adorama and I got lucky I nabbed the last 550D they had and it was body-only. Now I was back, with a camera in my hands and the Debconf10 could really begin!

I discovered this while doing automated testing of upgrades from Debian Lenny to Squeeze. A few packages in Debian still got circular dependencies, and it is often claimed that apt and aptitude should be able to handle this just fine, but some times these dependency loops causes apt to fail. An example is from todays upgrade of KDE using aptitude. In it, a bug in kdebase-workspace-data causes perl-modules to fail to upgrade. The cause is simple. If a package fail to unpack, then only part of packages with the circular dependency might end up being unpacked when unpacking aborts, and the ones already unpacked will fail to configure in the recovery phase because its dependencies are unavailable. In this log, the problem manifest itself with this error:

dpkg: dependency problems prevent configuration of perl-modules:
 perl-modules depends on perl (>= 5.10.1-1); however:
  Version of perl on system is 5.10.0-19lenny2.
dpkg: error processing perl-modules (--configure):
 dependency problems - leaving unconfigured

The perl/perl-modules circular dependency is already reported as a bug, and will hopefully be solved as soon as possible, but it is not the only one, and each one of these loops in the dependency tree can cause similar failures. Of course, they only occur when there are bugs in other packages causing the unpacking to fail, but it is rather nasty when the failure of one package causes the problem to become worse because of dependency loops. Thanks to the tireless effort by Bill Allombert, the number of circular dependencies left in Debian is dropping, and perhaps it will reach zero one day. :) Todays testing also exposed a bug in update-notifier and different behaviour between apt-get and aptitude, the latter possibly caused by some circular dependency. Reported both to BTS to try to get someone to look at it.

I just posted this announcement culminating several months of work with the next Debian Edu release. Not nearly done, but one major step completed.

This is the first test release based on Squeeze. The focus of this release is to test the user application selection. To have a look, install the standalone profile and let the developers know if the set of installed packages i.e. applications should be modified. If some user application is missing, or if there are some applications that no longer make sense to be included in Debian Edu, please let us know. Also, if a useful application is missing the translation for your language of choice, please let us know too. In addition, feedback and help to polish the desktop (menus, artwork, starters, etc.) is appreciated. We would like to ship a nice and handy KDE4 desktop targeted for schools out of the box. The other profiles should be installable, but there is a lot more work left to be done before they are ready, so do not expect to much. Changes compared to the lenny based version

• Everything from Debian Squeeze
  • Desktop environment KDE 4.4 => the new KDE desktop in combination with some new artwork
  • Web browser Iceweasel 3.5
  • OpenOffice.org 3.2
  • Educational toolbox GCompris 9.3
  • Music creator Rosegarden 10.04.2
  • Image editor Gimp 2.6.10
  • Virtual universe Celestia 1.6.0
  • Virtual stargazer Stellarium 0.10.4
  • 3D modeler Blender 2.49.2 (new application)
  • Video editor Kdenlive 0.7.7 (new application)
• Now using Kerberos for password checking (migration not finished). Enabled for:
  • PAM
  • LDAP
  • IMAP
  • SMTP (sender verification)
• New experimental roaming workstation profile for laptops.
• Show welcome page to users when they first log in. The URL is fetched from LDAP.
• New LXDE desktop option, in addition to KDE (default) and Gnome.
• General cleanup (not finished)

The following features are not working as they should

• No web based administration tool for creating users and groups. The scripts ldap-createuser-krb and ldap-add-user-to-group can be used for testing.
• DVD installs are missing debian-installer images for the PXE boot, and do not set up the PXE menu on eth0 because of this. LTSP clients should still boot from eth1 on thin client servers.
• The restructured KDE menu is not implemented.
• The LDAP server setup need to be reviewed for security.
• The LDAP directory structure need to be reworked.
• Different sets of packages are installed when using the DVD and the netinst CD. More packages are installed using the netinst CD.
• The jackd package fail to install. This is believed to be caused by some ongoing transition, and hopefully should be solved soon. The jackd1 package can be installed manually for those that need it.
• Some packages lack translations. See http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status, and help out with translations.

