After a very tasty breakfast of gorditas in the market, I sat through talks all of Thursday morning, which were all quite good. They were visionary talks, talks about where Debian was going to go, and what we can do to get it there. After a brief lunch, we returned for the talk of debugging debian-installer. I've been lugging around my laptop, jamaica, through the entire conference. It's an old A20m, which means that it's a rather bulky looking thing, that is quite heavy. What makes it noticable is that it's been epoxied together, after having been dropped one too many times. People marvel that GNOME runs reasonably on it. Anyway, during the talks, my wireless card decided it didn't want to work any more. Pulling it out and letting it cool down seemed to get it responsible again. Strange. After the afternoon talk on how to find security problems within Debian, I went back to the hotel to change. You see, we were going to a Formal Dinner. I had not packed for a formal dinner, thinking that all functions would be casual at the very most. Still, I pulled out a pair of pressed slacks, an ironed shirt and a colourful tie. When I left my room, it became apparent that Formal actually meant "clothes without any holes". We all packed into the coach buses from yesterday and drove into town. This was actually quite difficult for the drivers, because the streets were very narrow and the buses were incapable of turning around corners. I think it took us fifteen minutes to park, which mostly consisted of doing a 30-point turn. We disembarked and walked into a large building. Two of the walls were made of stone, the rest were made of stucco. There was a small stage presiding over a floor full of fold-up tables which were arranged in a Debianesque spiral. I decided that I was going to be at the nexus of activity, so I sat down at the central table and reserved a seat for AJ. As people seated themselves and started talking, there was a sudden commotion. Holger was running towards AJ with a plastic crown, deposited it unceremoniously on his head, and continued sprinting past. This drew applause and photographs, along some cheering of "Long Live the DPL!" AJ looked decidedly uncomfortable. It's probably for the best that Debian isn't a monarchy. Our evening got more and more interesting. A mariachi band came in the door and started playing. Soon after they started singing, rain began to fall. This made lovely sounds on the tin roof above, which made me a little sleepy. Right about now, a brawl sprang up near the front door. There was some shoving involved and quite a bit of yelling. Soon, the combatants were separated and some of them left the building in anger. All this time, the musicians were playing louder and louder. As the music crescendoed, the rain fell harder and the wind blew stronger, until we had to close up the shutters to keep the water from blowing in. And the band kept trying to play over the rain. Then, slowly, the roof began to spring leaks. We were lining up for food then, and by the time I got to the buffet table, water was pouring into the trays. I managed to get something reasonably dry and scurried back to my seat. Which was wet. After I got some food inside of me, I experience the final act that capped our evening. We were chatting a bit about the strange weather we were having indoors when suddenly, water started cascading down one of the walls. It made a tremendous roar and the floor of the building quickly flooded. As I was photographing the events, the lights suddenly went out with a pop. We were plunged into darkness. I made my way back to my seat and someone eventually found the fusebox. The lights were restored, one by one, and it was soon time to leave. I don't know how the organizers of next year's Debconf are going to be able to top this: ceremony, live music, fisticuffs over a woman, an indoor waterfall, and drama. This was a night we're all going to remember.

Contact Lookup Applet 0.14 is released, especially done for sebuild.

• Translate the .server files (Frederic Crozat)
• Don't set sensitivity ourself (Bastien Nocera)
• Correctly handle contacts with no email (Adam Petaccia)

Translators: Adam Weinberger (en_CA), Clytie Siddall (vi), Daniel Nylander (sv), Francisco Javier F. Serrador (es), Frank Arnold (de), Funda Wang (zh_CN), Gabor Kelemen (hu), Ilkka Tuohela (fi), I aki Larra aga Murgoitio (eu), Jean-Michel Ardantz (fr), Kjartan Maraas (nb), Marcel Telka (sk), Maria Soler (ca), Maxim Dziumanenko (uk), Micha Kastelik (pl), Miloslav Trmac (cs), Takeshi AIHANA (ja), Yavor Doganov (bg), ygimantas Beru ka (lt). You can grab it from the usual place. Debian packages heading towards Sid once I update my pbuilder...

Courtesy of my phrasebook:

English	Spanish
I'd like to get Internet access	Quisiera usar el Internet
broken	roto
tomorrow	ma ana

I noticed this morning that the book has a section on romance, going from "asking someone out" through "sex" to "problems". Suddenly this book became more interesting to my breakfast companions.

