Today is a nice milestone. For the first time my server is "in the cloud", and yet I have full control over the kernel it is running. While it should be possible to do this with Xen, I never found a host who would. So for the three years since I got rid of colocated physical hardware, I was constantly nagging my Xen hosters to update their kernels, often to fix security issues. And I sometimes struggled with things like udev that needed a newer kernel. Most importantly it just didn't feel right for "my" server to not run my kernel. Even though in this modern day, "my" server is just a fever dream of bigger computer. I'm infected with the Sovereign Computing meme. KVM probably makes this easier than does Xen. What Steve has set up at kvm-hosting.org is a great example and template for providing a small group with great hosting at a very fair price, with full control, and an excellent interface. It's the little things, like being able to view the my neighboring guests' virtial machines in top, that I really like.

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            
 2841 joey      20   0 1637m 1.0g 3152 S    7 13.2  48:27.20 kvm                
 6606 steve     20   0 1365m 1.0g 3540 S    2 13.2   9:29.52 kvm                
 2888 cernio    20   0 1269m 284m 3152 R    1  3.6   4:08.57 kvm   
 2800 ore2      20   0  754m 521m 3152 S    0  6.6   4:35.68 kvm     

This all feels sorta science fictional when I step back and look at it.

---

notes for kernel setup on kvm-hosting.org I want to be able to install regular Debian kernel packages. In these packages, the virtio drivers are modules, and need to be manually added to an initrd. So first edit /etc/initramfs-tools/modules and add the below to it, then run update-initramfs -k all -u to rebuild the initrd. BTW, some of these modules may not really be necessary.

virtio_blk
virtio_console
virtio_pci
virtio_net
virtio_balloon
virtio-rng

Then edit /etc/kernel-img.conf to configure the kernels to add a symlink to the latest version in /boot. This way, kvm-shell can be configured to boot the latest kernel automatically.

do_symlinks = yes
link_in_boot = yes

And here is a hook that rsyncs /boot, sending kernels and initrds to kvm-hosting, so its interface will let me boot them. This was put in /etc/initramfs-tools/hooks/kvm-hosting-rsync and made executable.

#!/bin/sh
# Use --copy-links so the symlinks to the current
# kernel and initrd are selectable in kvm-shell.
# 
# Use --delete because I like living dangerously. :)
rsync --copy-links --delete -vazr /boot/ kernels.kvm-hosting.net::joey-kernels/

Cross-posted to asheesh.org from the OpenHatch blog. (OpenHatch is my current project.)

"How do I get involved in free and open source software?"

"How do I encourage people to join my project?"

Gregory Wilson, a CS professor at UToronto, cites some recent successes at answering these questions with respect to students: "Google Summer of Code and UCOSP have both shown that it's easier for students to get into open source projects if there s a pile of tiny tickets for them to start with." We believe that these "bite-size" bug lists can benefit all sorts of new contributors, student or not. What you might not know is that more than a hundred projects have these small tasks tagged and waiting for you in their bug trackers.

To make it easier to find these, the OpenHatch volunteer opportunity finder allows you to browse, in one place, nearly 1000 bite-size bugs.

Do you know another project with bite-size opportunities we should index? You can get your project involved. Check out the list of bug trackers we index. If you contribute to a project, go to your bug tracker right now and label a few as bite-size. Then add your bug tracker to our index.

I want to especially thank GNOME for the ongoing GNOME Love effort that is our inspiration and the source of hundreds of these bite-size opportunities.

Happy hacking!

If this sort of thing is interesting to you, take a look at OpenHatch and subscribe to our blog or @openhatchery on Identi.ca or Twitter.

Well, I haven t moved myself, but my server is now hosted in the new Linode datacenter located in London. The migration has caused a downtime of more or less 4 hours yesterday, time for the data to cross the ocean.
The migration was successful, though you might still experience issues to connect to the services hosts on this linode due to the new IP adressess (both IPv4 and IPv6). Most DNS servers should however now be up-to-date. Thanks again to Linode for their great service and support.

A couple of weeks ago, Lucas Nussbaum wrote about his experience at the Ubuntu Developer Summit. Two things stuck out at me:

• "Ubuntu has clearly gone a very long way since 2004. Everything looks very well organized and polished, and gives the impression of a big machine that nothing can stop."

