Doesn t this class look great??

Department of History Workshop MEDIA AND COMMUNICATION IN THE MIDDLE AGES Professor Brigitte M. Bedos-Rezak Medieval circumstances presented multiple challenges to media, mobility, and communication. Cultivators were bound to the land and monks to their monasteries; pilgrims traveled to holy places, crusaders and warriors invaded and then settled foreign lands, rulers and nobles were frequently itinerant. Literacy was largely limited to Latin, and possessed principally by churchmen and nuns so the transmission of ideas occurred mainly through the spoken vernacular word, and by means of gestures, images, and the manipulation of symbolic objects (thus, for instance, the relics of saints were carried to distant lands to collect alms, to recover possessions appropriated by nobles, or to aid in battle). While seas, rivers, ports, networks of roads provided with rest houses, ferries and bridges, were generally available, routes and means of transportation selected differed markedly according to the traveler s status and the journey s purpose. Christianity stimulated pilgrimages, missions to convert the heathen, and crusades. Marriage took brides to foreign courts where they served as cultural ambassadors. Medieval kings and great nobles were continually on the road, changing their abode every two or three days. Lesser officials and messengers traveled on government business. Knights sought out tourneys and distant wars to advance their fortunes and reputations. Merchants and carriers transported goods to regional fairs, and engaged in international trade. Minstrels, jongleurs, and troubadours traveled to gain patronage and to extend their repertoire, spreading news and influencing the reputations of warriors, heroes, and kings. Students too journeyed extensively from place to place in order to sit at the feet of famous masters; some wandering scholars came to be known as Goliards. Artists were invited to decorate manuscripts and architects to erect buildings.
The pursuit of favorable opinion became an essential feature in the process of state-building during the Middle Ages. Those who challenged traditional norms also came to rely on the efficiency of communicative systems to expand their ranks with adherents. Through the use of propaganda, medieval society experimented with such forms and methods of communication as symbols, stereotypes, and slogans, thus elaborating features of communication which, however modified, are still in use today.

Most people (at least those who hear me shouting on irc) probably know that I'm not a fan of cdbs. While working on geoclue, which builds a lot of binary packages I realized, that cdbs wastes an insane amount of time by calling dh_* for every single package. One of the reasons geoclue uses cdbs is that the maintainer likes the short debian/rules file. We'll, compare yourself: cdbs:

#!/usr/bin/make -f
# -*- makefile -*-
# Uncomment this to turn on verbose mode.
#export DH_VERBOSE=1
include /usr/share/cdbs/1/rules/patchsys-quilt.mk
include /usr/share/cdbs/1/rules/debhelper.mk
include /usr/share/cdbs/1/class/autotools.mk
include /usr/share/cdbs/1/rules/utils.mk
common-binary-predeb-arch:: list-missing
clean::
    rm -f providers/gypsy/Makefile
    rm -rf debian/tmp

Build time: dpkg-buildpackage -B 132.20s user 41.52s system 90% cpu 3:11.13 total dh(1):

#!/usr/bin/make -f
# -*- makefile -*-
include /usr/share/quilt/quilt.make
build: $(QUILT_STAMPFN) build-stamp
build-stamp:
    dh build
    touch $@
%:
    dh $@
clean: clean-patched unpatch
clean-patched:
    dh clean
    rm -f providers/gypsy/Makefile
    rm -f build-stamp
.PHONY: patch unpatch clean clean-patched build 

Build time: dpkg-buildpackage -B 85.63s user 32.91s system 91% cpu 2:08.91 total So cdbs wasted about one minute of time using a 2.4 GHz Intel Core2Duo. I'm wondering how much more time it takes on slow architectures like mips(el) and arm(el). One more argument against the unmaintaible mess of makefiles called cdbs.

Structure Synth is an application for creating 3D structures from a set of user specified rules. It is an attempt to make a 3D version of Context Free (a free -GPL ed- program that generates images from written instructions called a grammar). The cool thing about Structure Synth is that it has a simple language for writing recursive scripts that can generate complex structures (kinda Processing, but in 3D), and you can feed the result into Sunflow (a rendering system for photo-realistic image synthesis, already available in Debian) to generate Escher-like cool images. The program is waiting in the NEW queue, but you can temporarily download my packages (for Debian SID amd64) if you want. Even though I ve tried hard to be the one to blog about this, my friend Javier Candeira has won the competition and has been able to write about this earlier than me Spanish readers might want to have a look at JoSeKBlog, where he describes how to combine Structure Synth and Sunflow, and where I first read about the existence of the program.

xmodmap has long been the only way to modify the keyboard map of the X server, short of the complex configuration daemon approaches used by the large desktop managers, like KDE and GNOME. But it has always been a hack: it modifies the X keyboard map and thus requires a baseline to work from, kind of like a patch needs the correct context to be applicable. Worse yet, xmodmap weirdness required me to invoke it twice to get the effect I wanted. When the recent upgrade to X.org 7.4 broke larger parts of my elaborate xmodmap configuration, I took the time to finally ditch xmodmap and implement my modifications as proper xkb configuration.

Background information I had tried before to use per-user xkb configuration, but could not find the answers I want. It was somewhat by chance that I found Doug Palmer s Unreliable Guide to XKB configuration at the same time that Julien Cristau and Matthew W. S. Bell provided me the necessary hints on the #xorg/irc.freenode.org IRC channel to get me started. The other resource worth mentioning is Ivan Pascal s collection of XKB documents, which were instrumental in my gaining an understanding of xkb. And just as I am writing this document, Debian s X Strike Force have published their Input Hotplug Guide, which is a nice complement to this very document you are reading right now, since it focuses on auto-configuration of xkb with HAL. The default xkb configuration comes with a lot of flexibility, and often you don t need anything else. But when you do, then this is how to do it:

Installing a new keyboard map The most basic way to install a new keyboard map is using xkbcomp, which can also be used to dump the currently installed map into a file. So, to get a bit of an idea of what we ll be dealing with, please run the following commands:

xkbcomp $DISPLAY xkb.dump
editor xkb.dump
xkbcomp xkb.dump $DISPLAY

The file is complex and large, and it completely went against my aesthetics to simply edit it to have xkb work according to my needs. I sought a way in which I could use as much as possible of the default configuration, and only place self-contained additional snippets in place to do the things I wanted done differently. setxkbmap and rule files Thus began my voyage into the domain of rule files. But before we dive into those, let s take a look at setxkbmap. Despite the trivial invocation of e.g. setxkbmap us to install a standard US-American keyboard map, the command also takes arguments. More specifically, it allows you to specify the following high-level parameters, which determine the sequence of events between key press and an application receiving a KeyPress event:

• Model: the keyboard model, which defines which keys are where
• Layout: the keyboard layout, which defines what the keys actually are
• Variant: slight variantions in the layout
• Options: configurable aspects of keyboard features and possibilities

Thus, with the following command line, I would select a US layout with international (dead) keys for my Thinkpad keyboard, and switch to an alternate symbol group with the windows keys (more on that later):

setxkbmap -model thinkpad -layout us -variant intl -option grp:win_switch

In many cases, between all combinations of the aforementioned parameters, this is all you ever need. But I wanted more. If you append -print to the above command, it will print the keymap it would install, rather than installing it:

% setxkbmap -model thinkpad -layout us -variant intl -option grp:win_switch -print
xkb_keymap  
  xkb_keycodes    include "evdev+aliases(qwerty)"        ;
  xkb_types       include "complete"     ;
  xkb_compat      include "complete"     ;
  xkb_symbols     include "pc+us(intl)+inet(evdev)+group(win_switch)"    ;
  xkb_geometry    include "thinkpad(us)"         ;
 ;

There are two things to note:

1. The -option grp:win_switch argument has been turned into an additional include group(win_switch) on the xkb_symbols line, just like the model, layout, and variant are responsible for other aspects in the output.
2. The output seems related to what xkbcomp dumped into the xkb.dump file we created earlier. Upon closer inspection, it turns out that the dump file is simply a pre-processed version of the keyboard map, with include instructions exploded.

