The flight to Mexico last Saturday went pretty much all ok, except that the plane had to start through at MEX because of some unexpected wind and the generally low air pressure at high altitudes. While this delayed the landing for about 20 minutes, I had the opportunity for a second look at this incredibly large city. After getting through customs, we (with Herman, Tore, and Annabelle) met Neil McGovern in the airport lounge, and after Marcella and Luciano had arrived, we had a rather bumpy ride to Oaxtepec, amounting to a 20h journey for me. The site here is really beautiful, with lots of green, palms, other plants, and of the swimming pool. However, so far Debcamp has been rather unproductive, we haven't had net access until Monday evening, and even yesterday round trip times and packet loss were so high that neither ssh (IRC!) nor scp/ftp/http were really usable. Using irssi's proxy module allowed me to get rid of the lag locally for IRC, but the connection was still unstable. I wrote some patches which I have yet to submit and replied to most of my NM mail, but the next projects will all require access to the BTS and debian.org machines to be worked on. At the moment, network is down again because the antenna connecting us from the village fell down. The main activity for me so far has ben to play Mao with Jesus, Adeodato, Marga, Graham, Gerfried, and others :-) Todo: get some real work done; upload pictures; go to the pool. Ah... network just went up again, yet still slow... mail queue flushed... network down again...

So about two weeks ago I started playing with Kerberos. And I'm still not finished with it, kerberizing one service after the other. Really fun, that. Kerberizing a network protocol involves somehow sending the Kerberos ticket in-band with the rest of the conversation. This is not entirely defined by the Kerberos protocol, and indeed, different network protocols have come up with different ways of sending the Kerberos ticket to the service. So far, I've encountered SPNEGO for HTTP, GSSAPI for IMAP and SSH, and SASL for LDAP. It sounds like a complex mess, but it really isn't; in general, kerberizing a service involves three steps:

1. Installing the Kerberos plugin (if any) for both the server and the client;
2. Generating the service principal, and adding it to a/the keytab;
3. Configuring the service so that it knows it can do Kerberos, and so that it knows how to act when a Kerberos request is sent

Yes, in the cases I've seen it's really that simple. Although I'm skipping step 0 here–reading the documentation. But I've done that for you already ;-) The hardest part is the initial setup. But even that isn't very hard, because the process is very well documented. For starters, install the krb5-doc package, and read the excellent /usr/share/doc/krb5-doc/README.KDC which explains just enough of the system to get you started. The rest will be explained to you through debconf and the like; and if you want more, the krb5-doc package also contains three info files which explain concepts and usage very well. There's an alternative implentation called heimdal, which I presume works similar; but I haven't tried it, so I don't have much details on that one. The process of installing krb5 is very straightforward; the only thing I'll let you know is that you should ensure that any host you're going to kerberize should have reverse name lookups configured and working correctly; otherwise, you're going to run into a bunch of serious problems. After the initial setup, you'll have a Kerberos realm, usually your domain name in upper case (GREP.BE in my case). You'll now want to set up principals for your users and principals for your hosts. Now, let me show you how to configure Kerberos for LDAP, PAM, HTTP, IMAP, and SSH:

PAM

By installing and using the libpam-krb5 package, you'll log in to kerberos and receive your TGT immediately at login time; the alternative would be having to use kinit (in the krb5-user package) afterwards. pam_krb5.so also takes care of destroying your tickets when you log out, so that you don't have to worry about that. This is very handy, but not really required; you could just use kinit all the time. Of course, using pam_krb5.so also means you have only one password for everything—and that is a very good argument to use it.

Anyway; our three steps:

1. Installing the plugin
As you've guessed, libpam-krb5 is the package you'll need. That, or the heimdal implementation.
2. Generating and installing the service principal
In the case of any service such as PAM that will give you a shell (thus, as we'll see later on, also SSH), the principal is supposed to be host/<hostname>@<REALM>. For instance, on rock.grep.be, the principal PAM will use is host/rock.grep.be@GREP.BE. We'll create it with kadmin (which can be done on any kerberized host):

wouter@rock:~$ sudo kadmin
Password for root/admin@GREP.BE:
kadmin:  addprinc -randkey host/rock.grep.be@GREP.BE
WARNING: no policy specified for host/rock.grep.be@GREP.BE; defaulting to no policy
Principal "host/rock.grep.be@GREP.BE" created.
kadmin:  ktadd host/rock.grep.be@GREP.BE
Entry for principal host/rock.grep.be@GREP.BE with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal host/rock.grep.be@GREP.BE with kvno 3, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/etc/krb5.keytab.
kadmin:  q

