So, if i’ve put my Oyster card through the wash does that mean i’ve broken the money laundering rules? And, more importantly, is it still going to work?

I have just uploaded javatools 0.5 to unstable and it is currently waiting in NEW. Anyone wishing to try it out earlier can find source and packages (it's arch: all) at http://www.srcf.ucam.org/~mjj29/javatools/ . Javatools replaces the existing jarwrapper package and also contains programs to help packagers in creating packages for Java programs and libraries. Packaging tools The javahelper package consists of several small programs which make packaging Java programs and libraries easier. They are generally designed to work in the same fashion as the debhelper programs, but start with the jh_ prefix. All of the programs have their command line arguments documented in manpages. jh_build Many Java programs and libraries are distributed without sane build systems. jh_build provides a simple interface for building Java source code into Jars, including setting the appropriate entries in the manifest. In almost all cases all that needs to be done to call jh_build is to set JAVA_HOME and CLASSPATH and then call jh_build with the name of the jar and the directory containing the source.

JAVA_HOME=/usr/lib/jvm/java-gcj
CLASSPATH=/usr/share/java/esd.jar:/usr/share/java/jsch.jar
jh_build weirdx.jar src
   

This command will compile all the Java files under src , set the classpath in the manifest and build it all into weirdx.jar. A couple of other options are worth mentioning. If this jar contains an application rather than a library then the -m or --main option can be used to set the Main-Class attribute in the manifest which will allow the resulting jar file to be be executed jh_build also provides a --clean parameter which should be called in the clean target of debian/rules . jh_libs For library packages Debian Java policy currently requires that the libraries be installed to /usr/share/java in a versioned format and with an unversioned symlink. jh_libs will take a jar and correctly install it. As with debhelper programs, this can either take a jar as a parameter, or read a list of jars from a file in the Debian directory. It also follows the -p , -i and -s semantics of debhelper for selecting which packages to install the jar to. When operating on a package, jh_libs will read the list of library jars from debian/package.jlibs or debian/jlibs . The jlibs file is a list of jars to install, one per line, and works exactly the same as listing them on the command line. Each jar is installed to debian/package/usr/share/java/ in the appropriate versioned and unversioned forms. jh_depends jh_depends works like dpkg-shlibdeps, but for jar files. For each jar in the package it takes the jars on which it depends and finds the packages to which they belong. These are included in the debhelper substvars as $ java:Depends . The control file can then just list that variable which is filled in automatically. This is done by reading the Class-Path attribute from the manifest of each jar. Jar files should include this attribute to prevent applications which use them from needing a full recursive classpath in their startup scripts and to prevent unneccessary transitions when the library changes its dependencies. If the package is not built with jh_build and the upstream build system doesn't set it correctly then jh_manifest can be used to fix this. If the application uses executable jars (see Runtime support below) then jh_depends will also add the appropriate depends on jarwrapper and the correct Java runtime. jh_manifest Many upstream build systems do not set the Class-Path attribute in the jars they create. This leads to several unwanted problems, such as expanding the classpath which applications have to use and introducing unneccessary transitions. They also may not set the Main-Class attribute. Both of these are required for running jars with the -jar parameter. jh_manifest can fix the manifest files of jars. It can either read from a manifest file in the Debian directory or run in a mode which updates all the jars with the CLASSPATH environment variable. The manifest files can either be debian/package.manifest or debian/manifest . The format of this file is a list of jars and indented below each one a list of manifest elements to set:

usr/share/weirdx/weirdx.jar:
 Main-Class: com.jcraft.weirdx.WeirdX
 Debian-Java-Home: /usr/lib/jvm/java-gcj
   

jh_exec The Runtime support section below describes running executable jars directly. jh_exec will scan package directories for jars in the paths, or symlinks to jar from the paths, and ensure that they have been set executable if necessary. jh_makepkg jh_makepkg will create template Debian packages for Java programs and libraries similar to dh-make . It should be run in the source directory and it will create the orig.tar.gz and most of the files in the Debian directory, which need only small changes neccessary to build the package. java-propose-classpath Some upstreams have complicated classpaths which may not be obvious to the packager when using jh_manifest to set the Class-Path attribute. java-propose-classpath will unpack a jar and look at the symbols imported to the class files, then scan all the jars in /usr/share/java . This shouldn't be run in the build since it is slow, and there may be ambiguities that the packager must resolve. It is still very useful for the packager as most of the time it will get it right automatically. Runtime support Javatools also provides some runtime support. Unlike compiled programs, or purely interpreted programs with hash-bang lines, Java programs cannot be directly executed. Many upstreams expect them to be run using java -jar jarname or java classname . This is not generally acceptible in systems which expect to just be able to run the command or launch it from a menu. As a result, many packagers are writing wrapper scripts which just call java with the correct classpath, jar and main class. jarwrapper There is an alternative to wrapper scripts, however. The binfmt_misc kernel module allows the kernel to call out to a program in userspace to execute specific types of file. jarwrapper registers itself as a handler for executable jars. This is done by reading values from the manifest file. In order for executable jars to work the following attributes must or may be defined in the manifest. These attributes can be set using jh_build and jh_manifest .