To download this multiarch netinstall release you can use

• ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso
• http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso
• rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso

To download this multiarch dvd release you can use

• ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso
• http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso
• rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso

There is no source DVD available yet. It will be prepared when we get closer to the final release. The MD5SUM of these images are

• 3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso
• 22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso

The SHA1SUM of these images are

• c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso
• 2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso

How to report bugs: http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla Please direct replies to debian-edu@lists.debian.org

About two weeks ago I got a Wifly-City G2000, the world's most powerful 802.11bg wireless network card. It features 2000mW which is 10 times more than the legally allowed limit of 200mW in Switzerland (or 2 times more than the allowed 1000mW in the USA, 5 times more than the allowed 400mW in Brazil, or 20 times more than the allowed 100mW in the EU). Contents The adapter is sold as a set named Wifly-City AVATAR-4PA with some accessories. click on the images for full resolution The box prominelty lists Linux compatibility and contains the following part:

• 1x Wireless Network Adapter with standard USB Type Mini-B
  (blue top face, black rear side)
• 1x 7dbi omnidirectional Antenna (black; SMA)
• 1x 10db directional Antenna (black; SMA)
• 1x 1m USB Cable (black; one Type A to Type Mini-B)
• 1x 5m USB Y Cable¹ (transparent; two Type A in Y to Type Mini-B)
• 1x Suction Cup (black)
• 1x 8cm Mini-CD with drivers and a manual

The adapter has a Realtek 8187L chipset. This is particulary nice since there is no firmware needed for this chipset (therefore no questinable binary-only firmware blob). Also, it works out of the box with any Linux as of kernel version 2.6.30 and newer. I tested it on lenny with kernel backports, vanilla squeeze and vanilla sid. In all of these setups, it works out of the box without any configuration whatsoever - just plug it in and it works. I know that this is how it is supposed to be but still, I am always surprised again when things just work. For those who care, this is the output of dmesg when plugging in the card...

[...]
usb 1-1: new high speed USB device using ehci_hcd and address 6
usb 1-1: New USB device found, idVendor=0bda, idProduct=8187
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: RTL8187_Wireless_LAN_Adapter
usb 1-1: Manufacturer: Manufacturer_Realtek_RTL8187_
usb 1-1: SerialNumber: xxxxxxxxxxxx
usb 1-1: configuration #1 chosen from 1 choice
phy1: Selected rate control algorithm 'minstrel'
phy1: hwaddr xx:xx:xx:xx:xx:xx, RTL8187vB (default) V1 + rtl8225z2, rfkill mask 2
rtl8187: Customer ID is 0xFF
Registered led device: rtl8187-phy1::tx
Registered led device: rtl8187-phy1::rx
rtl8187: wireless switch is on
usbcore: registered new interface driver rtl8187
ADDRCONF(NETDEV_UP): wlan1: link is not ready
wlan1: direct probe to AP xx:xx:xx:xx:xx:xx (try 1)
wlan1: direct probe responded
wlan1: authenticate with AP xx:xx:xx:xx:xx:xx (try 1)
wlan1: authenticated
wlan1: associate with AP xx:xx:xx:xx:xx:xx (try 1)
wlan1: RX AssocResp from xx:xx:xx:xx:xx:xx (capab=0x411 status=0 aid=5)
wlan1: associated
ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
wlan1: no IPv6 routers present
[...]