Generating the principal can really be done as any /admin user; but as the same isn't true for writing the keytab, I'm using sudo in the above example to become root.
3. Configuring

account	required	pam_krb5.so ignore_root
auth	sufficient	pam_krb5.so ignore_root forwardable
password optional	pam_krb5.so ignore_root
session	optional	pam_krb5.so ignore_root

After adding the above lines to the relevant files in /etc/pam.d, you should log off, then log on again, run 'klist', and marvel. If you add the lines to your passwd file as shown above, and don't remove the pam_unix.so lines, then local passwd-based authentication will still work. This can be nice if, for example, the Kerberos server is down, or you're working on a laptop that isn't always within reach of the Kerberos server. It doesn't do any harm; the worst that can happen is that at some point you happen to be on a network where there's a firewall which drops packets on the floor rather than sending you an ICMP port unreachable; in that case, you need to wait for the Kerberos login to time out, which takes half a minute or so (I haven't timed).

SSH

1. Installation
If you're running unstable, you don't need to do anything. The OpenSSH packages in unstable are all set to understand Kerberos. If, however, you're running stable, you'll want to replace your ssh package by the ssh-krb5 package, which is the regular SSH package plus some patches to enable GSSAPI (read: Kerberos) authentication.
2. Service principal
If you've done the PAM setup above, you're all set; SSH, being a service which gives you a shell, also uses the host/ service principal.
3. Configuration
Make sure both the server and the client have the GSSAPIAuthentication option enabled. After you've done so, restart the server.

IMAP

I'm using dovecot as my IMAP server, which has builtin support for GSSAPI authentication (at least in unstable; haven't checked stable in this regard).

1. Installation
As dovecot comes with everything compiled in, there is no need for installing extra packages.
2. Service principal
You'll need the imap/ principal (e.g., imap/rock.grep.be@GREP.BE). Note that the host name which is found by doing a reverse lookup on the ip of the server is what counts, not the name of the server as you're using it (so not, e.g., imap/imap.grep.be@GREP.BE)
3. Configuration
Edit your dovecot.conf, and find the line that starts with "mechanisms" in the auth default stanza. Make sure it contains at least the word gssapi. Restart dovecot. I haven't found a Free (as in speech) IMAP client that supports GSSAPI authentication. My client of choice, offlineimap, doesn't seem to support it; mutt doesn't either (unless I'm missing something); and while thunderbird in unstable is supposed to support it, I haven't been able to configure it correctly yet. Probably me. I have, however, been able to verify that it works by using a non-free software package. Obviously, this isn't good enough. In addition, I found that horde and imp don't like an IMAP server that has GSSAPI enabled if they don't, while enabling GSSAPI in horde requires a PHP extension that isn't packaged in Debian. So I've disabled it for the time being. Stay tuned.

LDAP

1. Installation
LDAP requires uses SASL for authentication, which doesn't have GSSAPI modules in the default package; for those, you need the libsasl2-modules-gssapi-heimdal package. Attentive readers will have noticed that this package contains the string heimdal in it, rather than krb5, and that this is not the same implementation that I've been using previously. Yes, true. But since there's no libsasl2-modules-gssapi-krb5, and since Kerberos is, after all, a well-defined protocol, this is not an issue—except in that you need a bit more diskspace for the additional libraries. Note that the modules have to be installed on both the client and the server.
2. Service principal
You need a service principal that starts with ldap/, obviously followed by the hostname and the realm.
3. Configuration
For those people whom you want to allow to authenticate themselves using Kerberos, make sure they have ' SASL <principal>' in their userPassword attribute set (e.g., I have userPassword: SASL wouter@GREP.BE). You can have that in addition to a regular encrypted password; the userPassword attribute is a multi-value attribute. Now if you use ldapsearch or anything similar, it will try to negotiate GSSAPI authentication as the SASL mechanism. If it doesn't do so, you can force it by adding -Y GSSAPI to the command line.

