A teacher in Arizona steals Linux CDs from a student and then accuses a Linux distributor of being a criminal [1]. Even though she had used Linux in the past she didn t believe that software was free. Of course that implies that in the past she had performed actions that she believed were criminal. Neat Little Mac Apps interviews Marshall Kirk McKusick - he describes how the BSD Daemon logo was designed and one of his most significant bugs [2]. OurDelta.org offers MySQL builds with some extra features and support [3]. I was recommended to use their builds by Arjen Lentz of Open Query [4], as one of my clients is going to use the services of Open Query it seems best to use the Our Delta builds if only to get better support from Open Query. The extra features in the Our Delta builds seem interesting, but I m not sure that my client needs any of them at this time. The Global Guerilla blog reports on a man who single-handedly invaded the most heavily guarded power station in Britain and shut it down to protest against new coal power stations [5]. The entire blog is worth reading, the author has a lot of interesting ideas. PhpMyVisites is a free web site analytics system that competes with Google Analytics [6]. I haven t implemented it yet, but it looks promising. It seems that PhpMyVisites is not being updated any more (not even security updates) and the replacement is Piwik [11]. Andrew Lahde was a fund manager who made significant amounts of money by betting on the inability of US mortgagees to repay their debts, he wrote an interesting goodbye letter (Telegraph.co.uk) [7]. He now has a Wikipedia page which gives some interesting background to his career [8]. An Employee of the Financial Times is famous for flaming Andrew [9], I have submitted a comment pointing out that being famous for flaming someone who is more successful than yourself is nothing to be proud of and suggesting that he advocate his own political views when criticising those of others - I doubt that it will get through moderation. It s a pity that Andrew doesn t have a blog, I would like to read more from him. At CCC a paper by Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, and Benne de Weger on how to crack the PKI infrastructure used for SSL signing was presented [10]. The root cause is some CAs still using MD5 even though it was broken a long time ago. Updated to note that Piwik is the replacement for PhpMyVisites.

• [1] http://linuxlock.blogspot.com/2008/12/linux-stop-holding-our-kids-back.html


• [2] http://www.neatlittlemacapps.com/show/nlma-episode-048-interview-marshall-kirk-mckusick


• [3] http://ourdelta.org/


• [4] http://openquery.com.au/


• [5] http://globalguerrillas.typepad.com/globalguerrillas/2008/12/journal-climate.html


• [6] http://www.phpmyvisites.us/


• [7] http://www.telegraph.co.uk/finance/financetopics/financialcrisis/3219870/The-astonishing-sign-off-of-a-wealthy-fund-manager-in-full.html


• [8] http://en.wikipedia.org/wiki/Andrew_Lahde


• [9] http://blogs.ft.com/gapperblog/2008/10/yours-truly-angry-mob/


• [10] http://www.phreedom.org/research/rogue-ca/


• [11] http://piwik.org/

In experimental you can find:

• blender 2.48a: Finally (sorry for that) packaged. Upstream release logs: 2.47, 2.48.
• python-networkx 0.99 and its companion python-pygraphviz 0.99: Quite a huge step forward, to polish things before a 1.0 release.
• hugin 0.7.0: Lots! of things changed since the last upstream release. Grab it!
• libgphoto2 2.4.3: Upstream release logs from 2.4.1 and even older.

Some of those packages have been there for quite some time already, but experimental being what it is, a bit of advertisement is always welcome I guess.

Given the recent brouhaha in Debian, and General Resolution regarding Lenny s Release policy as it relates to Firmware and Debian s Social Contract, which has led to the resignation of Manoj Srivastava from the position of Secretary for the Debian Project, I m reminded of the following passage from Gordon Dickson s Tactics of Mistakes (part of Dickson s Childe Cycle, in which he tells the story of the rise of the Dorsai):

No, said Cletus. I m trying to explain to you why I d never make an Exotic. In your calmness in the face of possible torture and the need to kill yourself, you were showing a particular form of ruthlessness. It was ruthlessness toward yourself but that s only the back side of the coin. You Exotics are essentially ruthless toward all men, because you re philosophers, and by and large, philosophers are ruthless people. Cletus! Mondar shook his head. Do you realize what you re saying? Of course, said Cletus, quietly. And you realize it as well as I do. The immediate teaching of philosophers may be gentle, but the theory behind their teaching is without compunction and that s why so much bloodshed and misery has always attended the paths of their followers, who claim to live by those teachings. More blood s been spilled by the militant adherents of prophets of change than by any other group of people down through the history of man.

