In several semi- or non-commercial associations work is done by volunteers who spend a lot of their spare time and energy for the goals of the association. This works fine as long as all people who are spending a lot of time on the goals are treated the same and work voluntarily. When some people decide that some people should get paid for their work, while others, who don't work significantly less, don't get paid for their work an uneasy situation is created. Why are some people treated better and get paid for their work while others don't get paid, but still work a lot on the same or similar issues? Why should those, who have to make money in other areas in order to live at all, continue to work voluntarily? I have always argued that in such constellations one must not have volunteers and paid workers do the same work. The only exceptions are volunteers who have stated that they want to do the same work, even though they don't get paid for it. Otherwise you'll create dissatisfaction of the volunteers, which in turn will most probably result in less volunteers, at least in the long term. Also volunteer work should be more interesting and relaxed than paid work, so that the volunteers have more freedoms and develop more fun doing the volunteer work they were asked to do. Paid work is fine for boring tasks that not enough volunteers are comfortable with, such as standing around asking visitors at an exhibition for their tickets, keeping people out of areas where they don't belong, working at a counter, folding and packing stuff etc. Looking at LinuxTag, we had such situations twice. First of all, two members of the board of directors have been on the payroll of the LinuxTag association for three or four months, while the others of the team have worked voluntarily. The same or at least a lot of similar work has been done by the same people before voluntarily. This has caused resentment by those who have worked for LinuxTag in their spare time, or even full-time for several months without getting a Penny for it. In addition to that there were two external service providers that have worked on some tasks (such as press coordination, social event and business acquisition) which didn't interfere with volunteer work. We've had those for years and especially for business acquisition it is important since they can maintain regular 9-to-5 business hours. These companies have worked very well, and we've had a great social event this year, after several years with extremely problematic social events. A second situation arose after it was clear that not enough hostesses were available and volunteers should work side by side with them. There is no problem as long as the volunteers want this. However, normally they don't. Many of them enjoy their freedom, not having to work for the entire time but having enough time to walk around and talk to people etc. Most volunteers feel very strange when they are asked to do the same job voluntarily while their neighbour is paid for it. In the Debian project I have always objected to paying some developers while not paying others. In my opinion, the best situation would be a company that employs a developer for regular company work but lets them work on Debian and Free Software issues for 30-60 % of their time. However, I have to admit that those, who work on Debian more or less for the entire day, and, hence, don't have enough time for their studies, jobs or work, will have to get some revenue or they will starve to death sooner or later. On the other hand, if they get paid for the work, they can't easily take a day off and enjoy their non-computer life. Err... I've heard that some people do...

Although I am by means an expert Python programmer, I do dabble -- at the moment, I'm dabbling fairly heavily in a project for work. I had need, as you do on occasion, for a call trace (I called this method, it returned X, I then called this other method, it returned Y, and so on). Astoundingly, I got no answer when I asked on #python, as I would have expected this sort of thing to be a gimme -- even possibly including it as a core language feature. But nary an answer was forthcoming. Searches for mixins or magic function calls which might solve my problem were similarly fruitless. I resigned myself to manually sticking print wrappers around the function calls of interest, but that got old real fast (especially after I spent about a half-hour chasing my tail because I'd forgotten to return the return value after I printed it). As usual, my subconscious saved the day. On the train home this afternoon, I suddenly had a brainwave, and the code which I've reproduced below appeared almost fully-formed at my fingertips. It's times like this that I really enjoy programming. Now, of course, someone will pop up and say "oh here it is over here", or "you just set the __trace_me_baby__ attribute on your object", but I can console myself with the fact that I know a lot more about grubby Python internals than I did before. The code: (a pre-saved version is also available).

# tracemixin.py
#
# A python mixin to trace the calling of methods.
#
# Copyright (C) 2005 Matthew Palmer 
#
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 2 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program; if not, write to the Free Software
#   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
#   or see http://www.gnu.org/licenses/gpl.html
#   
"""
A mixin class to permit the tracing of method calls on an object.
This class, when mixed in, overrides the default operation of method calls
so that requests to call methods which have been listed in the
self._traced_methods list will be printed with their arguments and return
values.  Also included is a simple call depth indication, using indents.
Tracing of particular methods can be turned on and off on a per-object basis
by simply including or removing the method's name in the _traced_methods
list on the particular object.  Whole classes can be traced by setting
the list as a class attribute.
To include this class, simply make it the first class name in the list of
parent classes when defining a new class, like so:
class Something(TraceMixin, RealParentClass):
You could probably leave the TraceMixin in your production code, although
it'll slow execution down by a bit.
Complete usage example:
from tracemixin import TraceMixin
class RandomTask(TraceMixin):
	def x(self):
		print "X!"
	