HTTP

1. Installation
You need the libapache-mod-auth-kerb or libapache2-mod-auth-kerb modules on the server. For the client, you need a browser which has SPNEGO support; Konqueror and Firefox are two examples of browsers that do.
2. Service principal.
The prefix here should be HTTP/. That's right, in upper case, contrary to previous examples where this wasn't the case. HTTP is also different in that apache usually isn't running as root. This is a good thing; however, it does mean that the kerberos authentication module is unable to read /etc/krb5.keytab. You'll have to write the service principal to a different keytab for apache; I've used the -k option to the ktadd command in kadmin to specify the keytab as /etc/apache2/keytab; I'll assume you do the same.
3. Configuration
Something like this, on the server:

<Location /some/URL>
	AuthType Kerberos
	KrbMethodNegotiate on
	Require valid-user
	Krb5Keytab /etc/apache2/keytab
</Location>

This will enable SPNEGO authentication; and if SPNEGO authentication fails for some reason (for example, because the used browser doesn't support SPNEGO, or because the user isn't logged in to Kerberos), it will fall back to Basic Authentication. While the latter is usually a good idea, it's less of a good idea if you're not using SSL, since then your password would be sent over the wire in cleartext. Luckily, the basic authentication can be switched off, by using KrbMethodK5Passwd off. If you go to my webserver logs, you'll see that you'll get a 401 right away, while the HTTPS version of the same allows you to try to log in by using basic authentication. On the client side, if you're using Firefox, you need to go to about:config, and set the option network.negotiate-auth.trusted-uris to a string that will identify the servers that may do SPNEGO authentication in your realm. In my case, I've set it to grep.be. For konqueror, doing something similar is not required—it'll do SPNEGO authentication out of the box.

So, that's what I've got set up on my network currently. Next on the list: NFS4 kerberos auth (requires updated nfs utilities, which aren't in Debian yet because of issues with NFS2, IIRC), PostgreSQL (it does seem to support it), and finding out if or how I can create principals can't be used for one authentication scheme or the other. Phew, that was a long post. I'll stop now.

On friday the 5th I started my trip to MX. I am assisting to Debconf 6 from the very first day, so that I can help the local team (at least with translations and such). I arrived to the airport early, so that I didnt have to suffer last minute stress if I see that the line is way too long and I have too little time to catch the plane. It all started fine (well, I forgot my keys at home when taking the dog for a walk, but I managed to reach my girlfriend and she came back to open the door for me). I must be the worst traveler in the world, since I seem to be causing only problems. Or maybe is that I question too many things that are the status quo and seem reasonable for other people. From the begining. It was check-in time, and the lady ask me about my hand luggage. I mentioned that since my friends were going to be waiting for me at the airport for almost 2 hours, I had prepared all my stuff so that I was not carrying anything dangerous in my two backpacks. Heck, I even left behind the regular tools that I carry with me, including the nail scissors,... The lady said it was not possible. "Sir, you can only carry 8 kilos of hand luggage". I looked around and saw people with lighter bags, but bulkier than mine. "Sorry, but, what is the reason? My luggage is smaller that the regular luggage, and I just need to get out asap". "Security reasons, sir". "Could you describe those reasons?". "... ... (surprise face) Security, sir. I would like to travel with my 20 kilos os luggage with me, sir". Yeah, sure. I am happy about that. I dont recall going away for such an extended period with such an small amount of things. When did all this madness start? Well, she did not manage to give me any reason why I could not take my things with me, but she got her sweet revenge. She put me on the back of the plane, with a guy who had at least 50k more on than I, although we both paid the same price for the ticket. I wonder where the security reasons are then, for those 50k... (Mental note: add to the travel checklist not to EVER forget deodorant and to take a shower before leaving home. Two showers. I had enough torture with the guy beside me...) The nice part of the flight was that for the first time i traveled on a Jet. Boy, is nice. Landed in Germany. The plane went to park on the backyard of the airport. We had a long 10min trip back to the terminal. The check-in for the plane to MX was a full hour set in advance, so that the HUGE amount of people that fits on one of those 747 had the time to show (for the 10th time) the passport. But looking aroung one wonders again where those security reasons not to let me carry my 8 kilos of luggage are: people around me had bought nearly their year salary on duty free stuff that wights more than 15k. Oh, boy, now I am confused. Is it so that someone has decided to add a rule in the name of security at some point after 11/9 and they forgot why? What difference does it make to get the luggage with 8 kilos from outside the terminal than from inside? As a side note, one can see that mexicans still keep much of the Spanish attitude. The speaker goes on, a man speaks in German and explains that people with children will board before anyone else. Nobody has understood anything, but they are already piling before the boarding gate. Once the man speaks in English, only the ones who dont understand English still await impatientily at the gate, mostly disturbing the check-in procedure for the flight, which will probably be delayed because of that. The second part of the trip was a bit more relaxed... I will skip the story about the looks-like-it-is-not-her-day flight attendant who could not understand a shit, and will only mention that when she served me a light coke and I handed her the empty can for dispossal, she gave me another full can with a face of "take-this-and-shut-up,dont-you-see-i-am-not-having-a-good-day?". I did not know Mexico was in the south hemisphere. At least that was the reason given for the satellite-linked internet only working the first three hours, although we were flying through Greenland, Canada, USA and Mexico's gulf for the 12h of flight, and Mexico IS on the (using the lonstanding critizised convention of not putting the map upside-down and say that is the right possition) north side. After landing it was a bit of rush, until I had to wait for my luggage, which of course came after waiting for almost 40min (Revenge of the Check-in Lady, take three... hi, if you read me). The people who create those inmigration forms MUST have short names. They have a big horizontal box with small vertical lines on the boxes to put your data trying to force you to put every character of your name in one small designated area. So there you go: "J E S U S _ D A N I E L _ C L I M E" That's right. Not even my first surname fits. Forget the second. This are the times that a friend of mine comes to mind: Enrique Garcia-Villarubia Gomez-Limon (Hi, if you read me). After all this I went out to find Amaya and h01ger waiting for me. We met Ganneff, Stockholm, Sam and Jeroen, and Damog, along with Agi, were coming right after picking up the van. We put Ganneff and Stockholm on a taxi and sent them to Oaxtepec, and left the airport for some dinner. Mexico is BIG, BIG, BIG. After driving for more than half an hour we got to a bridge from where you could see the city lights. And still, they were covering the horizon. HUGE. That realization is something I have not digested yet. Some local beers and tacos made the end of the night and we headed to Hector's place, where we were going to spend the night. From a not so negative point of view, the whole experience has been positive, and enlightening, to say it mildly. The food is mostly spicy. It could burn hell. Amaya is trying to get use to it by eating an insane amount of hot stuff but I refuse to do so. For the scared (hi, helix) I have not managed to get anything from the tap water. So nobody is dead, yet, although rumor has it that some are in comas. The net is here, although the roundtrip values are not very exciting. Mao has visited already the place, and said it is here to stay. Summary for the ones to come: this is HOT. I mean, really HOT. Forget your long jeans and bring shorts, even if you dont like to show your legs, sun screen cream, t-shirts, deodorant, swimming suit, and keep a bottle of water all the time with you. Food is served at a more sensible time than in Finland: 02:00h and 20:00h. See you in MX.