The conflict between idealism and pragmatism is a very old one in the Free and Open Source Software Movement. At one end of the spectrum stands Richard Stallman, who has never compromised on issues regarding his vision of Software Freedom. Standing at various distances from this idealistic pole are various members of the Open Source Community. For example, in the mid-1990 s, I used to give presentations about Linux using Microsoft Powerpoint. There were those in the audience that would give me grief about using a non-free program such as MS Powerpoint, but my response was that I saw no difference between driving a car which had non-free firmware and using a non-free slide presentation program. I would prefer to use free office suite, but at the time, nothing approached the usability of Powerpoint, and while dual-booting into Windows was a pain, I could do a better job using Powerpoint than other tools, and I refused to handcap myself just to salve the sensibilities of those who felt very strongly about Free Software and who viewed the use of all non-Free Software as an ultimate evil that must be stamped out at all costs. It is the notion of Free Software as a philosophy, with no compromises, which has been the source of many of the disputes inside Debian. Consider, if you will, the first clause of the Debian Social Contract:

Debian will remain 100% free We provide the guidelines that we use to determine if a work is free in the document entitled The Debian Free Software Guidelines. We promise that the Debian system and all its components will be free according to these guidelines. We will support people who create or use both free and non-free works on Debian. We will never make the system require the use of a non-free component.

This clause has in it no room for compromise. Note the use of words such as 100% free and never make the system require the use of a non-free component (emphasis mine). In addition, the Debian Social Contract tends to be interpreted by Computer Programmers, who view such imperatives as constraints that must never be violated, under any circumstances. Unfortunately, the real world is rarely so cut-and-dried. Even the most basic injunctions, such as Thou shalt not kill have exceptions. Few people might agree with claims made by the U.S. Republican Party that the war in Iraq qualified as a Just War as defined by Thomas Aquinas, but rather more people might agree that the July 20, 1944 plot to assassinate Hitler would be considered justifiable. And most people would probably agree most of the actions undertaken by the Allied Soldiers on World War II battlefields that involved killing other soldiers would be considered a valid exception to the moral (and for those in the Judeo-Christian tradition, biblical) injunction, Thou shalt not kill . As another example, consider the novel and musical Les Mis rables, by Victor Hugo. One of the key themes of this story is whether or not Thou shalt not steal is an absolute or not. Ultimately, the police inspector Javert, who lived his whole life asserting that law (untempered by mercy, or any other human considerations) was more important than all else, drowns himself in the Seine when he realizes that his life s fundamental organizing principle was at odds with what was ultimately the Right Thing To Do. So if even the sixth and eighth commandments admit to exceptions, why is it that some Debian developers approach the first clause of the Debian Social Contract with a take-no-prisoners, no-exceptions policy? Especially given the fourth clause of the Debian Social contract:

Our priorities are our users and free software We will be guided by the needs of our users and the free software community. We will place their interests first in our priorities. We will support the needs of our users for operation in many different kinds of computing environments. We will not object to non-free works that are intended to be used on Debian systems, or attempt to charge a fee to people who create or use such works. We will allow others to create distributions containing both the Debian system and other works, without any fee from us. In furtherance of these goals, we will provide an integrated system of high-quality materials with no legal restrictions that would prevent such uses of the system.

This clause does not have the same sort of absolutist words as the first clause, so many Debian Developers have held that the needs of the users is defined by 100% free software . Others have not agreed with this interpretation but regardless of how needs of the users should be interpreted, the fact of the matter is, injuctions such as Thou shalt not kill are just as absolute and yet in the real world, we recognize that there are exceptions to such absolutes, apparently unyielding claims on our behavior. I personally believe that 100% free software is a wonderful aspirational goal, but in particular with regards to standards documents and firmware, there are other considerations that should be taken into account. People of good will may disagree about what those exceptions should be, but I think one thing that we should consider as even higher priority and with a greater claim on how we behave is the needs of our users and fellow developers as people. For those who claim Christianity as their religious tradition, Jesus once stated,

Thou shalt love the Lord thy God with all thy heart, and with all thy soul, and with all thy mind. This is the first and great commandment. And the second is like unto it: Thou shalt love thy neighbour as thyself. On these two commandments hang all the law and the prophets.