	def y(self, arg):
		print "%s Y!" % arg
		self.x()
x = RandomTask()
x.x()
x._traced_methods = ['x', 'y']
x.y('why?')
Output:
X!
::y(why?)
why? Y!
  ::x()
X!
  =>None
=>None
"""
class TraceMixin(object):
	_traced_methods = []
	_depth = 0
	def __getattribute__(self, attr):
		if attr in object.__getattribute__(self, '_traced_methods'):
			self.method = attr
			attr = '_trace_proxy'
		return object.__getattribute__(self, attr)
	
	def _trace_proxy(self, *args):
		realmethod = object.__getattribute__(self, self.method)
		if realmethod and realmethod.__class__ == self._trace_proxy.__class__:
			print "%s::%s(%s)" % (self._depth*'  ', self.method, ', '.join(args))
			self._depth += 1
			rv = realmethod(*args)
			self._depth -= 1
			print "%s=>%s" % (self._depth*'  ', rv)
			return rv
		else:
			raise AttributeError

I've followed AJ's experiment in funding free software development with his AJ Market with interest and have thrown money in the pot once or twice for some of the projects I care about. It's an interesting approach. I'm too lazy to do anything like that, or rather, I'm already paid sufficiently to work on free software that doing a joeyh market would too much resemble work. However, I did decide to try something I've seen done occasionally, since I also wonder how that works out -- I added a paypal donations button to the website for one piece of free software. Just as a test, to see if it annoys anyone, and if anyone bothers clicking on it. I chose alien since it's well known, regularly used by a suprisingly large number of people and even appears on the first page of otherwise quite amusing results on a google search for "alien". (I suppose that adding google ads to the page would generate more money, but in a probably less interesting way.) Unlike AJ, I won't promise that clicking on the link will motivate me to work on anything. In fact, the most likely use of any money I get from this will be to pass the buck along to the AJ market or something similar.

I spent too much time today reading MIPS disassembly of the ADAM2 bootload, as used on the Netgear DG834G. The problem is that the version used on the Netgear performs a checksum over most of the flash device on every boot. This makes the use of JFFS2, as done by OpenWRT, somewhat problematic. In an ideal world I'd try to compile up a newer, less restrictive version of ADAM2 but there's no JTAG on the Netgear that I've found and the thought of frying the bootloader and bricking the device wasn't appealing. So what I've ended up doing is finding where the checksum is done and changing the branch instruction that aborts the boot to a nop. It's still scary, but it appears to do the job. PLEASE NOTE THE BELOW COULD PERMANENTLY BREAK YOUR ROUTER First, obtain your ADAM2 image. This is 128K and is mtd2 from the bootloader view. It should have an md5sum of 0530bfdf00ec155f4182afd70da028c1. If it doesn't, stop. The version I'm talking about is 0.18.01 as distributed by Netgear. Assuming you have the right md5sum you want to go to offset 0x3944 where the 4 bytes should be 44 09 00 0C (representing a jal 0x90002510 during execution). Replace these 4 bytes with 0 (representing nop) and you should end up with a new image with an md5sum of d8a2f4623bf6f64b7427812f0e849aa7. You'll then need to do something like dd if=adam2-fix.bin of=/dev/mtdblock/2 on the device (I don't believe you'll be able to rewrite the bootloader from the bootloader for some reason...). After that ADAM2 will still checksum the flash, but will continue to boot it after printing a checksum error message. This means you can go off and build yourself an OpenWRT AR7 based image and install it on your Netgear. Rock.

I won. I completed 50,000 words in time. Of course, only about 13,000 words are directly usable if and when I end up editing the story, the rest will have to be removed – they were imposed by the strict timetable and the explicit leave to lower one’s standards. But, bottom line: I WON! Ps. Please don’t ask to see the manuscript. It’s not that good Pps. My mother won, too. Conga rats!

