Some weeks ago the kernel on vore, Debian's sparc porting machine and sparc buildd, was exchanged and didn't run as stable as expected. According to the site admin he was able to fix these problems in the meantime. However, one week ago the machine became unavailable again. This time it's a connectivity problem with the switch port. Unfortunately the security buildd for sparc has no redundancy. Even though auric, the other sparc machine of the Debian project hosted at the same place, visi.net, was configured to run a buildd for the general distribution, it wasn't set up to pick up security as well. It is not know when the connectivity problem of vore will be fixed. However, this morning build logs for security updates were received from a new machine. It looks like somebody spent some time on fixing the issue without vore and alleviate the situation. Hope we'll have a sparc buildd soon again.

Gentoo took our users away. Then Ubuntu drove away the developers. Now, this will take Debian out of its misery. If you weren’t concerned, now you should be.

I was searching today for a tool able to launch a shell in a vim. I found vim-shell. It took me only a few minutes to have a patch against vim 6.4 working, and some more seconds to have the debs. sadly, it didn't fit my expectations. I hoped that vim-shell would allow me to switch between interactive shell and editing sessions, allowing to scroll in the history buffer, copy things, edit others, remove some lines, well, having the shell living in a vim window. sadly :

• vim-shell is only a terminal emulator in vim
• it does not works well in gvim where the feature is the most needed (in a term, you can ^Z vim to have a shell, or run vim inside a screen and have as many shells as you like).

I hope such evolutions will come fast ...

Broken News is absolutely fantastic, and I just discovered that there is a third series of Peep Show "coming soon". Cashback! Update: just found out that the new series will start on the 11^th November. Back of the net!

I am excited this evening. I just found a CD that I burned back in 1996 or 1997 or so. On this CD is some data I thought I had lost. It has copies of information on some floppies that can't be read anymore. But it also has the PowerPoint presentation I did as an 8th grader that got me to National History Day in Washington, DC. Not only that, but also the original high-resolution scans of the photos I used in that presentation. Some of these scans are of photos that date back to the early 1900s, whose owners may not be easily reachable today. I had been hoping to find this for years. I knew it was buried somewhere. And YES -- stumbled across it tonight. I will be posting some photos on this blog in the coming days. But first, I have to find a way to convert this ancient PowerPoint file to a format that OpenOffice can read -- so I get the correct story behind each photo. The scans were saved back in the days when a person got 8 characters to name a file. Not very descriptive. (And I remember how much space it took up on the hard drive I had back then, and how much I wanted to just delete those big picture files. Glad I didn't.)

OK, so I spent some fun time playing around with my 5g video iPod — time for more serious action now. I have created two patches today which add support for the video iPod to gtkpod, a GTK+ based, platform independent GUI for Apple's iPod.
These initial patches allow you to sync m4v video files to your iPod and watch them there. I will add support for all other video formats which work on the iPod, soon. The patches will be sent to the gtkpod maintainers, of course, in the hope that they can be included in the next release. Note: This is pre-alpha, barely-tested code! Use at your own risk! Installation instructions:

• Get the current CVS version of libgpod. Apply the following patch: libgpod_5g_video_ipod_support.patch. Compile and install libgpod.
• Get the current CVS version of gtkpod. Apply the following patch: gtkpod_5g_video_ipod_support.patch. Compile and install gtkpod.
• Mount your iPod (USB cable): mount -t vfat /dev/sda2 /mnt/ipod
• Start gtkpod (possibly as root, depending on your system) . Maybe you need to edit the settings and adjust the mount point for the iPod (/mnt/ipod is the default).
• Click on the "Read" button to read in the iTunesDB from the iPod, click on "Files" to add a video file (e.g. this Apple commercial from 1977), click on "Sync" to upload the file to your iPod.
• Quit gtkpod, unmount the iPod (umount /mnt/ipod), disconnect the USB cable.
• Profit!!!1

I get a "Destroying mmap buffer" error every time I sync the iPod, but that's probably a gtkpod bug, and it's non-fatal anyways. If you happen to own a video iPod, please test the patches and report whether they work! Thanks!