At this point, it became clear to me that this was the correct way forward, and I started to investigate those points in order. The translation from parameters to an xkb_keymap stanza by setxkbmap is actually governed by a rule file. A rule is nothing more than a set of criteria, and what setxkbmap should do in case they all match. On a Debian system, you can find this file in /usr/share/X11/xkb/rules/evdev, and /usr/share/X11/xkb/rules/evdev.lst is a listing of all available parameter values. The xkb_symbols include line in the above xkb_keymap output is the result of the following rules in the first file, which setxkbmap had matched (from top to bottom) and processed:

! model         layout              =       symbols
  [...]
  *             *                   =       pc+%l(%v)
! model                             =       symbols
  *                                 =       +inet(evdev)
! option                            =       symbols
  [...]
  grp:win_switch                    =       +group(win_switch)

It should now not be hard to deduce the xkb_symbols include line quoted above, starting from the setxkbmap command line. I ll reproduce both for you for convenience:

setxkbmap -model thinkpad -layout us -variant intl -option grp:win_switch
xkb_symbols     include "pc+us(intl)+inet(evdev)+group(win_switch)"    ;

A short note about the syntax here: group(win_switch) in the symbols column simply references the xkb_symbols stanza named win_switch in the symbols file group (/usr/share/X11/xkb/symbols/group). Thus, the rules file maps parameters to sets of snippets to include, and the output of setxkbmap applies those rules to create the xkb_keymap output, to be processed by xkbcomp (which setxkbmap invokes implicitly, unless the -print argument was given on invocation). It seems that for a criteria (option, model, layout, ) to be honoured, it has to appear in the corresponding listing file, evdev.lst in this case. There is also evdev.xml, but I couldn t figure out its role.

Attaching symbols to keys I ended up creating a symbols file of reasonable size, which I won t discuss here. Instead, let s solve the following two tasks for the purpose of this document:

1. Make the Win-Hyphen key combination generate an en dash ( ), and Win-Shift-Hyphen an em dash ( ).
2. Let the Caps Lock key generate Mod4, which can be used e.g. to control the window manager.

To approach these two tasks, let s create a symbols file in ~/.xkb/symbols/xkbtest and add two stanzas to it:

partial alphanumeric_keys
xkb_symbols "dashes"  
  key <AE11>  
    symbols[Group2] = [ endash, emdash ]
   ;
 ;
partial modifier_keys
xkb_symbols "caps_mod4"  
  replace key <CAPS>  
    [ VoidSymbol, VoidSymbol ]
   ;
  modifier_map Mod4   <CAPS>  ;
 ;

Now let me explain these in turn:

1. We used the option grp:win_switch earlier, which told xkb that we would like to use the windows keys to switch to group 2. In the custom symbols file, we now simply define the symbols to be generated for each key, when the second group has been selected. Key <AE11> is the hyphen key. To find out the names of all the other keys on your keyboard, you can use the following command:

   xkbprint -label name $DISPLAY -   gv -orientation=seascape -
   
   

   I had to declare the stanza partial because it is not a complete keyboard map, but can only be used to augment/modify other maps. I also declared it alphanumeric_keys to tell xkb that I would be modifying alphanumeric keys inside it. If I also wanted to change modifier keys, I would also specify modifier_keys. The rest should be straight-forward. You can get the names of available symbols from keysymdef.h (/usr/include/X11/keysymdef.h on a Debian system, package x11proto-core-dev), stripping the XK_ prefix.
2. The second stanza replaces the Caps Lock key definition and prevents it from generating symbols (VoidSymbol). The important aspect of the second stanza is the modifier_map instruction, which causes the key to generate the Mod4 modifier event, which I can later use to bind key combinations for my window manager (awesome).

The easiest way to verify those changes is to put the setxkbmap -print output of the keyboard map you would like to use as a baseline into ~/.xkb/keymap/xkbtest, and append snippets to be included to the xkb_symbols line, e.g.:

"pc+us(intl)+inet(evdev)+group(win_switch)+xkbtest(dashes)+xkbtest(caps_mod4)"

When you try to load this keyboard map with xkbcomp, it will fail because it cannot find the xkbtest symbol definition file. You have to let the tool know where to look, by appending a path to its search list (note the use of $HOME instead of ~, which the shell would not expand):

xkbcomp -I$HOME/.xkb ~/.xkb/keymap/xkbtest $DISPLAY

You can use xev to verify the results, or just type Win-Hyphen into a terminal; does it produce ? By the way, I found xev much more useful for such purposes when invoked as follows (thanks to Penny for the idea):

xev   sed -ne '/^KeyPress/,/^$/p'

Unfortunately, xev does not give any indication of which modifier symbols are generated. I have found no other way to verify the outcome, other than to tell my window manager to do something in response to e.g. Mod4-Enter, reloaded it, and then tried it out.

Rules again, and why I did not use them in the end Once I got this far, I proceeded to add option-to-symbol-snippet mappings to the rules file, and added each option to the listing file too. A few bugs [[!debbugs 524512 desc=later]], I finally had setxkbmap spit out the right xkb_keymap and could install the new keyboard map with xkbcomp, like so:

setxkbmap -I$HOME/.xkb [...] -print   xkbcomp -I$HOME/xkb - :0

I wrote a small script to automatically do that at the start of the X session and could have gone to play outside, if it hadn t been for the itch I felt due to the entire rule file stored in my configuration. I certainly did not like that, but I could also not find a way to extend a rule file with additional rules. When I looked at the aforementioned script again, it suddenly became obvious that I was going a far longer path than I had to. Even though the rule system is powerful and allows me to e.g. automatically include symbol maps to remap keys on my Thinkpad, based on the keyboard model I configured, the benefit (if any) did not justify the additional complexity. In the end, I simplified the script that loads the keyboard map, and defined a default xkb_keymap, as well as one for the Thinkpad, wich I identify by its fully-qualified hostname. If a specific file is available for a given host, it is used. Otherwise, the script uses the default.

