Since Joey Hess posted a short conversation we had on IRC today about the role of the DPL, I thought it's a good time to express some of my thoughts. Basically, I think that most people have a bad understanding of which tasks are really involved in being DPL (e.g. much more purely administrative crap that nobody else wants to do) and that they're quite naive about what the DPL can achieve, at least in the current climate. Let's just look at the current discussions on the -vote list. It's this time of the year when everyone pretends that its Christmas, expresses their feelings of what's wrong with Debian and where Santa Claus^W^Wthe candidates reassure them that everything will be fine. "Will you fix NM? Fix or replace ftp-master? etc." "Oh, sure I will, all of that (and more)." Honestly, would you elect someone if they told you they won't or can't? The strange thing is that the same questions get asked every year, and yet people don't get the hint and look for other solutions. I'm not overly happy with any of the candidates this year, and I was seriously considering running again, not next year but possibly later. However, this Christmas wankfest reminded me again why that may not be such a good idea after all. I remember how much time I spent answering questions on -vote myself, and while I'm all for transparency, many of the questions were just a waste of time. This year, the questions were relatively sane in the beginning but now it's just a waste of time most questions are posed in a way that it's clear what kind of answer people want to hear. I spent hours and hours answering questions, but at some point I thought "cannot we just stop talking for hours about what I'd do if elected and actually start doing all that stuff?". That would have been so much more productive. Instead of asking the DPL what they'll do to solve All The Problems In Debian, why don't you ask yourself what you can do to improve the situation? There's a bottleneck with the DAM, you say. Right, the chances that you'll be added as DAM are relatively small. But have you ever considered helping the DAM and to make their life easier? How about signing up as an Application Manager and producing such good reports that it'll be a piece of cake for the DAM to approve people based on your reports? Right, it won't fix the bottleneck, but it will make the situation so much better. Instead of bitching about the security team, why don't you prepare a package, write the text for the DSA and get everything ready in a way that a DSA member can simply take your work, recompile the package and issue the advisory? Now I'm sure some people will say that they've tried that and failed. Yes, not every upload for DSA will be accepted as it is, but how hard have you tried? And people always complain about the cabal and how hard it is to join teams. And while I agree that this is partly true, there are so many counter examples too. Look at me as an example. In 2.5 years, I became the most productive Application Manager, joined (and took over) the NM Front Desk, became a "senior" Quality Assurance member, and got elected as project leader. Am I special? No, in no way I just put in a lot of effort. Look at Jeroen van Wolffelaar, who joined at the end of 2004, and who is involved in QA (especially MIA) and lintian, is the co-author of the new packages.d.o code and an ftp assistant. Andi Barth (who got an account in January 2004) has done important QA work (bts2ldap), is a maintainer of the developers reference and a release manager. So it's not possible to join a team, you say? Maybe you're just not trying hard enough (and the right way!). (Hint: "make me a DAM/ftp-master/whatever" doesn't work as well as "how can I make your job easier?"). What I'm trying to say is that people should stop believing that the DPL will fix everything and that they should actually help out themselves. If we all work together and put effort into the areas that need work we might actually achieve something. People have been asking for a strong leader and this urge got stronger over the last few years. But, face it, we currently don't have a culture which accepts a strong leader. Joey Hess mentioned that he wants to see a DPL who pushes technical changes. I did that too, to some degree (mostly in private since that works much better than on a mailing list where a big flamewar is guaranteed). For example, I kindly asked Joey to lower the priority of the non-free question so it would not get asked in a default installation. And he did because Joey is a reasonable guy. (He also told me that me making this request made it easier for him to justify.) However, unfortunately, not everyone is like Joey. And what are you going to do if a maintainer refuses to listen, as many do? I mean, seriously, what can you do? Some are increasingly talking about the good old times of Bruce Perens who would tell people what to do and make decisions. The urge for a strong leader increased over the last years. I think that's partly a reason why Branden got elected last year people expected him to completely shake things up. I haven't talked to him and I wasn't part of the leadership team, so I don't really know what happened, but from what (little) I've heard, it seems that he tried, quickly realized just how rigid some of the structures are and gave up. You have to see things in a historical perspective (and I can only recommend that people who have access to the debian-private archives take the time to read through them). There's a reason we have had "weak" leaders since Bruce. While now a large number of people think that Bruce was the best thing since sliced bread, lots of people were really pissed off back then with him commanding people around. And what was the result? A constitution that would ensure that no leader would ever have such power again. And that's what we're currently stuck with. I think that one of the biggest problems Debian is currently facing is the inability to make decisions. There are so many endless, completely futile (and repetitive) discussions going on. We need someone who comes in, tells people to shut up and makes a decision on behalf of the project. A decision people will follow, even if they personally disagree with it. But seriously, do you think our culture would currently accept such a leader? I can tell you from experience that even people who have been asking for a "strong" leader won't actually follow a leader who tells them to take a certain course of action. We really need to fix this problem, and the problem is in our culture. And since our culture is defined by who we are, you should start with yourself first. Start by asking yourself a few questions. Do you think before posting something to our lists, and ask yourself twice whether it really adds value to the discussion? If there's an area that is problematic, will you try to help out? If asked to do something you're not particularly interested in but which is good for the project will you do it? And most importantly, will you contribute to make our culture something that is fun? The project leader is important, but don't wait for them to fix all of our problems. If there's a problem, try to figure out a way how you can solve it!