I’m trying to accomplish what I believe should be a simple task with iptables—replace my DSL router with a linux box. The linux box also routes packets to other machines on the LAN based on destination IP address (the box receives packets for multiple IP addresses from the Internet) and port number, and blocks other packets based on originator IP and port number, but as I understand the firewalling and inbound routing chains are totally separate from the outbound NAT functionality. In any case, the inbound stuff works perfectly now. It seems simple enough to set up a box, where eth0 faces the Internet and eth1 faces the LAN, to act as a gateway or proxy to the LAN:

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 

And that actually works perfectly, except that a Windows box inside my LAN is unable to connect to a VPN outside the LAN, while it worked fine with the Buffalo router I had in place before. All other services are properly accessible through the gateway. So I posted a description of my situation to comp.security.firewalls. I admit that I have, at best, a basic understanding of iptables, but I have read the manpage and documentation and gotten it to do 99% of what I need with the exception of this VPN issue. In response, a “Wolfgang Kueter” called me clueless multiple times, said that I had no idea what I was doing, and that I “misunderstand almost everything,” and that I should pay a professional to do it for me and read books on TCP/IP and the IPSec protocol specification itself. Other newsgroup postings by this fellow have a similar tone, e.g. building a security suite (Q: What combination of software firewall, anti-virus, etc., are you using and have you noticed any discernable effect on performance? A: None, because they are useless crap. … I don’t use such crap, so how could I?). Steve suggests that Web 2.0 should have some way to tag people like this as jerks, and their reputation would then follow them around on the web. Since that technology doesn’t yet exist, the next best thing, I suppose, is to just blog about it and hope this entry turns up in a search on the person’s name. Abrasive responses to legitimate requests for help from people hoping to learn something don’t do anything to advance the free software movement. I suppose this kind of person will always exist, but I wish they didn’t. I don’t want to be petty about this sort of thing, but I actually don’t think I need to hire a professional or read books about TCP/IP and the IPSec protocol specification itself to configure a Linux box as a residential gateway. Does anyone disagree?

It took me hours to get FastCGI and Suexec working properly. I'm so annoyed by the horrible docs available for it only. First I tried using fcgid (which at least is DFSG-free) but wasn't able to run moinmoin properly at all. So I gave up on that quickly. So I ended up trying "non-free" libapache2-mod-fastcgi. Oh what a mess. Getting the non-suexec fastcgi working was easy. Now I tried to make it a bit more secure... The "Documentation" claims that all you need to do is enable the SuExec Wrapper. So I configured a "FastCgiServer", set -user and -group appropriately, somehow found out that I need to chown the executeable and the dir containing the executeable accordingly, and that the user and group need to be higher than 100 - ok. (Although group www-data would have been okay, I guess). Reloaded apache. And the fastcgi process is started and running with the right userid. By now I was using a mini test-fastcgi, which prints getuid() - and so I could see that despite my process runing as a different user, it still returned 33 (=www-data). Damn! The reason I found out later after manually changing URIs to find the right docs etc. was that I need to enable mod_suexec, then add the SuexecUserGroup option to my vhost. For incoming requests, FastCGI will check for a running fcgi server with the same path and the same user and group ids as the one you defined in the fastcgi config. Otherwise it will start a new dynamic server. And there is no "FastCgiUserGroup" option or something obvious to configure the user and group name for the cgi path - but you need to do that for mod_suexec. Apache config is a PITA anyway. With its pseudo-XML syntax etc. - we really need to get rid of it sometime... So here is a short howto for using suexec and mod_fastcgi on apache2:

• Install apache2 with suexec (should be included) and fastcgi.
• Name your FastCGI .fcgi, setup +ExecCGI and the fastcgi-script handler
• Test if your fastcgi runs as www-data user (i.e. non-suexec)
• Add a "FastCgiServer" statement to the fastcgi.conf with appropriate -user and -group statements, enable FastCgiWrapper
• chown the CGI and its parent directory to these ids, also consider setting the "immutable" flag on your cgi
• Enable mod_suexec by calling "a2enmod suexec"
• In your VHost, add a "SuExecUserGroup appruser apprgroup" statement matching the usernames you gave above.
• restart apache. You should now see your fcgi process running with the correct userid. Otherwise check suexec.log and apache error log
• Try to access a web page generated by the fastcgi, and make sure it didn't start another fastcgi daemon...