This is a continuation from before. Before I go plunging into writing code for a generic vcs-pkg implementation, I wanted to take a close look at my current, working, non-generic implementation: making sure that the generic implementation can support at least this one concrete work-flow will keep me grounded. One of the features of my home grown porcelain for building package has been that I use a fixed layout for all the packages I maintain. There is a top level directory for all working trees. Each package gets a sub-directory under this working area. And in each package sub-directory, are the upstream versions, the checked out VCS working directory, and anything else package related. With this layout, knowing the package name is enough to locate the working directory. This enable me to, for example, hack away at a package in Emacs, and when done, go to any open terminal window, and say stage_release kernel-package or tag_releases ucf without needing to know what the current directory is (usually, the packages working directory is several levels deep /usr/local/git/debian/make-dfsg/make-dfsg-3.91, for instance. However, this is less palatable for a generic tool imposing a directory structure layout is pretty heavy. And I guess I can always create a function called cdwd, or something, to take away the tedium of typing out long cd commands. Anyway, looking at my code, there is the information that the scripts seem to need in order to do their work.

• Staging area. This is where software to be built is exported (and this area is visible from my build virtual machine).
  • User specified (configuration)
• Working Area. This is the location where all my packaging work happens. Each package I work on has a sub-directory in here, and the working directories for each package live in the package sub-directory. Note: Should not be needed.
  • User specified.
• Working directory. This is the checked out tree from the VCS, and this is the place where we get the source tree from which the package can be built.
  • Since we know the location of the working are, if the package name is known, we can just look in the package s sub-directory in the working area.
    • For rpm based sources, look for the spec file
    • For Debian sources, locate debian/rules
  • If package name is not known, look for spec or debian/rules in the current directory, and parse either the spec file or debian/changelog.
  • If in a VCS directory, look for the base of the tree
    • tla tree-root
    • bzr info
    • git rev-parse --show cdup
    • hg root
    • You have to climb the tree for subversion
  • If you are in a debian directory, and changelog and rules files exist
  Then, look for the spec file or debian/rules in the base directory
• package name
  • User specified, on the command line
  • If in the working directory of the package, can be parsed from the spec or changelog files.
• upstream tar archive
  • Usually located in the parent directory of the working directory (the package specific sub-directory of the working area)
  • If pristine-tar is in use, given two trees (branches, commits. etc), namely:
    • a tree for upstream (default: the branch ~upstream~)
    • a tree for the delta (default: the branch ~pristine-tar~)
    The tree can be generated
  • Given an upstream tree (default: the branch ~upstream~), a tar archive can be generated, but is likely to be not bit-for-bit identical to the original tar archive.

So, if I do away with the whole working area layout convention, this can be reduced to just requiring the user to:

• Specify Staging area
• Call the script in the working directory (dpkg-buildpackage imposes this too).
• Either use pristine-tar or have the upstream tar archive in the parent directory of the working directory

Hmm. One user specified directory, where the results are dumped. I can live with that. However, gitpkg has a different concept: it works purely on the git objects, you feed it upto three tree objects, the first being the tree with sources to build, and the second and third trees being looked at only if the upstream tar archive can not be located, and passes the trees to pristine tar to re-construct the upstram tar. The package name and version are constructed after the source-tar archive is extracted to the staging area. I like the minimality of this. This is continued here.

So, we are still mostly able to keep our release each two weeks promise. For this release we have two big additions to the support side of the project: translations support, and gtk-doc support. The former is made of the usual makefile rules used by gettext-enabled projects with a rework to fit in the non-recursive build process of WebKitGTK+. The later is not as well integrated yet, so you have to go manually to WebKit/gtk/docs and type make, but not before editing WebKit/gtk/webkit/webkitprivate.cpp and adding a call to g_thread_init(NULL); to webkit_init(). You get the idea, we need help in polishing this one. As for code, Xan Lopez has been doing some serious work on accessibility support, using ATK. After the a11y hackfest he landed a number of patches moving forward in this direction. It looks like we will be able to meet the requirements for becoming blessed for use by GNOME. We also got a nice printing API, that allows applications to stop using the nasty hack that would send a print() call through javascript. They are also able to control/monitor the print process, or automate it, so that no print dialog is shown, if they wish. That s it, come join the party =D. Now, for 1.1.6, I m hoping Diego finishes the spelling check patch, and it would be awesome to have Jan s proper error reporting!

There are a lot of little git scripts and tools being written by a lot of people. Including a lot of tools written by people I have a lot of respect for. And yet, they are mostly useless for me. Take git-pkg. Can t use it. Does not work with git submodules. Then there is our nice, new, shiny, incredibly bodacious 3.0 (git) source format. Again, useless: does not cater to submodules. I like submodules. They are nice. They allow for projects to take upstream sources, add Debian packaging instructions, and put them into git. They allow you to stitch together disparate projects, with different authors, and different release schedules and goals, into a coherent, integrated, software project. Yes, I use git submodules for my Debian packaging. I think it is conceptually and practically the correct solution. Why submodules? Well, one of the first things I discovered was that most of the packaging for my packages was very similar but not identical. Unfortunately, the previous incarnation of my packages with a monolithic rules file in each ./debian/ directory, it was easy for the rules files in packages to get out of sync and there was no easy way to merge changes in the common portions an any sane automated fashion. The ./debian/ directories for all my packages package that they are instrumental in packaging. So, since I make the ./debian/ directories branches of the same project, it is far easier to package a new package, or to roll out a new feature when policy changes the same commit can be applied across all the branches, and thus all my source packages, easily. With a separate debian-dir project, I can separate the management of the packaging rules from the package code itself. Also, I have abstracted out the really common bits across all my packages into a ./debian.common directory, which is yet another project, and included in as a submodule in all the packages so there is a central place to change the common bits, without having to duplicate my efforts 30-odd times. Now people are complaining since they have no idea how to clone my package repositories, since apparently no one actually pays attention to a file called .gitmodules, and even when they do, they, and the tools they use, have no clue what to do with it. I am tired of sending emails with one off-cluebats, and I am building my own porcelain around something I hope to present as a generic vcs-pkg implementation soon. The firs step is a wrapper around git-clone, that understands git submodules. So, here is the browsable code (there is a link in there to the downloadable sources too). Complete with a built in man page. Takes the same arguments as git-clone, but with fewer options. Have fun.

Consider the following mod_rewrite configuration :

RewriteCond % REQUEST_URI !^/FR/fr
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ /FR/fr$1 [PT,L]

The need here, is to get anything that wouldn t begin with /FR/fr from $DOCROOT/FR/fr (through, possibly, any other module rules, which was important in the setup where these rules were), except if they begin with /common/ or is /favicon.ico. Depending on the requests pattern, reordering the RewriteConds can be better. Anyways, the case at hand was to massively duplicate this setup over different countries and languages. Basically, domain.fr/foo/bar would need to come from $DOCROOT/FR/fr/foo/bar, domain.co.uk/foo/bar from $DOCROOT/GB/en/foo/bar, while anydomain/common/foo/bar would come from $DOCROOT/common/foo/bar. In such a case, you have a lot of possible solutions, each of which has its pros and cons.