...and this is the output of lsusb:

Bus 001 Device 006: ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter

Special Offer I have played with the card for some time now and am really pleased with it. It works nicely with all the standard tools (aircrack-ng, kismet, etc.). The only bummer is that the card is quite expensive. Fortunately, we could arrange a good deal for Free Software people where the store selling it does not make any money on it: instead of 89 USD you can get it for 68 USD (including everything). If you are interested in getting one and you are comming to DebConf 10 in New York between 2010-07-25 and 2010-08-08, you can write an email to Ralph Amissah or speak to Ralph personally during the event. ¹ I have no idea why they are shipping with a Y cable because the adapter does not need one. However, it does not disturb and in case I ever need an Y cable, I now have one :)

Sometimes I write things that are for myself, and later decide to release on the off-chance other people might be interested. I've hated procmail for a long time, but it is extremely flexible, and for the longest time I figured since I'd got things working the way I wanted there was little point changing. When it comes to procmail there are few alternatives:

• Exim filters.
• Maildrop.
• Email::Filter

Unfortunately both Exim and Email::Filter suffer from a lack of "pipe" support. To be more specific Exim filters and Email::Filter allow you to pipe an incoming message to an external program - but they regard that as the end of the delivery process. So, for example, you cannot receive a message (on STDIN), pipe it through crm114, then process that updated message. (i.e. The output of crm114). Maildrop does allow pipes, but suffers from other problems which makes me "not like it". My own approach is to have a simple mail-sieve command which is configured thusly:

set maildir=/home/steve/Maildir
set logfile=/home/.trash.d/mail-sieve.log
#
#  Null-senders
#
Return-Path: /<>/        save .Automated.bounces/
#
#  Spam filter
#
filter /usr/bin/crm -u /home/steve/.crm /usr/share/crm114/mailreaver.crm
#
#  Spam?
#
X-CRM114-Status: /SPAM/   save .CRM.Spam/
X-CRM114-Status: /Unsure/ save .CRM.Unsure/
#
#  People / Lists
#
From: /foo@example.com/  save .people.foo/
From: /bar@example.com/  save .people.bar/
..
..
#
#  Domains
#
To: /steve.org.uk$/               save .steve.org.uk/
To: /debian-administration.org$/  save .debian-administration.org.personal/
#
#  All done.
#
save .inbox.unfiled/

On the one hand this is simple, readable, and complete enough for myself. On the other hand if I were going to make it releasable I think I'd probably want to add both conditionals and the ability to match upon multiple header values. Getting there would probably involve something like this on the ~/.mail-filter side :

if ( ( From: /foo@example.com )  
     ( From: /bar@example.com ) )
 
   save .people.example.com/
   exit
 
# ps. remind me how much I hate parsers and lexers?

That starts to look very much like Exim's filter language, at which point I think "why should I bother". Pragmatically the simplest solution would be to add a "Filter" primitive to Email::Filter - and pretend I understood the nasty "Exit" settings. ObQuote: Andre, we don't use profanity or double negatives here at True Directions. - "But I'm a Cheerleader".

yeahhhh!!!

otavio

Wow, it even works!

daniel

I just did some work on two NBD features: authentication and named exports. The first was written by Brad Allen back in 2008. I'd been thinking about an authentication scheme back at DebConf 8, and discussed it on the nbd-general mailinglist. Brad picked it up and ran with it, but it never got finished. Basically, what I did today was forward-port the code so that it would compile (and work) with today's version of the NBD utilities. I tested it and it works, but I'm not sure what to do with it. NBD is not encrypted; so there's no protection against TCP hijacking or some such. Oh well; I might still integrate it into nbd mainline. The second feature is something way more interesting. It had been on my long-term TODO list for quite a while, but I never sat down to implement it. Until today, that is. This patch has been compile-tested, but I haven't functionally tested it yet; I'll do that tomorrow. The main reason it took so long to implement, was that initial NBD handshake made that quite hard. Upon connecting, nbd-server as it currently exists will open the file or block device that it needs to export, and before nbd-client has sent anything sends information on that export (its size, whether or not it is read-only, etc) to the client. Unfortunately, this does mean that I cannot add new features to nbd-server while retaining full backwards compatibility if these features may involve changing what nbd-server sends during the initial handshake, as is the case here. This could be worked around by having the server first send information on a "default" export to the client, and then variate that if the client informs the server that it actually wants something else. But this would have been rather ugly, since it means that errors in open() or stat() calls for the initial "default" export would have to be non-fatal until the client actually tries to read or write to or from the device, at which point they would suddenly become fatal. This would open a can of worms near which I didn't want to tread. The way I fixed it in the end, however, is fairly simple. If names are used to specify an export, nbd-server can live with just one port to export all block devices that it supports, rather than needing many. As such, I can "reserve" one port for the new-style named exports. On this port, nbd-server would expect that clients send a name, and would not function correctly with clients that don't understand names. At the same time, nbd-server could still export the same block devices on other ports as well, using the old-style protocol, for clients that do not support named devices. This would of course require that both the client and the server know perfectly well what the port is, and that it does not change too easily. As such, I've just put in a request for an assigned port number over at IANA, so that I can be sure that the port will not change unexpectedly. This also means I won't make a public release with this change until the port number has been assigned, so that I don't need to support two 'default' nbd-server ports in the future (one "temporary" and one IANA-assigned port). For now, however, I think I'll go grab some food.