• Main-Class: The name of the class to be run when the application starts. (REQUIRED)
• Class-Path: The path to all the jar files on which this jar depends. (REQUIRED unless empty)
• Debian-Java-Home: A Debian-specific property if this application depends on a specific runtime. Specify the path to the runtime which should be used. (OPTIONAL)
• Debian-Java-Parameters: A Debian-specific property if this application needs extra options to the JVM. (OPTIONAL)

Putting it together This section shows the debian packaging generated by jh_makepkg for an application and a library using jh_build . Sample Library Packaging debian/control

Source: jsch
Section: libs
Priority: optional
Maintainer: Matthew Johnson 
Build-Depends: debhelper (>= 5), javahelper, java-gcj-compat-dev, libzlib-java
Standards-Version: 3.7.3
Homepage: http://www.jcraft.com/jsch/
Package: libjsch-java
Architecture: all
Depends: $ java:Depends , $ misc:Depends 
Description: Java secure channel
 JSch is a pure Java implementation of SSH2. JSch allows you to
 connect to an sshd server and use port forwarding, X11 forwarding,
 file transfer, etc., and you can integrate its functionality
 into your own Java programs. JSch is licensed under a BSD style
 license.
   

debian/rules

#!/usr/bin/make -f
export JAVA_HOME=/usr/lib/jvm/java-gcj
export CLASSPATH=/usr/share/java/zlib.jar
build: build-stamp
build-stamp:
	dh_testdir
	jh_build jsch.jar src
	touch $@
clean:
	dh_testdir
	dh_testroot
	jh_build --clean
	dh_clean
	rm -f build-stamp jsch.jar
install: build
	dh_testdir
	dh_testroot
	dh_clean -k
	dh_installdirs
binary-arch: build install
	# Java packages are arch: all, nothing to do here
binary-indep: build install
	# Create the package here
	dh_testdir
	dh_testroot
	dh_clean -k
	dh_install -i
	dh_installdocs -i
	dh_installchangelogs -i
	dh_javadoc -i --sourcedir=src 
	jh_libs -i
	jh_depends -i
	dh_compress -i
	dh_fixperms -i
	dh_installdeb -i
	dh_gencontrol -i
	dh_md5sums -i
	dh_builddeb -i
binary: binary-indep binary-arch
.PHONY: build clean binary-indep binary-arch binary install
   

debian/libjsch-java.jlibs

jsch.jar
   

Sample Application Packaging debian/control

Source: salliere
Section: misc
Priority: optional
Maintainer: Matthew Johnson 
Build-Depends: debhelper (>= 5), java-gcj-compat-dev, fastjar, 
               libmatthew-debug-java, libcsv-java,
               libitext-java, javahelper
Standards-Version: 3.7.3
Package: salliere
Architecture: all
Depends: $ java:Depends , $ misc:Depends 
Description: Short Description
 Long Description
   

debian/rules

#!/usr/bin/make -f
export JAVA_HOME=/usr/lib/jvm/java-gcj
export CLASSPATH=/usr/share/java/csv.jar:/usr/share/java/debug-disable.jar:/usr/share/java/itext.jar
build: build-stamp
build-stamp:
   dh_testdir
   # Build the package
   jh_build salliere.jar src
   touch $@
clean:
   dh_testdir
   dh_testroot
   jh_build --clean
   dh_clean
   rm -f build-stamp salliere.jar
install: build
   dh_testdir
   dh_testroot
   dh_clean -k
   dh_installdirs
binary-arch: build install
   # Java packages are arch: all, nothing to do here
binary-indep: build install
   # Create the package here
   dh_testdir
   dh_testroot
   dh_clean -k
   dh_install -i
   dh_installdocs -i
   dh_installchangelogs -i
   jh_manifest -i
   dh_link -i
   jh_exec -i
   jh_depends -i
   dh_compress -i
   dh_fixperms -i
   dh_installdeb -i
   dh_gencontrol -i
   dh_md5sums -i
   dh_builddeb -i
binary: binary-indep binary-arch
.PHONY: build clean binary-indep binary-arch binary install
   

debian/salliere.install

salliere.jar usr/share/salliere
   

debian/salliere.links

usr/share/salliere/salliere.jar usr/bin
   

In just over a month (1 month and 1 day, to be precise), it's FOSDEM again. The Debian Developers Room schedule is almost complete, and some interesting things are being published around it. Such as the pre-FOSDEM beer event. In previous years, this always happened at the "Le Roi d'Espagne", a bar at Grand Place in Brussels. This was a nice place for many years, because it's easily found, and they have this backroom where quite a lot of people would fit in. Unfortunately, "quite a lot" does not equal "a huge number", with the amount of people going to the pre-FOSDEM beer event more and more approaching the latter than the former as the years go by. Last year, it finally became too crowded, and it was decided that the pre-FOSDEM beer event would change bars this year. Which has now happened. This year, the pre-FOSDEM beer event will be at the Delirium Caf , which is not at the Grand Place anymore, but just 100m away from it; the FOSDEM website has more information. A nice feature of the Delirium Caf , besides the fact that they are much larger, is the huge amount of different beers they have. Over 2000 of them, which you can query online!. And that's not even considering the soft drinks or waters or whatever, which they also have on their menu. Another novelty this year is the streaming; the main tracks that will be held in Janson will be streamed out of the event, and the Debian video team is also planning to do some streaming. Meaning, even if you can't make it to FOSDEM, you'll still be able to follow some of it. You won't be able to follow everything, especially not the hallway track which at FOSDEM is a very important one; but at least you'll be able to sample some bits, which is nice. Other than that, not much will change. There'll be a key signing party, organized by yours truly. There'll be Lightning talks, there'll be the Main track, and there'll be a number of Developer rooms, including the Debian one—which, occasionally, is also organized by yours truly. This conference has always been my favourite (even though I haven't been to many conferences besides FOSDEM); I've never missed even one edition ever since the very first one back in 2001 (when it was still called OSDEM). And since a few years, I've also been offering crashing space at our office, for international geeks who don't mind roughing it a bit (it's an office, there no shower, there's only floor space). This year, perhaps I haven't been spamming enough for that, but for now I only have two people who're interested in sleeping over (and they're not even sure); if you're going to FOSDEM and still need a place to sleep, you're (probably ;-) welcome. Send me an email. On the Debian front, things are going well, for the most part. The list of speakers for the Devroom is nearing completion, leaving me with little more to do than to start assigning times. We've been assigned a booth as well, but there I still need to figure out how to organize it, and what to do with it. There will of course be the regular UK T-shirts, and probably some other merchandizing, but I also want something involving some computer device. We've had this d-i "babelbox" installation running a few times now, which was nice; but I do think we need some variation, too. The only problem with that approach is that I don't really know what that variation could be. Suggestions are welcome! And so time goes on, and FOSDEM draws nearer. At some point it'll eventually happen, and then it will be over before one can say "blueberry pie". Sometimes I wonder whether all these months of preparation are actually worth it. But when FOSDEM is actually here, I'm sure I'll find that it is, indeed, worth it...