The Apple Public Source License is a GPL-incompatible file-level copyleft license. That's mostly irrelevant - what actually matters is that both the FSF and OSI regard it as free or open source. So no problem, right? Except that the APSL hasn't really caught on. Freshmean lists two whole pieces of APSL software. Both of them are derived from Apple code released under the APSL. That is, nobody other than Apple has chosen to start a project based on APSL code. It's actually worse than that. Section 12.1(c) of the license automatically terminates your right to use or distribute the software if you sue Apple for patent infringement. Any patent infringement. Apple have infringed your new chip process patent? Better hope you don't rely on any APSL code. Apple's new TFT design copies yours? Better work on a replacement for Howl. Apple have stolen your entire motherboard design? Bad luck - using this code made it awkward for you to defend your IP. As a result of this, the only significant APSL project (Howl) has effectively been entirely replaced by Avahi. Both Gnome and KDE adopted Avahi once it became stable. In other words, the only community projects using APSL code rejected it the moment there was an alternative - and the reason for developing Avahi in the first place was that several projects refused to ship APSLed code. It's hard to claim that the APSL is regarded as an adequately free or open source license if almost nobody is willing to depend on code under it. In other words, the community has rejected the idea that it's really an open source license. But both OSI and the FSF lack any obvious mechanism of discussing decisions they've made. Both OSI and the FSF have claims to representing the community. How does the community let them know that their views are at odds with it?