English	Spanish
I can't get it up - sorry	Lo siento, no puedo levantarla

Whee, the hard part of moving is over, thanks to my girlfriend Franzi, Sebastian and Martin who not only helped but also managed things where I failed. I'm currently sitting in the old flat, cleaning up the last bits of my presence there (like footprints that match the color of the wall paint). The next steps will be setting myself up in the new place, and finding back to normal life. This will also involve getting a DSL line, so don't expect too much Debian activity in the next time.

I missed Belle and Sebastian when they came to Philly the weekend before last. However, NPR has a recording of their D.C. concert online here. It’s very, very good. (Thanks to Fernando and Steve for pointing it out.)

Embarrasing enough, Ubuntu has shipped a Catalan translation for the very prominent About Ubuntu GNOME Panel menu entry which read Quant a Ubuntutu . It s been there for so long that irazuzta and I really considered not fixing it at all for hysterical raisins . Anyway, seb128 now has a patch to correct this at long last in Ubuntu s gnome-panel. He promised to include it in monday's 2.14.0 upload seb: DON T FORGET! In the meanwhile, Jordi Irazuzta and I just finished setting up the Ubuntu Catalan Translators team, with the mailing of some detailed instructions on how we want to get work done in the team. It's been months of planning and designing a workflow to make a Ubuntu translation team and the openness that Rosetta offers to all the members of a team fit in Softcatal s high standards for the quality of the translations made by the organisation. As soon as people start mailing back and get subscribed to the team s mailing list, they'll get tasks assigned and we'll get the team kickstarted, with lots of work to be done before the Dapper release. The key for this team s success is that we educate our volunteers to contribute their Ubuntu translations to the upstream projects or relevant Catalan teams, and that this is somehow coordinated. The experience will be quite good for me to identify some of the social problems with Rosetta, as many times people ask if their translations for Ubuntu will appear in other distributions as well. The team is led, for now, by Jordi Irazuzta, lo noi de l'Ebre, and me. If you're a Catalan Ubuntu user and want to lend a hand, you're more than welcome to join the mailing list to help, and become a Ubuntaire!

I'm so glad I finally decided to attend FOSDEM this year, as last weekend in Bruxelles was so cool it reminded me of the unforgettable week in Helsinki for DebConf 5 last summer. I travelled early on Friday with Ivan Vilata, the dude who dragged me into the Catalan translations world, and about 12:30 we were finding our way through Bruxelles airport. We had barely no problems getting to Ra l's place in Boulevard Louis Schmidt, thanks to the detailed HOWTO he provided a few days before. We dropped our bags in his appartment and went out with him and Virginia after a well deserved mini-nap. On our way to the Grand' Place, where we'd hook up with the Softcatal crowd and the rest of FOSDEM people, we stopped in A la Morte Subite, where we Ivan and I started our personal training on Belgian beers. The Roy d'Espagne is an excellent name for a place where to meet our friends from Catalunya. I didn't know that was a formal meeting point that kickstarts FOSDEM, so I was really impressed when I got to the second floor and found the place was packed with Free Software people, many of them I already knew in person. Reaching Softcatala's table near the window took about 15 minutes, and after saying hi to most people, we decided we could use a quieter place to have dinner, and then go back.

The Grand' Place was bombed by seb128 in 1695 Ra l and Virginia, our official guides during the weekend, chose a Vietnamese restaurant in the Stock Exchange area they frequent, and for little money we got an enormous meal. Back at the Roy d'Espagne, I tried to say hello to most Debian people I saw around, while at the same time I tried to be with my hosts and the Catalan people. A while after, I spotted tbm and azeem downstairs, who I finally met. I talked to Michael for a long while, and at some point we left as we didn't want to miss the last tram. Ivan, luckily, only snores rarely, so we slept for a while, and then took the tram to the Universit Libre du Bruxelles. The main room was already packed for RMS's keynote, which was pretty good. After that, we went to several talks here and there, while I kept meeting some people around the place. Ivan and I left when the show ended and we met with Virginia and Ra l at the centre. This time, we hooked up with Xevi and Jes s Corrius from Softcatal , as Toni Hermoso had abandoned us for a cheap dinner with the Mozilla.org people. We were taken to a packed bar/restaurant (don't remember the name right now), which had a few interesting features: they wouldn't sell any Coca-Cola, would not accept credit cards in protest for the high fees Visa charges on small businesses, and something I wouldn't expect to see in 2006, their chart of prices hadn't been rounded up when they switched to the Euro. So some plate would be 9.72, others 12.43, etc. After dinner we had a few beers at the Th atre de Toone, located in some tiny alley in the centre and being pretty tired, we went back home at 23:30 or so. Sunday was a busy days, due to the number of interesting Debian and GNOME talks going on. I'd highlight liw's talk on Piuparts, Enrico's on debtags and fjp's on Debian Installer in the Debian room, and kris' on the future of GTK+. There was also a cool demo of Novell's XGL. During a dead slot, I approached Little Daniel and keithp to see if he could point me at some mapping between UTF-8 and XKB symbol names. But Daniel was cool enough to solve a problem a lot simpler than expected. :) jdub's closing talk was just fantastic, and telling him "See you in Vilanova, we left the University, for our last dinner around Bruxelles.

