After another German post from me appearing on planet.debian.org yesterday, I investigated the issue further, and I (hopefully) found the problem: The rss feed URL I was providing looked like it was for the english feed, but actually it wasn’t. And since serendipity has the tendency to be very forgiving when it comes to URLs with mistakes, it was indeed providing my all-blog-feed. I changed the URL now, I guess this will cause some old english entries to re-appear, but I hope that it will be the last time.

I know for myself that picking up unparsed userdata is teh evil. But we also all know that the usual webpage and mailer script coder isn't thinking. And to my knowledge the php mail() function is the only one that perverted to parse the headers additional to an explicit given recipient list for additional recipients. Yes, you read right. Often enough people use things like mail("myown@addre.ss", "subject", $body, "From: $_POST['name'] <$_POST['email']>") without thinking about it, because, there is this extra to field anyway. Right?
Wrong! SPAMers will come and send things like email="some@jo.ke\nBcc: my@sp.am, list@is.bigg.er, than@you.rs". People that put up such webmail scripts usually don't notice it anyway, they just delete the spam right ahead, not noticing that it was an abuse of their form. And the ISP has to deal with having to get the system out of the blacklists again.... At least none of the hosts on which customers are able to put up such scripts directly affect our own mail system, it's just the shared hosts they use... Still, deadly annoying. And then people are claiming that such misfeatures aren't a problem in PHP but in the coders? If it would at least be documented in the description of the function, but if one can claim it that it is it's at most just very vague hinted...

My father asked me how to setup an alert to remind him of the evening news. (The serious ones in the public channel, not the sensational in the private channels...) My first suggestion was to use evolution, but it cluttered his calendar view. I guess you could avoid that by using a separate calendar file, though. Still, these alerts are of very low priority, so I considered that the new notifications should actually suit better. Sending notifications from the command line is supposedly easy - if you're in the same session. Otherwise, you have to find out which socket to send it to. (Btw: what happens when the dbus daemon is restarted ungracefully? will notifications be broken until the session is restarted, too?) Anyway, here's the solution I came up with:

#!/bin/sh
pids= pgrep -u $USER gnome-session 
title="$1"
text="$2"
for pid in $pids; do
        # find DBUS session bus for this session
        DBUS_SESSION_BUS_ADDRESS= grep -z DBUS_SESSION_BUS_ADDRESS \
           /proc/$pid/environ   sed -e 's/DBUS_SESSION_BUS_ADDRESS=//' 
        # use it
        DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS \
           notify-send -u low -t 7200 "$title" "$text"
done

This will send a notification with a lifetime of 3 minutes to all running gnome-sessions of the current user. Supposedly works fine from cron (not yet tested, though). Error handling isn't perfect yet, either (but again, this is a very low priority notification). P.S. hint of the day: use a line like

apt-get install libnotify-bin && notify-send 'Yay! Completed!'

To get a fancy notification when your long-running process of the day is completed. Sweet.

So my sister is working at a school where the computers are in a shocking state. All infected with viruses, spyware and malware. The machines either crawl along or are incredibly unstable. Some of them run some sort of virus protection program and I’ve seen one or two computers running two different anti-virus programs. On my travels I have seen countless infected Windows machines. It’s incredible! And the worse thing about it, is that the Free Software geeks and outfits can’t seem to capitalise enough on it. So what can I do? The Computer Scientist. Well, not a lot. For example all the Windows machines are in Korean. I can’t figure out how to change win32 language. Can you? Plus, I don’t want to re-install Windows. I want to deploy some Linux based solution. So what are the requirements? They need to :

• print timetables (via a crappy Epson inkjet) with something like Office
• be able to play macromedia based games
• use a browser