I just read an interesting approach to finding a life partner [1]. A summary is “There is a sad truth to the world today. I am part of a dying breed of people known as “shell users.” … Because there are fewer and fewer of us, I must help keep our lineage alive. I am looking for someone to help me do this. I need a woman (obviously) who is willing to raise a child with me in the method of Unix.“. While there is a moderate amount of humour in the post (I recommend that you read it in full) it is a genuine attempt to find a partner. One thing that has occurred to me is that part of the cause of the attitude toward women that is sometimes demonstrated in my community is the fact that there are so many guys who are single and have been single for a long time. If this problem was alleviated then I believe that some of the other social issues would be significantly improved. The advert in question is a bit more courageous than most guys would be prepared to consider (it’s up there with the guy who paid for a giant sign to be installed beside a highway). But there are many other options. ESR has some advice to offer [2], but the name of the URL (sextips) seems an accurate representation of the focus of the pages. One problem with ESR’s advice is that it seems to assume an ability to be extroverted (or at least fake it) which is greater than many geeks possess. Another problem is that he assumes that geeks are inherently more intelligent than average people - there is more than adequate evidence to disprove this theory. It seems more reasonable to only assume that geeks are better than average at doing geeky things. It seems to me that the one thing that geeks really are better at is writing email! Therefore it seems logical that geeks who want good success in meeting women should try and involve the use of email in some way. Singles web sites seem an obvious way to take advantage of this. Unfortunately there is a strange cultural aversion to using such web sites which even afflicts geeks. For some reason it’s thought to be a good idea to try and meet a life partner in a place where there is inadequate light, too much background noise to talk properly, and where everyone has taken mind-altering chemicals (I am referring to drinking alcohol at a bar of night-club). Once strange cultural ideas are discarded it seems obvious that if you want to meet a potential life-partner then you should do so in a place where there is good light, an opportunity to talk, and where everyone is in a normal state of mind. Starting out with email and then talking over the phone and exchanging JPEG pictures seems to be a sensible option in this regard. Most times that you chat to someone you meet over the net it won’t go any further than email or maybe phone-calls. But that’s still entertaining and useful practice at communicating with women. One thing that the Craig’s List advertiser really got right is that he knows what he wants. An advantage of the singles sites on the net is that they often force people to make decisions. When a singles site demands that you enter a desired number of children that you want to have (with 0 being an acceptable answer) then you will be forced to consider the issue and make a decision. While being prepared to negotiate about such things may be desirable, I can’t imagine anyone finding it appealing when someone doesn’t know what they want or doesn’t have the confidence to say it. Finally don’t rule out the possibility of meeting someone through your local LUG. There are a quite a few married couples who met through the Linux community. But don’t go making “pick-up” attempts on women in the community - the result will not be positive. Via Michael Still.

• [1] http://www.craigslist.org/about/best/nyc/485967082.html


• [2] http://catb.org/~esr/writings/sextips/

Share This

Although I lot of people have been lauding the Kindle, I recently decided to go with the Sony PRS-505 instead. Yes, the Kindle has built-in EVDO access, and the ability to buy books without a computer, or even browse the web; and yes, the Sony has once again demonstrated it can’t create a compelling 21st century computer application to save its life. However, it had a few things that at least for me, made a better choice for me than the Kindle:

1. The Sony is thinner — I want to be able to slip it into my laptop case and have it take the absolute minimum amount of space.
2. The Sony simply looks much more elegant than the Kindle; steel with a leather cover simply looks a lot better than white, cheasy plastic.
3. I’m not interested in buying a lot of DRM’ed ebooks; ergo, I won’t be buying may books from either Sony or Amazon’s web sites. It is highly likely that within 2 years I will be buying a more advanced eBook reader, possibly one with color, and I don’t want to be locked into a single format where I have to go and repurchase all of my books just because some the latest and greatest eBook reader uses an incompatible DRM technology from whatever Sony or Amazon has used.
4. The Sony is $100 cheaper. Given that something better will be available within 2-3 years at the very most, and possibly sooner, I’m just not interested in spending $400 on a first generation prototype.
5. Perhaps the most important, the Sony has the really, really good open source support. Kovid Goyal’s libprs500 project supports the Sony PRS-500 and PRS-505, and has very good version tools, allowing people to convert eBooks previously stored in HTML, PDF, TXT, Microsoft Reader (.lit), IDPF/Open eBook (.epub) into Sony’s format. And with a little bit of work, it does a very, very good job with the conversion. Better yet, its ability to convert multiple HTML pages into a single eBook, with credible table of contents, means that libprs500 can pull down the New York Times, the Economist, etc., automatically format it into a single eBook which you can save onto your Sony Reader, and then read it while you are on the airplane. No muss, no fuss. I can also take various books that are available on the web as HTML and also convert them into an eBook which can be used by the Sony Reader very easily.