jdub clues the audience about some basic acronyms We managed to rescue madduck from the Debian UK beer trap and went to an Italian for dinner, this time with Josep and Mia, from Softcatal , making a nice mix of German, Valencian/Catalan, and Swedish at our table.

Mia, Josep, Ra l, Ivan, Martin and Jordi after pizza Ra l took us around the city centre and told us about the underground river, the remaining city wall's tower, and the church that leaned against it. That night's beer lesson happened in the "2000 beer bar". We all had a 7 Trappist Westvleteren Bleu 8, apparently "the best beer of the world". It was pretty good, actually. Our weekend in Bruxelles was about to end. After not that much sleep, Ivan and I took a tram and a bus to the Airport, arriving in Val ncia around 10AM, and after seeing the best view of the Pyrenees ever, which were absolutely covered with snow, as well as many other places in the Pa s Valenci and Teruel due to massive snows during the two days we were out. FOSDEM is probably a "can't miss" yearly event now. Thanks to all the organisers for their hard work to make it happen. You rock.

• A quantum computer program has produced an answer without actually running. Quantum mechanics is strange.
• Googlebot was based on lynx all these years? WTF? Google is strange.
• Explanation of the Anomalies of Water. Yeah, water is strange, too.

I woke up on Friday morning and wondered what breakfast would be. Then I remembered that I was staying at the W and decided to forage for food elsewhere. I took a taxicab with spider88, enochsmiles, maradydd. It was a strange hybrid SUV cab that was painted all yellow, I would later learn that Yellow Cab drivers were scary and that I should avoid them. We got to StudioZ and discovered that we didn't know how to get inside. We figured that out eventually and took stock of the situation. I started moving tables about and setting up chairs, because I abhor standing about with my hands in my pockets. Then I helped hang banners from the rafters. After I did that, I tried to see if I could do anything else. Since CodeCon is run on the cheap so that anybody can attend, drinks like coffee are not included in the conference fee. And since the conference was being held in a night club, there was a convenient bar that would be a good place to setup a concessions stand. So I put things in order and stood behind the counter. I got to see people walk in the door and after registering with wealhtheow or Spider, they'd stand in bewilderment in front of my bar. It was a lot of fun to watch all sorts of people come through. And then I'd smile at them and offer to get them something to drink. We started Lance's talk a little late in order to let everyone settle in their seats. I met him the night before where he talked about his Apache module that has heuristics for detecting when a phisher is trying to clone your website. Or when your website has been cloned and the phisher is passing login requests through to you. This kind of thing is totally what financial institutions have to start doing. We got coffee from this place called Cafe Organica, which seems to have some mixed online reviews. Or rather, Jonathan did, in a big messenger bag filled with carafes. Since Jonathan doesn't actually drink coffee, it was left to me to decide whether it was any good. It seemed to be drip coffee that was thick, dark and strong. Very decent for something that was brewed hours ago. The customers didn't seem to mind, as we ran out of coffee every day. The next presentation was SiteAdvisor which takes an interesting tack on safely surfing the web. Instead of building security features into your browser, there's a central server that stores information about sites that you're visiting. But what was really interesting was how they got this information. They had an automated tool that went in pretending to be a real person, signed up for some e-mails, downloaded some programs, and examined what happened afterward. I missed the majority of the VidTorrent presentation, because I was busy chatting with people and offering them refreshments. Also, their demo didn't work because the wireless setup at the conference kept on going down. People were abusing the free Wireless network that Cliff was trying to keep up and running. Which is sad, because Cliff had basically volunteered to set that up on his own time. Tom came up after that to present Localhost, which is a unimaginatively named piece of software, but is interesting because it lets you browse a world-wide filesystem of torrents. What's interesting about his filesystem is that it uses a distributed hash table, so that even if there are files with the same name, you'll be able to distinguish the distinct