In the summer of 2004, my laptop (an iBook G4) ran Debian GNU/Linux on PowerPC. I tried out Ubuntu that autumn, and was very impressed. It's been five years since then. My desktop still runs Debian, and I'm proud to be a "two-distro" community member. At the same time, this juggernaut nature raises concern. When Ubuntu releases ship with significant flaws, I quietly sigh and wonder, Are we doing good service to the people coming to GNU/Linux for the first time and seeing Ubuntu? This bugginess has bit me a few times (even for upgrades between one release and the next), and it pushed a friend of mine to switch a lot of his computing to DragonflyBSD. Lucas points out that Ubuntu's done a fantastic job of becoming visible. A look at Google Trends shows that people search for "Ubuntu" about as much as they search for "Linux" at all. Richard Stallman complains when people refer to GNU/Linux as just "Linux." But today, the most popular name for an operating system based on GNU is probably "Ubuntu." For Stallman, having his hard work associated with someone else's "Linux" project must be frustrating. As a Debian contributor, it would be easy to succumb to the same feeling with regard to Ubuntu. Lucas is well aware of that. He asks,

• "Will Debian manage to stay relevant, or are we just going to be the technically-pure distro without many users that serves as a package supermarket for Ubuntu?"

Debian does have users! I was feeling a bit disheartened about my maintenance work on alpine lately, when out of the blue I received an email from a fellow at MIT asking me if I would accept some help with maintenance from him. Just seeing the note was a relief; it's very nice to be reminded that I have users to take care of. Debian is not as popular as Ubuntu on the desktop (or laptop), it's true. But technically sharp people do frequently still choose it. For example, the FreeNAS project recently announced a switch from FreeBSD to Debian (and a new name as coreNAS). But we could end up a "package supermarket". To stave this off, we must do good releases and make sure people know about them. Doing all that work takes us all time. We must recruit new contributors, help them find things to work on, and make sure they feel welcome. And sometimes-sloppy maintainers like me ought to fix our packages, and get help from others where necessary. I promise to work toward that.

Three years ago, while I was in Ghana, I wrote a small screensaver that displays a randomly picked unicode character full-screen. I like it because there is a huge bunch of very weird characters and signs in the unicode standard. It also prints the unicode codepoint and character name. Now I finally got around to properly package it: Created a small homepage, a source tarball with (hopefully) proper autotool files, all managed in a git repository (also on gitorious), complete with manpage, README and other additional files. I m also going to upload the package to Debian, so you can just do apt-get install unicode-screensaver as soon as it gets accepted.It can probably not enter the official xscreensaver distribution as it adds dependencies on the fontconfig and freetype libraries.

Subject: zlib_1.2.3.3.dfsg-16_amd64.changes REJECTED
Reject Reasons:
lib32z1: lintian output: 'embedded-zlib ./usr/lib32/libz.so.1.2.3.3',
+automatically rejected package.
lib32z1: If you have a good reason, you may override this lintian tag.

I guess I should ve actually reported the lintian bug rather than just ignoring the bogus warning.

As I ran out of time whilst writing the "introducing ujail" post on monday I would like to further elaborate on the idea, giving you some examples of possible use cases and then having a look at FAQs regarding ujail. Additionally I have created a second proof of concept that should be a lot faster, see below for more details.

Use cases of ujail

Monday's post was rather technical, so let's have a look at possible use cases today.

The main reason for both having the idea of ujail and starting working on it is my web server. I am running quite a few (S)CGI scripts there and, even though running them as different users, on a per-vhost basis, I have the impression of the whole thing being a bit insecure.

Okay, PHP does provide its famous open_basedir feature, but I am also running some Python applications which I simply cannot restrict easily. My first ideas involved adding something similar to open_basedir to Python, followed by the idea of replacing some C library functions, like fopen and friends on startup time.

Whilst the adding open_basedir to Python would have involved changing a lot of Python's internals I soon discarded the library patching idea as those could be worked around by injected code directly invoking syscalls. It didn't take long for me to notice that I have to dig deeper. The idea of ujail was born and after coming up with the proof of concept this seems to be a viable solution.

Now ujail is not only about protecting a web server from its web applications, but could do a lot more, for example:

• Creating a sandbox for untrusted code (socket&file i/o emulation)
  
• Implementing some sort of personal firewall (socket-call only emulation)
• Testing applications that perform low-level system operations (read: package managers and friends, filesystem emulation)

I am sure you can come up with even more use-cases. What should be noted is that emulating a system call does not mean that one necessarily needs to emulate the whole filesystem. What can be done, for example, is patching through access to common files (libraries, executables, etc.) whilst maintaining a virtual filesystem for data that will eventually be modified. A copy-on-write approach is possible too, for example. There are multiple methods with which the multiple filesystem could be implemented, the most common would probably be using a state directory.