I’ve uploaded amaroK 1.4-beta2 packages to experimental, and to the new amarok-latest repository. NP: Alejandro Sanz, Cuando nadie me ve

Since the demand for blosxom anti-comment-spam solutions respective appropriate blosxom plugins seems to be really high, I’ve decided to polish up my apparently quite well working although still in beta state being anti-spam enhanced version of the comments plugin (ZIP) by putting the blacklist outside in an external file and writing some (still short) docs. I use it since 11th of January this year and got only two spam comments and many more normal comments since then, so it should work. Although: I also got a question if my trackback doesn’t work. Hmmm. So no warranties, just an offer for help fighting against comment spam. ;-) Another feature which is basically ported from the writeback notify plugin is notification of the blog owner about new comments by mail. Since on the server on which my blog runs the used Perl module Mail::Sendmail was not available, I used Mail::Send instead for my version. For installation you first need to download the ZIP file of the original comments plugin, install it’s templates and then install my anti-spam enhanced version of the plugin itself.

Now playing: Rockapella — Come on Eileen

I recently bought a Samsung ML-2010, which is a nice laser printer for home use, and tried to set it up on Debian, only to discover that Samsung wasn't hip to my architecture, namely amd64/x86_64. It's no matter, their printer drivers still work, but you have to hack around a bunch of their checks. I'm documenting them here because I'd rather not forget when I reinstall, and it's probably useful for others to know about it. Step 1 - Install the necessary packages - In my case all I needed to install was ia32-libs, because I already had all of the other packages needed installed. The samsung tool uses cupsys, so you may need to install the cupsys package and it's dependencies. Step 2 - Unpack the driver - Get the driver from Samsung and untar it, producing a directory called "image" Step 3 - Hack around the glibc detection - The setup program is "smart" and tries to detect if there is a GLIBC with a high enough version. The bad news is that it uses the wrong version, because it is not familiar with the ia32-libs positioning of it. Luckily, it uses a script to do it's dirty work, so I just changed scripts/test-libc.sh to this:

#!/bin/sh
#
# Test the Libc version and make sure it is > 2.0
#
exit 0

Mostly because I know that we meet the requirement of glibc > 2.0. Step 4 - Run the setup program directly - The setup script (script.sh) doesn't like to run on x86_64 architectures, because of it's architecture checking. This is annoying, so looking into script.sh, find the program that it runs and run it directly, that is, run ./setup.data/bin/Linux/x86/glibc-2.1/setup.gtk as root (it will be putting things in /usr/local). Step 5 - Add your printer to the setup utility - run /usr/local/linuxprinter/bin/linux-config and add the printer. It's pretty straightforward, and actually follows the docs which Samsung gives out from here on.

During the last two months, the Debian Catalan localisation team has seen two of their major milestones completed, after some tough work. The group managed to release Sarge with a completely translated installer, but failed to provide a translation of the Install Manual, which was a regression for us, as it had been available in Woody. We didn't give up, and thanks to the stubborness of Miguel Gea and braindmg we slowly started translating the Sarge manual months after the release, so it could at least appear in the website. But progress was too slow, so we planned an online meeting for the beginnings of the year to try to complete the translation doing a whole lot of translations during a weekend. Soon after we learned that joeyh, fjp and the d-i team wanted to terminate Sarge d-i manual support in svn RSN, as they would start to make changes to the docs to reflect etch changes, but fortunately Frans agreed to give us a slightly extended deadline, if we agreed to finish the job by January 14th:

20:37 < CIA-7> debian-installer: fjp d-i * r33721
               /sarge/installer/doc/manual/ca/: Add Catalan translation as
               translators would like to finish it for Sarge and have promised
               to do so 14 Januari 2006 at the latest

I really didn't think we would be able to make 100% in just 10 days, but the team, assisted by a large number of minionsnew contributors that volunteered on #debian-catalan, managed to do it I believe a few days before the deadline. Guillem announced it on our list. Releasing etch with an up to date Catalan manual will be a lot easier, if we try to maintain it up to date as etch development carries on. The second milestone was yesterday's completion of the Catalan translation for all five levels of the etch debian-installer, after a year of no translation activity on that front, and months of braindmg bugging me to do my chunk of work. Although it's now showing a shiny 100%, there's a lot of review work to do, and polishing it should be our focus for the next release. I seem to have recovered some of my interest in translations. That's good, because GNOME 2.14 is around the corner, and it wouldn't be fair for Josep if he ends up doing all the job. :) Also, I've been quietly working with a group of people at Softcatal in a project that will probably have lots of press in our community. It's not public yet though, but I hope that it'll be announced in the next few weeks.

A couple weeks ago I was going to lunch and met up with one of my friends who I hadn't seen in a while. I had to wait for her to finish her TAing job, in the same lab that I once taught in. I was surprised at my reaction - I wanted to jump right into the room and start helping out. I restrained myself, but it gave me a good reminder of what my actual goal is in grad school. I want to be a professor - I wasn't sure when I started here at the U of M, but after two or three teaching sessions I was certain I was going to teach. It probably helped that it was a class which I have a good amount of experience teaching, being one of the classes I helped with for 3 semesters. Lately I've been trying to remember why I am going through with it all in order to get the Ph.D, and seeing that class was a good reminder. It makes me think that I might want to request a Teaching Assistant job every year or so just to keep me on the right track towards something. Unfortunately, I think if I want to finish in a reasonable amount of time, I will need to focus 100 percent on the thesis before long.