copies. Which is useful if you want to tell whether you're downloading a legitimate and popular file, or some malicious file that someone's injected. The last talk of the day was Truman, which not only demonstrated an interesting piece of technology, but also quite educational. The tool itself is a specialised Linux distribution that can capture what happens inside itself and simulate a public connexion to the Internet. This is advantages, Joe tells us, because modern pieces of malware are smart enough to disable themselves when they detect sandboxed environments. After people filed out, we packed away everything into storage as StudioZ is a nightclub, so it was setting up for its nightclub crowd. Everyone else went next door to Loft11 where a party was being held, sponsored by bramcohen's awesome company I went inside and bumped into Graydon and we tried to go about finding fellow Canadians. This was not so successful on the crowded downstairs floor, so we went upstairs to chat and catch up. I met some people who were at the speaker's reception and successfully remembered their names. Then I met a guy who was at the night club just waiting for his buddy, and I explained CodeCon to him. He thought it was a great idea. Len Sassaman and Bram got up to give a little speech, which I tried to take photographs of. But failed. Instead, I noticed that they were on this awesome glass ceiling which made me want to dance. I didn't do that though, because my feet hurt from standing all day. I poked my head into a room upstairs that was all white, which was very cool. Some people were playing a game of Werewolf which finished with the villagers winning. I hung out with some people like Eric, Pete, and Kelsey who told the story of her pink Barbie backpack. I also met Chloe and her husband, whose name I have forgotten. But Chloe is awesome because she is now independently wealthy so that she can pursue her dream of studying the nitrogen cycle in soil using post-doc maths. Impressive! I also met akashayi who is not a professional computer programmer at all. She teaches martial arts by day, and slings code by night. She drove all the way from Los Angeles to attend CodeCon and was having the time of her life. I wistfully remember when I was that excited about computing, so just hanging out with her was awesome. She promised me a Kempo lesson if I ever made my way to L.A., which is an offer I intend to collect. I found Spider downstairs, sitting on a couch with Daniel. The night was getting long and we were totally exhausted, so we took a taxicab to the W. There, we went up to Enoch's room party where he treated us to $17 cheeseburgers. Now, I didn't think that cheeseburgers that expensive were worth it, but boy oh boy were those good. Spider and I took a cab to kineticphoenix and riseorbleed's place sometime past midnight and we dragged our luggage into their guest room. Which was really more of an awesome guest apartment. Hurray for knowing people in foreign cities! I don't remember much after that. I think I turned on a space heater before passing out.

Today I finally got annoyed enough with Ubuntu's GTK+ defaulting my file choosers to $HOME/Documents rather than $HOME. I can see how this would be useful, but Documents contains a few files, whereas I generally want to get into ~/Pictures, or ~/Programming. Luckily sebuild saves the day, by telling me about GTK_DEFAULT_FILECHOOSER_DIR. One quick export later:

export GTK_DEFAULT_FILECHOOSER_DIR=$HOME

And voilà, it works. Now please can the comments section of this post not turn into a new GTK file chooser sucks arse d000dz old one r0xkkz. You try explaining to a non-geek why parent folder is .., and why . is in the folder list at all. NP: Songs In The Key Of Life, Stevie Wonder

I learned just last week that my law school professor John Flym was counsel in the Vanguard Case. He testified before the Senate Judiciary Committee on Friday. It appears that John is also retiring. This will be a great loss for Northeastern Law School. He was one of my favorite professors at Northeastern. Some students didn’t understand his clinical approach, which among other things demanded that we take nothing for granted and rejected easy or prefabicated answers to questions, but I found his teaching to be some of the best preparation for practicing law in the real world. Right wing critics have predictably attempted to dig up “dirt” to discredit John—e.g., Baseball Crank: LAW: Who Is John Flym?. I don’t mind linking to that entry and increasing its PageRank, however, since I don’t find anything objectionable in the “dirt” the writer has dug up. In fact, it only increases my respect for the man. (He opposes nuclear weapons and torture? How shocking!)