I am about to give a presentation in Tacna, Per , at the VI SIIS, Universidad Nacional Jorge Basadre Grohmann. What is different this time? That I am waiting for the conference to start, sitting in my nice workplace at IIEc-UNAM. Yes, I was supposed to go and talk there (and was quite excited to go to the I ConclaDeb at Arequipa last week). Anyway, why cancel my talk, having the technical means to carry it out?
Less than five minutes from now we will start. There is only one thing I regret: As a complete multimedia neophyte, I could not suggest an application to do this from within Linux - We will be using MSN for the presentation. I have a friend's computer on my desktop, and MSN worked great (and at the first try!) for this - Who can suggest me a free alternative for doing this (specially taking into account that I cannot go to the other end and do much configuration on their side - It must be something speaking a standard format)
Anyway... Time to talk! I'll have my paper (Spanish only, sorry - Analizadores morfol gicos aplicados al lenguaje natural, aplicaciones para la b squeda de informaci n) online. Right now I only have my presentation there, but in a couple of hours, the paper should be there as well.

Isaac, there is actually a cleaner way to do the same as your hook. Just add the following to your .pbuilderrc file :

export CCACHE_DIR="/var/cache/pbuilder/ccache"
export PATH="/usr/lib/ccache:$ PATH " EXTRAPACKAGES=ccache
BINDMOUNTS="$ CCACHE_DIR "

That will need bug #341453 to be fixed first, though, but if you set both BUILDUSERID and BUILDUSERNAME it will work out of the box (with the default configuration, PATH is not preserved because of the bug). Note that you can also set HOOKDIR instead of using the --hookdir command line argument, thus not needing your wrapper.

I just finished rewriting an old firewall tool from Perl to Python. Since it's in Python and about firewalling I dubbed it Pyroman. I investigated a dozen of firewall-tools before, including shorewall and firehol. Each had it's stength and its weaknesses. After writing iptables rules in a shell script every now and then for a more complex project (with like 6 networks of which 3 are bridged together) and two dozen of differently configured hosts, NATs, VPN, everything. My predecessor had written a shell script to configure the firewall, but this was really bad to maintain. So I ended up writing a perl application to generate the rules from a modular configuration (read: usually one file per host, containing a perl hashmap) Well, after happily using this script for two years, I dedcided it's about time to rewrite it and document it extensively. I chose python for the rewrite. You can get the result here: Pyroman 0.1.1. The good:

• Written in pretty python
• Extensively documented (Python docstrings)
• Much faster than sh+awk based solutions
• Really easy syntax to add hosts, nats
• You can add custom iptables rules when needed
• Designed for complex networks
• Lots of verification checks done before execution
• Designed to use the same configuration files on multiple hosts (e.g. failover firewalls or the destination host itself; it will detect if you are talking about a local or a remote host
• It will report file name and line number on parser errors, verification errors and execution errors.
• If any rule fails to setup, a rollback will occur, restoring your previous firewall
• (will likely have auto-rollback if you lock yourself out in the next version with a simple timer)
• Extensive configuration example

The bad:

• Not yet tested in production
• Doesn't completely hide iptables complexity (some core config files are just containing iptables rules, but why invent a new syntax?)
• Only iptables, no TC/Shaping, no IPsec, proxy arp setup, VPN, ifconfig (I use other tools for that, e.g. heartbeat)

To tease you a little more into testing, here's an example host configuration: ("dmz" is an interface alias - where the web server is connected to -, as are "INT", "DMZ" and "ANY" for clients on these interfaces)

"""
A really simple webserver configuration.
These examples are just boring... ;-)
But without NAT they would be even more boring. ;-)
"""
# web server
add_host(
        name="web",
        ip="10.100.1.2",
        iface="dmz"
)
# offering, well, web service.
allow(
        client="ANY DMZ INT",
        server="web",
        service="www ssh ping"
)
# internal hosts may access FTP, too
allow(
        client="INT",
        server="web",
        service="ftp"
)
# setup NAT
add_nat(
        client="ANY INT",
        server="web",
        ip="12.34.56.80"
)

(Yes, this is a python script. No, you probably won't care to write your configuration in a programming language, will you?)

I don't know how I did it, but I did it: Somehow, I got EMILE to work on jazz, my Quadra 950. Unfortunately the kernel does get loaded but it will panic rather soon after that. But at least it's a step in the right direction. Now to get the bloody thing to boot again, using penguin. Because that's the downside of EMILE: if you fuck up your boot, you're in trouble... I'll probably need to test on different hardware; the Q950 is quite different from other hardware, and it apparently isn't entirely compatible. Oh well.