Throughout the last couple of years, I've had some bad decisions. I decided to start using my credit to work for me, and to buy things which I couldn't afford. Partly this was because I had a horrible ex, who I thought I should do things for, and partly because of just living outside of my means for a certain period of time. The long and short of it is, I've gotten myself into a bit of credit card debt. I'm not in any big trouble, just needing to pay it down so that I can get on with using that money for other things. There is a couple of web applications that I have in the works which will help me remind myself, but that's neither here nor there at this point. So, I have all of this credit at high interest rates, surely there is someone out there that will look at my credit and finance it at a lower rate, make some money off of me, right? I'm thinking that what I need is a consolidation loan - something to lump together my credit card debt and give me one monthly payment. What I call this, is debt consolidation. Thinking we are in the age of the internet, I type "debt consolidation" into google and give it a try. This is my first mistake. Apparently "debt consolidation" doesn't mean that you are consolidating your debt, it instead means that you are going into what I would call debt negotiation. This means you decide of your own volition that you are going to stop paying your bills, and try to negotiate with the credit card companies to pay off your debt at a fraction of your actual debt. But I don't know this, so I nievely fill out a couple of forms at "debt consolidation" sites. This gets pretty long, so I put in a break. Read on, MacDuff. The Scam The first people who got in contact with me were some people from Credit Solutions. Let me be clear on this: I'm not making broad generalizations about the company here - I can only speak of my own experiences. The person who I got on the phone went through a whole spiel, "explaining" how it works. He was very high-pressure and very fast talking, just from the start I didn't want to buy anything from him because he seemed like a used car salesman who decided that it was better to make money from nothing than from goods. Here's the explanation he gave me: You've probably been paying your cards down already, so you've paid 70-100% of the cost of your original loan. You stopped paying your cards, wait 3 months, and then they start negotiating with their "powerhouse lawyers". Then they negotiate you to pay your debt at 40-60% of the current balance, and the credit card companies get to take the remaining 40% as a tax loss. Now is when the math gets strange. The man on the phone attempted to say that this meant that the credit card company got 140% of the current balance. This doesn't make sense to me, especially because I'm a smart credit card consumer, and most of my debt is on 0% APR promotional rate cards. This means that they have made at most 3% of the balance from me, based on balance transfer fees. The man on the phone tried to dance around the issue, saying that they actually will get the 40% tax loss and that means they'll still get 140%. 140%? This doesn't make sense - 60% plus 40% is 100%, not 140%. Lets add to this that a tax loss is not the same as profit: a tax loss only gets you like, 30% of your loss. At this point, I've decided that I'm being taken for a ride already, but I ask how it works anyway. Here's how this particular company is setup: I pay into a savings account (of my own), automatically deposit around $200 a month, and they take money out. For the first three months, they take the WHOLE amount. After that, they take half the amount, and leave the other half. They then start negotiating with your creditors, and when they make a deal, they tell you "pay them now". In the end, they take 15% of the settled cost of your debt. On $6k settled debt, this is another $900. I really didn't want to do it now, mostly because of the high cost. The man kept coming back to my objections with "you can't borrow your way out of debt". Of course you can't borrow your way out of debt. That's stupid. I wasn't planning on borrowing money and then ending up with less debt. I was planning on borrowing money so that I'm not paying so much in order to have the debt. Apparently he thought I was an idiot, because he kept repeating it to me. He sent me a little packet of stuff, which laid out the whole plan. After that, he gave me a call back. This is when I got really defensive. I asked him point blank: "What is the worst thing that can happen to me if I go with this plan?" His answer: "You stop paying your bills." On the surface, this is true. The worst thing that can happen is that I stop paying my credit card bills. He neglected to mention the fact that ceasing payment on my credit cards would ruin my credit, cause insane fees for lateness, and possibly send me to forced arbitration with the creditors. Every creditor that I have ever had since 2002 has had an arbitration agreement, which basically would end up in garnishment of wages. The Scum About a week after my first bad experience with a debt "consolidation" company, I got a second call from a completely separate company. They introduced themselves on the phone as "Christian Financial Services" or some such. Basically the same deal, but this was a low-pressure sell instead of a high-pressure sell. He was much more reasonable, and talked me through the whole thing at my own pace, taking his time to lay everything out that I could understand it. It was basically the same deal, 15% and they negotiate for you, but they set up an escrow account instead of you doing it yourself. When I asked the same "worst situation" question, he gave me a realistic outlook, and this company is in a much better standing. If the creditors don't like their negotiation and take you to arbitration, you actually get representation from their company to help you out. I was almost willing to do it. Then I went and looked at their actual company online, and discovered that they are a chamelon of some sorts. They were originally called something similar to "USA Debt Consolidation" or something otherwise patriotic. Apparently they decided that God could be on their side, at least it's good advertising. What good company has to change their name to get religion on their side? A good company would not need to change it's name. The Sweet Some people have gone with these companies, and they have actually negotiated with the creditors in order to pay off your debt at a fraction of the price. If it happens, that's the sweet part of this. Just given an example of $10,000 credit card debt, it is possible to pay around $6,000 and have all of your debt paid off. It's basically saying that you can spend money that you won't have to pay back, ever. There is some hit to your credit rating in the short term, but in the long term, it starts going the other direction. The hard part is finding a company who will do this and who you like. I had an even harder hurdle to surmount - I don't really believe that it is ethical to do this. I spent the money, I should pay it back - that's the deal I made with the company when I signed up for the card. To me, I need to go through with paying them back. Luckily, I came into this with a decent credit rating, and will probably go out with a similarly decent one. Right now, I am a prime target for anyone who wants to give me a large loan at a decent rate - if I can pay less for the money I spent, I'm savvy enough to do it. The Alternative There is one other option which I looked into, and will represent the only company that I will link through this diatribe: Consumer Credit Counseling Services or Money Management International are truly non-profit and have good word-of-mouth from anyone I have talked to. They will not negotiate to settle your debt, but they will work with the creditors to get lower percentage, and help you through your budget. The couple of talks on the phone that I had with these people were very productive, and I got some stuff in the mail to help me out. You pay down the entirety of your debt. The downside is that you get a good size hit on your credit rating. My Choice In my position, I decided that I was on a good track myself already - I'm paying off my cards smartly, taking the highest APR out as quickly as possible. On my current plan, I will be completely debt-free in 3 years, less if I get some windfall of any sort. One of the bonuses of having a good credit rating is that people are willing to loan me money at promotional rates for some amounts of time. When my promos run out, I play financial musical chairs and get the lowest rate on all of my money. That's just for me though, to each his own. The most important part in all of this is that I got control of my budget, and started living within my means. My punishment for living outside of my means for so much time is that now I have to live well within my means. I have to live within the means set upon by having to pay a large chunk of each paycheck to the creditors. Once I'm outside this, it will be much easier for me to have lots of happiness and savings.