Even for those who do not claim Christianity as their religious tradition, most moral and ethical frameworks have some variant on the Golden Rule: Do unto others as you would have them do unto you . I would consider, for example, that the Golden Rule is at least a high priority claim on my behavior as the notion of free speech, and in many cases, it would be a higher priority claim. The recent controversy surrounding Josselin Mouette was started precisely because Joss has taken a something which is a good thing, namely Free Speech, and relegated it to a principle more important than all else, and claiming that any restraint on such a notion was equivalent to censorship. I think the same thing is true for free software, although it is a subtler trap. Philosophical claims than 100% free software as most important consideration is dangerously close to treating Free Software as the Object of Ultimate Concern or in religious terms, idolotry. For those who are religious, it s clear why this is a bad thing; for those who aren t if you are unwilling to worship a supernatural being, you may want to very carefully consider whether you are willing to take a philosophical construct and raise it to a position of commanding your highest allegiance to all else, including how you treat other people. Ultimately, I consider people to be more important than computers, hardware or software. So over time, while I may have had some disagreements with how Mark Shuttleworth has run Canonical Software and Ubuntu (but hey, he s the multimillionaire, and I m not), I have to give him props for Ubuntu s Code of Conduct. If Debian Developer took the some kind of Code of Conduct at least as seriously as the Social Contract, I think interactions between Debian Developers would be far more efficient, and in the end the project would be far more successful. This may, however, require lessening the importance of philosophical constructs such as Free Speech and Free Software, and perhaps becoming more pragmatic and more considerate towards one another.

So I have been getting used to madduck's workflow for topgit and debian packaging, and one thing that bugged me a bit was all the steps required to to build. I tend to build quite a lot when debugging, so I wrote up a quick and dirty script to

• export a copy of the master branch somewhere
• export the patches from topgit
• invoke debuild

I don't claim this is anywhere ready production quality, but maybe it helps someone. Assumptions (that I remember)

• you use the workflow above
• you use pristine tar for your original tarballs
• you invoke the script (I call it tg-debuild) from somewhere in your work tree

Here is the actual script:

#!/bin/sh
set -x
if [ x$1 = x-k ]; then
    keep=1
else
    keep=0
fi
WORKROOT=/tmp
WORKDIR= mktemp -d $WORKROOT/tg-debuild-XXXX 
# yes, this could be nicer
SOURCEPKG= dpkg-parsechangelog   grep ^Source:   sed 's/^Source:\s*//' 
UPSTREAM= dpkg-parsechangelog   grep ^Version:   sed -e 's/^Version:\s*//' -e s/-[^-]*// 
ORIG=$WORKDIR/$ SOURCEPKG _$ UPSTREAM .orig.tar.gz
pristine-tar checkout $ORIG
WORKTREE=$WORKDIR/$SOURCEPKG-$UPSTREAM
CDUP= git rev-parse --show-cdup 
GDPATH=$PWD/$CDUP/.git
DEST=$PWD/$CDUP/../build-area
git archive --prefix=$WORKTREE/ --format=tar master   tar xfP -
GIT_DIR=$GDPATH make -C $WORKTREE -f debian/rules tg-export
cd $WORKTREE && GIT_DIR=$GDPATH debuild 
if [ $?==0 -a -d $DEST ]; then
    cp $WORKDIR/*.deb $WORKDIR/*.dsc $WORKDIR/*.diff.gz $WORKDIR/*.changes $DEST
fi
if [ $keep = 0 ]; then
    rm -fr $WORKDIR
fi

Russ Allbery recently commented that it is really nice to receive patches for trivial scripts posted online. I agree. More than once I've posted a trivial script and had it be improved by people, or later included elsewhere. So in the spirit of sharing here is my latest toy script:

• make-whitelist

This is a trivial script which searches a Maildir hierarchy and outputs a list of each email address which you've ever sent mail to. Why would you want that? In my case my (personal) spam filtering makes use of whitelisting, and the assumption is that if I've ever mailed you in the past then I want to see your replies, and you get a break. These days my (personal) mail filtering has a couple of broad rules:

• If your mail is HTML it is junk. Unless I'm bored.
• If your mail is GPG signed/encrypted I will see it.
• If your mail address is on my whitelist then I want to see it.

After that then I see your message only if CRM119 decides I should.

#
# remove potentially spoofed header
#
:0 fhw
* ^X-whitelist:
  $FORMAIL -I "X-whitelist"
#
#  GPG-signed messages are OK and will be whitelisted
#
:0fW
* < 1024000
 /home/steve/bin/isgpged
:0e
  $FORMAIL -A "X-whitelist: yes" -A "X-GPG-Signed: Yes"
#
#  Get the sender of the message.
#
FROM= formail -x From:  sed 's/^\([^@]*[ <]\)//'   sed 's/\([ >]\).*$//' 
#
# Add a whitelist tag if appropriate
#
:0 fhw
* !^X-whitelist: yes
* ? test -s $HOME/.procmail_whitelist
* ? echo $FROM  fgrep -qisf $HOME/.procmail_whitelist
  $FORMAIL -A "X-whitelist: yes" -A "X-Whitelist-Test: $FROM"

The net result of these tests is that I can now run the spam filter on non-whitelisted mails:

#
# Run CRM114 mailreaver
#
:0fw: .msgid.lock
* !^X-whitelist: yes
  /usr/bin/crm -u /home/steve/.crm /usr/share/crm114/mailreaver.crm
#
#  Spam.
#
:0:
* ^X-CRM114-Status: SPAM.*
* !^X-whitelist: yes
.CRM.Spam/
#
#  Unsure.
#
:0
* ^X-CRM114-Status:.*UNSURE
* !^X-whitelist: yes
.CRM.Unsure/

There is more to my setup than that, but that's the minimum you'd need to see. Of course this is a reminder, once more, that the kind of filtering that you carry out for yourself is different from that that other people will do. ObFilm: The NeverEnding Story

This blog post is brought up to you by Sergio Leone. The Ugly See somebody propose the following change to a Depends line to make sure that a proper versioned dependency is set:

-Depends: $ shlibs:Depends , $ misc:Depends , $ xserver:Depends 
+Depends: libts-0.0-0 (>= 1.0-5), $ shlibs:Depends , $ misc:Depends , $ xserver:Depends 

While the obvious fix is to read Policy 8.6.5 and to use a debian/shlibs.local file accordingly. The Bad See the same person blog about his own competences: I m not expecting people to have to match my levels of output [ ] : He s a he , no point in using some gender-neutral thingy. The Good I ve been proposed to become an Application Manager, which I accepted. Time to get back to my first NM!

Sticking with the theme that blogs are all about completely biased and probably controversial opinion and not much else, I'm glad that Thomas has made his thoughts clear. Thomas - I fully agree (but your blog doesn't support comments, so I'm putting it here).

Debian, to me, needs to about Quality over quantity (being very aggressive over orphaned packages and their reverse dependencies) and about everyone working towards the releases. Not to pick arbitrary time-based deadlines for releases but actively fixing release-critical bugs, so that the release can proceed smoothly with stable, reliable packages. Debian developers who feel unable to fix release critical bugs maybe should not be developers any more - or at least be banned from mailing lists on lists.debian.org which appear to be the only "contribution" being made.

There's no reason to continue using Gtk1.2 and no point in complaining about it because there is no prospect of anyone stepping up to maintain gtk1.2 itself. There is therefore no point in the long threads complaining about removing gtk1.2 because nobody is going to do any work to retain gtk1.2.

If you aren't prepared to do the work, you should not feel you have any rights to complain about the lack of such work being done. We're all volunteers - don't expect someone else to sift the wheat from the chaff, get rid of your own cruft. Debian needs to be an association of people who do, not the current association of people who complain, moan and generally fight amongst themselves. The answer to this negativity is a can-do attitude - it is not as if there aren't enough problems out there to fix, get out there and raise the quality. (First though, get Lenny released.)

Not everyone can do the same amount of workload but within the work that you are able to do, there must be a balance between the work you do for yourself and the work you do for the distribution. I'm not expecting people to have to match my levels of output, I am expecting people to match the proportion of time that they allocate to fixing problems outside their own limited niche. If that proportion approaches zero then maybe Debian doesn't need you any more.

There is no reason to have project members who do not contribute to either quality or releases - that doesn't just mean not fixing bugs, it means not being a part of any team or other group in Debian that provides support for general quality or the release.

If you aren't fussed about the quality of packages (in general, not just your own) and aren't willing to contribute just a small amount of your time to use your privileges to fix release-critical issues, then those privileges should be removed - you obviously don't need them. (Also, if you aren't a DD yet and you want sponsorship, these rules apply to you too. I won't sponsor people who have no feel for quality or want to help Debian make releases. I'm beginning to wish other sponsors would do the same. Quality is far more important than quantity - merely adding packages because they exist and because someone posts a request for a sponsor is insufficient. Completely insufficient, counter-productive too. See my sponsorship requirements.)

Note: this post is entirely opinionated and I don't care if you disagree. I will take a particularly brutal approach to comments that do not grasp this fact.

I consider myself a fairly creative thinker but not even close to outrageously creative. I do have a few friends that fit that later category and one of them is my ex-roommate, Zack Brown (of kernel traffic fame. After many, really too many months of not seeing him, I met him for dinner last night under very snowy NYC conditions and as is always the case, he opened our evening meeting with an unusual and compelling story (and I usually am skeptical of his claims but my skepticism is most often totally unwarranted). Last night, his declaration was the following. He let me know that he has been working on a game, since before we met in 2001, which I was never knew about, and just recently all the pieces and this is metaphorical and literal for there are many pieces in the game have come together and has filed a patent for the game (news to me that you could patent a game). After thinking about it for 7 years(!!!), he has invented a game that I have to say looks stunningly interesting Crumble. It is simple in its rules and format but the strategy is quite demanding and complex. It is requires deep thought but also, it seems, a very visual mind. If you are interested in following its development and marketing (he is looking for manufacturers), you can keep track of developments on his blog. If you are a daring and patient soul (who can refrain from sneezing and laughing) you can make your own pieces and play sooner. And if you work at Google (NYC office) apparently, people are already playing, so you can join and Crumble Away!