The GPLv3 process to discuss and decide on the final GPLv3 license is warming engines with today's launch of http://gplv3.fsf.org/. Currently the website is only featuring a Process Definition document, but it does contain the schedule to work on the license. The plan is for the license draft to be released on the 16-17 of January 2006. With the final license agreed upon no later than March 2007. It will be interesting how the FSF and the Free-Software community will come to an agreement on something so fundamental with so many conflicting requirements.

I’m getting ready for my departure to Edinburgh, everything is arranged. I will leave for my parents this afternoon. They will bring me to the airport tomorrow around 9:00. My flight (number 6922) is at 12:25 (CET) and will arrive at Edinburgh Airport on 13:00 (GMT). There, I will take a taxi to the campus, meet the people I will be working with and get my room (which should have a permanent Internet connection). Last night I had a good dinner of soup, lots of pancakes and dessert with my flatmates. Afterwards friends and my brother visited for a last cup of tea and the traditional finishing bite at the kebab place. Thanks for stopping by guys! I hope to be able to report frequently about what’s happening and what I am doing if time allows me too, stay tuned…

Pepsi Max

Pepsi One

jumper

sweater

petticoat

jumper (many sniggers when you refer to "putting on your jumper")

entree

appetizer

main course

entree (ordering entree-sized dishes will not have the desired result)

Does anyone out there have any experience with LDAP servers (the version in sarge) that die under a big amount of requests? We are trying to set a mail server for 250K+ users and it keeps on stopping working when 10K+ mail are sent in a very short time... If you need more information about the slapd configuration, I will be glad to provide it. And yes, I have read the performance manual and augmented the default values for cache size, max amount of locks, threads (up to 32K), requested locks,... and the filesystem is using noatime. Indexes are in place and used, and the database has been rebuilt with the indexes. And the problem happens when using a single entry from the database, so is not a question of having to find different entries. Thanks.

Sun! Sunlight is a wonderful thing. Yesterday I came back from a six day vacation in Madrid. The weather was not warm, a bit warmer than in Finland, but especially it was dry and sunny. Pretty good autumn weather, actually. The best week I've had for a while. This was my Quest for Sun '05. I stayed at Amaya's place, slept well and long every night, had a wonderful time with some Debian people, and walked outside and visited a couple of wonderful art museums. Thank you, especially, Amaya, Holger, and Miriam. And also vi and emacs, the feline foot fetishists who rule Amaya's apartment. I took some pictures. They're touristy snapshots, not meant to be art. I meant to make notes about my experiences during the week, but the nice, classy Moleskine notebook I bought especially for the trip got lost the first full day. Some moments stuck into my mind, however.

• Amaya's cats attacking my feet while I slept. At one point, one of them sat on my knees for a while and pounced every time I moved in my sleep.
• Tapas is a very good never-ending style of food. It just keeps coming: every time you get to the end of the plates you now have, the waiter brings more.
• Food in general was very good. Even cheap fast-food like kebab.
• Art museums in countries with a long history of art are bloody big. Both the Museo del Prado and the Museo de Arte Thyssen-Bornemisza seem to require about seven straight hours for a proper visit (I spent about three at each, and saw half of each). I think this is so that people will attract fewer cats by being too tired to move their feet during the night.
• Telling the history of love, bed, and sex to Amaya and Holger over a meal. I really should write that down some day. (They're editors.)
• One of Amaya's cats is crazy and likes showers. Or at least likes to sit in the shower after someone's used it.
• The Retiro park is wonderful. I could spend a lot of time just walking about in it. I did.
• Food in Spain is good. Spanish eating times are crazy, but you get used to them.
• Me: "Back when I was working on Kannel...". Person next to me: "Oh you worked on Kannel? It is such a nice program". Moments to live for. Enough to motivate me to write and publish some more free code.
• "Gracias", "buenos noches", and "de nada" is enough Spanish to get you live well for a week. Helps to have native speakers as guides, of course.
• Did I mention that the food is great?

Since the Quest for Sun '05 was a success, I definitely will do it again. A week of light (and sleeping properly) really improved my mood. Maybe even enough that I will be able to deal with the remaining months of dark, gloom, wet, and cold of the winter in Helsinki. The only big negative thing about this trip was flying. I suggest that international air travel henceforth shall be called "The Cattle Drive".