This last point is I believe one of the best reasons why the Sony Reader will be able to compete very successfully with the Kindle. The libprs500 software is written as a python application, and it will work on Windows, Linux, and MacOS — and its GUI user interface is far better than the truly pathetic Sony Connect software. Score one for Open Source! In my opinion, Sony should send a very nice gift certificate to Kovid as a thank you; his open source project has added an immeasurable amount of value to their product. The only thing that you can’t do using the libprs500 software is buy DRM’ed books which are locked to the Sony Reader — but that isn’t something that many people will be particularly interested in, I suspect. OK, I did buy Pillars of the Earth, which was available on the Sony site for $6 dollars — hmm, cheaper than Amazon’s $9.99 — but that was an investment I was willing to flush down the toilet when the PRS-505 becomes obsolete, mainly so I could test what buying a DRM’ed book would be like from the Sony web site. But I probably won’t be buying many books with DRM that way. On the other hand, I am quite willing to spend quite a bit more money on non-DRM’ed books from publishes such as Baen Books. Here’s to the hope to the publishing industry figures things out faster than RIAA’s member companies. In the meantime, I will be mostly pretending that the both the Sony and Amazon eBook stores with their proprietary DRM’ed books don’t exist…

It bothers me that my Tor usage is less than I'd like because it is just so fiddly. When it comes to privacy I want to keep things simple, I want to use tor, but I dont want to use it for things that aren't sane. In practise that means I want to use tor for a small amount of browsing:

• When the host is a.com, b.com, & c.com
• When the traffic is not over SSL.

To do that I have to install privoxy, and use that with a configuration file like this:

# don't forward by default.
forward-socks4   /    .
# don't forward by default, even more so for HTTPS
forward-socks4   :443 .
# but we do want tor on these three sites:
forward-socks4   a.com/       127.0.0.1:9050 .
forward-socks4   b.com/       127.0.0.1:9050 .
forward-socks4   c.com/       127.0.0.1:9050 .

I'm using absolutely nothing else in my Privoxy configuration, so it seems like overkill. I'd love to hear about a simple rule-based proxy-chaining tool - if there is one out there then I'd love to know about it lazyweb. If not it shouldn't be too hard to write one with the Net::Proxy & Net::Socks module(s).

<global>
  listen 1234
  no-proxy
</global>
<sites>  
  hostname one.com
  port != 443
  proxy socks localhost 8050
</sites>
<sites>  
  hostname two.com
  port != 443
  proxy socks localhost 8050
</sites>
<sites>
  hostname foo.com
  port = 80
  proxy localhost 8000
</sites>

Debian Enhancement Proposals (DEPs): wanna comment? Ok, ok, you're right, I was late, but a good old rule of SPAM is: the more, the better. So, if you care about decision management (or, better, tracking) in Debian and you've always wondered why don't we have something like PEPs? please take part in this discussion: a nice "by product" of the Extremadura Debian QA meeting by Dato, Lars, and myself.

Following my rebuild of all packages using /bin/dash as /bin/sh, we now have a nice list of bugs. Those bugs are cool:

• The relaxed NMU rules apply to them, since they are part of the dash release goal. Which means that they can all be fixed using 0-day NMUs.
• Most of them are really easy to fix. (for many of them, a patch is already provided by Ubuntu)

So, if you want to get involved in Debian development, try to submit NMU patches for those bugs. If you want me to sponsor the upload, please Cc me when you submit the patch. And even if you don’t care about Debian, but only about Ubuntu (which is fondamentally wrong, as everybody knows that Ubuntu is based on Debian), fixing these bugs also helps Ubuntu a lot: all those bugs hurt Ubuntu, since Ubuntu uses dash as /bin/sh by default, and, even if the packages in Ubuntu have been patched, it’s still causing additional work every time a new package is uploaded to Debian, and has to imported in Ubuntu. If you have questions with the process, please ask them using the comments below. Notes:
I use the following process on those bugs, and it’s probably a good idea that you do the same if you intent to submit patches:

• build the package with a chroot using bash
• build the package with a chroot using dash (you can just use a different pbuilder tarball for that). Check that the problem can be reproduced.
• fix the package
• build the new package with a chroot using bash
• build the new package with a chroot using dash
• compare the built packages using debdiff for old_package_using_bash, new_package_using_bash, and new_package_using_dash. If the content doesn’t match, we have a problem.

If you submit NMU patches, please also have a look at the other bugs in the package, or at the lintian output. I don’t mind sponsoring small fixes for non-cosmetic/non-wishlist stuff at the same time.