Sony DRM rootkit love.
RIAA/MPAA broadcast flag on steroids love (PDF). Now, tell me what you will do with your computers and personal pictures/videos when they belong to you no more...

Branden has authorized funds to cover my travel expenses and I've booked a ticket so it's official. I will be attending foss.in

I have heard of Gobby many times now, but when Daniel Stone blogged about it today, I finally decided to give it a try. For those who don't yet know what I'm talking about:

Gobby is a free collaborative editor based on libobby, a library which provides synced document buffers. It supports multiple documents in one session and a multi-user chat. It runs on Microsoft Windows, Mac OS X, Linux and other Unix-like platforms.

One apt-get install gobby later, I was astounded as to how mature it already feels. I think Gobby will be of great benefit when taking notes during conferences, talks and so on. It could also prove invaluable as a pair programming tool. Anyways, I already hear you crying "but SubEthaEdit has been doing this for ages", which is true. But:

• Gobby is GPL'd, SubEthaEdit is not.
• Gobby is a cross-platform tool, SubEthaEdit is not (I don't own no Mac, you insensitive clod!).

There you have it. (via Daniel Stone)

So, many people have had many things to say about Gobby, the much-vaunted app with the most phenomenally awful and unfortunate name I've ever seen in a free software app. This tends to be either hype (oh my god, it will enable us to leverage synergies to maximise shareholder value like we've never leveraged synergies before!), or disappointment (is that it?). Mine is neither, really.

I don't find that collaborative editing is hugely groundbreaking; a small IRC channel which everyone uses to document things, then assembled into a text document from there, can do roughly the same job. One thing we've been using it for at Ubuntu Below Zero is taking notes in BoFs. Most people in the BoF log in and the main note taker does the bulk of the work, and either him or the assignee steers conversation.

Normally in BoFs, I either get so involved in it that I forget that I'm supposed to be taking notes and thus don't, or tune out somewhat and forget to take any notes, and have to reconstruct it from vague memories later on. What Gobby is useful for in this case, is keeping the note-taker honest. If the notetaker is writing down anything inaccurate, you can just fix it; if they're forgetting to take notes at all, you can stop talking and throw some Mentos at them.

I think this alone makes it tremendously useful for stuff like note-taking in BoF sessions, and could be useful for minuting conference calls also. Adding the IRCalike interface is useful too as an out-of-band channel to throw URLs around (and to give Seb crap about using azerty) also. So I'm pretty sure I'll keep using it for that.

itv4 launches tonight on freeview and ntl cable, but it seems that Sky have an administrative problem that will stop it being on Sky until next week. Anyone else suspicious? To compensate, itv4 launch night is being broadcast on Men and Motors too (which is visible across Europe, I think). The talk on the newsgroups suggests that itv4 is on satellite and it's only the non-standard Sky EPG which won't be updated. If you want it sooner, you may be able to use a standard DVB-S receiver or "Add Channels". Eutelsat float price falls. The report suggests it's because of other floats, people not wanting to invest so much in communications and bad bank practices. BBC World closes 10 radio services, opens 1 TV service which might suggest how much more expensive TV is to make. Meanwhile, a report says:

"Public service broadcasters are compromising quality to compete with commercial channels, and many of them depend on Governments or political parties. Meanwhile, ever-larger concentrations are developing in the commercial sector, often with clear political affiliations."

(Television across Europe report from OSI EUMAP) There's a guide to what I'm planning to do Real Soon Now: konekti la komputilon al televido If you want to get involved with radio instead, you could answer this call for help with rampART radio, from ram radio. I think they were interesting listening during G8 and on 7 July, but maybe they need a different approach for the rest of the time. RampART broadcast over the internet, which was how I listened. Many of the documents describing the internet are non-free, which is a silly silly pain. I've supported the petition about Problems with the IETF's copying permissions, by Simon Josefsson (author of libidn and gnutls) but I haven't done more yet. Moving to games, Sam Hocevar's post about Monsterz is unhappy with the difficulty of finding items for it:

"it makes me feel like coders are years ahead in terms of sharing their digital work for everyone to use and improve."