• Create a virtual host per domain, duplicating all the rules in each of them.
  

  <VirtualHost *:80>
ServerName domain.fr
RewriteCond % REQUEST_URI !^/FR/fr
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ /FR/fr$1 [PT,L]
</VirtualHost> <VirtualHost *:80>
ServerName domain.co.uk
RewriteCond % REQUEST_URI !^/GB/en
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ /GB/en$1 [PT,L]
</VirtualHost>
( )

  Pros: quite efficient for execution time. Cons: Doesn t scale very well for humans : a lot of virtual hosts and rewrite rules to maintain ; if the list of urls that don t need rewrite increases, all set of rules need to be updated.
• Put all the rewrite rules into a single virtual host, adding a condition on the SERVER_NAME:
  

  <VirtualHost *:80>
ServerName domain.fr
ServerAlias domain.co.uk RewriteCond % SERVER_NAME =domain.fr
RewriteCond % REQUEST_URI !^/FR/fr
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ /FR/fr$1 [PT,L] RewriteCond % SERVER_NAME =domain.co.uk
RewriteCond % REQUEST_URI !^/GB/en
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ /GB/en$1 [PT,L] (...)
</VirtualHost>

  Pros: are there ?. Cons: Doesn t scale very well : a lot of rewrite rules to maintain ; rewrite rules being executed sequencially, the more domains there are, the more checks are done for the last domains ; if the list of urls that don t need rewrite increases, all set of rules need to be updated.
• Same as above, refactoring the common parts.
  

  <VirtualHost *:80>
ServerName domain.fr
ServerAlias domain.co.uk RewriteCond % REQUEST_URI ^/common/ [OR]
RewriteCond % REQUEST_URI ^/favicon.ico$
RewriteRule .* - [L] RewriteCond % SERVER_NAME =domain.fr
RewriteCond % REQUEST_URI !^/FR/fr
RewriteRule ^(.*)$ /FR/fr$1 [PT,L] RewriteCond % SERVER_NAME =domain.co.uk
RewriteCond % REQUEST_URI !^/GB/en
RewriteRule ^(.*)$ /GB/en$1 [PT,L] (...)
</VirtualHost>

  Pros: gives a canonical place for urls that don t need rewrite. Cons: Doesn t scale very well : a lot of rewrite rules to maintain ; rewrite rules being executed sequencially, the more domains there are, the more checks are done for the last domains.
• Use a RewriteMap.
  Pros: Scales better ; gives a canonical place for urls that don t need rewrite. Cons: a separate file to maintain ; can be tricky to setup.

The main problem with mod_rewrite is that there is no way to use variables or back references in the test patterns. In our case, we d like to be able to do something like this:

RewriteMap l10n txt:l10n.map # switch to dbm when necessary
RewriteCond % REQUEST_URI !^$ l10n:% SERVER_NAME
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ $ l10n:% SERVER_NAME $1 [PT,L]

Or

RewriteMap l10n txt:l10n.map # switch to dbm when necessary
RewriteCond $ l10n:% SERVER_NAME ^(.+)$
RewriteCond % REQUEST_URI !^%1
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ %1$1 [PT,L]

The map file would have on each line a domain name followed by the corresponding url start (/FR/fr for domain.fr, etc.). Unfortunately, the above setup is not possible. A way around this lack of functionnality is to use some nice perl regexp trick.

RewriteMap l10n txt:l10n.map # switch to dbm when necessary
RewriteCond $ l10n:% SERVER_NAME ^(.+)$
RewriteCond %1% REQUEST_URI !^(.+)\1
RewriteCond % REQUEST_URI !^/common/
RewriteCond % REQUEST_URI !^/favicon.ico$
RewriteRule ^(.*)$ %1$1 [PT,L]

As you can see, only the second RewriteCond differs. What we really want to test is whether the % REQUEST_URI begins with the proper url start or not. Let s say we re considering domain.fr and the map gave us /FR/fr. Following the first RewriteCond, %1 contains /FR/fr. At the second RewriteCond, if % REQUEST_URI begins with /FR/fr then %1% REQUEST_URI begins with /FR/fr/FR/fr. Otherwise, it will only begin with /FR/fr. What we can test, then, is whether this %1% REQUEST_URI aggregate contains a repeating pattern at its beginning. This is exactly what the perl regexp does: it captures at least one character at the beginning of the tested string (^(.+)), and wants to find this captured string again (\1). It is worth mentioning that this obviously falls flat when the url start itself contains a repeating pattern (e.g. /fr/fr instead of /FR/fr). As we want the RewriteRule to work only when our % REQUEST_URI does not begin with /FR/fr, we negate the regexp, which means nothing will actually be captured, such that %1 in the RewriteRule will still be the last captured text, from the very first RewriteCond. Note that if all the tested url starts are the same length and/or pattern, it may be worth changing the regexp to be more precise (and faster to match or not). Such as ^(/../..)\1 in our present case.

This is a short summary of how I'm currently experimenting with dpkg to generate, check and install TDebs in a pbuilder chroot. Do NOT use my modified version of dpkg outside a chroot!. Also, I don't expect any of this to be useful or usable by anyone not running Debian sid. If you're reading this via an aggregator other than planet.debian.org, please don't try this on your own systems. (Comments complaining that it breaks Ubuntu will be deleted - I'll have good fun laughing at you but the comments will still be deleted.)

The code (such as it is) lives at git.debian.org and it's safe to build the package on the normal system, as long as you install it in the chroot. I actually use a --prefix to allow

sudo make install

to copy the executables into the right places in the chroot. I find that quite simple to do via the terminal plugin in Anjuta.

Building a TDeb for the first time:
I expect lots of comments here, this probably won't be entirely workable initially, but the idea is to get the source for a package that has translations, that is easy and quick to build, few build dependencies and one with which you are already familiar. Adapt that package to support a TDeb by adding the relevant Package: to debian/control. All you need to include is: XC-Package-Type: tdeb and ensure that the new package is Architecture: all. Current convention is to call it $sourcepkg-tdeb. (Yes, although TDebs are initially going to be for debconf support in Squeeze+1, initial experimentation is with program translations because it's easier.)

/usr/share/emdebian-tools/dh_gentdeb (from the emdebian-tdeb package in Debian) can help prepare the translation files by creating the debian/$sourcepkg-tdeb/ directory hierarchy but you could also do the same by installing all /usr/share/locale/ content in the tdeb package in debian/rules or debian/foo.install. Remember to remove the translation files from any other package.

Building the TDeb should be as simple as:

dpkg-deb --tdeb -b debian/pilot-qof-tdeb ../pilot-qof-tdeb_0.1.7-1_all.tdeb


You do not need to build the source itself but you may want to do that for other reasons. You can then view the contents using:

dpkg-deb -c ../pilot-qof-locale_0.1.7-1_all.tdeb

or

ar -t ../pilot-qof-locale_0.1.7-1_all.tdeb

Install (dpkg -i ../pilot-qof-locale_0.1.7-1_all.tdeb --lang vi) used to work but I've messed up something there, so any ideas on what I've done wrong would be appreciated.