It is not uncommon to run a Linux system with a kernel that was compiled for another distribution. One reason for doing this is the difficulty in compiling and testing a kernel to make sure it will do what you require. It’s not THAT difficult for someone who knows what they are doing, but if someone else has already done the work then it seems like a waste to re-invent the wheel. Sometimes it’s an issue of a driver that one distribution supports but not another, copying the entire kernel package from another distribution may be easier than compiling a new kernel with the extra driver. Sometimes it’s a kernel bug, if distribution A has fixed the bug and distribution B hasn’t, then it’s often easier to install a kernel package from distribution A when running distribution B. Another reason for running different distributions with the same kernel is Xen. If you have a Dom0 which hosts instances for different distributions as DomU’s then running the same kernel on all of them can make it easier to manage. Unfortunately it’s not uncommon for different distributions to have different kernel feature sets. One example I’m currently dealing with is the fact that the Debian/Etch kernel is compiled with CONFIG_AUDITSYSCALL disabled while RHEL and CentOS require it. So if you run a RHEL or CentOS system with a Debian kernel (EG running a Debian Xen server with a RHEL or CentOS DomU) then you see messages such as the following in your logs. crond[7824]: pam_loginuid(crond:session): set_loginuid failed opening loginuid The loginuid feature allows login and equivalent programs (which includes xdm and other graphical login programs, cron and every other program that runs a program on behalf of another user) to set the loginuid. This loginuid will be stored by the kernel, inherited across fork() and exec, and not be changed by running setuid or setgid programs. Therefore if you see some strange entries in your audit log indicating an attempted attack you can determine the original login UID of the person responsible. In terms of security features it’s not a really high priority. But it is really annoying when programs that work on RHEL don’t work properly with a Debian kernel and put many unwanted messages in the log files. For people who have less background knowledge about these things it may be more than annoying, and may even force them to change their deployment plans to make the message go away (not everyone knows which messages can be ignored or where to ask about such things). The fact that Etch has no user-space support for the auditing features in question (auditing system calls or setting the loginuid) was never a good reason for not enabling this feature (IMHO). Using the auditing system calls was simply a matter of copying the auditctl program from a RHEL, Fedora, or CentOS system (for those who didn’t feel inclined to compile the source). The loginuid required changes to PAM to enable it, but is actually a small part of the auditing layer. As a general rule minimising the differences between distribution kernels is going to benefit most people. Some people complain about kernel bloat, but there are worse candidates for that accusation and given that it seems impossible to buy a machine with less than 512M of RAM and a 900MHz CPU (the specs of the ASUS EeePC) adding a few extra kernel features seems unlikely to hurt anyone. It is of course always possible to compile your own kernel for the smallest machines. Finally I am in the process of back-porting SE Linux code and related security features to Etch, and having this already enabled in the kernel would make my work easier. I won’t do a 7 year support cycle for it unless someone pays, but supporting Etch past the release of Lenny with the latest SE Linux features (and the current features working properly) is my aim.

Share This

Well, this is being written on my broken HP laptop and from within GNOME at that. The problems that I anticipated last time are truly ugly : trying to manage a system that uses repositories from Mepis, Ubuntu and Debian are as horrendous as most Debianites would expect. Debian-based is not an easy balance and this is something that I will revisit within Emdebian. It would be easier if I didn't insist on Debian being added to the mix.
There are problems with cyclic upgrades where apt gets confused and repeatedly upgrades the same packages at the same version.
There are problems doing any building on the box - none of the -dev packages will install without massive work on apt-cache policy $foo and apt-get install $foo=$debian_version, due to dependency problems from having mixed distros. The end result of these was that all of KDE had to be removed - presumably due to upgrading libc6 but didn't worry about trying to put it back.
The wireless connection is still down - but it didn't work with plain Mepis either. The graphics are really weird - the proprietary NVidia kernel driver only copes with 1024x768 and I had expected more, plus scrolling behaviour is distracting.
So yes, even the this horrible setup can work in a basic and quite limited way but I'll need a full Debian install quite soon. It's stable, it's usable for limited tasks and at least I've been able to get GNOME onto it.
I'm going to leave it for now and revisit it later with a fresh Debian amd64 install - I've got to get back to some Emdebian stuff.
(Oh and yes, I did replace firefox with iceweasel).

(Disclaimer: I’ve decided to blog this mainly to get it off my mind. I’m not claiming it’s viable or appropriate, nor that the tool would be up to the job, or anything else. Heck, I’m not even involved with debian-www at all, but don’t we all love to share happy ideas.) The other day, when trying to think of a possible Summer of Code project to undertake this year, I thought that working on migrating (by making a parallel copy, see below) www.debian.org and wiki.debian.org to be ikiwiki-powered could be one, and see how it goes. Me, I think that having www.debian.org use a markup language, and have wiki.debian.org (or www.debian.org/wiki) live in a real VCS (us being Debian people, after all) would be two big pluses. The www instance would be only editable via the repository, either by the current group or DD-wide, and would have stuff like htmlscrubber disabled. And the wiki would be another setup/instance, with the normal setup for an ikiwiki wiki setup, backed up by a real e.g. Subversion repository open to all DDs, and possibly contributors at request. I believe that would be very very cool. Plus web edits as usual. This could also be used as a fresh start, and maybe as an opportunity to accomplish the long-awaited re-design of the site: if this job is done by making a live paralell copy, able to update itself from the current webml repository, and MoinMoin as well, it would give an interesting playground for experimenting, and could be adopted later on, when it’s truly polished, if ever.