On Heise’s security site HeiSec, Microsoft is advertising (in German) with a Flash animation of a rolling, black horse approaching the reader. Then suddenly a red gate closes and a text apprears:

Trojans must stay out.

If we translate this back to ancient greek history, it would say:

Microsofties must stay out

since Trojans were the inhabitants of Troy (German: Troja) and in the horse were the Greek aggressors. So I strongly agree. ;-) I really hate it, if people just reverse the meaning of something by abbreviating it (here by turning the adjective into a noun). And then not noticing it. The term Trojan Horse in computing is just one (unfortunately) often seen example… But no wonder that Microsoft doesn’t care about such things. They care about so less (e.g. stable software, secure operating systems, users, administrators, trust, etc.) except keeping their monopoly, making money and making even more money.

Books in this series (all published by Baen):

1. An Oblique Approach (1998)
2. In the Heart of Darkness (1998)
3. Destiny’s Shield (1999)
4. Fortune’s Stroke (2000)
5. The Tide of Victory (2001)
6. The Dance of Time (2006)

The premise sounds a little silly: a cyborg and a crystalline artificial intelligence travel back through time from the far future into the Sixth Century. The cyborg’s mission: to create a totalitarian world government that will create the perfect future according to one branch of fanatics. The crystal’s mission: to aid the Byzantine general Belisarius to defeat the cyborg. Never mind that premise. Here is another. Gunpowder and associated technologies are introduced in the 6th Century, first in India and second in the (Eastern) Roman Empire. What happens next? Based on an outline for a trilogy by David Drake, Eric Flint has created a masterpiece in this six-volume story. It really is a united story, not a collection of six independent novels; the story starts in the first book and ends in the sixth. There will be no more books in this series (except, perhaps, as a “sequel” series, though the authors have not hinted about this). It is a masterpiece, all right. In an action-adventure story, plot is paramount, and the Belisarius hexalogy has an unusually tight plot for the word count. The characters are well drawn; evidence of this claim is that I wept, much like Belisarius himself, when one of the significant secondary characters died – in battle, yes, but by a fortune’s stroke and not by any enemy’s design. The characterization of the societies and countries involved is suberb in my admittedly history-challenged opinion; India is described vividly, although, as Flint has mentioned, it’s extremely anachronistic (Flint himself considers this appropriate under the circumstances, and describes his portrait of 6th Century India as “impressionistic”). After a slightly slow start – it takes several not so exciting chapters for the premise of the story to be revealed – the story starts climbing like an aeroplane after takeoff, and never stops. The mood in the beginning is downright depressing, with only a tiny bit of hope, but it steadily brightens, and the last book is pure payoff, immensely satisfying to this reader. It was so satisfying, that I haven’t suffered from story world withdrawal after finishing The Dance of Time. This is unusual. I have no other option but to rate this story 5/5.

… rereading the spec makes you realize you’ve forgotten to deal with an important cross-cutting issue, and trying to figure out what are the undoubtedly numerous changes to the design that are required to handle this issue, makes your head hurt. (Another sign: when your writing is as convoluted as your worst code.) It’s so good it’s past bedtime. There’s no trouble figuring out what to do next

That's nice. Apparently SUSE/Novell are planning to no longer include any proprietary (kernel) drivers in their Linux distributions. (Most of) the kernel developers dislike binary drivers in the kernel and SUSE/Novell are clearly supporting the developers with their move. Although they plan a system for including binary drivers from userspace somehow, I still think this is a good sign. I hope it will help to convince some hardware manufacturers to release the source code of some of their (now) proprietary drivers... This whole debate was started by Arjan van de Ven's original post to the LKML in December 2005, AFAIK. (via Heise)

Conan O’Brien came to Finland on Saturday to shoot some stuff for his show. Today, he was a last-minute guest in one of our national-television talk shows. The interview lasted for about fifteen minutes. I made a transcript. An excerpt:

Arto Nyberg: So how are your feelings now, when you remember yesterday’s crowd waiting for you outside the airport? Conan O’Brien: I’m still getting over it, that was a high point of my life because I’ve never… Arto Nyberg: Be honest. Conan O’Brien: I’m being honest, I’ve never… I’ve been in front of some happy, excited crowds before, but the intensity of that reaction, there were, I think, several thousand people… I’m just going to say fifty thousand… I don’t know if that’s the exact number, but let’s go with eighty thousand. Arto Nyberg: Let’s… Conan O’Brien: There were many, many people at the airport, and they were extremely excited, and they were very nice, and they seemed to genuinely like the show and… like what we’re doing, and I was excited. Arto Nyberg: Did you expect one hundred thousand people coming greet you?