Subverting git with subversion

Yes, I'm a git phobe. Don't flame me and any comments about my git foo by the git fanboy contingent will also be deleted.

I have to use git for this because the dpkg maintainers like git. That doesn't mean I have to like it or even use it. So, I use a local SVN repository. I do all my development work against that (because it's more friendly) and make local commits to it. Then, when I'm reasonably happy with the results, I copy the files across into git, fake a git commit message that more or less covers the real changes and use a script to "push" git to do what I intended. If (more likely, when) git decides to be all unfriendly and throw a completely unintelligible error message, I simply rm -rf git/path/, check out a fresh git, copy the real stuff from SVN and send the lot back as a single commit to git. Hah!

(For those who are not so blinded by their git obsession that they may actually care about my process, I can only say that local SVN is blisteringly fast and never, ever, fails.)

Yesterday was my grandma Klassen s funeral at Alexanderwohl Mennonite Church, where she had been a member for decades. My uncle, a pastor, gave the meditation. He had been a missionary in Vietnam during the war, and he remained there after the United States withdrawal. During that time, things were very dangerous for him, and all means of communicating with the family back home were completely cut off. My grandparents had no way of knowing if he was OK. He later heard of a conversation my grandma had with a neighbor one day during this time: Neighbor: You must be so worried about your son in Vietnam! Grandma: Not really. I gave him back to the Lord the day he graduated high school. Neighbor: If you re not worried, then I m REALLY worried! Grandma: Why worry? Heaven is just as close to Vietnam as it is to Kansas. That exchange sums her up pretty well, I think. She was so deeply religious that it gave her a great sense of peace about life. We heard so many stories about her this week. We heard how, when she was already in her upper 80s, she helped a farmer get his equipment out of the mud and ran some heavy farm machinery. She was in charge of my cousin s schoolwork for a little while (she lived with them back then, and his parents were taking a trip). She apparently made sure he did every little assignment left for him in exacting detail, even the ones that his mother had said were extra , just in case he needed something else to do. Apparently when his parents got back, he said he loved his time with grandma, but begged them to never put her in charge of his schoolwork again! I told the story of learning to play chess when I was a child. My grandpa was teaching me the game. I was having some trouble learning some of the rules, and was frustrated because he was also beating me (like usual). After a little while of me getting more and more frustrated, grandma said something to him in German and all of a sudden I started winning. Yesterday evening was the community Good Friday church, with the combined choirs of our church and Alexanderwohl singing. That wasn t the easiest thing to do after the funeral in the morning, but I m glad I did. Tomorrow I ll be singing again for Easter.

About a year ago, I read American Gothic by Steven Biel and the book has left a surprising lasting impression on me. The book describes the background, history, and life of "American Gothic: America's most famous painting" by Grant Wood. Even if you don't recognize the name "American Gothic", you are likely to recognize the picture or the scene. The book is a serious and -- as far as I can tell -- reasonably comprehensive treatment of the subject that is interesting, insightful at points, and a breeze to read. Of course, the book is not actually about the painting that hangs in the Art Institute of Chicago -- although it will certainly teach you more than you probably ever wanted to know about that painting, its subjects, its settings, etc. The book is really the story of how that paining has been received, understood, and used. Nearly half of the book focuses on examples of people who have remixed, reworked, reimagined, and reproduced the painting in myriad forms, formats, settings, and ways. The book contains scores of photographs of celebrities posing in American Gothic style settings, dozens of political cartoons based on the paintings, images of talk shows, magazine covers, Broadway plays, product advertisements, toys, gifts, kitch, and more, done up in recognizeable representations of the basic American Gothic form. There is a very incomplete of references to American Gothic in popular culture at Wikipedia that can give a tiny taste of what is out there. The last chapter of the book is devoted to these "parodies" and there's some brief talk of issues around copyright and control of the image. Wood's sister Nan was the owner of the copyright for much of the second half of the twentieth century and is also the woman in the painting. She famously charged several makers of more lurid take-offs with defamation and successfully blocked a number of remixes. In 1988, Nan transferred ownership to the Visual Artists and Galleries Association (VAGA) which will hold the copyright until 2025. VAGA also claims "rights of publicity" in Nan's image which will last until 2060. VAGA takes a very expansive view of its copyright claims and argues that it has both veto power and royalty rights to any recognizably similar work. For example, VAGA does not want the American Gothic image used in alcohol advertisements and has successfully had such ads pulled. Biel's book contains no reference to the amount of money made from licensing the work but one can only conclude that it must be massive. VAGA blocked a plan by Iowa to use the picture on the back of the Iowa state quarter due to licensing disagreements; instead Iowa used a different Wood painting that was clearly in the public domain. What struck me most about Biel's book is related to just how deeply ingrained in American culture the American Gothic image has become. The book cites simple surveys that show that almost every American recognizes the painting (although only a small fraction know the painting's name or who painted it). The thousands of parodies that the book documents are testament to the fact that the painting has become a way of representing something essential about American culture and its values. But in a strange way, the painting's popularity and incessant reuse has also made it part of the culture that it so effectively captured. We can think of culture as a set of shared values and references that help us related to each other and to communicate. Just like idioms in language, culture helps us communicate more effectively, certainly, but also lets us communicate messages that would not be communicable otherwise. When Out Magazine, Coors, or any of several dozen others replace the figures in American Gothic with a gay or lesbian couple, they are succinctly sending a message about homosexual relationships and American traditional values that could not be made any other way. In this way, American Gothic -- both the painting and Biel's book -- represent a strong argument for free culture. If American Society has infused American Gothic with so much value, how can it be fair to let one person or organization own it? Are they not owning an essential mode through which a society can relate, experience, and communicate? I can't help but conclude that it shouldn't matter if VAGA does not like alcohol, advertisements, homosexuality, or wants to make a some money every time someone makes a cartoon parody. These are trivial concerns next to the importance of our society's need to communicate about these issues. If doing so requires the use of a shared cultural reference in VAGA's painting, I find it hard to justify VAGA's position of control. We need to be able to reproduce and reimagine American Gothic because it has become part of us. It's a striking example of the way that art becomes culture and the reason that truly free culture is the only appropriate response. We can't afford to let our experience of the world and each other -- to let ourselves at a very fundamental level -- be owned and controlled.