A new release (now at version 0.8.5) of Rcpp is now on CRAN and in Debian. This release constitutes a quick follow-up to the last release 0.8.4 which we got out just before CRAN closed for summer vacations. Some fixes were made right after last release: two harmless warnings from the help file parser of the development version of R are now addressed, and we stopped using shell expansions in the Makefile snippets. We also added to some internal speedups we discovered while prepapring the talk about RProtoBuf for last week's useR! meeting. The NEWS entry follows below:

0.8.5   2010-07-25
    o   speed improvements. Vector::names, RObject::slot have been improved
        to take advantage of R API functions instead of callbacks to R
    o   Some small updates to the Rd-based documentation which now points to 
        content in the vignettes.  Also a small formatting change to suppress
        a warning from the development version of R.
    o   Minor changes to Date() code which may reenable SunStudio builds

As always, even fuller details are in Rcpp Changelog page and the Rcpp page which also leads to the downloads, the browseable doxygen docs and zip files of doxygen output for the standard formats. A local directory has source and documentation too. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page

a short description of my experiences on entering the U.S. disclaimer: austrian passport, VWP, EWR airport, yesterday evening.

immigration I spent roughly two minutes at the immigration counter. the dialog with the polite, tired, & probably bored guy was like:

he: what are you doing in the US?
me: going to a computer conference at columbia university.
he: how long are you staying?
me: until the 14^th of august.
/he looks at passport
he: you are here for the first time?
me: yup.
he: (instructions for fingerprint scanning & photo)
he: do you work at home? what are you doing there?
/me explains
/he probably doesn't really listen
/he stamps passport

customs I had ticked "I bring food" on the customs declaration form, & entered "cheese, 0.5 kg, $9" in the "goods to declare" box. the guy handling the queue sent all people without any "yes" ticks straight to the exit, & me to the counter. dialog with the friendly lady:

she: what food are you bringing?
me: two small pieces of cheese.
she: anything else? meat? fruits?
me: no.
she: ok, put your bags here. (belt for the luggage scanner)

that was all, no more questions, no inspections, or whatever. & noone actually looked at the customs declaration form except for the one "yes".

Hey, (Big) Apple! I'll arrive in New York tomorrow to attend the Debcamp and the Debconf. I will a talk about the Java packaging nightmare during the Java track next monday. Some other things i will work on:

- getting sensible-java done
- parallelize dak (the Debian archive kit) because we have 16 cpu cores on ftp-master.debian.org now
- autobuild all packages maintained by the Java packaging team to find FTBFS bug early
- fixing RC bugs maybe?