So this weekend is Trivia weekend, which means that my clock gets inverted for a couple days at least, as I tend to be on the "night team". Right now it's the beginning of hour 40, of which I've been around for about half. We just found out we're ahead of the team on the other side of the city. Hooray! Holy Hell. Audio Speed Round.

I'd been planning on waiting to blog about the issuing of my Social Security number until I actually received the card, but as it seems that it has been lost in the mail, I could be waiting a while... So I was doing my regular weekly "what the fuck is going on with my Social Security number application?" phone call to the San Jose Social Security Administration office on January 12, when for a change, they couldn't actually find my application by the reference number that they'd given me. Lo and behold, my number had been allocated two days earlier. They told me that my card would be mailed out in 10 working days from the date of allocation, or that I could come into the office and get a bit of paper that told me what the number was. Let's just say that I'm glad I didn't wait for the card, or I'd still not be getting paid... So ten working days passed, and then some, and no card. This made me somewhat concerned, since everyone's been telling me how the SSN is the Primary Key of All Things, and that if it gets stolen, you're screwed as your identity can be stolen, with all the bad things that accompany that. So I rang the San Jose office back, to see if they had anything useful to say for themselves, and of course, they didn't. They couldn't tell me anything. They couldn't even tell me what address they had on record to ship the card to. They couldn't offer any postal tracking information, and they said that if it bounced for some reason, it would go back to Baltimore, where it would be destroyed. Oh goody. So after the trip to the DMV today, I thought I'd drop into the Mountain View Social Security office to request a new card. Well, let me just say that I can see why they zip-tie the chairs together... After waiting for over an hour and a half to get to speak to someone, they said that they would need to request secondary verification of something or other before they could issue me a card, and that it could take up to four weeks (the same secondary verification that took nearly 2 months in the first place). Or I could go to the San Jose office, where they already had the verification on file, and they could request a new card for me immediately. I was so flabbergasted that I just walked out of there. In hindsight, I should have told them to just go ahead and request the secondary verification, as so far I haven't actually needed to present the card to anyone wanting my SSN, and it's a lot more convenient (I think) to have to deal with the Mountain View Social Security office than the San Jose one. What absolutely blows me away is that there is no trust, no communication between offices. The fact that one Social Security office has already requested (and received) secondary verification of my existence from Immigration isn't sufficient for another office. They can't even ship a copy of that from one office to another? The mind boggles at the inefficiencies. I want that hour and a half of my life back.

I have been playing around with avidemux, Frank Sinatra and Chavela Vargas. This is the result. Excuse the poor, amateur quality and the terrible lighting, just enjoy the love (or plain lack of it) in these videos.

Lola hunts a Grass Hopper (June 2005).

Vi and Emacs have been with me for a little more that six months now. This is a summary of the greatest moments. (July 2005 - January 2006).

Okay, something bugs me, and it's somewhat irrational, and somewhat rational. I totally hate really long URLs needed to "verify" that the sign-up is valid. There are more than one type of these, sometimes they are required to continue into the site, sometime just for extra features, but they are more often that not, very long. Now, I don't like long URLs in general in emails, because there are many services which allow you to shorten them for public use. Recently I signed up for 30 boxes and they sent me this monstrosity:

http://30boxes.com/signup.php?action=finishSignup&d=aSDFJKLa43da
safjdAL5RLKj4afjrafa45J5kljtyTGJrALKJgFKLsaj5klJ4jkljakljdkalflk
fASJKjdfa4r23890fdfjskl342390fakjlei309dk390ujkal39032kd03j9djd9

Okay, so lets look at this rationally for a bit. How many unique strings can they have from that huge behemoth of an identifier. There are 145 characters. They are using the entire uppercase (26), lowercase (26) and numbers (10), so there are a total of 62 unique symbols for each spot. That gives us a total of 62¹⁴⁵ different strings. That's