I often need to connect to a server with ssh from another server because I don t have direct access. I even gave a small configuration example to use such jump hosts using ProxyCommands. A while ago, I got fed up to have to add new entries for each host I wanted to join with a jump server, especially when I only need these entries sporadicly, and decided to write a generic configuration. I ended up with this setup:

Host *%*
ProxyCommand ssh $(echo %h cut -d%% -f1) nc -w1 $(echo %h cut -d%% -f2) %p

The trick here is that you can use subshell expansions in a ProxyCommand. So, when I ssh to host1%host2 , the first subshell expansion returns host1 and the second host2 , this setup ends up being the equivalent of :

Host host1%host2
ProxyCommand ssh host1 nc -w1 host2 %p

which is quite similar to the setup from my previous post. Later on, I came up with an even more powerful implementation:

Host *%*
ProxyCommand ssh $(echo %h awk -F%% ' OFS="%%"; NF--; print $0 ') nc $(echo %h awk -F%% ' print $NF ') %p

Here, the first awk splits at the % characters and returns all fields except the last one, and the second awk returns only the last field. As a consequence, sshing to host1%host2%host3%host4 will have the first subshell expansion return host1%host2%host3 and the second host4 . The setup will then be equivalent to:

Host host1%host2%host3%host4
ProxyCommand ssh host1%host2%host3 nc -w1 host4 %p

The ssh in the ProxyCommand will, in turn, trigger the rule again so that the result is that host4 will be contacted from host3, which is contacted from host2 that we contacted from host1. In the meanwhile, I decided % was not that nice a separator, and switched to using /, which also allows for a nicer setup with the same recursive effect:

Host */*
ProxyCommand ssh $(dirname %h) nc -w1 $(basename %h) %p

Finally, since some remote hosts don t have nc installed, I usually copy it in my $HOME on these servers and changed my setup to:

Host */*
ProxyCommand ssh $(dirname %h) PATH=.:\$PATH nc -w1 $(basename %h) %p

The main drawback of this method is that the more jump hosts you use, the more your ssh traffic is encapsulated (recursively) in other ssh traffic. The advantage, though, is that you don t need to forward an agent onto untrusted servers to use ssh key authentication on any of the jump or final servers, nor to forward X11 or tunnel multiple times.

Many people in the western world are completely unaware that in the Moldavian Republic there is an ongoing protest against the current Communist Party which is at power after the parliamentary elections held on Sunday. The protestants accuse the Communists of election fraud and there are numerous reports of dead people being recorded as voters, people which, by religion, chose not to vote, and other several people which couldn't have voted.

Tuesday the protests took a violent turn, apparently "aided" by some instigators which were reported to be seen as recording the protesters, taking notes and, generally, not fitting the picture. During the day the national television broadcasted absolutely no information on the events, and aired documentaries, cartoons and no news on any of the protests. To me, this looked very much alike what the Romanian Television aired during the Romanian Revolution in December '89 when during the fights in the streets of Bucharest the Television aired no images from the centre of Bucharest.

But, back to Moldavia, at the end of the day, sadly, the Parliament and Presidency buildings were devastated, making it easy for the Communist leaders to produce some disinformation propaganda based on real footage.

Yet again, sadly, but it seems under the protection of some of the aforementioned instigators, the flags of the EU and Romania were waved at the highest levels of the Parliament building during the time the protesters allegedly took over that building (there were several reports that the Police forces actually simply let them in, without actually needing/being forced to do that; also the passivity of the policemen seen in the footage from Romanian televisons was obvious).

As many Moldavian students live and study in Romania, some of them wanted to go home and take part at the protests happening in Chi in u. To their surprise, many of them were denied the right to enter their home country. Many, if not all, Romanian journalists were also denied access in the country accusing alternatively technical issues, lack of proper papers (although only the passport or the ID card was officially required), lack of safety, or simply refusing without reason.


Today, the Moldavian president Voronin, accused Romania as being behind the manifestations in Chi in u, Moldova's capital and said it will declare as a persona non grata the Ambasador of Romania in Moldova, and thus forcing him to leave Moldova within 24 hours. He went even further and said that visas will be required from now on for Romanian nationals. As soon as this was announced, it was one of the most invoked reasons by the Moldavian customs as a rejection reason, although, according to Moldavian Embassy officials in Romania, no rules or procedure were known for the release of visas for Romanian nationals.

Also, during Wenesday, Moldavian crossing points were opened and closed alternatively but incosistently accros the entire border for Moldavian nationals. Romanian nationals were denied in most cases (although some Romanian truck drivers were reported as allowed to cross). At some point during the day the Moldavian officials from the customs told the Moldavian students awating at the border that they are offered access on the condition they go direclty home with the buses provided by the Moldavian customs and were warned that going to Chi in u wasn't a smart choice for them. Some of the information from students which managed to enter their home country suggested that is advisable to not enter the country since they were going to be denied of the right to leave the country later, when they were to return to Romania to their studies (after Easter).

What's sadder is that the Moldavian voting system is built in such a way that the vote counting, in the end is done by Government officials behind closed doors, inside a Ministry. OTOH, the international official observed the things which happend in public, but did not see any of the dead voter lists (since they were not present when those votes were casted), and declared the vote as mostly legal and without major or significant incidents.


According to the media, before the elections, the Communists were credited with 35-37% of the votes in an independent poll, while in the exit poll conducted by the Communists themselves they were credited with 42-45% of the votes. In the end the last official partial results credited them with approximately 51% of the votes.

About Vladimir Voronin, it is a known fact that he has double citizenship, Moldavian and Russian and is a reserve general within the Russian Army and currently has a pretty nice pension from the Russian state.


All I can say is that, although the Moldavians' desire to have a real democracy is a legal and reasonable request, the western world chose, due to the international circumstances, to look the other way around and not to incommodate Russia in any way. Moreover, to accuse Romania to have unionist desires an act upon those desires is planly stupid since now Romania is part of the EU and Moldova uniting with Romania is simply impossible now, since Moldavia's economy would sunk even more the fragile and regressing Romanian economy and Romania would instantly fail the EU requirements which would mean disaster for us.

(The title is a bit strong, on purpose) LWN links to an article describing how to provide robust clustered storage with Linux and GFS. While explaining how to setup GFS can be nice, the incentive made me jump. The author writes:

Load balancing is difficult; often we need to share file systems via NFS or other mechanisms to provide a central location for the data. While you may be protected against a Web server node failure, you are still sharing fate with the central storage node. Using GFS, the free clustered file system in Linux, you can create a truly robust cluster that does not depend on other servers. In this article, we show you how to properly configure GFS.

In case you don t know, GFS is not exactly a clustered storage . It is more a shared storage . You have one storage, and several clients accessing it. You have one storage array, compared to the NFS case, where you have one central server for the data. But what is a storage array except a special (and expensive) kind of server ? You don t depend on other servers, but you depend on other servers ? How is that supposed to be different ?

Conceptually, a clustered file system allows multiple operating systems to mount the same file system, and write to it at the same time. There are many clustered file systems available including Sun s Lustre, OCFS from Oracle, and GFS for Linux.

OCFS and GFS are the same class of file systems, but Lustre is definitely out of league and would, actually, provide a truly robust cluster that does not depend on other servers. Lustre is a truly clustered filesystem, that distributes data on several nodes such that losing some nodes don t make you lose access to the data. With the incentive given by the author, and considering he lists Lustre as an example, I would actually have preferred an article about setting up Lustre.

A few hours ago, a new version of kernel-package was uploaded to experimental. This is a major change,and I would appreciate it if folks took it out for a spin, kicked the tires, and provide feedback about where this version is lacking. This is only part of the way along in this development cycle. I would like to add a debug-info separation, either in a different directory than / in the image packages, or a separate package by itself. I would also like to create an overlay directory for /usr/share/kernel-package/, so people can inject code or override the defaults for kernel-package easily. I am also willing to make any changes to standardize the handling of hook scripts for kernel packages in Debian.