Yesterday my brother and I checked out of the youth hostel - it was a nice place, but I think it would have been better if we'd had the time to focus on the youth hostelling experience. As it was, I felt like we were just interlopers peeking into a world where we didn't belong. We headed across Central Park and visited the Met, which is huge - and noted with some satisfaction all the things that came from England. When we left, it was raining, and we walked down Fifth Avenue in the downpour. After so much heat, it was a great relief - but it'll probably be straight sunshine for a few days now. After a visit to a Barnes & Noble (which was a novelty, since I don't think they have a UK presence - I bought a book on JQuery), we went up the Empire State Building on a whim. Quite a view, and a cheesy but informative audio guide. Then after fetching our luggage back from the youth hostel, we went our separate ways to our respective accommodation. For me, this meant finding Columbia University. I don't have a great track record with the whole "taking a note of where I'm meant to turn up" thing, and this time saw me wandering around the campus asking directions of people who couldn't understand me. For anyone else with the same habits: you want to find the corner of Broadway and 114th St. (you might get off the #1 subway at Broadway and 116th and walk south), and then proceed down 114th and through the first set of gates on the left. There's a green sign on the gates saying something about "Tech Campus". The Carman building is the first entrance immediately on the left after that. Alternatively you could go through the main campus entrance on Broadway opposite 115th St, and follow the path round the large building on your right until you get to just before the gates. So then stumbling into all the DebConf people, we went for dinner at a local restaurant; and later out to a bar. Now I need to haul my ass outta bed (it's almost 12pm local time) and find the hacklab, or maybe breakfast.

The web offers a compelling platform for developing modern applications. How can free software benefit more from web technology, and at the same time promote more software freedom on the web? What would the world be like if FLOSS web applications were as plentiful and successful as traditional FLOSS applications are today? Web architecture The web, as a collection of interlinked hypertext documents available on the Internet, has been well established for over a decade. However, the web as an application architecture is only just hitting its stride. With modern tools and frameworks, it s relatively straightforward to build rich applications with browser-oriented frontends and HTTP-accessible backends. This architecture has its limitations, of course: browser compatibility nightmares, limited offline capabilities, network latency, performance challenges, server-side scalability, complicated multimedia story, and so on. Most of these are slowly but surely being addressed or ameliorated as web technology improves. However, for a large class of applications, these limitations are easily outweighed by the advantages: cross-platform support, instantaneous upgrades, global availability, etc. The web enables developers to reach the largest audience of users with the most compelling functionality, and simplifies users lives by giving them immediate access to their digital lives from anywhere. Some web advocates would go so far as to say that if an application can be built for the web, it should be built for the web because it will be more successful. It s no surprise that new web applications are being developed at a staggering rate, and I expect this trend to continue. So what? This trend represents a significant threat, and a corresponding opportunity, to free software. Relatively few web applications are free software, and relatively few free software applications are built for the web. Therefore, the momentum which is leading developers and users to the web is also leading them (further) away from free software. Traditionally, pragmatists have adopted free software applications because they offered immediate gratification: it s much faster and easier to install a free software application than to buy a proprietary one. The SaaS model of web applications offers the same (and better) immediacy, so free software has lost some of its appeal among pragmatists, who instead turn to proprietary web applications. Why install and run a heavyweight client application when you can just click a link? Many web applications perhaps even a majority are built using free software, but are not themselves free. A new generation of developers share an appreciation for free software tools and frameworks, but see little value in sharing their own software. To these developers, free software is something you use, not something you make. Free software cannot afford to ignore the web. Instead, we should embrace the web more completely, more powerfully, and more effectively than proprietary systems do. What would that look like? In my view, a FLOSS client platform which fully embraced the web would:

• treat web applications as first-class citizens. The web would not be just another application, represented by a browser, but more like a native application runtime. Web applications could feel much more native while still preserving the advantages of a web-style user experience. There would be no web browser: that s a tool for legacy systems to run web applications within a compatibility environment.
• provide a seamless experience for developers to build web applications. It would be as fast and easy to develop a trivial client/server web application as it is to write Hello, world! in PyGTK using Quickly. For bonus points, it would be easy to develop and run web applications locally, and then deploy directly to a PaaS or IaaS cloud.
• empower the user to manage their applications and data regardless of where they are hosted. Traditional operating systems act as a connecting fabric for local applications, providing a shared namespace, file store and IPC mechanisms, but web applications are lacking this. The web s security model requires that applications are thoroughly sandboxed from each other, but a mediating operating system could connect them in meaningful ways, just as web browsers store cookies and passwords for various websites while protecting them from each other.