FAQs

There have been some questions about ujail in comments to my first post which I would like to answer. Also, I have been thinking about things that are different about ujail compared to other virtualization techniques. Feel free to add additional questions either in a comment or drop me an email: debian at sp dot or dot at.

1. Could you change the license of ujail to ... ?
   
   Not likely to happen. The proof of concept's license is GPLv3 and the actual code's license will be too. However, ujail is a userspace application that does not need any modifications to the kernel so there should be no problems with porting ujail from GNU/Linux to any other system.
   
   
2. Does ujail work on operating systems other than GNU/Linux?
   
   Not yet. If it's technically possible to implement the technique on other operating systems I would be happy to accept patches.
   
   
3. Do I need to patch my kernel for ujail to work?
   
   No, ujail is running in userspace. The only thing it needs is Linux with support for PTRACE_SYSEMU.
   
   
4. How is this approach different from using LD_PRELOAD?
   
   With LD_PRELOAD one can replace library functions, but malicious code could still directly invoke syscalls, working around this protection completely. Also, statically linked binaries cannot be restricted with LD_PRELOAD.
   
   
5. How is this approach different from user-mode-linux?
   
   User-mode-linux (UML) works by emulating a full kernel in userspace and allows you to virtualize a whole Linux instance (including a new init process, etc). ujail is about providing a way of restricting a single process (and its childs) inside a running system in terms of access to syscalls and the partial emulation of those.
   
   
6. How is this approach different from linux-vserver?
   
   Linux-vserver is a kernel patch and runs in kernel space, as opposed to ujail, which works in userspace.
   Also, linux-vserver works similarly to user-mode-linux, providing a fully virtualized Linux instance.
   
   
7. Does the account running ujail need any special privileges?
   
   No, the only restrictions that apply are those of ptrace.
   
   
8. Where is the code?
   
   Right now ujail is in a planning phase, and only the proof of concept code has been written and published. The actual ujail code is yet to be written and the code will be hosted on launchpad.net.
   
   

Proof of concept, part 2

An anonymous person (who were you stranger?) added a comment to my first post, suggesting "Also, why patch the process rather than just modifying its state and trapping into the kernel?". I have had a look at this approach earlier, but it didn't work out. However, I decided to give it yet another try and created a second proof of concept. That code does not require patching any code, but only modifies the instruction pointer (eip) and the first register (eax). This should be a lot faster than patching the code.

Technically the new main loop works by calling PTRACE_SYSEMU and waiting for a notification. It then saves the instruction pointer and switches to PTRACE_SYSCALL. As before it waits for the emulated syscall to exit and at this point sets eax from orig_eax and decreases the value of the instruction pointer by the size of the "int $0x80" instruction. Another call to PTRACE_SYSCALL resumes the process. The next event is the process actually entering the real syscall and yet another one leaving the syscall again. These are resumed by PTRACE_SYSCALL and PTRACE_SYSEMU respectively. So, comparing this with the first approach we are only modifying two registers now, instead of writing to the TEXT area of the running process.

Thanks should go to the anonymous commenter for making me give this approach another try.

Questions? Criticism? More ideas? Want to contribute?

Coming to an end I would yet again like to let you know that I am open for questions, criticism, more ideas and contributions in general. So if you are interested in this topic come join the discussion by either dropping me an email, writing a comment to this post or replying to this post on your own blog.

Yesterday webex started failing for me. I did not change anything related to java recently so I was a little perplexed.

Checking it turns out that even the standard test your java page failed. strace revealed the nice error:

$ grep ffff /tmp/TRA
6938 connect(22, sa_family=AF_INET6, sin6_port=htons(80), inet_pton(AF_INET6, "::ffff:72.5.124.95", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0 , 28 <unfinished ...>
6938 connect(22, sa_family=AF_INET6, sin6_port=htons(80), inet_pton(AF_INET6, "::ffff:72.5.124.95", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0 , 28) = -1 ENETUNREACH (Network is unreachable)

Notice that I don't have IPv6 connectivity!

Googling it turns out that you can disable IPv6 in java by modifying to ~/.java/deployment/deployment.properties the line:

deployment.javaws.jre.0.args=-Djava.net.preferIPv4Stack\=true

and all is now well. Until I need to access an IPv6 device with java of course :-(.