I was asked to take a look at a machine where aptitude don't even want to do the upgrade to etch. A first inspection shows some weird repositories in the source.list file and many daemons noone ever should use on that machine. I was able to do the upgrade with apt-get then. After some time I got asked over modifications in /etc/exports. It basically included the following content:[1]

/     *(rw,async,no_root_squash)
/home *(rw,async,no_root_squash,nohide)
/usr  *(rw,async,no_root_squash,nohide)
/var  *(rw,async,no_root_squash,nohide)

[1]	For those who don't speak NFS: This exports the specified filesystems (/, /home, /usr and /var) to everyone, and accepts whatever the client system say.

The machine was taked out of service immediately. We'll have no chance to answer the question whether this was silliness or intend.

Most of the book deals with things we already know yet never learn. Huston Smith

This is perhaps one of the most enlightening books I ve ever read, and yet I feel like I ve only grasped a small bit of its meaning. It is with that warning that I attempt this review. I should add at the outset that this is one of those books where no matter what you expect it to be, after reading it, you will find that it wasn t what you expected. I heartily recommend it to everyone, from the devoutly religious to the devoutly atheistic. Science and Scientism Smith begins with a discussion of science and scientism. He is a forceful defender of science and of the work of scientists in general. But he is careful to separate science from scientism. Paraphrased, he defines scientism as the belief that science is the only (or the best) route to truth about everything. He points out that, through no explicit fault of scientists, scientism has become so ingrained in our modern psyche that even theologians have started thinking in terms of it. Yet there are some pretty glaring flaws in scientism, particularly where it comes to matters of philosophy, conscience, meaning, and religion. Smith argues that the foundation of science is the controlled experiment and logical inferences derived from it. He then proceeds to make strong case that it is not possible for humans to set up a controlled experiment to either prove or disprove the existence of something more than our material world a transcendence, a metaphysical reality, a spirit, a God. We, with our existence trapped in this finite world, cannot possibly hope to capture and control something so much more than us in every way: intelligence, versatility, and finiteness . Thus science can t even address the question. That hasn t stopped people from claiming that religion is just a helpful delusion, for instance, despite not being able to prove whether it is in fact a delusion or reality. Worldviews Smith then asks us to indulge a moment in considering two different worldviews: one the science-only worldview so common these days, and the other a more traditional religious worldview with a rightful place for science. He defers supporting evidence for each for later chapters. The science-only worldview is pretty familiar to many, and I have even heard parts of it articulated in comments left on this blog. It goes roughly like this: The universe is x billions of years old. It is, so far as we presently know, a vast expanse with mostly dead matter. Earth is the only exception, which contains some living organisms and even sentient beings, though these make up a small fraction of even the earth. This life arrived by accident through physical and biological processes, some of which are well-understood and some aren t. In the end, the universe will again become entirely dead, as our planet will be incinerated when our sun goes nova. Or, in any case, the entire universe will eventually expire in one of various ways. This worldview suggests that it is an accident that we are here and that we have consciousness, and that our actions have no ultimate meaning because the earth will eventually be incinerated anyhow. The traditional worldview holds the opposite: that instead of having our origins in the tiniest and simplest of building blocks, and eventually improving over time, we should more properly think of ourselves as being derived from something greater than ourselves. That greater something is part of our world, but something much bigger than it too. It does not rule out science, but neither is it something that science can ever explain. It suggests that our lives have a purpose, that our work has meaning, and that there are ultimate ends to seek. Smith is a scholar of world religions, and draws on his considerable experience to point out that virtually all world religions, before the Enlightenment, drew essentially the same picture of our world and the more . He reminds us though perhaps less effectively than Marcus Borg that there are other ways of knowing truth besides science, and suggests that we pay attention to what the vast majority of humanity had to say about the nature of existence before a human invention started to squelch the story. The Stories The book is filled with personal stories (Smith spent at least a decade each researching and practicing at least four different religions), quotes, and insights. I consider it the most enlightening book on religion I have yet read. Smith has more than a passing familiarity with physics, and the physicists in the crowd will probably be delighted at his discussions of quantum mechanics and the claim that nonlocality provides us with the first level platform since modern science arose on which scientists and theologians can continue their discussions. One passage reads like this:

Again I will let Henry Stapp say it: Everything we [now] know about Nature is in accord with the idea that the fundamental process of Nature lies outside space-time, but generates events that can be located in space-time. Stapp does not mention matter, but his phrase space-time implies it, for physics locks the three together.

He says that quantum theory of course can t prove that there is a God, but that recent research seems to disprove the old notion that, given enough time, all questions will be answerable by science. Even if you disagree with every one of Smith s conclusions, you ll be along for a fascinating ride through physics, biology, philosophy, and innumerable religions. One of my favorite anecdotes concerns noted physicist David Bohm (who studied under Oppenheimer and worked with Einstein, among others). He gave a lecture at one point, apparently touching on his hidden variable theories to a great extent. At its conclusion, a senior physics professor asked derivisely, What does all this philosophy have to do with physics? Bohm replied, I do not make that distinction. How s that for something to ponder? The Writing The book is fun to read, and the stories make it all the moreso. However, it is not a light read. Houston Smith wrote this near the beginning, without any hint of irony:

The first of these differences is that Gass s is an aristocratic book, written for the literary elite, whereas mine is as plebeian as I can render its not always simple arguments.

I can think of a few simpler ways to express that thought. In any case, it isn t light reading, but it is accessible even if you, like me, have little formal training in philosophy, theology, or quantum physics. Conclusion I would do such a poor job trying to paraphrase Smith s main points that I haven t even really attempted to do so here. Get the book you ll be in for a treat. Incidentally, I had been thinking of buying the book for awhile. What finally made me do so was an NPR story about how he helped preserve the sound of the Gyuto Monks Tantric Choir back in 1964, when he (of course) was sleeping in a monastery in the Himalayas and awoke to investigate something transcendent the holiest sound I have ever heard. I pressed the Buy button for the Kindle edition a few minutes later.

The German online magazine FreiesMagazin has started a programming contest yesterday. The task is to write an AI for a two-player bejeweled-like game, where the stones that you can match cause your opponent to lose live points.This evening I thought that this would be a nice finger exercise in Haskell programming, and indeed it was. Most time was spent writing the code that communicates with the game supervisor (via text files) and that re-implements the game logic to simulate the next steps. The example code is in C++, so I had to do it again, but it s rather short: 123 lines, consisting of 8 lines for the module header, 26 lines for the data definitions, 16 lines for in- and output and 73 lines for the actual rules of the game.Writing the rest was really easy. 15 lines use a generic Haskell module to implement alpha-beta-search in Strategy.hs, and 6 lines of code to glue it all together. And I m sure one can do better...The program wins against the demo AI. By choosing other algorithms provided by game-tree might even improve that. Feel free to try it out!My code is available in a darcs repository (browse) under the GPL2 or later and I invite everyone to use it as a base for contest entries. If you want to use Haskell, you can just replace the Strategy.hs and do not have to re-implement the game logic. If you submit such a program, just make sure you credit me appropriately. Also, as always, patches are welcome. If the code is too slow for your taste, you can decrease the depth parameter in Strategy.hs.