Today I discovered on Debian's Package Tracking System that Ubuntu has patched my Netatalk package. The patch seems to be rather useful (start cnid_metad in init if the user requests it). I just wonder why it was never submitted directly to me. Isn't it easier just to take the upstream message than to (re-)sync every time I release a new version?

Some of the books I read in 2005:

Bruce Feiler, Walking the Bible: A Journey by Land Through the Five Books of Moses
Georges Perec, Species of Spaces and other pieces
Bob McCulloch, My Fare City: A Taxi Driver's Guide to Edinburgh
Origen, On First Principles (translated by G. W. Butterworth)
Sin-leqi-unninni, Gilgamesh: a new English version by Stephen Mitchell
Vladimir Nabokov, Pale Fire
Richard Fletcher, The Conversion of Europe: from paganism to Christianity 371–1386 AD
M. A. Screech, Laughter at the Foot of the Cross
Oliver Sacks, The Man Who Mistook His Wife for a Hat
Otto Friedrich, The Kingdom of Auschwitz
Nicholas Barton, The Lost Rivers of London: a study of their effects upon London and Londoners, and the effects of London and Londoners upon them
Anton Chekhov, The Steppe and Other Stories (translated by Ronald Hingley)
George Orwell, Down and Out in Paris and London
Otto F. A. Meinardus, Coptic Saints and Pilgrimages
Aleksandr Solzhenitsyn, One Day in the Life of Ivan Denisovich
R.W.B. Lewis, Dante: a life
Miles Glendinning and Aonghus MacKechnie, Scottish Architecture
Arturo P rez-Reverte, The Flanders Panel
John Chadwick, The Decipherment of Linear B (second edition)
Bart D. Ehrman, Lost Christianities: the battles for Scripture and the faiths we never knew
Plato, Timaeus and Critias (translated by Desmond Lee)
Albert Camus, The Outsider
Tim Wallace-Murphy and Marilyn Hopkins, Rosslyn: guardian of the secrets of the Holy Grail
Ginevra Lovatelli, Secret Rome
Dauvit Brown and Thomas Owen Clancy (editors), Spes Scotorum: Hope of Scots: Saint Columba, Iona and Scotland
Plato, Phaedrus and Letters VII and VIII (translated by Walter Hamilton)
William Chester Jordan, Europe in the High Middle Ages (The Penguin History of Europe)
J. M. Coetzee, Disgrace
Giovanni Boccaccio, Famous Women (translated by Virginia Brown)
Kazuo Ishiguro, An Artist of the Floating World
Georges Perec, A Void (translated by Gilbert Adair)
Saul Bellow, The Victim
Franz Kafka, The Trial
George Orwell, Nineteen Eighty-Four
J. K. Rowling, Harry Potter and the Half-Blood Prince
Francesco Colonna, Hypnerotomachia Poliphili: The Strife of Love in a Dream (translated by Joscelyn Godwin)
Italo Calvino, Our Ancestors (The Cloven Viscount; Baron in the Trees; The Non-Existent Knight) (translated by Archibald Colquhoun)
Eusebius, The History of the Church (translated by G. A. Williamson)
Flynt Leverett, Inheriting Syria: Bashar's trial by fire
Paul Auster, The New York Trilogy (City of Glass; Ghosts; The Locked Room)

Following up on my previous post, here's a new status update of the whole GNOME situation. Very soon after posting that roadmap, the two steps in the process were completed, with the ftpmasters freeing dbus into experimental, and seb128 doing a round of GTK+ family uploads. No big problems have been detected in GTK+ 2.8 in unstable, so those bits are going very well. As soon as dbus 0.60 hit experimental, both the KDE and GNOME camps got busy recompiling their stuff. KDE 3.5.0 moved from Alioth to experimental, and sjoerd got busy in a recompile quest to make sure GNOME was installable again in experimental. The dbus 0.60 transition in experimental was done in barely a few hours, and some extra dbus-using packages have been transitioning since then. So, what's holding our unstable upload? We first need to wait for KDE 3.4 enter testing, thus clearing the major blocker for the C++ ABI transition. The number of packages involved in this is so big it's not even funny, so it's quite complicated. In short, the GNOME team is sitting on their hands watching some C++ fun. There are a few more news bits though. Last night, there was a round of experimental updates, bringing most of the modules to their 2.12.2 versions (just 2 or 3 are missing now), and meta-gnome2 was again updated to support these versions. If you issue your usual aptitude install gnome-desktop-environment, you'll pull newer versions of most of the stuff, if that's the way you update your experimental packages. Also, the gnome package now supports gnome-screensaver. Give it a try, and be ready to purge xscreensaver if you're happy with it!