That’s it. It also can’t be more complex. No username or passwords please. We don’t want to have to train people to use a new system. Must be simple. Oh diddums. Can Director macromedia kid games be played in Linux? I don’t think so. Oh I wish these kids’ software was on a N64 or something. There is only like 10 PCs in this school and installing them with Linux would take quite a bit of my time. I need some sort of centralised control tower where I can control deployment of my own customized Ubuntu based distro. I know very well about SkoleLinux but it is simply too complicated. No need for email. Outsource to Gmail and hosted service. Must be simple. All I can think of will be complex and painful. Grrr…

Simple answer: because RSS and Atom are XML formats. So please generate valid output. Adhere to the standards! The RSS feeds of Planet Gnome and Planet Ubuntu, for example, are currently broken. (Planet Gnome due to a bug in Planetplanet AFAICT, Planet Ubuntu due to a broken RSS feed from Wordpress... Yes, you must escape single < characters in XML...) Templating systems such as the default templating of the Django Framework, or the popular Clearsilver templating engine are unfortunately not suited for XML output. Oh, and please never ever write XML using 'print' commands either. Use a proper XML writer, which can handle charset issues and escaping properly. Good examples for XML-enabled templating engines include TAL and METAL used by Zope (but available for a variety of languages), and KID (again python, used by the Turbogears Framework). Closely related is the "HTML fragments" issue, which basically is why I want XML to be used internally, too (you could also store StructuredText only, and convert it to XML just for transformation to the output): HTML fragments in my blog should be valid slices of an XHTML file, to avoid issues when generating both the web pages as well as when integrating the feed into other pages. With RSS, the HTML code is AFAICT escaped in one big data chunk, so it doesn't matter there. It probably does for Atom. So what a good blog tool (including a rewrite of planetplanet which has way too many bugs) needs to do is to parse it's input data (plain text, HTML provided by a web browsers WYSIWYG edit component, mail, structured text, XML, ...) and either reject broken entries or try to guess whats intended, but guarantee that the output is valid XML. Then generate proper feeds and output from that. Thanks to all those who already replied to my previous posting. One thing I was pointed at, and I'll probably look into is Apache Forrest. Although I likely will use KID instead, if I happen to write my own tool after or despite my upcoming final exams.

It seems that after two hours stuck in front of my minicom, trying to upgrade my server/gateway from Xen 2 to Xen 3, Sarge version of udev and hotplug are too old. I will have to try with a backport tomorrow... What a pity...

As regular readers of my blog should know by now, I’m a big fan of SaaS (software-as-a-service). I’d go so far as to say it’s the future of software. Like all things, though, SaaS has its drawbacks, the biggest of which are questions of reliability, as the recent outages of salesforce.com have made painfully clear to its customers. It’s great if your data lives on the network, but what happens when your data isn’t available, either because the network isn’t available or because the servers it lives on are down? (The rhetorical question brings to mind Leslie Lamport’s famous observation that “a distributed system is one in which the failure of a computer you didn’t even know existed can render your own computer unusable”.) Security and trust are important too. Prime example: saleforce.com’s less than forthright acknowledgment of the recent outages. Another: Just today, Google launched version 3.0 of its desktop search software, which gives users the incredibly useful ability to search their local documents from any computer in the world. Of course, it does this by storing the index (and, apparently, the documents themselves) on Google servers. Hmm. Do I really want my business plans stored somewhere on the web outside of my direct control? Then again, an increasing number of people keep their email on the web, so chances are, if I’m collaborating with someone, they’re already there. As much time as I’ve spent thinking about SaaS, though, this was a new one: A friend of mine managed to get himself locked out of his Yahoo account, and after hours on the phone with Yahoo support, he seems unable to convince the Yahoo bureaucracy he is who he says he is so they will let him back in. He even offered to fly to Sunnyvale to present his driver license. Apparently, the zip code Yahoo has on file is different than the zip code he’s had his entire life, and the support staff say they can’t unlock his account until he gives them the right answer, which he’s already doing. (Apparently, the best one particularly dim bulb in Yahoo customer service could come up with is that he call back each day with a different guess till he gets it right.) In short, there seems to be some sort of an immovable object/irresistible force thing going on, and he’s not sure how to break the deadlock so he can get back to his data. The most pressing problem is that he’s got some tax related information in his email account, and on the current path, there seems to be no way for him to get to it by April 15. So, I pose two questions here: First, if you work at Yahoo, how in the hell can my friend get his access back? As already stated, he’s spent hours on the phone to no avail. I’ve tried inquiries on the backchannel but have received no responses. Second, for the larger SaaS community, if our data lives on the network, what happens if Google, Yahoo and the like become the phone company?