As my Institute's sysadmin, I was appointed as the responsible for my Institute's certificate handling for today's voting session for the Universitary Council (Consejo Universitario). UNAM, Mexico's largest University, is moving towards an e-voting platform. I talked about this with our (sole) candidate for the Council, and she told me this has been used a couple of times already - And, as expected, it has led to having to repeat voting sessions, due in part to e-voting's inherent lackings: It is impossible to act on any kind of impugnation. The only thing we have is an electronic vote trail, no way to recount or to make sure that all votes got in. Besides, we had a perfectly antinatural and inadequate identification system, which means voter's identity have no way to be trusted. Besides, we still have all the traditional Universitary bureaucratic paper flow, which completely obscures any positive points this e-voting system might have had. Before going any further, if you are interested: There is a so-called security audit certificate for this system. In Spanish, yes. Take a look at it if you understand the language and want to crack some laughs. I will not make a detailed review of (what I could gather about) the setup. But to make things short: I had to go to the central administrative offices to get a CD-ROM with the monitoring station's SSL certificate. This certificate is tied to an IP address, so only one computer was able to be set up as a monitoring station. So far, so good. But, what is the monitoring station's real role? You will probably laugh. The voting session (at my Institute - Each dependency can specify its own opening and closing times) was from 10:00 and until 18:00. We were instructed to place this computer at a public location, from where:

• Shortly before 10:00, we had to check the booth's status was set to closed and that zero votes were received.
• During the votation period, the computer would continuously display the number of received votes, refreshing the page twice a minute1
• During the day, anybody could go to the computer and check the number of total votes received. Its main function is, I think, to show that no votes are substracted precisely when a person is staring at it.
• Shortly before 18:00, we had to check the booth's status was still set to open, and wait until 18:00 to witness the booth is now closed.
• Get the needed data from the system and hand it over to the proper bodies. I'll get back to this point later on.

So, what is strange here? That there is a tremendous apparatus providing supposed security to... Information that is completely worthless. Just protecting a number that is, for all purposes, public. Oh, and the opening and closing of the booth - Of course, the system could have flaws during the process, or inject spurious votes along the way, or flip-flop the votes cast whichever way. But, did I mention votes? So far I have not mentioned how people are supposed to vote. Together with our last paycheck, we got a piece of paper with all of the needed information: A randomly generated, 10-character-long-with-mixed-case-and-symbols password, and the link to a web page2. This paper was folded, yes, but it was in no way secured - So, whoever wanted to have all of our passwords could just go through the bunch of papers and get them. Now, contrasting to the strong perception of physical security surrounding the oh-so-important monitoring stations, how can a person vote? Oh, sure, just fire up your favorite browser and go to https://www.jornadaelectoral.unam.mx/, produce your student number if you are a student or your full RFC3, select via checkboxes4, click on "submit", and voil , you have voted. From any location, from any machine. Yes, the University's population is largely itinerant, many people will be voting from abroad and all. It is good to give them a voice. But... At what price? Lets see... The security audit mentions the system is free from any malicious routine that can automatically alter the results and it has the minimum needed validations against spurious data injections from the most common Web browsers. However, if I am interested in modifying the results... I could put a trojan in a Faculty's laboratories, which modifies the votes sent by their users (students vote as well). Yes, I'd have to know how the system works, but lets accept security through obscurity does not work, and that this is a well-known system (as it has been used for over 3 years and is at version 3.5). PHP-based, for further points. Oh, and (if I recall correctly) a voter does not even get feedback as for which formula did he vote for, so no way of knowing if the computer really sent the information I requested. And given the low security for the password handling, I would not bet on it being worth much. Besides, this system was partly established to allow people voting from abroad - as long as they picked up their March 10 paycheck. That excludes anybody who has spent over three weeks away! Many other things can be said. Last detail: e-voting's main selling point is that the results are known instantaneously, and (if no paper trail exists) no tedious re-counting is ever done, right? Meet universitary bureaucracy. Technology changes, but processes don't. The Local Electoral Surveillance Commission has the responsability to enter once again the system after the vote has finished, and ask the server for the preliminary results. This consists of a tarball with the tally sheet (from the voters, who voted and who didn't), the total votes for each formula, and... one more file I don't remember. They also have to generate the signed legal documents where they testify to the received information. And then, ahem, they have to burn those files5 onto a CD-ROM, print them, and physically take them to the central administrative offices. Yes, take something from the server and get it to the server. For us it is not terrible (1.5Km can be readily done), but this same procedure must be done by people in other cities where there are University campii holding elections. How Nice! Anyway... Worst of both worlds. The inefficacies of a paper-based ellection, together with the unaccountability of an e-voting ellection, sprinkled with fake sense of security here and there. Bah.

1. 1. Except that it didn't. I guess they didn't stress-test the server, so every couple of minutes it returned a connection error. Of course, the page would no longer self-update. And after noticing that, I (and nobody else but me) had to go and give the password and certificate for the system to continue to operate.
2. 2. which is http://www.dgae-siae.unam.mx/ - The Schooling Administration General Direction (DGAE), an universitary body which has no relation with electoral issues. DGAE made available a poster detailing how to vote... But, again, lets ignore that fact for now
3. 3. A nationwide ID number, largely derived from name and birth date data - Both numbers are often widely known, they cannot be considered private in any way.
4. 4. Oh, for goodness sake... The "ballot" has 1..n options, and each has a checkbox, not a radio button. That means, you can select multiple options, which is of course invalid. Why? Because the electoral rules indicate that selecting more than one option in a ballot makes the ballot invalid, and thus, a way for making it invalid must be provided. Isn't logic beautiful?!
5. 5. Want some more insight on what needs to be done? Take a look at the instructions. Don't forget paying attention to the lexicon used - We are still asked to count the votes, an impossible feat given the vote is 100% system-based - Quote: Los miembros de la CLVE realizar n, con base en el reporte del sistema, el c mputo de los votos depositados en la urna a favor de cada una de las f rmulas, declarando nulos los votos que procedan.

fun with my machines at home in the last days:

• on the laptop my network interfaces got renamed from eth0 to eth1 & from ath0 to wlan0. messing with /etc/udev/rules.d/70-persistent-net.rules helped. this seems to be #521521.
• strange sound phenomenons on my desktop. turns out that (1) centerim's new sounds are nice but very quiet & (2) the audible bell in xterm is broken; the latter is #520405. fixed by quickly creating a local 243-0.1 package.
• on my laptop the function keys don't work via acpi any more. turns out that CONFIG_ACPI_PROC_EVENT is finally turned off in debian's 2.6.29 kernel, & I found no documentation on how to make the keys work again with hal/evdev/whatnot. this is #521279, & right now I'm building a kernel with CONFIG_ACPI_PROC_EVENT enabled.

sometimes running unstable can be a bit time-consuming ...