He's not alone. Want a big example? Stuart Yeates noticed that ibiblio's torrents have poor copyright info. I've also spotted Sourceforge and BerliOS hosting non-free data in the past. That's really annoying: you can't adapt everything you download from them and you have to read the terms really closely if you want to develop free software. It surprises me that Sourceforge and BerliOS stick so closely to the FSF's software=programs myth. It might be surprising that ibiblio's torrents seem blind to copyright metadata, but it's probably little surprise that a European Commission group assumes that strong, standardised, zealously-enforced copy controls are The Only Way and has meant the EFF Urges Fresh Inquiry Into Ramifications of DRM. There's news of a peer-to-peer technology that honours copyright law, by Derek Sooman. Will it work? Will it support liberal copyright terms as well as Big Media Grabs? Might Big Media outdo ibiblio? I doubt it.

Yeah, according to eWeek, RedHat wants Xen to be part of the Linux kernel. My point of view, if anybody cares, is that it's a good point for us. Virtualization (or supervision, call it as you want to) is a new battle coming in our little world.
Why? Because it's the new easy way to secure and handle big and/or complex information system infrastructure and architecture in a cheaper way. No more need of many boxes dedicated to one job, just a few, and run as many as you want different OS and isolate them. The second argument is the possibility to manage workload flows, migrate then, freeze them and so on, in a transparent way. That's why virtualization is great and powerful in some way and because you will love it. Yeah, I confess, I love Xen, because it works. And finally, we don't want Microsoft to have this argument on its side only. ;-)

Wow, a year ago today I woke up and started my first day working for Opened Hand. It's been an absolute riot, when I started it was just Matthew and myself and the Nokia work was a mystery project, now the Nokia 770 is being shipped to developers and there are five programmers. In other news, we finally got the mortgage agreed so hopefully will be moving house in December. NP: Bitches Brew, Miles Davis

Yes, I know that number by heart now. It's not a silly number, it's a bug. A grave bug on binutils which I opened, since the current version of binutils in unstable is, well, rather broken. I spent today tracking it down, and I found it. I must say I didn't expect that—I know next to nothing about the ELF file format, and even less about the binutils internals, so... But anyway, this is what I did:

• I compiled a simple application with a broken binutils installed, and ran it inside gdb. It of course segfaulted before it even reached main(), but that was expected. The interesting bit of information was where it segfaulted.
• With objdump -D, I checked where that was. Turned out it was in some obscure section called '<.plt>', which I had never heard of before; as I found out, that is the "Procedure Linkage Table"—whatever that may mean.
• I then compiled the same application against a known good binutils, and compared. The result of that comparison can be found in the bug log (which I linked to above); anyhow, there was a difference in one of the opcodes. The result of that was that rather than jumping to some bit inside the application (at 0x8000267c), it would jump to address 28b6.
  That can't be right, of course.
• The issue was now to find out what the relevant change was. Running debdiff over the sources of both packages produced a 30M diff, so going through that would've been a little too cumbersome.
  IRC to the rescue.
  P2 told me that the code responsible for the PLT was to be found in libbfd, and that I should look at the source files in the directory for that file. Looking at the diff, I found that the file bfd/elf32-m68k.c had seen quite a lot of changes relating to ColdFire V4E support. The ColdFire V4E is a processor of which the instruction set is based on the m68k instruction set, and it should technically be possible to produce an ABI that will run on both systems, though Debian doesn't support it yet; however, it appeared that the relocation code which was added in support of the V4E was broken somehow—after reviewing patches for a few hours, I finally stumbled upon revision 1.74, of which the commit log says Add support for generating PLT lookups for the ColdFire. Which is so closely related that it can't be a coincidence. I built me a new cross-binutils based on the most recent source package but with that revision reversed, and tested, which seemed to succeed. Now I'm double-checking by building a native version, which might take a while; but I expect that one to work, too.