The GNOME team has been sitting on top of ready-to-go GNOME 2.12 for way too many weeks now, but unfortunately a series of planned and unplanned transitions affecting unstable prevented us from moving them from experimental to unstable. Today's good news is that these transitions are either going well (C++) or not at all (freetype upstream), so the release team gave us green light to start a fun GNOME 2.10 2.12 transition. There are a few aspects in this cycle that makes it a bit special and a bit more complex. GNOME 2.12 in experimental uses dbus 0.50, which is API/bus incompatible with the previous version in testing/unstable, so when we upload GNOME 2.12, the new dbus will go in too. As KDE is also using dbus in a few places, KDE and GNOME uploads will need to happen at the same time. To make it even better, dbus 0.50 has been obsoleted by 0.60, which is again API and bus incompatible with the previous version. The GNOME and KDE teams have agreed on the following plan:

1. The Project Utopia people have uploaded dbus 0.60 to experimental, and is currently waiting in NEW.
2. The mighty seb128 will upload GTK+ 2.8 and Pango 1.10 to unstable RSN, so our first version of GTK using Cairo starts to get broadly tested in architectures other than i386 and powerpc.
3. Once dbus 0.60 is accepted in the archive, the GNOME team will rush to recompile GNOME 2.12.2 against this new dbus, and test that everything is ok with the new version.
   At the same time, the KDE camp will upload their shiny KDE 3.5 debs, compiled too against dbus 0.60, to experimental, for the first time.
4. When everything has transitioned to dbus 0.60 in experimental, GNOME and KDE will be uploaded to unstable.
5. Vorlon will take a deep breath and will try to figure out how to get the two monsters in testing at the same time. Vorlon, we love you. :)

This looks like it'll take months to do, but I really don't think it'll be the case. We hope to be ready for a full GNOME 2.12 upload to unstable, at long last, pretty soon. As always, the brave can still use GNOME 2.12 in experimental with the usual aptitude -t experimental install gnome-desktop-environment. More updates as stuff happens!

This musical Russian roulette thing that's been going on lately in Planet Debian is not a new thing. It made rounds in the Finnish blog circles in the beginning of December. Here's my list (I made a twenty-song list, not just ten-song like most):

1. Jethro Tull - Acres Wild
2. Cliff Eidelman - Surrender for Peace (Star Trek VI soundtrack)
3. Miljoonasade - Paskanmarjat
4. Roxette - Fireworks
5. Verdi - Alfredo! Voi! (La Traviata)
6. Ultra Bra - Hei kuule Suomi
7. Cincinnati Pop Orchestra - Back to the Future theme
8. Johann Sebastian Bach - Blute nur, du liebes Herz (St. Matthew passion)
9. Verdi - Annina? (La Traviata)
10. Miljoonasade - Radiorakkautta
11. Pave Maijanen - Palava syd n
12. Nirvana - In Bloom
13. Albert Prefjean - Sous les toits de Paris
14. (unknown horrible synthesizer thing) - Thunderball (James Bond)
15. Sibelius - String Quartet D minor op. 56 "Voces intimae" I Andante - Allegro molto moderato
16. Emmi - No Nothing
17. The Kings of Convenience - The Girl from Back Then
18. Maija Vilkkumaa - Kristiina
19. Buddy Holly and the Crickets - Oh, Boy!
20. Buddy Holly and the Crickets - Valley of Tears