Dear Lazyweb, Anyone aware of a nice blog software that

• Uses some kind of proper XML to store all data (and thus always create valid output,
• Allows me to enter stuff using some StructuredText human-writeable markup and copy HTML fragements from other pages in there.
• Does reasonable caching instead of doing XSLT transforms over and over again...
• Allows me to tag posts, and provide customized RSS feeds (e.g. all english, non-personal, XML-related posts
• Doesn't force me to use the web to blog (like WordPress)
• Doesn't use PHP or ASP or JSP and a MySQL database which I consider bloated and potentially insecure - should be nice and clean code, which PHP rarely ever is.
• Doesn't use extensive frameworks such as Ruby on Rails or TurboGears either... I don't want to have to install these.
• Doesn't bring with it another stupid user management (like WordPress and all these fancy php thingys do)
• Preferrably doesn't require CGI at all...
• Doesn't need to have comments, and lets me disable them. It's my blog, I don't want to have to care about spam and you are supposed to read it using a RSS reader (and no UI-hell Internet Exploder 7), actually. :-)
• Is OpenSource, obviously. I will certainly want to remove some things I consider stupid. I've yet to see a commercial software I'm happy with.

And I bet I forgot some additional restrictions... Thanks for any suggestions..

Today I "quit" (formally) my math studies and became a computer science student instead. While my next term will officially be my 6th term in CS, I will be doing my finals and then start writing my thesis (which you usually do somewhere in your 9th-11th term). I have in fact been studying CS longer than that, but I also wanted to do math (mostly because CS was too boring for me most of the time, and math provided a higher challenge) - and instead of formally doing both (which would have required finding out specific formalities noone knows, and maybe paying some extra money) I went with math for a long time. Now that I was approaching final exams for both math and computer science, I had to decide: do math, do CS or do both. Being lazy (and wanting to finish as soon as possible now) I decided to pick the easiest - computer science. My diploma topic will be very mathematical, though - a special logic for reasoning on the web, so it's logic, web 3.0 and theoretical computer science combined. Sweet. I guess it really doesn't matter that I don't end up with two degrees, given all my other qualifications. :-)

Joel Spolsky: “Listen, I know that everybody is saying that the cool thing to do these days is Ship Early and Often, but when you ship half-baked ajax calendars that don’t do much and then get Scoble to go nuts about how great they are, well, you’re going to have a lot of people like me checking it out and realizing that, for example, no thought whatsoever has gone into printing, which is fine, it’s a 1.0 release, but you know what? I’m not going to look at 30 Boxes again — I’ve spent enough time evaluating it. G’bye. I’ve talked about this before — it’s the Marimba phenomenon — when you get premature publicity, lots of people check out your thing, and it’s not done yet, so now most of the people that tried your thing think it’s lame, and now you have two problems: your thing is lame and everybody knows it.” “Release early, release often” is a strategy that works because it allows for incremental improvement—you don’t have these “big bang” releases every few years where you try to anticipate what your users will want, because your users are telling you what they want every step of the way while the thing is coming together. That said, Joel makes some very good points, and companies following the “release early, release often” formula would do well to consider them. In short, for “release early, release often” not to backfire, its proponents need to do a better job differentiating between the users that want to actively participate in the development of a new product and the users that are simply looking to solve a problem, because that latter group is ultimately going to be disappointed if the thing isn’t fully baked.