I'm pretty excited about this, both because we've had this bug for almost two months now (and we really needed to get rid of it) and because it's actually the first time I track down a bug in anything toolchain-related. This is nice.

This is by far the most stressful long period I can remember in my life. I was quite in control of things approximately until around June. Since then, things have been falling over me in a quick and heavy sucession - First of all, being co-organizer at Debconf was quite hard. I had run conferences before, but nothing ever like this - And, I should add, I never had a German boss running the show. [friend="Stockholm"], as a project leader, you really rule... But whoever works with you should be warned: It is not easy.
Gunnar's Rule of Future Life No. 2: It's easier to be the coordinator (remember I was officially the Tyrant for three years at CONSOL? :) ) than to be in the immediately subordinate team.
Back home, I expected the regular post-vacation rush, so having a hard August -trying to make everything on time- was expectable and OK. I don't remember exactly what projects was I in during August/September (I remember some minor stuff, but I think adding it all together was the mistake). There is one thing I did, though: Accepting way too many invitations as a speaker, at least one every two weeks. And, as many of you know, you cannot just travel somewhere and keep working - When I am at a conference, I want to get to talk with the people there, I want to know what are they interested in (why they invited me in the first place), and make friends with them. But this time it was (as it happens every year - Why are most conferences stuck together September-November?) just way too much.
Gunnar's Rule of Future Life No. 2: Be careful on what you accept. It's easy saying "yes" to a conference. It's hard keeping sanity afterwards.
Ok... I have been going places. For example, two weeks ago I was to San Luis Potos . Instead of staying there for two days, I left my office at 7PM, took the metro to the bus station, got the bus at 9PM, arrived at 2AM, went to my hotel, woke up at 7:30AM, had breakfast, coded for ~1hr, went to the conference theater, delivered my talk at 11AM, went for a quick lunch (which became a takeaway order) at 1:15PM, got on my bus at 2PM, arrived back in Mexico City at 7PM, got to a (fucking long) meeting at 8PM, left the meeting at 12AM, and finally got back home at 1AM. Fun, huh?
Gunnar's Rule of Future Life No. 3: Yes, it's fun to travel. It is much more fun to travel when you actually get to know the place!
...And pressure has not given way. As soon as I finish with one project, there is another one demanding my attention right away. October has been more than hectic. I had to cancel two invitations (on which I was to go to two cities each time) I was quite looking forward to, in Peru - I am very sorry, friends at Lima, Moquegua, Tacna and Arequipa... But I won't make it there this year. I am specially frustrated by not being able to make it to Concladeb in Arequipa - I really want to see DebianPeru/DebianArequipa's good work! And I am specially sorry on canceling today my trip to Moquegua, after they had already booked (and paid) for the tickets... It seems the money will not be lost after all, but I was such a pain in the ass for them, it is not fair I am cancelling... But anyway.
Gunnar's Rule of Future Life No. 4: Remember to learn from past experiences - It feels incredibly as a deja-vu from last year.
I hope I am not spoiling any surprises: Today, instead of blogging, I am supposed to be setting up the Comas server for Debconf6. Even with all of my worries, yes, I am still determined to be the man behind the show for Debconf. It will be in Oaxtepec, don't worry, and it will be a huge success. So let me finish this post quick, and it will be sooner you can register for it ;-) There are still too many points to work on Comas, though. I am setting up a tweaked version, against my will, but with the commitment to fix it transparently and soon. Oh... Yes, and I still have to coordinate with the locals here, as it's taking forever for us to open the fscking bank account so we can start receiving funds and paying money. Did I mention Debconf would be in Mexico? Ok, I will do my best not to make lateness the norm.
Gunnar's Rule of Future Life No. 5: Try not to bore your audience with too many details. Remember you have to work, and somebody might complain you lose too much time blogging!
But before I leave you alone: You might ask why do I mention the addiction in my post title... Well, because I have started treating my main addiction. It is really not easy, and I don't ever want to know what is it like to have a chemical addiction, like people who abuse drugs. If you have seen me face to face, it should be obvious: I have a very strong addiction to food. For one month already, I have been as conscious as I can every time I open my mouth - And, yes, it was not just three times a day. I have made some advances (sorry, I cannot really measure it, as home scales make it only to 120kg). Today is a big day for me: I was admitted in a pilot obesity control follow-up treatment at my University's sports health direction. I am very happy about this, as I do need mentoring and hand-holding. This is a seriously difficult process to follow, and I really hope to carry it thoroughly. Fortunately, my health has been perfect until now - But I cannot abuse myself forever.