I consider myself a fairly creative thinker but not even close to outrageously creative. I do have a few friends that fit that later category and one of them is my ex-roommate, Zack Brown (of kernel traffic fame. After many, really too many months of not seeing him, I met him for dinner last night under very snowy NYC conditions and as is always the case, he opened our evening meeting with an unusual and compelling story (and I usually am skeptical of his claims but my skepticism is most often totally unwarranted). Last night, his declaration was the following. He let me know that he has been working on a game, since before we met in 2001, which I was never knew about, and just recently all the pieces and this is metaphorical and literal for there are many pieces in the game have come together and has filed a patent for the game (news to me that you could patent a game). After thinking about it for 7 years(!!!), he has invented a game that I have to say looks stunningly interesting Crumble. It is simple in its rules and format but the strategy is quite demanding and complex. It is requires deep thought but also, it seems, a very visual mind. If you are interested in following its development and marketing (he is looking for manufacturers), you can keep track of developments on his blog. If you are a daring and patient soul (who can refrain from sneezing and laughing) you can make your own pieces and play sooner. And if you work at Google (NYC office) apparently, people are already playing, so you can join and Crumble Away!

Two policy issues have been brewing in debian and I ve been mostly quiet about them because I ve been busy with TTLLP work. One is the Lenny release GR which I m still trying to make sense of. I mean: yikes! I ve been reading debian-legal and -vote for years and this ballot confuses me. I think I ll vote 5324671 but I m really not sure what that means. The other big issue is that Manoj has resigned as secretary. I think this is a good thing, if for no other reason than he s been secretary for 7 years and I feel it s not healthy for one person to hold that post too long in a thousand-strong group. I ve disagreed with Manoj about some tasks, but I didn t see any point in making this difficult job even less fun, so I stopped criticising him a while ago. Since then, my comments on the secretary s work have usually been limited to small review comments on ballots (which are then apparently ignored anyway, but at least I offer help). I m apprehensive about who will replace Manoj. In the short term, Bdale Garbee acts as secretary, but surely Bdale is busy enough already? Given his increased vote-taking activity, Neil McGovern seems a likely choice, but the work left undone after his term as SPI secretary may count against him. More generally, I think there s a problem with Debian s secretary, so anyone who would be a good secretary would probably refuse to do it as currently defined. There s an email about bundled votes and the secretary by Steve Langasek which touches on this major problem:

the secretary is the *only* line of defense against gaming of the GR process by a small group of developers who propose an uncontroversial but orthogonal amendment that will always win over the alternatives, in the process preventing the will of the project from being formally enacted

In other words, in Debian, the secretary is both secretary (usually an appointed or consensual post in most organisations, in my experience) and chairman (usually an elected post) - both doing the hard administrative leg-work and actually ruling on contentious issues, rather than just giving an opinion to the chairman. Manoj commented that he would be happy if the constitution was changed, to clarify the issue, or to explicitly add another entity to handle intepretations . Is it time to split the secretary s role?

Bastian Venthur notices how the "How many bugs have you fixed today" question is used as a killer-argument against critism at the release-process.

I must confess that I also don't like this attitude of people to use such arguments as a form to silence others. It is something that only people should do, who enjoyed bad manners.
But OTOH it is really sad to see that always the same people are fixing rc bugs. I can only guess, but it seems like out of over 1000 developers eventually 100 are actively involved in the squashing of release-critical-bugs. That is a shame. And people who try to blame the release team for the consequences happening because of this only aren't really helpful, too. Its not like having a release team is meant to be a "5 people to rule/rescue the world" approach.

Bastian, the problem with your attitude is, that you adduct such arguments with it. If its not visible that you do anything more to get Lenny out, except pointing with the finger at the release team, saying "Ha! Ha!", and speculating how we will fail to release Lenny timely, then you shouldn't wonder. You should remember that you are a part of the "We", which is failing, when we as a project miss yet another release date.

And yes, I do agree that our release process is not really ideal and I think we should further push changes to optimize it (which already happened, given that the unblock-policy was way less strict as the years before), but where is your constructive contribution to that?