I spent the whole weekend looking for a DRM-encumbered Sony CD so that I could check for myself whether my code was really being redistributed without permission. I eventually found one: Suspicious Activity?, by The Bad Plus. A rather enjoyable post-modern jazz album. I am rather lucky, it could have been C line Dion. As expected, installing the CD s custom player also installed a stealth aries.sys driver along with a few other interesting files such as $sys$DRMServer.exe, all hidden in a $sys$filesystem directory. I rapidly got rid of this cruft and started studying the really important file, ECDPlayerControl.ocx. It is the file Sebastian Porst and Matti Nikki found to be containing parts of mpglib, LAME, faad2, VLC... Evidence that the DRMS code comes from VLC There are of course obvious similarities between some functions and structures of ECDPlayerControl.ocx and the ones in VLC s source. However, given how precise the implementation of a cryptographic protocol needs to be, the possibility that two separate implementations show many similarities must not be dismissed. The data structures and constant tables especially are likely to be identical. I think however that I found strong enough evidence that this is not the case here. The original drms.c was written by Jon on 01/05/04. I then hacked on that file on 01/18/04 and reorganised it, also replacing the reverse-engineered MD5 and AES functions with clean implementations, then Jon added DRMSv2 support on 05/05/04 and I reorganised the code again on 05/08/04. Some of these changes were specific to VLC (not in that they made the code unusable outside of VLC, but rather that they made it possible to use an external MD5 hash provider, for instance), so they were the bits I was looking for in ECDPlayerControl.ocx. For instance, Jon s original code had the following instruction:

p_acei[ 4 ] = 0x5476212A;

Since all bytes of this long word are comprised between 0x20 and 0x7f, it was later rewritten like this:

char p_secret1[] = "Tv!*";

This change makes the code more human-readable because many other secrets in the Apple DRMS protocol are ASCII strings. Also, I know how to look for binaries that use the string "Tv!*", but it takes me some more time to think of a way to find binaries that use 0x5476212A. And the Sony rootkit uses the following (only relevant lines shown):

 .text:100883B8   mov   cl, byte ptr ds:xxxxx+4 ; 0
 .text:100883C2   mov   eax, dword ptr ds:xxxxx ; "Tv!*"
 .text:100883C8   mov   [esp+70h+yyyyy], eax
 .text:100883DC   mov   [esp+7Ch+zzzzz], cl

The use of xxxxx+4 shows that ECDPlayerControl.ocx uses a string instead of a 32 bits integer to store the secret, disregarding the fact that the 5th character of the string (a null char) is never used. Another example: in this commit I reorganised the DoExtShuffle() function, merging FourthPass() and FifthPass() and discarding a structure allocated on the stack. What is important here is that DoExtShuffle() was built by a complex combination of choices, the main purpose of which being to reduce the size of the C functions:

 static void DoExtShuffle( uint32_t * p_bordel )
  
     uint32_t i_ret;
     i_ret = FirstPass( p_bordel );
     SecondPass( p_bordel, i_ret );
     ThirdPass( p_bordel );
     FourthPass( p_bordel );
  

Note how i_ret is not reused and could be merged into the p_bordel array, or maybe SecondPass() merged into FirstPass(). This choice is definitely a legacy of how the code evolved. And the Sony equivalent: a perfect match.

 .text:10089F3C xxxxx:
 .text:10089F3C   mov   ecx, esi
 .text:10089F3E   call  yyyyy
 .text:10089F43   push  eax
 .text:10089F44   mov   eax, esi
 .text:10089F46   call  zzzzz
 .text:10089F4B   add   esp, 4
 .text:10089F4E   call  ttttt
 .text:10089F53   call  uuuuu

After having studied the Sony code for a while, I have of course gathered dozens of such examples. But I also discovered a few new things. Where does the DRMS code come from? The code undoubtedly comes originally from VLC, but it has traveled a lot. I would be surpried if it came directly from VLC, as no other part of VLC is included with the rootkit. And although there are parts of FAAC in the Sony code and FAAC includes VLC s drms.c, the version currently in the FAAC CVS is horribly outdated. Sebastian Porst also noticed a few obvious differences between the Sony code and the version of drms.c present in VLC. The most obvious being this one:

 if( p_shuffle->i_version == 0x01000300 )
  
     DoExtShuffle( p_bordel );
  

Which became:

 .text:10089F2E   cmp   eax, 1000300h
 .text:10089F33   jz    short DoExtShuffle
 .text:10089F35   cmp   eax, 1000400h
 .text:10089F3A   jnz   short skip
 .text:10089F3C DoExtShuffle:
 .text:10089F3C   ...
 .text:10089F58 skip:
 .text:10089F58   ...