Barnes and Noble's new nook ebook reader is now shipping to people. Mine[1] is due to turn up tomorrow, but the instruction manual is available for download already. Quoting from it:

Notwithstanding anything to the contrary in this Agreement, certain components of the
Software are licensed subject to the General Public License Version 2.0, a copy of which is attached
as Exhibit A (the GPL License ). You may not use these components except in compliance with
the GPL License. In addition, you may have additional rights with respect to such components
under the GPL License, including, without limitation, the right to obtain the source code for such
components from us. You may obtain a copy of such source code by contacting us through the
contact information provided on the Web Site. We will provide such source code in accordance
with the GPL License.

Which is all very promising[2], except contacting them via either phone or email reveals that nobody has the faintest idea what I'm talking about. I can certainly imagine that they have other concerns right now (delaying your initial shipments by up to two weeks depending on how early people ordered suggests some kind of utter failure somewhere in the chain), but it's depressing that approximately nobody appears to be able to get this right.

Updated:

After further conversations with tech support, I was told that I'll be mailed a CD of source within two weeks.

[1] I had a Sony, which unfortunately had a bit of an accident. On the other hand, it was running 2.4, so maybe it was a lucky escape of some sort?
[2] Well, apart from the traditional confusion of the GPL as something that claims to restrict use

Just some quick superficial observations on the Debian/Ubuntu package distributed by Google:

• Most files are installed in /opt/google/.
• It attempts to patch /usr/share/gnome-control-center/gnome-default-applications.xml on postinst (maybe legacy compatibility? Someone with more gnome-fu than me care to explain?).
• The postinst also automatically adds a souce for updates to /etc/apt/sources.list.d and an archive key (this is IMHO the worst part)
• It includes a daily cronjob that at least at first glance tries to do the same things the postinst did (new apt source, archive key, etc) and some further archive configuration. The cron script is called at the end of postinst.
• A casual look at objdump suggests it s statically linked to libv8
• On a slightly more positive note, it at least seems to successfully undo most of the changes once removed, with the exception of the added archive key and the above mentioned patch to gnome s default apps list (that is: if there s any situation it actually gets applied).

I understand it might be too much hassle doing it the right way (from the corporate POV), but then why not simply cooperate a bit more with the community? Hopefully they ll accept some criticism and suggestions.
Or even better: they could simply reuse all the work being done to officially package Chromium.

Mika Tiainen reported the Debian bug #560000 on Tuesday December 8th, against the ferm package. Bug #550000 was reported as of October 7th 2009. So, again, no matter what, we're still keeping up with the very regular "10,000 bugs in 2 months" pace This time, I would like to highlight a specific bug that missed to be #560000 by very few hours: namely "#559980: aptitude: Totally broken on GNU/kFreeBSD". Please read that bug report and take time to send Cyril "KiBi" Brulebois a nice "Chapeau" ("hat off") for the time he invested in analyzing this bug and providing a good workaround. Update: KiBi told me that his workaround is broken. Still, the "hat off" still stands as what impressed me is more the nice investigation work than the workaround itself. Of course, admittedly, Cyril is not alone doing such work but it never hurts telling good people they are doing good work. To all Planet readers: <Teletubbies mode ON>from time to time, please remember putting more light on those people doing great and sometimes obscure work in our project</Teletubbies>. After all, blogs are not only about ranting, right? :)

Funny coincidence that David writes how well Linux and Printers go together for 12 years, while it is apparently impossible to print something with CUPS in unstable since a week

I just had the following conversation with my linux desktop:

Me: "Hi, I'd like to use my new printer please." Computer: "Do you mean this HP Laserjet CP1515n on the network?" Me: "Erm, yes I do." Computer: "Good. You've got a test page printing as we speak. Anything else I can help you with?"

Sadly I don't have any alternative modern operating systems to compare it to, but having done similar things with linux over the last 12 years, I'm impressed with how far we've come. Thank you to everyone who made this possible.

Martin, Prague airport used to be (one of) most expensive airport for food and drinks prices. They recently reduced prices quite a lot, but I still think they fully qualify to be in the group of most expensive airports. But it has great advantage that every other airport looks cheap for us. This is almost same as prices for taxi, which is also usually cheaper than in Prague :-).

For a Java project, I wanted to give the Eclipse profiler a try. It didn't work, because it was missing a library (open the "Error log" view to see such things)The corresponding library - libstdc++-5, and old C++ library - is no longer available in Debian unstable, so you need to grab the package from lenny. It will install fine on unstable.Things may or may not be different on other architectures.[Update: But TPTP is far from stable for me. It freezes Eclipse pretty much all the time.]