If you follow online discussions of programming languages, you'll occasionally see articles about language X "dying". It is, however, a bad metaphor, because the "life cycle" of a programming language is different from single biological units, of which you can definitely say at some point "He's not pining ... this is an ex-parrot!". Once a programming language is widely deployed, it simply won't up and disappear from one day to the next. Too many people and companies depend on it, and replacing it is difficult enough, that the "switching costs" will keep it in place for many years. The obvious example is Cobol. This effect works in favor of languages that are not "the new thing", and means they will probably not truly cease to be used for many, many years. On the other hand, it's also pretty easy to tell which way the wind is blowing and get an idea of what's hot and what's not. Java got hyped a lot in the past, now it's Ruby. Scala is beginning to get hyped some, so is Erlang. Careful observers can spot the rise of languages as they hit the early stages of the technology adoption lifecycle. By paying attention to what's going on in the wider world, it's also possible to see when languages are used less and less for new projects, and solely kept on for the legacy systems. I think this is what most people mean by "dying", but of course it creates confusion, because it's clear that the language is still utilized. In some cases, I think it may be possible that a language continues to be more widely adopted, yet still seems to lag behind, simply because other languages are being adopted at a significantly higher rate. So what it's really about is two factors: how widely deployed is the language in any given moment, and, perhaps more importantly, the rate of adoption - is it accelerating or slowing down? Are more people jumping on the bandwagon, or is the language being used less by innovators, early adopters, and new projects? You need both those coordinates to understand where a language is at - it may be huge but declining, small but on its way up, or a niche language that never achieved widespread usage that isn't catching on any more. The last one is the one you'd probably want to be wary of. The first two will probably be ok as long as you understand what you're getting, and the type of user or organization you are matches where the language is at in its lifecycle. I think that perhaps those interested in discussing these things seriously ought to find some good terms to use. "Forth's rate of adoption is declining" doesn't sound as exciting as "Java is dying!" though. "Fortran's diffusion is decelerating" doesn't have much of a ring to it. Any other ideas?

It's been a while, but a new update to DebTorrent is available in unstable. There is also a new version of the helper apt-transport-debtorrent (0.2.0) to go with it, which was mostly the cause of the long delay (due to a pending apt transition to testing). It is now highly recommended to install both, read below for new reasons why. One of the previous problems with debtorrent was the incorrect status updates displayed by apt, due to it not being aware of pieces of large files that have already downloaded. Using these new versions together will help to improve the update status messages shown during a download. Now, apt-get update will display a status at the bottom that will look something like:

DebTorrent: 837MiB left at 319 KiB/s (46m03s)

You may not be able to see it all if there are multiple updates to different mirrors under way. In aptitude, the status will appear on a line by itself at the bottom of the list of downloaded files. The status line will update about once per second, and should give a good indication of how much time is really left. The other (incorrect) status information presented by apt/aptitude will still be there but you can ignore it. I've only tested apt and aptitude, so I'm not sure how (or if) synaptic, adept or gnome-apt will display these messages, though they are general apt status messages, usually used for displaying the status while logging into an FTP server. This should also fix another problem that debtorrent can have with downloading large files (usually on slower connections). Since apt can't see the download happening for a long time, the connection would sometimes time out. With these status updates the connection is constantly active, so the timeouts shouldn't be a problem when downloading large packages (although they may still occur when doing an apt-get update, as there are no status updates during that process). I did implement a better solution, as suggested by Micha Politowski on the wiki. This solution uses the creation of sparse files to let apt know how much of a file has actually been downloaded. However, apt doesn't understand how a single process can download multiple files in prarallel, so it only follows the last file that was started, and complains when a file finishes that was not the last one that started. I've disabled that for now while I see if it's possible to modify apt to work better in this situation. Here are the changes for debtorrent:

• Update to support apt debtorrent transport version 0.2
  • send piece downloaded status messages (currently disbaled due to apt not liking it)
  • send general status update messages
• Fix some minor packaging issues
• Upgrade to standards version 3.7.3 (no changes)
• Remove the unneeded binary-arch rule
• Changes the XS-Vcs-* headers to Vcs-*
• Moved Homepage from description to Source package fields

And for apt-transport-debtorrent:

• Upgrade transport version to 0.2
  • Create sparse files based on status messages (102) from DebTorrent
  • Send general status updates to apt (103) from DebTorrent
• Remove support for Range headers as they may confuse the sparse file allocation
• Fix typo in long description
• Upgrade to standards version 3.7.3 (no changes)
• Changes the XS-Vcs-* headers to Vcs-*
• Moved Homepage from description to Source package fields

I missed this one when it happened earlier last month, but I'm still putting it on my 2007 page of Bad Technology. Thanks to a colleague for pointing it out. Apparently MSN's Santa-bot made inappropriate comments to children and was exposed in Microsoft's sex-obsessed RoboSanta spouts filth at children The Register After that, it was almost inevitable that it would be taken off-line, even if just for a short while, so I think the next headline could have been predicted:- Microsoft kills Santa Claus The Register What surprised me was the ham-fisted PR attempt described in Microsoft accuses kids of bullying Santa into sex chat The Register If it was a mistake, then admit it. How did it happen? Unruly programmers wanting easter eggs at Christmas, did someone make the Santa-bot by modifying a porno-bot, or was it a learning bot finally corrupted by all the abuse it was sent - like Arnold on UEA/tsw's #pubfood IRC? Truly bizarre.