Imagine a world where free web applications are as plentiful and malleable as free native applications are today. Developers would be able to branch, test and submit patches to them. What about Chrome OS? Chrome OS is a step in the right direction, but doesn t yet realize this vision. It s a traditional operating system which is stripped down and focused on running one application (a web browser) very, very well. In some ways, it elevates web applications to first-class status, though its paradigm is still fundamentally that of a web browser. It is not designed for development, but for consuming the web. Developers who want to create and deploy web applications must use a more traditional operating system to do so. It does not put the end user in control. On the contrary, the user is almost entirely dependent on SaaS applications for all of their needs. Although it is constructed using free software, it does not seem to deliver the principles or benefits of software freedom to the web itself. How? Just as free software was bootstrapped on proprietary UNIX, the present-day web is fertile ground for the development of free web applications. The web is based on open standards. There are already excellent web development tools, web application frameworks and server software which are FLOSS. Leading-edge web browsers like Firefox and Chrome/Chromium, where much web innovation is happening today, are already open source. This is a huge head start toward a free web. I think what s missing is a client platform which catalyzes the development and use of FLOSS web applications.

Why use a Chroot environment? A large part of the use of chroot environments is for the purpose of security, it used to be the only way of isolating a user from a section of the files on a server. In many of the cases where a chroot used to be used for security it is now common practice to use a virtual server. Also another thing to note is that SE Linux provides greater access restrictions to most daemons than a chroot environment would so in many case using SE Linux with a sensible policy is a better option than using a chroot environment to restrict a daemon. So it seems to me that the security benefits that can be obtained by using a chroot environment have been dramatically decreased over the last 5+ years. One significant benefit of a chroot environment is that of running multiple different versions of software on one system. If for example you have several daemons that won t run correctly on the same distribution and if you don t want to have separate virtual machines (either because you don t run a virtualisation technology or because the resources/expense of having multiple virtual servers is unacceptable) then running multiple chroot environments is a reasonable option. The Simplest Solution The simplest case is when all the chroot environments are equally trusted, that means among many other things that they all have the latest security patches applied. Then you can run them all with the same labels, so every file in the chroot environment will have the same label as it s counterpart in the real root this will mean that for example a user from the real root could run /chroot/bin/passwd and possibly get results you don t desire. But it s generally regarded that the correct thing to do is to have a chroot environment on a filesystem that s mounted nosuid which will deal with most instances of such problems. One thing to note however is that the nosuid mount option also prevents SE Linux domain transitions, so it s not such a good option when you use SE Linux as domain transitions are often used to reduce the privileges assigned to the process. There are two programs for labeling files in SE Linux, restorecon is the most commonly used one but there is also setfiles which although being the same executable (restorecon is a symlink to setfiles) has some different command-line options. The following command on a default configuration of a Debian/Lenny system will label a chroot environment under /chroot with the same labels as the main environment: setfiles -r /chroot /etc/selinux/default/contexts/files/file_contexts /chroot I am considering adding an option to support chroot environments to restorecon, if I do that then I will probably back-port it to Lenny, but that won t happen for a while. For a simple chroot once the filesystem is labelled it s ready to go, then you can start daemons in the chroot environment in the usual way. Less trusted Chroot environments A reasonably common case is where the chroot environment is not as trusted. One example is when you run an image of an old server in a chroot environment. A good way of dealing with this is to selectively label parts of the filesystem as required. The following shell code instructs semanage to add file contexts entries for a chroot environment that is used for the purpose of running Apache. Note that I have given specific labels to device nodes null and urandom and the socket file log in the /dev directory of the chroot environment (these are the only things that are really required under /dev), and I have also put in a rule to specify that no other files or devices under /dev should be labelled. If /dev is bind mounted to /chroot/dev then it s important to not relabel all the devices to avoid messing up the real root environment and it s impractical to put in a specific rule for every possible device node. Note that the following is for a RHEL4 chroot environment, other distributions will vary a little some of the file names. semanage -i << END
fcontext -a -t root_t -f -d /chroot
fcontext -a -t bin_t /chroot/bin.*
fcontext -a -t usr_t /chroot/usr.*
fcontext -a -t usr_t /chroot/opt.*
fcontext -a -f -d /chroot/dev
fcontext -a -f -s -t devlog_t /chroot/dev/log
fcontext -a -f -c -t null_device_t /chroot/dev/null
fcontext -a -f -c -t urandom_device_t /chroot/dev/urandom
fcontext -a -t "<<none>>" "/chroot/dev/.*"
fcontext -a -t "<<none>>" "/chroot/proc.*"
fcontext -a -t lib_t /chroot/lib.*
fcontext -a -t lib_t /chroot/usr/lib.*
fcontext -a -t bin_t /chroot/usr/bin.*
fcontext -a -t httpd_exec_t -d /chroot/usr/bin/httpd
fcontext -a -t var_t /chroot/var.*
fcontext -a -t var_lib_t /chroot/var/lib.*
fcontext -a -t httpd_var_lib_t /chroot/var/lib/php.*
fcontext -a -t var_log_t /chroot/var/log.*
fcontext -a -t var_log_t -f /chroot/var/log/horde.log.*
fcontext -a -t httpd_log_t /chroot/var/log/httpd.*
fcontext -a -t var_run_t /chroot/var/run.*
fcontext -a -t httpd_var_run_t -f /chroot/var/run/httpd.pid
fcontext -a -t httpd_sys_content_t /chroot/var/www.*
END
You could create a shell script to run the above commands multiple times for multiple separate Apache chroot environments. If there is a need to isolate the various Apache instances from each other (as opposed to just protecting the rest of the system from a rogue Apache process) then you could start each copy of Apache with a different MCS sensitivity label which will provide adequate isolation for most purposes as long as no sensitivity label dominates the low level of any of the others. If you do that then the semanage commands require the -r option to specify the range. You could have one chroot environment under /chroot-0 with the sensitivity label of s0:c0 for it s files and another under /chroot-1 with the sensitivity label of s0:c1 for it s files. To start one environment you would use a command such as the following: runcon -l s0:c0 setsid chroot /chroot-0 /usr/sbin/httpd