Looks like my plans for installing cfengine are hitting problems before I’ve even started getting very far. By default cfengine will not copy files from the master host to the client nodes if their clocks are “too far” out of sync. Unfortunately I cannot sync the clocks on all my nodes, much as I would like to, since UML doesn’t play nice with clocks going backwards .. On the plus side I’ve got a nifty script which will push updates to remote systems via a combination of rsync + dpkg - that allowed me to update 50ish machines and cause them all to start logging remotely with syslog-ng in the space of around an hour. If I could generalise this system it might be sufficient to copy files, do minor edits, and essentially do the tasks I wanted to automate with cfengine in the first place! In related news the more I learn of ruby the more I’m coming to dislike it…. It is just so .. un-perl! Still ruby is nicer than daemontools

... and already liking it. Though, first things first, some notes about the trip so far: The plane from vienna took off 50 minutes late due to weather reasons. It was quite nice, though, and I hope that some of the night pictures of town lightnings are usable. At least the delay reduced my waiting time at the madrid airport quite a bit. Which brings me to that airport. It's... HUGE! I mean... erm, it has signs telling people that it will take 25 minutes to the gate that the plane to mexico will be leaving. And that is including the trip on some underground train they have that it doesn't take you much longer than that... But appart from that, I arrived on the gate area before midnight so I was able to order some drink at the starbucks. At least some shop that knows how to let people enjoy the waiting time. :) The plane to mexico left on schedule at 1:50, so it was completely dark outside when we started. And almost the whole trip, up until about the last 20 minutes or so of the 13 hour flight, it was completely dark outside, because we were travelling ahead of the sun. So it wasn't too bad, being able to get some good sleep, at least as good as possible on a plane. Having arrived in mexio airport with a short delay and waiting a bit for my suitcase I finally met up with Frans Pop, because I was too scared of getting lost without any sense for the spanish language yet. We took one of the prepaid official taxis to the bus that will take us the rest of the trip. The taxi drive was really... well, interesting. It was the fastest trip I've ever seen in any car in city area, but the bad thing: I can't even tell you how fast we were at times because the speedometer was b0rked and displayed only zero all of the time. I guess taxi drivers are most the same all around the world, but this one definitely mastered the art. The bustrip wasn't anything notable, besides a bit tiresome due to the air in the bus, the partly monotonous vegetation outside and that I was sure to not be able to watch the movie to the end, besides that the sound was too silent. :) Finally arrived at Oaxtepec, which turned out that our hotel seems to be in some sort of recreation area, maybe even a bit of themepark... At least it has some rollercoasters, at least they showed them on the video. We'll see. I at least tried out the pool already, it's not even feeling cold for me. Not have met all the people yet that are rumoured to be around already, but I guess it might happen at lunch, which is expected soonish. Due to network not working though this blog post will have to wait until afterwards.

A new major version of our favorite text editor vim [1] has been released! Yes, that's that awesome text-mode editor your geeky friends keep telling you about, the one that many people use since many years and still haven't explored more than 20% of its features [2]. I'm well aware that if you're a vim user you probably have already heard about it, but I'm blogging the news here one more time, just in case ;-) I think the most interesting new features for me will be tabs, omni-completion, and "browsing remote directories, zip and tar archives" from within vim (no need to fire up mc anymore). A more complete list of new features is available in the release announcement. [1] Emacs users are allowed to start flaming now...
[2] Now, this may sound like I'm talking about Emacs here, but I'm actually not ;-)

A two-part documentary, "Code Breakers" will be aired on BBC World TV starting on 10 May 2006. [cont. with times and links]

Ross, I don't think something like that exists. But it's not actually hard to make, really.

• Apache can be configured to redirect any PUT request to a given script. Just write yourself a small PHP or CGI script that will take a file, put it somewhere safe, and send a 200(ish) status code back. PHP has a function for precisely that purpose.
• Writing something to give you an HTML form back if someone does a GET / isn't exactly hard.

Altogether, it sounds like a bit of tinkering that'll be finished in an hour or so.

Never be trustfull and think that wireless will work! Now we splitted in smaller groups and could have normal no wireless lan, if I had a cable! Which I didn't brought, since I thought, that surely in big company like IBM (hosting OSDL's DAM-2 meeting) they will have working wireless...

Greeting from OSDLs Desctops Architects Meeting II in Mainz, where I'm honoured to represent the Debian Project. Not much to say till now; we just started with an introduction round... but after 40 short introductions of people, I already forgot the first ones. Personal note: I used to be stationed here in Mainz during my military service so many years ago... Actually: I used the same train station this morning than I did during those days. I nearly went the wrong way to my old barracks... but it was some kind of strange, unfamiliar. E.G. they started to dig an old roman theatre when I was the last time there, now they are nearly finished. Looks impressive... I never saw the beatifull side of Mainz (which might be related to the problem, that I always hated to be here during those days). Oh, break. I need to go; will blog more interesting stuff later. Oh, BTW: One bigger point of discuss here are standards, especially LSB and freedesktop.org and what people expect from their next releases. I have just a very general knowledge of them and feel some kind of week about that topic... What do we expect from them?