America is a land brimming with paradoxes, one of them being our simultaneous obsession with freedom and rules. We purport to be the land of the free (and while this is and may not be true, we do hold steadfast to this idea). But we also love rules rules and rules, and wait there are more and more and more rules, too many rules, which often come in the form of the form of a sign, this one being one of my favorites. (shall not produce grease laden fumes?! yes, I think it was written by an academic). So I appreciate small reminders that poke fun of and holes in our love of rules and warnings, such as the one I found on my new bamboo-based shirt, pictured above. I have taken a huge liking for bamboo shirts as of late (I am obsessed with the tactile and can only stand soft cloth, which is why I love bamboo-based cloth) and I ordered a few shirts of the Internet. I only noticed the warning when I pulled the shirt out of the dryer late the other night and it was by far one of the only times I smiled from left to right at 1 am when doing laundry. More people should take the time to plant these easter-egg type jokes as they are, I am sure, much appreciated.

America is a land brimming with paradoxes, one of them being our simultaneous obsession with freedom and rules. We purport to be the land of the free (and while this is and may not be true, we do hold steadfast to this idea). But we also love rules rules and rules, and wait there are more and more and more rules, too many rules, which often come in the form of the form of a sign, this one being one of my favorites. (shall not produce grease laden fumes?! yes, I think it was written by an academic). So I appreciate small reminders that poke fun of and holes in our love of rules and warnings, such as the one I found on my new bamboo-based shirt, pictured above. I have taken a huge liking for bamboo shirts as of late (I am obsessed with the tactile and can only stand soft cloth, which is why I love bamboo-based cloth) and I ordered a few shirts of the Internet. I only noticed the warning when I pulled the shirt out of the dryer late the other night and it was by far one of the only times I smiled from left to right at 1 am when doing laundry. More people should take the time to plant these easter-egg type jokes as they are, I am sure, much appreciated.

Just a quick note that I was planning to write as soon as possible: I m (still) having fun with debian !. Yes, things go slowly, yes we consume a lot of energy to discuss again and again the same things.. But, hey, that s what I am proud of ! Somehow, I truly appreciate people with which I had strong disagreement. I didn t like the moments when this generated frustration for me, but when I look at the overall picture, I really believe there are not a lot of projects who can still go on *and* support the level of free speech and opinions that we have. Diversity of opinions is a difficult thing for big projects, and I am proud we can afford it ! "We will not hide problems from our users." is one of the most meaningful sentence I got from this project, and all of this makes real sense to me. It is democracy !

Debian has a secretary that:

• doesn t close the General Resolution: Project membership procedures vote in time. It s 6:30 (UTC) right now, with a vote running till (past) midnight, and no results around, and the vote is still under Voting Open .
• doesn t open the General Resolution: Lenny and resolving DFSG violations vote in time. Still at 6:30 (UTC), this vote is under In Discussion , while it should have started at (past) midnight.
• shortens the voting period for that stupid vote to one single week while it hasn t been requested, as Sledge confirmed after my asking for a reference.
• initially failed to send the ballot to debian-devel-announce@.

Epic FAIL. (I won t mention again the incredible decision of putting everything into a single vote, others have done so already. And that s of course the worst of all.) Update: Just for fun (or despair), I sent another ballot for the General Resolution: Project membership procedures vote. And guess what?

This is an acknowledgement for your vote [record msg00356.raw] for
the vote "Project membership procedures"
sent in on Mon, 15 Dec 2008 08:37:16 +0100, with the subject
"Re: Final call for votes: GR: Project membership procedures"
 
Your vote has been recorded as follows
 
I note that this is not your first vote.
The time now is Mon Dec 15 08:08:06 2008
Thanks for your vote.

I m lacking words, and running out of popcorn.