As a buildd admin, you get to see the myriad of ways in which packages can fail to build. Sometimes this is due to interesting technical reasons about the architecture in question; sometimes... not so much.

cc1: unknown option: -mmmx

For reference, I maintain powerpc and m68k buildd hosts.

configure: error: pkg-config: command not found

Checking build-dependencies is hard. Right?

ccache: failed to create /home/buildd/.ccache (No such file or directory)

No, I don't manually install ccache inside the buildd chroot, which must mean some build-dependency pulled it in. Why one would want to do that, I dunno it's not like a build that takes longer would produce a different package, so it clearly is not required for the build. (BTW, the invalidity of $HOME is on purpose -- packages are not allowed to write outside their build directory during builds, which includes home directories) ... and more. Sometimes, I wonder how people get the right to upload. But, well.

Yesterday, I've arrived in New York City for the annual Debconf. Well, that is, today's the first day of Debcamp, and obviously not that many people have arrived yet. Since I arrived a day early, I'd also booked a hotel room for one night. But that's okay, it allowed me to sleep off my jetlag not that I had much of it, but anyway. Today, then, I signed in to the dormroom. Turned out I was the first non-organizer to do so, and that there wasn't even anyone in the hacklab yet. Well, that's what you get for being so early, I guess. Not quite sure yet what to make of the weather. When the plane touched down yesterday, the captain announced over the PA that the outside temperature was 99 degrees Fahrenheit (some 37 degrees Celcius), which is hot, especially when added to the rather high humidity. You walk outside for five minutes, and you're sweating like a pig. Today started off on the same foot, but then about an hour ago or so it started raining, and it hasn't stopped yet; and it doesn't feel like what I would call a regular summer thunderstorm, either. Bit weird. But then, who cares about rain at a computer conference, right? Right.