How nice. The FCC wants "a "back door" be built into all Internet-communications hardware and software to provide access for law enforcement agencies". This and similar horror scenarios for the freedom and privacy of the people are nothing unusual these days. A more general (and more paranoid) question: How do we know whether our software or hardware is backdoored/wiretapped? We all know that using a certain OS from Redmond opens a lot of security holes in itself. Add to that all the now-public attempts of agencies and companies ranging from the FBI, NSA, Sony to antivirus-software vendors who install backdoors on your PC, and you've got some very good reasons to never trust any closed-source software again. This is not a problem for most of us using Free Software and free operating systems (Linux, *BSD, etc.). Theoretically, we can read the source code of almost every single instruction being executed on our hardware, and verify that the software doesn't do any funny things like phoning home, logging keystrokes, opening backdoors and so on. However, how can we know whether or not our hardware has been backdoored/wiretapped/trojaned (or whatever you want to call it)? Given that almost all devices we own nowadays (PDA, iPod, cell phone, hardware VOIP phone, and all the other gadgets) as well as most parts of our PCs and laptops have some sort of microcontrollers on them, how can we be sure that there is no secret code hidden in there which spies on us or provides hidden backdoors to them (whoever that may be)? With some devices you can dump the firmware and analyze that, but most parts are probably not easily analyzable by mere mortals. Think network cards, builtin wireless cards, sound cards, bluetooth chips and so on. IMHO, a good first step in the right direction are things like OpenBIOS (Free Software firmware/BIOS) and OpenEZX (Free Software GSM phones). Alas, I think DRM will pose a major threat here in future, as we probably cannot easily replace custom firmware/software anymore if DRM in the worst form becomes reality. So, how would you go about to ensure that your hardware has not been backdoored? How can we detect such things? How can we defend against such things? How can we remove backdoors if we find any? Do you know of any relevant research, papers, documents, HOWTOs? Any cases you know of where such things happened? Any practical tips or advice?

Last week, some friends and I played a very exciting and long (6 hours) game of Risk. At the end, I thought: Too bad we can’t rewind the game and play it fast forward, just see how the tides of colors are waging.Well, on Sunday, I though, why not, and started writing “RiskRecorder”. It is my first larger project with python and gtk+, and I am quite content with both of them. The map is stolen from JRisk, and with that the idea of a gif file that maps pixels to countries. The RiskRecorder is meant to be used during a game of regular risk, to - well - record the moves. As a side benefit, you don’t have to calcuate the number of units you get anymore, as the RiskRecorder can tell you that. You can then save the whole game for later review.It should be in a usable state by now, but I plan to add more features sometime, like better animations and graphs showing development of the game.To try it yourself, you need the program itself (one file so far), then get at least the board.map, board_map.gif and board_pic.jpg from the jrisk CVS repository (you can open any other JRisk map in RiskRecorder, too). You might need to download the python bindings for gtk and cairo, too. On debian, I assume that apt-get install python-gtk2 python-cairo will get you what you need.As always, comments, bugreports and patches are welcome. To follow development, have a look at my svn repository.

This has quite amazing amounts of crack. It looks like someone thought, "Hey, some people like Muine and some other people like Rhythmbox. Let's glue them together!". Please make it stop. Update: apparently people think I'm mocking the author. Yeah, maybe a little. However, there are some serious cracky features in there, which I personally don't like, and as this is a personal blog this is where I get to say that sort of thing. Of course there is a hell of a lot of effort in this program (albeit in Python so its easier to get stuff working), but why is this another program? We already have music players. If I only count the blessed and pratically-blessed players, there is Totem, Rhythmbox and Muine, all with different UI designs. The author of Listen must have at least partially liked one of those (from the screenshots he liked the playlist of Muine but the overall design of Rhythmbox) and then worked on one of those, say adding a pane to Rhythmbox to do what he wanted instead of duplicating large amounts of non-trivial code. It's likely that the result of this would look nothing like Listen, as I still firmly believe that it is ugly. Of course what he does in his time is his choice and none of my business, so if he wants to write another music player he can, but if someone wants to make a real contribution to the community they should interact with the community in the first place. Otherwise it's just a pet project and if it duplicates existing programs, will likely remain a pet project. Maybe this comes down to centralised source code verses distributed source code (CVS vs Arch), but I doubt it. Downloading a tarball to start patching is easy, and for most people creating an Arch branch isn't exactly trivial. Update 2: This is a very amusing open letter.