I’ve just read an interesting article in the New Yorker titled “Twilight of the Books” [1]. It started with some depressing statistics about literacy. One comment that I couldn’t figure out concerned “the panic that takes hold of humanists when the decline of reading is discussed“. The decline in literacy concerns me because I want to live in a society where everyone can contribute as equals and where all voters have the possibility of becoming well informed about the issues that affect their vote. If literacy declines far enough then fascism seems to be the inevitable result. I’m not sure whether that makes me a humanist according to the author. Below in the second part of this post (not included in the feed) I include my dictionary definition of the word, #4 is the definition most commonly used today (which is a reasonable match for my beliefs). There is some interesting information regarding basic research on the mental abilities of literate and illiterate people which suggests that people who an read are better at handling abstract concepts and hypothetical situations. The article notes that spending time on the net increases academic scores for children. It also makes the interesting claim that visiting pr0n sites increases grades, I find that difficult to believe. I wonder whether there is a difference between readers and writers in this regard. Does the typical serious net user who averages writing more than 3650 messages a year for fun (in addition to whatever email may need to be written for work) plus some blog posts and writing other web pages have different mental abilities to someone who just reads what others write? Does blogging (and other writing on your choice of topic) change your brain? What about programmers, does spending 8 hours a day writing formal rules for hypothetical mathematical situations (which is essentially what programming is about) change your brain? Are programmers going to have greater abilities for managing abstract concepts and hypothetical situations than people who have not had such experience? NB It will be difficult to determine this as people who have such skills will find programming easier and more fun so therefore a career in programming computers is self-selecting for people with such abilities. Another interesting fact is the results of research into the comprehension of a PowerPoint presentation. People who read it without an audio-visual accompanying it learned more and rated it as more interesting. Based on this my plan is that in future when attending conferences I will try and read papers which are presented BEFORE attending the lectures. Unfortunately most conferences which have papers presented seem based on the idea that you give a lecture about a topic as a teaser for your paper and assume that the audience knows nothing about it (conferences which don’t have papers outnumber the ones that do). Most Linux conferences seem based on the idea that almost no-one reads papers at all, they attend lectures and visit web sites and IRC channels afterwards. NB this comment is based on talking to people who attend conferences and my observations on attending conferences - it is not a criticism of any conferences merely an observation on cultural attitudes. Based on this information it seems reasonable to provide copies of lecture notes to the audience before the lecture. For example for a typical talk that I give to a LUG I could blog the lecture notes before the meeting and email the LUG mailing-list with the URL, people who really want to learn would hear me talk AFTER reading the notes and hopefully get the best of both forms of learning. I had been considering producing some YouTube [2] videos with instructions on how to use SE Linux. But it seems that might not be such a good idea (at least not a good enough idea to justify the amount of effort I would have to spend). The author seems to misunderstand YouTube, it is NOT about making the Internet resemble TV (where millions of mindless drones watch content created for the lowest common denominator in the audience). The AtGoogleTalks on YouTube [3] and www.ted.com are examples of high-quality free content (comparable to the best TV documentaries - the type of content which is cited as increasing the academic results of children) and the culture of creation and discussion must be a good thing. Most TV is bad because it’s one-way communication and the quality of the content is low. YouTube videos are widely discussed in email, blogs, and other written forums. The creation of the best (and often most viewed) videos would surely involve some writing. I wonder whether the benefits attributed to reading can be obtained without reading fiction. The nature of work is changing to require an increasing amount of reading and writing. The most menial work requires reading instruction manuals. Most of the best paid jobs involve a lot of reading and writing. If reading fiction isn’t required then it seems that there is little risk in the immediate future.

• [1] http://www.newyorker.com/arts/critics/atlarge/2007/12/24/071224crat_atlarge_crain?currentPage=all


• [2] http://www.youtube.com


• [3] http://au.youtube.com/profile?user=AtGoogleTalks

(more…)

Share This

Most audio players offer visualizations. Unfortunately most of them either are just plain boring or don't really visualize the music very well. KDE's amarok has one that is really excellent: jakdaw. Jakdaw does a good job of both following and representing the intensity of the music. And it generates an amazing display of colors. But even with a good visualization a lot of music is not all that interesting to watch. Over the last month or so I've occasionally been "looking" through my music collection. The visualizations are surprisingly varied for different artists. And though a lot of them are nice to watch, some artists consistently produce much more varied and artistic displays than others. To some degree it is predictable, but not always. Quite often the visualization is a lot less interesting than you'd expect and especially some slower or quieter songs produce much more interesting displays than you'd expect. A blanket of sound does not produce a very interesting display, but strong accents and mood changes do. As is often the case in art, the real challenge in composing music seems to be leaving things out and to have individual instruments play their own tune instead of having everything move together. The two artists that really stand out so far are Björk and Faithless. Both consistently produce visualizations that are at times stunningly beautiful and also show a lot more detail in the music than others. For Björk It's Oh So Quiet (from Post) and Violently Happy (from Debut) are very nice, but two songs that really stand out are Hunter (from Homogenic) and Hyper Balad (from Post). For Faithless songs like We Come 1 and Tarantula (from Outrospective), and Salva Mea and Insomnia (from Reverence) are truly worth watching.

Spamassassin supposedly can precompile rules to allow faster operation. It compiles an optimized matching automaton that will process all the regular expressions in parallel.Anyway, in order to use it, you need to manuall install some dependencies. They probably can't be introduced as real dependencies to not enforce them upon people who don't want to use this feature. So far, I've identified

aptitude install re2c gcc libc6-dev make

I'm aware that many people will have the libc6-dev and gcc stuff already installed, and the re2c dependency is well-documented. But I actually had removed the C compiler from my mail server.