That 0x01000400 is a version check for 4th generation iPods firmwares. I also discovered at least 40 KB of new lookup tables that seem to be used for more buffer shuffling. At first I thought it was simply F4I s DRM implementation, but the shuffling calls are nested with iPod hardware information retrieval from our DRMS code, so they re really part of drms.c. Sony distributing a DRMSv3 descrambler? The only explanation I can think of is that someone took the VLC code, added support for an upcoming Apple DRMS format version and redistributed the software without letting the VLC authors know, probably violating the GPL (I only say that because I have not found the software yet, but I feel pretty safe in saying it). Since it is based on GPL software, I was already entitled to ask Sony for the source code of ECDPlayerControl.ocx. But as the copyright holder of a significant part of the software they counterfeited, maybe I have a greater chance of being heard. Not that it would be difficult to reverse-engineer it yet another time, but it would be awesome if the next opensource iTunes Music Store file player was contributed by Sony!

Two Sundays ago, Jim and I walked down to Ubuntu Love Day. The Ubuntu Below Zero conference is being held at the Holiday Inn in Chinatown. That's the one with the fake Chinese tiles on the roof, which is sort of tacky. We found our way downstairs to the conference room and sat down. The previous night's revelries still had quite the effect, so I'm afraid I drifted in and out while listening to people speak. I thought I had rid myself of this habit, but apparently university has trained me to consider digital projectors as sleeping aids. I'll have to do something about this one day. I got to see some fairly interesting people: Mattias Klaus, whom I met earlier at Jeff Bailey's place; Fabio Di Nitto, who is incredibly jolly; Chris Peterman, who was with his classmates from Clarkson; Colin Watson, whom I thanked for working so hard on Debian; Jeff Waugh, who dressed up as an inmate; and plenty of others. Oh, I managed to meet Andrew Mitchell in person, but we failed to have a proper CHUG meeting while we were all in town. We broke for lunch, which was held in the hotel restaurant. A buffet, with some Chinese-style dishes, was being served. There, we had to negotiate with the unilingual (Cantonese) staff to find out what Jeff could eat. We had a special order of plain white rice brought for him and we were informed that it was safe for him to eat the stir-fried vegetables. I suggested to Jeff that he ought to keep a phrasebook on him whenever he travels. On each page, one per language, there should be a written description of what he can and cannot eat. Then, he just has to show this to waiters who don't speak English or French. For reference, the characters that mean "vegetarian" in Chinese are and . Most of the time, they mean "vegan", but there are some places where eggs and oysters are considered vegetarian. After lunch, Mark Shuttleworth gave Jeff a very nice birthday speech. He also gave Jeff a nice bottle of wine, which was very nice. And Matthias came up to give Jeff a bottle of fish-oil pills, which was very odd. Then, there were two Birds Of a Feather sessions, involving how to make an Ubuntu package and how to be an Ubuntu advocate. Being upstream to both these issues, I sat in the middle of the room and listened to both presentations at once. This was quite interesting, and slightly taxing. After this was done, we broke up once more. The plan for the evening was to meet for dinner in the hotel lobby. This transformed to meeting outside the front door. Jim, wlach, and I showed up and were greeted by this mass of people. Since there were stragglers and I knew where dinner was to be held, Jeff took a group of nineteen people in the metro. I followed about ten minutes later with a group of eighteen. We met up on St-Denis, and by this time we had lost some of the more impatient, and more hungry, people. Eventually, a group of twenty-three were milling about outside Le Nil Bleu. Angie had made arrangements for us to be served a set meal, and they had agreed to seat twenty-five of us. I went inside to let the staff know that we had arrived. When 20:30 came around, we were let into the restaurant and seated. I think the kitchen was still preparing food, because we had to wait about an hour before being served. Unlike my previous experience there with Jeff, the food was quite good this time and the service was very attentive. We enjoyed ourselves very much, and Jeff seemed to be having a very excellent birthday dinner. Some of the guests were not so happy, because the food was a little spicy for their European palates. Since gratuities are not standardised around the world, we discovered that some people had not tipped. To cover the embarassment, Angie and I made sure that the wait-staff were adequately compensated for their efforts. I'll be sure to go back to this restaurant again, but with a more significant crowd to ensure good service. After eating, a group of us including Matthias and Tollef went up to B l K , which was just a little north on Mont-Royal. That's a really interesting bar with beautiful tiled floors and ostrich heads on the walls. We enjoyed the lovely music, had a very good conversation there, and laughed until we were all exhausted. Since the Canonical people had to be awake for the 09:00 keynote speech the next day, they left early. Jim and I bid goodnight to them before we staggered home.