Transforming data is hard. When I joined my current company, there were stupendous amounts of Perl/PHP/Bash/<insert random programming language here> scripts that would run on a cron job and do magic things to our data. They d create reports, they d tell the purchasers when we were running out of stock, they d synchronise data between our Frontend and backend databases, they d collect, they d collate, they d do everything and anything. Except, with all these scripts, in all these random languages, written by a multitude of previous developers (at different skill levels), they weren t particularly maintainable (and sometimes, they weren t particularly readable or understandable either imagine a 6000 line perl script that pretty much ran different permutations of the same data over and over again) Enter Pentaho, and specifically it s Kettle project. (since renamed Pentaho Data Integration ), a tool that lets you manipulate your data in pretty much any way you can imagine, in the simplest and easiest way imaginable.

That s right, it s a GUI for data manipulation.

I know a lot of you are probably sceptical right now. The first time I ever saw this was when a previous boss of mine put it forward as a potential solution for one of our problems (getting our orders from the front end database down to the office/warehouse). I saw it, and I thought GUI? Nah, that s not how real programmers do things! , so after the development team put forward another proposal to solve this, and it got accepted, I thought I d never see the thing again.

That was until my current boss started playing with it, trying to work out what it was doing so that he could get these evil GUI based scripts into something manageable, like nice, pretty code. Thing s, when my boss plays with things that he doesn t know about, he tends to read up, research, and, 9 times out of 10, change his mind.

We wiped the previous server (it was rather noisy! We re glad it s no longer switched on!) and set up a new server to house our BI platform . Starting off with a few scripts, my boss learnt to love this tool, and then, as I m his 2nd in command (aka general lackey) started making me learn how to use it.

Again, I was sceptical, I didn t want to learn, and I put up resistance, but my boss was going away for nearly a month, and by this time, a few of our key business processes relied on Kettle, so, grudgingly, I sat down, and started to learn.

You may be wondering now, why I started off this story talking about all those magical and wonderful scripts that no one seemed to know the inner workings of. These scripts, as I ve already mentioned were unwieldy, and at times, god-damned awful. The plan was to move them to the BI system (as my boss had been doing already).

I like to think of Kettle as a bridge between the process-flow diagram, and the code. I started converting these scripts, and I was astonished by the fact that most of the conversions I was doing was converting a long perl script into 3 or 4 Integration steps

I m totally besotted with this program now. Any time I have to do data manipulation, I turn to it. I can t describe how (once you ve got used to it s quirks) easy it is to use, how simple it is, and how much it just makes sense. Best of all, most of those evil scripts are gone now, and replaced with pretty diagrams that do the work for you.

If you have to play with large data sets on a regular basis, I urge you to try it out. You can buy me a beer for reccommending it next time you see me at $conference.

Dear life,

It has been a pretty crazy couple of months, had to stay away from most of the things that I would normally breeze through, including but not limited to a few aspects of my real life day job, Debian work, movies, the routine yearly Oct-Nov time vacation that I take etc. Obviously, hobbies took a big hit. Also had to let go of an opportunity to travel to one of my favorite places, IIT Guwahati; something that I don't usually pass up. Sigh! But such is life.

Been bouncing back slowly:

I finally moved a few domains that I run (including my personal domain) and their email to a linode and I am quite liking it so far (I would've been great if I had some more disk space at my disposal but 16GB isn't all that bad).

On the Debian front, finished attending to package sponsorship requests, I've been updating packages (there is one elinks RC bug that I'll fix next) and work is finally under progress for the clang ITP in the Debian GIT repository.

There are a ton of pictures in RAW format that I haven't yet had the time to convert to JPEG (I use UFRaw but the output that I got from Bibble Pro is fairly impressive -- perhaps I should consider getting myself a license) but that could wait.

Found a decent place to rent (I should be moving in about a month or so). I would've liked a place that isn't an apartment or at least in a smaller community, preferably something in-town but good places are difficult to come by.

I am back,

Giridhar

Lately I have been thinking about methods to provide a stripped down, secured environment for running untrusted code on GNU/Linux. With this post I would like to present you with the first results of my research.

ujail - brief introduction

I have chosen ujail as the name for the technique I am proposing. ujail stands for micro jail in userspace and, in itself, describes the concept briefly. The main idea is to have a userspace process monitor system calls of one of its childs and emulate some calls, if needed. This is done using ptrace and namely both PTRACE_SYSEMU and PTRACE_SYSCALL.
The ujail process should not be able to monitor syscalls, like strace does, but also intercept and emulate them.