I've been wanting to have a play with Xen for quite some time, but have a pathological dislike of compiling kernels, so hadn't gotten around to it. So needless to say, I'm very very (very very) pleased to see Xen 3.0 packages in Debian now, and so spent some time today having a fiddle. Frankly, I'm very pleased with how easy it's been to get everything going. Mad props to Steve Kemp for xen-tools, it makes the ease of creating a new DomU approach that of falling off a log. A big thanks also to the Debian kernel team for packaging this stuff up at last as well. So, here's what I did: I installed linux-image-2.6.16-1-xen-686 and xen-hypervisor-3.0-i386, along with the aforementioned xen-tools and xen-utils-3.0. The linux-image-2.6.16-1-xen-686 kernel package doesn't create an initrd by default, so I created one by hand with mkinitramfs-kpkg. I put this in my GRUB config:

title           Xen
root            (hd0,0)
kernel          /boot/xen-3.0-i386.gz
module          /boot/vmlinuz-2.6.16-1-xen-686 root=/dev/hda1 ro console=tty0
module          /boot/initrd.img-2.6.16-1-xen-686
boot

There's a couple of kernel images available that mention Xen, the aforementioned linux-image-2.6.16-1-xen-686 and also linux-image-2.6.16-1-xen-vserver-686. Unfortunately the package descriptions are the same as the stock 2.6.16 kernel package, and I initially formed the opinion that one was the Dom0 kernel and the other was the DomU kernel. It turns out that the linux-image-2.6.16-1-xen-686 will operate as either, and the vserver one will work as a DomU (I haven't tried it as a Dom0). I'm currently using file-backed storage, but I want to switch to directly using LVM once I get the hang of things. I created the filesystem for the DomU with:

xen-create-image \
--hostname testvm \
--size 2Gb --swap 128Mb --memory 96Mb \
--fs ext3 --dir /srv \
--dhcp \
--cache yes --dist etch \
--mirror http://mirror.linux.org.au/debian \
--kernel /boot/vmlinuz-2.6.16-1-xen-vserver-686 \
--initrd /boot/initrd.img-2.6.16-1-xen-vserver-686

The one problem with this script is it puts SCSI (i.e. /etc/sda) devices in /etc/fstab, but refers to them as /dev/hda devices everywhere else. So to avoid a kernel panic on booting the DomU, I had to mount the image that was created and edit the /etc/fstab file to fix this up. I also needed to add vif = [ '' ] to get an eth0 interface to exist in the DomU instance. There's some other stuff you put here to use a consistent MAC address, rather than a per-instance-boot one. I also found I needed to edit /etc/xen/xend-config.sxp to use network-bridge instead of network-dummy and vif-bridge. I found I needed to reboot as just restarting xend afterwards royally messed with the networking setup. That was about it. Creating an instance of the VM then worked. Making sure the loop kernel module is loaded helps avoid some obscure errors.

After the start of the DebCamp I’m just pissed off about just everything. I don’t know if that’s because people could expect you to do something you aren’t supposed to do; or because people are just trying to do children pranks and only look like adult morons; or because I’m just exhausted of children urinating in the pool; or because of the heat; or because I’m supposed to handle all the jokes about Mexican food; or because of having to go to school everyday; or because of having to skip my classes; or because of missing Ana, missing Venezuela; or because of the fact that I won’t be able to get the money I’m spending on DebConf back; or just because every fucking thing around me. On the other hand, just as I heard Holger saying: “I will try to relax and have fun”, and won’t give a shit at anything not worthwhile.

Every once in a while, there is an argument in the debian-legal mailing list: a particular package was rejected because its license didn’t comply with the DFSG, and someone asks for Debian to relax its interpretation of the DFSG. This package, they say, is very important and useful, and the Social Contract states that users are our priority, and, after all, the DFSG are only guidelines and can be skipped every once in a while. I don’t subscribe to this line of thinking. The DFSG are not only a set of “features” the license of a work must have to consider that work “free”: they are a list of promises to our users about what they will be able to do with everything they receive from us. For example, when DFSG#2 says that “the license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software”, this means to our users: “everything you get from Debian you’ll be authorized to modify, and then give your modified copy to anyone under the same terms as when you received your copy”. That’s why when someone says “the DFSG are just guidelines, we can bypass them just for this very useful package” it would not be proper to actually do it, as we would not be living up to our own promises. This post was not triggered by any particular event; I just wanted to write something not containing a doctored photo or a joke :-)