78848779858160540639233408124436328679807474352650645474403652978
77812230999983634922053904324829205441837830921209410767866820350
39259149646534571887966722870103317751633817974743087029882020930
78213775489032524047364643001443429901072761743321026356976812032

different combinations. In scientific notation, thats 7.8 × 10²⁵⁹. Just for comparison, the entire number of atoms in the universe is high-balled at 6 × 10⁷⁹ (on this page). That's more than a googol of identifiers for EACH ATOM, EVERYWHERE. Isn't naming each atom once enough? Then you would only need 45 characters, which would nicely fit in one line of my email client if you just shortened your "finishSignup" to "fS" and action to "a". As a bonus, it also saves you approximately 117 bytes of bandwidth per email. UPDATE: Apparently it has ALL the information, in addition to being completely too long. I replaced it with random crap.

Simple answer: because RSS and Atom are XML formats. So please generate valid output. Adhere to the standards! The RSS feeds of Planet Gnome and Planet Ubuntu, for example, are currently broken. (Planet Gnome due to a bug in Planetplanet AFAICT, Planet Ubuntu due to a broken RSS feed from Wordpress... Yes, you must escape single < characters in XML...) Templating systems such as the default templating of the Django Framework, or the popular Clearsilver templating engine are unfortunately not suited for XML output. Oh, and please never ever write XML using 'print' commands either. Use a proper XML writer, which can handle charset issues and escaping properly. Good examples for XML-enabled templating engines include TAL and METAL used by Zope (but available for a variety of languages), and KID (again python, used by the Turbogears Framework). Closely related is the "HTML fragments" issue, which basically is why I want XML to be used internally, too (you could also store StructuredText only, and convert it to XML just for transformation to the output): HTML fragments in my blog should be valid slices of an XHTML file, to avoid issues when generating both the web pages as well as when integrating the feed into other pages. With RSS, the HTML code is AFAICT escaped in one big data chunk, so it doesn't matter there. It probably does for Atom. So what a good blog tool (including a rewrite of planetplanet which has way too many bugs) needs to do is to parse it's input data (plain text, HTML provided by a web browsers WYSIWYG edit component, mail, structured text, XML, ...) and either reject broken entries or try to guess whats intended, but guarantee that the output is valid XML. Then generate proper feeds and output from that. Thanks to all those who already replied to my previous posting. One thing I was pointed at, and I'll probably look into is Apache Forrest. Although I likely will use KID instead, if I happen to write my own tool after or despite my upcoming final exams.

How nice. The FCC wants "a "back door" be built into all Internet-communications hardware and software to provide access for law enforcement agencies". This and similar horror scenarios for the freedom and privacy of the people are nothing unusual these days. A more general (and more paranoid) question: How do we know whether our software or hardware is backdoored/wiretapped? We all know that using a certain OS from Redmond opens a lot of security holes in itself. Add to that all the now-public attempts of agencies and companies ranging from the FBI, NSA, Sony to antivirus-software vendors who install backdoors on your PC, and you've got some very good reasons to never trust any closed-source software again. This is not a problem for most of us using Free Software and free operating systems (Linux, *BSD, etc.). Theoretically, we can read the source code of almost every single instruction being executed on our hardware, and verify that the software doesn't do any funny things like phoning home, logging keystrokes, opening backdoors and so on. However, how can we know whether or not our hardware has been backdoored/wiretapped/trojaned (or whatever you want to call it)? Given that almost all devices we own nowadays (PDA, iPod, cell phone, hardware VOIP phone, and all the other gadgets) as well as most parts of our PCs and laptops have some sort of microcontrollers on them, how can we be sure that there is no secret code hidden in there which spies on us or provides hidden backdoors to them (whoever that may be)? With some devices you can dump the firmware and analyze that, but most parts are probably not easily analyzable by mere mortals. Think network cards, builtin wireless cards, sound cards, bluetooth chips and so on. IMHO, a good first step in the right direction are things like OpenBIOS (Free Software firmware/BIOS) and OpenEZX (Free Software GSM phones). Alas, I think DRM will pose a major threat here in future, as we probably cannot easily replace custom firmware/software anymore if DRM in the worst form becomes reality. So, how would you go about to ensure that your hardware has not been backdoored? How can we detect such things? How can we defend against such things? How can we remove backdoors if we find any? Do you know of any relevant research, papers, documents, HOWTOs? Any cases you know of where such things happened? Any practical tips or advice?