This sounds a lot like user mode linux (uml), but the method is different. Whilst uml comes with a complete kernel, emulates all system calls and this way provides a virtualized system, ujail is intended to only emulate some systemcalls, without emulating the kernel.

Revisiting PTRACE_SYSCALL & PTRACE_SYSEMU

To better explain how the ujail technique works I would like to have a quick look at PTRACE_SYSCALL and PTRACE_SYSEMU again.

PTRACE_SYSCALL allows a userspace process to be notified whenever a traced process enters or leaves a system call. This means that two notifications are normally sent: one before system call entry and one afterwards. Even though one is able to change the parameters of system calls this method does not allow system calls to be fully emulated (think virtual filesystem here).

PTRACE_SYSEMU on the other hand provides one notification on syscall entry and expects the receiver of the notification to emulate the syscall. This method alone sounds great, but this also means that memory allocation needs to be emulated too, which is quite complex in userspace.

A hybrid of PTRACE_SYSCALL & PTRACE_SYSEMU

Now on to the concept behind ujail. The method I am describing works by calling PTRACE_SYSEMU for a specific process and this way taking over emulation of all system calls. However, some system calls are complex to emulate in userspace, and so a hybrid of both PTRACE_SYSEMU and PTRACE_SYSCALL is needed. In short this works by checking whether the syscall needs to be emulated when the PTRACE_SYSEMU event is received.
Now one way is emulating the syscall, filling the processes' registers and resuming execution of the process. This is simple and straight-forward.

The second way is forwarding the system call to the kernel. The problem here is that calling the syscall in the monitoring process will make the new resources available to that very process, and not the process to be jailed. This is where the hybrid method kicks in.

The proof of concept code creates a backup of the next instruction to be executed along with a copy of the instruction pointer at this point and patches it with the opcodes for "int $0x80", causing the syscall to be made again. After that it resumes execution with PTRACE_SYSCALL and waits again. The first event to be received now is the program leaving the emulated system call, which can be ignored. Resuming yet again will give use two PTRACE_SYSCALL events, one for syscall entry and one for syscall exit.

The first event is not really interesting, but at the second event the opcode backup is restored and the eip set from the saved value. Now the kernel has handled the syscall and the result is ready for the child process. A final call of PTRACE_SYSEMU resumes execution of the child and waits for the next syscall.

Proof of concept

The proof of concept code can be downloaded from its bazaar branch at launchpad.net. It is intended to be used on i386 systems only and works with simple programs, but is known not to work with anything using fork, vfork and most likely will not work for binaries using threading.

Finally, I would like to thank Pradeep Padala for his "Playing with ptrace" articles [0][1], which were fun to read and worked as a great introduction of ptrace for me.

Now there is only one thing left to say: if you are interested in this method, see loopholes or problems or want to contribute, please go ahead and contact me:

debian at sp dot or dot at

More release critical bug squashing of the "week" (fortnight, really):

• openarena-data Debian bug #523323 + patch (the necessary changes in openarena are extensive, so I don't plan to NMU this unless there's no response for a long time)
• fuse Debian bug #550334, Debian bug #553015, Debian bug #557143

Removals from testing and proposed removals from unstable:

• alien-arena Debian bug #559725 (removal from testing only)
• commit-tool Debian bug #558592 (removal from testing only)
• gadfly Debian bug #559375
• gaim-otr Debian bug #552761 (transitional package)
• levee Debian bug #558604
• libroxen-adbanner Debian bug #559251
• libroxen-diary Debian bug #559250
• libroxen-imho Debian bug #559249 (removed from archive)
• libroxen-tokenfs Debian bug #559248
• mailreader Debian bug #559252
• openc++ Debian bug #559111
• overkill Debian bug #558669
• p3nfs Debian bug #559105
• portslave Debian bug #559254
• skyutils2 Debian bug #558605 (removed from archive)
• whirlpool Debian bug #559255
• ziproxy Debian bug #559627

Possible candidates for removal:

• bfm (unmaintained upstream since 2004, declining popcon score)

Other drive-by QA:

• tse3 Debian bug #524726 marked as done (by a binNMU)
• joy2key Debian bug #554521 downgraded to important
• nvidia-graphics-drivers Debian bug #525414 noted as probably fixed, submitter/maintainer pinged for confirmation
• Bugs filed about the packages keeping zope3 around in testing: Debian bug #558204, Debian bug #558205
• mail-notification-evolution Debian bug #559106 upgraded to serious