Steve Langasek just posted this mail to the debian-alpha mailinglist: As of two days ago, the debian-installer svn tree has been switched to use Linux 2.6.15 exclusively on alpha, instead of the previous 2.4.27. This means that with the most recent daily builds, all installer images for alpha are using 2.6 kernels *only*, and the current plan is that d-i beta2 will be the same. If you haven't tried 2.6 on your alpha yet, now would be a good time so you can let us know if it doesn't work before we drop 2.4 for etch completely. http://www.debian.org/devel/debian-installer/

http://cdimage.debian.org/cdimage/daily-builds/daily/arch-latest/alpha/iso-cd/debian-testing-alpha-netinst.iso

http://cdimage.debian.org/cdimage/daily-builds/daily/arch-latest/alpha/iso-cd/debian-testing-alpha-businesscard.iso

http://people.debian.org/~vorlon/d-i/alpha/daily/ Good timing, I have to install my new PC164 next weekend... :-)

I have the honour of having been asked to be on the programme committee for the 2nd Workshop on Scripting for the Semantic Web. Whereas a lot of semantic web conferences are heavily academic, this workshop mixes the learned approach with real world deployment experience and sharp-end grassroots semweb hacking. The topics the workshop seeks to cover are close to my heart and represent the place where a lot of discovery and experimental deployment of the semantic web is taking place. So, you should consider submitting a paper to this workshop if you're doing serious implementation work around RDF, wikis, syndication, FOAF and related topics. I was a little flattered to see DOAP in the list of buzzwords in the call for participation too! The workshop also includes the Scripting Challenge, where an iPod nano is up for grabs for "the most innovative small scripting application or mashup. The application must be implemented using a scripting language and Semantic Web technologies. It should access, visualize or combine information from different sources in new unforeseen ways." You can find the call for participation online at semanticscripting.org. The workshop itself will be held on June 11 in Budva, Montenegro--the day before the 3rd European Semantic Web Conference.

It seems that all of Microsoft's hoo-hah about patent indemnification and the associated attacks on Linux aren't even worth the electrons they're excited with. According to an article in The Register, a patent infringement suit brought by a Guatemalan inventor has resulted in all users of newer versions of Microsoft Office needing to install a new, presumably non-infringing, version of the software next time they reinstall. Users who fail to do so "will no longer be covered by Microsoft's guarantee against patent infringement liability." I don't see how this is any different to what you get with patent infringement in the FLOSS realm. Someone says "that code violates my patent rights", the developers reimplement to avoid infringing, users have to upgrade. I'm just not seeing the difference here.

Julien Danjou and others replied to my "please don't obfuscate BitTorrent" post, pointing out providers in France, Canada that already filter BitTorrent one way or another. I've read similar things about some DSL providers in Germany (Telekom however is proud that they don't do that). But basically this only shows my point: by having the major p2p filesharing protocols use non-standard ports and non-detectable protocols, more and more providers take measures like doing QoS for non-standard ports or filtering them altogether. And just as you reported, this has bad side effects on the ability of other users to e.g. use VoIP or play online games. Remember: my point is to make P2P protocols easy to filter/limit by routers, so provider do NOT block/throttle all non-HTTP connections, but can selectively throttle only P2P filesharing when they think they need to. Because otherwise they'll break other stuff such as online games and VoIP. Now by putting your BitTorrent on ports such as 80 or some VoIP port which isn't throttled, you only cause these providers to e.g. install a transparent proxy for these services. You make it only worse. I agree that you don't have that much choice in countries where there is some kind of monopoly there. But then this increase in filtering will probably allow new companies to enter the market.