I've been using NiMH batteries for quite a few years now. Ever since my first-ever digital camera came with a free AA charger and four free rechargable NiMH batteries. I'm still using that charger, and it's been almost 10 years. I have a few complaints about my existing charger. It won't charge AAA batteries, and it doesn't have a discharge feature. Without that, it can be difficult to avoid shortening battery life due to the memory effect which even NiMH batteries are susceptible to. Also, it charges batteries in pairs, which can result in various charging problems when dealing with batteries of uneven charge or uneven storage characteristics. Also, many of my batteries were old. So, I set out to find a better charger, and to find the best current NiMH batteries. The Charger A little Googling revealed a very useful page at Steve's Digicams. They suggested the Lacrosse BC-900 Advanced Charger. I ordered this unit from Thomas Distributing and must say it is a very slick unit. It has four main modes: charge, which does a simple charge-until-full; discharge, which will discharge then charge a battery; refresh, which discharges then charges the battery repeatedly until no increase in capacity is measured; and test, which checks the condition of the battery. The charging and discharging current is fully configurable. I opt for a gentle, slow 200 mA charging current. But others can increase it to many times that. The BC-900 has a built-in temperature cutoff circuit, so it will pause charging if your batteries are about to overheat. The BC-900 can charge up to 4 AA or AAA batteries simultaneously. Each battery is charged individually, and each battery can have its own mode and charging/discharging current set. The unit comes with some starter NiMH AA and AAA batteries, plus a carrying case for batteries and the charger. Thomas Distributing also added four more free AA NiMH batteries (nice). Batteries I found the Great Battery Shootout site to help with choosing batteries. I eventually chose Maha Powerex batteries and have been happy with them as well. They come in various different capacities (including some larger than are listed on the shootout page) and Thomas Distributing had good prices. Hope this helps if you're planning on using rechargable batteries.

My "test" boxes (well, they are in fact production systems) are now all up and running SELinux with a "strict" policy and in enforcing mode, after some weeks in "permissive" mode to detect the last missing policy rules (well, maybe I'm still missing something in cron.monthly?) What took most of the time was in fact to write policy for some services or custom applications that didn't have one before. And that I basically was just checking the logs every day to see if some new audit errors had appeared. Oh, and inbetween we completely emptied the server racks and their wiring and redid the room... Just to mention a few things that were "missing": My OpenVPN is running a custom script to update DNS on login and logout, which obviously was missing from the SELinux policy. I'm also using heartbeat to failover between the two firewalls and two mailservers; that policy took me probably one hour (without much previous experience) to write. Then I have another custom LDAP to aliases for a Lotus directory (which hopefully will be replaced by a sane application soon... whoever invented "implicite email adresses" should be shot. Just put all email adresses into the directory, so any app can look them up without trying to guess what your generation rules are... firstname.lastname@domain.tld sounds easy, but what with non-ascii characters?) Anyway, the systems are doing pretty well. Maybe I'm going to enabled SELinux on the web server next. ( (cra-)PHP and typo3 will probably make that more difficult, though...) Oh, and I need to sort out which of my policy changes are local changes, and which I should feed "upstream".

This essay is part of my Finnish criminal justice series. See the introductory essay for more information and an overview of the Finnish criminal court system. In this essay I will be presenting an overview of the Finnish penal code – the principles, and the measurement of punishments. I will write separate essays on the actual crimes recognized by the penal code. As always: I am not a lawyer, and this is not legal advice.
Read more

I think I agree with Ian Holsman's analysis of this article on "How to make money from open source" - actually I would go a bit further. Ian says that you don't need to be a committer to make money from open source. Indeed, in some ways the big question in terms of "open source economics" has been how to more tightly couple the people doing the valuable work with some percentage of the rewards - at least enough to let them keep hacking. While it's evident that open source works, and that there are big economic benefits involved, it's a tough nut to crack in terms of renumeration for people working on stuff. Selling software is, if nothing else, a really simple mental model that is very easy to grasp - you write software, you sell it. If it's good, people buy it and you can either reinvest that money, or take it as profit. Open source software that scratches an itch has immediate benefits to the author, especially if the author manages to get other people on board to help out. But the category that's not really covered is the group of people writing something "out of the blue" because they think it's a cool idea. If it is, and it takes off, they really aren't guaranteed anything at all for their troubles. I don't see too many ways around this while still playing by the rules of the game. There are some clever ideas like dual licensing, but they aren't applicable everywhere. I suppose you could declare software a public good and get the government involved in its production, but I'm not very enthusiastic about that... In any case, it's an interesting topic, and perhaps some day clever entrepreneurs will find better ways of financing the production of open source software.