There are lots of cases where you can have a positive view of a stock, but still want a bit of investment protection. A fairly typical way of getting some protection against a drop in price is to place a stop-loss order with your broker, so that if a stock hits a certain price that you set, the broker will automatically sell the stock. This limits your loss (known as downside protection), and if the price doesn’t go down, then you keep all the stock, and you get to take full advantage if the price goes up (known as upside participation). Also, it should be free to place a stop-loss order with your broker, unless the price is hit and the stock is sold. So, stop-loss orders have three benefits: downside protection, upside participation, and no up-front cost. Unfortunately, there are a couple downsides (no pun intended) to stop-loss orders. The first is that if a stock is really plummeting (there aren’t any buyers at all), then it may be difficult or impossible for your broker to get the price that you’ve specified. That’s sort of an extreme situation though and only happens about once every thirty years (think October 19, 1987). The other, much more likely, scenario is that the stock goes through a temporary decline (causing your stock to be sold), but then recovers. In that case, you’ve sold for a loss and you miss out on the recovery. So instead of placing a stop-loss order with your broker, you can purchase what’s called a protective put. A “put” is a contract that says the buyer of the put has the right (not an obligation; it’s the buyer’s choice) to sell stock on (or before, in most cases) a predetermined day at a predetermined price to the person who sold (”wrote”) the put. For example, today RHAT closed at $23.22; you can buy an option to sell 100 RHAT shares at $22.50 (the strike price) anytime between today and November 18, 2005 (the option expiration date) for $55 (as reported by Yahoo!). So you get downside protection and full upside participation, for a price. (There’s also a married put, which is the same thing as a protective put, except you buy the stock at the same time as the put; a protective put implies that you already own the stock.) But there is still the annoying up-front cost. If you’re willing to risk missing out on some of the potential upside though, you can offset the costs. A collar is when you buy a protective put and at the same time selling a call option. By selling (writing) a call, you give someone else the right (again, not the obligation) to buy shares on a predetermined date for a predetermined price. For example, say you do buy the protective put above, and at the same time, write a call option for 100 RHAT shares that expires on November 18, 2005 for a strike price of $25. The proceeds from this sale will be $30 (again, minus fees). So for a cost of $25 ($55 to buy the put minus $30 to write the call), you’ve got downside protection, and upside participation up to about 7.7%. All of this assumes that your preference is to keep the stock. But say that your stock has done very well and it’s gotten to be a sizeable part of your portfolio, and you’d like to diversify a bit. That means that you’re serious about selling it, regardless of what you think the price is going to do. (There are lots of good reasons to sell a stock that’s enjoyed nice gains, not the least of which is that nice gains are generally caused by nice growth, and a company can only grow so big.) Selling the stock outright is one technique; another is a variant of dollar-cost averaging, but instead of buying a fixed dollar amount, sell a fixed number of shares. But you can combine either of these with writing call options to potentially achieve even better results. A covered call is when you own a stock and write a call option on it (like a married put, a buy-write is when you buy the stock and write the call at the same time). Instead of selling the stock immediately, you give someone else the option to buy it from you at a predetermined future date. Because the date is in the future, there’s a bit of a premium that buyers will pay (which means more money for you). For example, November 18, 2005 calls for RHAT with a strike price of $22.50 are selling for $120 for 100 shares; that means that if the option is exercised, you make $22.50 from the sale, plus $1.20 per share from the option, for a total of $23.70 as your effective sale price. If the option is not exercised though, then your shares are not sold, but you get to keep the $120, and do the whole thing over again. (Unfortunately for me, Brocade has a company policy prohibiting collars and covered calls. But fortunately for me, I don’t own very much BRCDE stock.)