Next semester I am teaching a new undergraduate course tentatively titled Technology, Society, and Media: The Body under Transition, in Movement, and under (Massive) Transformation(s). As designed, the course should address technology and media in fairly broad stokes (which I do) but I narrow and control what is a truly unwieldy subject by framing the issues/readings in relation to the human body. Generally speaking, we will interrogate the ways in which technology engenders or erases bodily/human possibilities/capacities and especially the ethical and political ramifications that precipitate from the use/abuse of technology. We traverse a wide range of topics from the telegraph (and how it was used to speak with the dead) to the role of human enhancement technologies of today, to questions of surveillance and privacy, among many other topics. I am pretty far along with the syllabus and pretty happy with it. So far I think I have struck a nice balance between fun/light/accessible readings and some which are bit more theoretically dense. I am still looking for one or two pieces, perhaps one on tattoos and body modification and another about karaoke. If anyone knows any great articles on these topics, do pass along the information. I am probably most excited about the cluster of issues that address eugenics (and most students know next to nothing about America s central role in unleashing the Eugenics movement), disability rights activism, human enhancement technologies, and transhumanism. Considering human enhancement in light of previous efforts to enhance our population brings into relief the similar and distinct ethical issues that haunt this field. One of the most hot button issues of today concern the use of human enhancing drugs. The prestigious journal Nature has just published an editorial on the topic of cognitive enhancement drugs,Towards responsible use of cognitive-enhancing drugs by the healthy, which is a fairly interesting read and covers some of the main controversies. For me, however, the interesting issue is not only whether human enhancement is right or wrong though this is certainly important but what our embrace of these drugs tell us about the conditions under which our bodies live and labor. That is, I think we are actually missing out on posing some other important questions simply by framing this int terms of human enhancement. I suspect, and this is where ethnography would really help out, that many people turning to enhancement drugs may not be medically sick, in the technical sense but I don t think they are healthy either. Many who turn to these drugs feel pretty worn, pretty exhausted, pretty frazzled (the perfect word, I think, is agotado, Spanish for exhausted) and use these drugs as crutches, as band-aids, as an elixir to help out one preserver in tough work circumstances. I am sure there are folks who take these drugs feel fine and are just trying to push their limits and capacities but I troll many many many patient support sites and it also seems to me that many people live under a state of low-grade chronic state of unwellness. Given the pace of society, given what and how we eat, given the extraordinary rates of depression in our society ,given the fact that babies are born with 200 + chemicals in their bodies (what a way to start out life) I am skeptical that enhancement really captures what is going on with these drugs. I have not yet come up with the right term, but I am trying to come up with a phrase that would reflect the ways in which these drugs are not used as therapies for a discrete condition (Type 1 diabetes) but how they are a collective response to a state of low grade chronic unwellness that seems to mark the lives of a whole lot of people. This, I think, would be one responsible approach to human enhancement technologies that would contextualize their use within a much broader frame, one that is attuned to how bodies have been made, remade, and limited under actual material conditions of labor and life in the 21st century.

First time

• I started Debian: some years ago.
• I uploaded a package: some months ago.
• I prepared a stable upload: some weeks ago.
• I voted: some days ago.

So far, so good. But after having voted in reply to a possible abuse of position, now we have a vote with another abuse of position, as pointed several times on debian-vote@. Too bad we haven t seen any reply from the DPL. Yet? In the meantime, I was pointed (thanks!) to a marvellous secretary sucking page, best viewed with a CSS3-enabled browser. Screenshot from midori follows (note that it could be even worse with konqi from experimental, at least so am I told): Oh, and another first time but not Debian-related:

• 3-hour swimming session: some hours ago. Bed time.

I just updated the Software behind Planet Debian to Planet Venus, away from PlanetPlanet. The major benefit right now is the threading, we are now using 15 threads to download the various feeds instead of just one. For all the rest it is currently the same as the old PlanetPlanet, as we use the same templates. But we might switch to something different, we now have the option. The reason for that switch, beside a little more recent code, was the faster updates which was driven by a request we got recently. Language based Planet Debian, ie. a spanish, a german, one. This is now doable without trashing the machine it runs on and will be there soon. I m not yet sure what the exact rules for the language planets will be, but I guess something along the following will do (have to discuss with the other Planet maintainers, this is just my 2 on it):

• Same content as you would put on planet.debian.org, ie. mostly Debian related.
• Special feed with only the language for this planet.
• At least 10 feeds have to be there before a new language gets added.
• Language planets will appear as planet.debian.org/$LANGUAGE, where $LANGUAGE will be the two-letter code for it.

While I was doing this I also went and disabled a large number of non-working feed entries in our Planet config. A diff is available, if you find yourself in it, feel free to reactivate our entry as soon as it is reachable again. [Update] Planet now also features an Atom feed, in case you prefer that.

Now we have seen what per-process namespaces and shared subtrees are and how to operate them, we can try to combine these two features. We ll be using our newns tool from this earlier post to create new namespaces. And for practical reasons, let s say you have a terminal with a 1$ prompt and a second terminal with a 2$ prompt (that will allow me to skip go to the second terminal phrases). In the kernel, per-process namespaces are a bit like bind mounts, such that shared subtrees work with namespaces like they do with bind mounts. As with standard bind mounts, the default shared subtree mode is private, which means mounts done on either namespaces will be private to the namespace. Only mount points active at the time of the new namespace creation will be in both namespaces:

1$ ./newns
1$ mount /dev/sda1 /mnt
1$ ls /mnt
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
2$ ls /mnt
2$ mount /dev/sda1 /cdrom
2$ ls /cdrom
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
1$ ls /cdrom
1$ umount /mnt
1$ exit # Exit from newns
2$ umount /cdrom


shared mode allows both namespaces to share subsequent mounts. As with bind mounts, and for obvious reasons, you need to change the subtree mode before creating the new namespace:

1$ mount --make-rshared /
1$ ./newns
1$ mount --bind /usr /mnt
1$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
2$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6


Like with shared bind mounts, the new mount point can be unmounted from either namespace:

2$ umount /mnt
1$ ls /mnt
1$ exit # Exit from newns

A slave subtree will have mount points under its master (shared) subtrees propagated, while propagation won t happen in the other direction. Again, very much like bind mounts:

1$ mount --make-rshared / # For completeness, we already did that earlier
1$ ./newns
1$ mount --make-rslave /
1$ mount --bind /usr /mnt
1$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
2$ ls /mnt
2$ mount --bind /usr /cdrom
2$ ls /cdrom
bin games include lib lib32 lib64 local sbin share src X11R6
1$ ls /cdrom
bin games include lib lib32 lib64 local sbin share src X11R6
1$ exit # Exit from newns
2$ umount /cdrom


Contrary to shared and slave, unbindable doesn t add value when used in two different namespaces. This is only something that will have impact on the current namespace:

1$ mount --make-rshared / # For completeness, we already did that earlier
1$ ./newns
2$ mount --make-runbindable /
2$ mount --bind /usr /mnt
mount: wrong fs type, bad option, bad superblock on /usr,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg tail or so
1$ mount --bind /usr /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
1$ exit # Exit from newns
1$ mount --make-rprivate # Set back to default

Now we ve seen what can be done with namespaces and shared subtrees, let s see what nice features can be implemented with both. As Russell revealed, pam-namespace is able to polyinstanciate some directories following rules set in /etc/security/namespace.conf (see namespace.conf(5)). The sad thing is that it apparently can t just create a new namespace without polyinstanciating a directory, which could be useful if you only want separate namespaces, but no polyinstanciated directory. Russell s recipe goes as follows:

• At boot time, / is put in shared mode and /tmp in private mode.
• When opening a session, pam will create a new namespace, and bind mount /tmp-inst/$USER to /tmp.

What this means is that in the newly created namespace, a user reading in /tmp will actually be reading in /tmp-inst/$USER without the user knowing. Also, if root mounts something on the parent namespace, it will be propagated (/ being shared) to the user namespace. This means that mounting USB storage, for example, will be propagated to the user namespace. This also means that something mounted from the user namespace will also be propagated to the parent namespace. In both cases, this only applies to mounts occuring outside of /tmp, for which mounts don t get propagated. Note that without setting /tmp as private, when PAM would be mounting /tmp/inst/$USER, it would propagate as well, setting /tmp to /tmp/inst/$USER for everyone. So setting /tmp as private is mandatory. There is, however, a flaw in Russell s recipe: If any of the user mounts something under a submount of /, under /var for example, if /var is mounted, it won t be mounted to a user that already had a session opened. For that to be possible, you have to use --make-rshared instead of --make-shared in Russell s recipe. Some nice setup that can be done with all these, is the following: Add the following to /etc/security/namespace.conf:

/tmp tmpfs tmpfs root

Add the following to /etc/pam.d/common-session:

session required pam_namespace.so

Until here, it is pretty much the same as Russell s, except /tmp is a tmpfs instead of a real directory in /tmp-inst/, which can have some advantages. It doesn t seem to be possible to give pam-namespace a size for the tmpfs, though. Add the following to /etc/rc.local:

mount --make-rshared /
mount --bind /tmp /tmp
mount --make-private /tmp

Here again, this is the same as Russell s except for the correction for --make-rshared as seen above. If /tmp is already a mount point (on my systems, it is a tmpfs), you can remove mount --bind /tmp /tmp from above. Add the following to /etc/security/namespace.init:

mount --make-rslave /

Now, this is where it gets interesting: we re setting the whole tree as slave in the user namespace which means that if a user mounts a file system anywhere, it will only be seen in his session. Which means the user can more safely mount encrypted volumes: they won t be available to other users (root can still go wandering in /dev/kmem, though). And you don t even need SE linux for that. The caveat is that if you open a root session with su, from the user session, you are still inside the user boundaries, and don t have access to the virtual filesystem as it is for init. And if you mount something as root then, while it will appear in the user namespace, it won t appear neither in other users namespace nor in init s, which can be a good thing in some cases, but a burden in others. It means you may need to setup a special user that won t get a new namespace in /etc/security/namespace.conf. An alternative model would be to only set the user s home as slave, which means anything mounted by the user in his home directory would stay private in his namespace, while anything mounted outside would be shared with other namespaces. For that, you may want to replace the lines we added to /etc/security/namespace.init with the following:

HOME=$(getent passwd $3 cut -d: -f6)
mount --bind "$HOME" "$HOME"
mount --make-rslave "$HOME"


Either way, the remaining problem is that a root session opened with su from the user session won t get access to the original /tmp. As we saw, there are various use cases for namespaces and shared subtrees. I ll follow-up again on these features soon, as I ll be using them in yet another way to achieve a very different purpose.