In a comment on my post about Bad Project Management [1] Don Marti [2] says “the more money you charge, the less of your time people waste, and the more seriously they take you” and “you can affect the client more, whether you’re peddling idiocy or wisdom“. That’s a nice theory, however I don’t recall seeing an example of it anywhere that I have worked. There are two broad categories of employers, large and small. Large companies have HR departments etc who decide on rough pay scales. Once the budget is approved (by senior management and HR) for someone’s contract fees or salary the amount of money seems to be of little concern to the line manager. They have a group of N people reporting to them who are all paid by money that comes from some mysterious place (with no direct connection to the quality or quantity of work done) and therefore the amount of money paid is not very relevant. Often team-leaders don’t even know how much the people who report to them are being paid! Note that this applies to people who have a similar job title, if I am paid twice as much as another sys-admin in a corporate environment I don’t expect to get more attention, but someone who has a more senior job title (or in the case of the UK has been to a more prestigious school or has a better accent) may get more attention. Small companies are rarely in a position to be silly in this way. This doesn’t mean that the most highly paid person gets the most attention, it’s more a matter of making a logical case. Most of the small companies I have worked for have been run in a sensible manner, and my ideas have often received more attention than those of others because I have had a better technical background than my colleagues. However in some cases my suggestions have received less attention because I was receiving a higher pay rate. The reason is that I was being paid a rate that the company could not afford in the long-term and therefore the people who would work there in future years would have to maintain the systems in question which meant that their ability to do such maintenance was often considered to be more important than my ideas about the best way to design the system. I have worked for a small company that had no financial pressure to do sensible things (they had some sweet deals going with major corporations which essentially gave them money for nothing). They had chaotic management which they could get away with because there were no immediate consequences for doing silly things (such as not forcing their clients to have a method of backing up servers that they installed). I can’t claim that Don’s advice in this regard never applies, but my observations of situations where it didn’t apply lead me to believe that it’s applicable to some situations in limited areas and is not a general rule. Don also refers to “a high number that you would quote to a client you didn’t want in order to get them to go away“. This is an issue that causes a lot of disagreement. One consultant I respect advises people to never make such quotes, if you don’t want a job then say that you are not available - one reason is that if a position is so bad that you want the potential client to go away then you don’t want to be tempted to reconsider if they agree to pay you a silly amount of money, another is that it may be considered ethically wrong to make an offer is not genuine. Another consultant I respect claims that his greatest career success was when he turned up to an interview in casual clothes, explained to the potential client that he would never wear a suit and demanded an excessive amount of money. The client agreed to such terms and he then went on to charge other clients similar amounts of money and continued to refuse to wear a suit. I won’t claim that it’s wrong to demand excessive amounts of money to make an unwanted potential client go away and I will not rule out the possibility of doing so at some future time. But I think it should be noted that the practice is controversial and not referred to as something that anyone might do. It is something that I don’t recall doing at any previous time in my career (so I haven’t done it in a formal manner at least - I may have done so at the informal discussion phase and forgotten). Please note that I encourage you to read my previous post with Don’s comment in it’s original context to avoid any risk of misinterpretation. The purpose of this post is not to disagree with Don (I agree with him almost all of the time) but to disagree with some very commonly held beliefs which Don represented in his comment.

• [1] http://etbe.coker.com.au/2007/12/19/bad-project-management/


• [2] http://www.linuxworld.com/community/?q=blog/6

Share This

I promised it some time ago and now it has been done: Debian packages for the development tree (1.1 series) of Bluefish are ready for Debian users (i386 only). The packages can be installed along with the stable version, so you can safely test new features and give us feedback and bug reports. NOTE: The packages cannot be (re)built on Etch, because debhelper version 5.0.57 or higher is necessary. I will fix this part of debian/rules soon, so it can be (re)built on Etch too.

A Debian package is uniquely identified by its name and version; there is no further information taken into account by dpkg. This keeps the packaging system rather simple, but has the disadvantage that all information that would otherwise be placed in extra data fields has to be encoded into these two fields. As the names of all binary packages generated from a single source package need to be known when building the .dsc file, no substitutions are allowed in the package name. Back in the Good Old Days, the only extra bit of information in the name field used to be the SONAME from the library in the package (thus implicitly saying that each library should have its own package), which meant that the maintainer had to adapt the debian/control file every time a library's ABI changed. This being the Good Old Days, people writing libraries actually thought about things, so ABI changes were few and far between. These days, libraries are stacked on top of each other, re-exporting the underlying libraries' ABI. The SONAME system could in theory handle these situations if the SONAME of every library whose ABI is re-exported is encoded into the SONAME of the newly built library. So if my own ABI version is "2", and some of the functions I export use types defined in glib, then after building against glib1.2, my SONAME would be somewhat similar to "2+glib1.2". For languages that don't have a well-defined ABI (i.e. anything but C), the version of the language ABI(s) used will also have to be added. Obviously, this would also have to be encoded into the package name, which is where trouble starts during transitions. The last C++ ABI transition had all C++ library maintainers add a suffix to the package name; dependent ABIs are not handled at all in Debian right now (which led to the libpng mess). The existing encoding rules are not entirely formalized, and it is not guaranteed that they are bijective. For example, packages used together with cross compilers have been following the convention of using the name that the native package would use, followed by a dash, the target architecture name, another dash and the word "cross". There is no guarantee that the architecture name does not contain a dash, however, so we cannot simply take the second to last word as the architecture name if the last word is "cross" (think "libgcc1-kfreebsd-i386-cross"), which makes it difficult to write a plug-in to apt that would automatically download the binary for the target architecture and convert it using dpkg-cross. I've decided to nonetheless go ahead with my request that the "-*-cross" part of the package name space be reserved for packages related to cross compilation; it will work for the time being.