Search Results: "rul"

7 May 2007

David Welton: Google Apps + Domain Registration

I'm impressed. Via Google Apps, I was able to register a domain (squeezedbooks.com - nothing there yet, though) for $10. But it's not just a domain, it comes with email, google calendar, and a bunch of the other google apps thrown in for free. That's a lot of stuff for ten bucks - especially for the large portions of the world where the currencies are appreciating against the dollar. The service does have some drawbacks though.

6 May 2007

Russell Coker: permalinks in wordpress, Apache redirection, and other blog stuff

When I first put my new blog online I didn’t think to set the custom permalinks option to avoid having /index.php in all URLs (which wastes a few bytes and looks nasty). So I decided to change to better URLs but unfortunately many people have already bookmarked the bad URLs. I wanted to give a HTTP 301 redirection when someone uses the old index.php version (so that bookmarks get updated) and then redirect to the PHP file. Unfortunately having a redirection from ^/index.php to a version without it and then a local rewrite to include index.php again doesn’t seem to work (any advice would be appreciated). So I put the following in my /etc/wordpress/htaccess file (the location for such things in Debian) so that foo.php is used instead where foo.php is a sym-link to index.php. I’m wondering whether I should file a bug report against the Debian package requesting that a sym-link be in the package to facilitate such things - if it’s not possible to do what I desire without the symlink.
RewriteEngine On
RewriteBase /
#RewriteCond % REQUEST_URI  ^/index.php/?(.*$) [NC]
#RewriteRule . /%1 [R=301,L]
RewriteCond % REQUEST_FILENAME  !-f
RewriteCond % REQUEST_FILENAME  !-d
#RewriteRule . /foo.php%1 [L]
RewriteRule . /index.php%1 [L]
Update: I am now using the permalink-redirect plugin (thanks for the tip Method) which solves the problem of the obsolete URLs as well as solving the problem of having two representations of the URL (with and without a trailing slash). I have updated the above htaccess file sample to reflect my new configuration (with the old settings commented out for the benefit of people who don’t want the permalink-redirect plugin). The way Wordpress allows the table prefix to be stored in the MySQL configuration section is very handy. Some time ago I asked for advice on a blog server for multiple users and Wordpress-MU was recommended, but it seems that for most situations where you want multiple blogs the non-MU version of Wordpress will do the job. It seems that the main benefit of Wordpress-MU is that setting up multiple blogs doesn’t require running shell scripts, which for the cases I’m most interested in doesn’t compete with the benefit that the non-MU version has of being packaged in Debian. On the topic of Wordpress in Debian, it’s a pity that none of the plugins are packaged in Debian. I plan to create a repository for plugins and themes that I use if no-one else has started such a repository. I believe that a repository of Debian packages for such things will provide significant benefits to users, including updates for security reasons and having plugins that are known to work (some of the plugins appear to only work on Windows). Also there are a few issues that I would like to improve in Wordpress. One is that the Uncategorised category is selected by default so if I select another category and forget to de-select Uncategorised then it’s a little confusing. Another is that the categories are displayed in the side-bar without mentioning the number of matching posts. The way blogger lists the number of posts per category (and sorts the categories in order) is much more convenient. Also another advantage of blogger is the handling of archives where you can click on a month to see a list of the names of all posts in that month. I’m not about to go back, but it would be nice to have those features. Does anyone have any ideas how to solve these problems?

4 May 2007

Gon ri Le Bouder: Svn Build stat

During the last two week I improved the status package for the Debian Game Team. I rewrote it from scratch with mod_perl + Catalyst. It uses a database to store the build reports and It’s able to build packages from more than one repository. It can also use other computers as build host. But there is still tone of things to improve and this is a short TODO list : http://nana.rulezlan.org/svnbuildstat/. Thanks : Glandium for the bug graphs, Rapha l Semeteys and Walid Nouh for there build hosts and the mentors.debian.net guys for the CSS :).

2 May 2007

Cameron Dale: May-02-2007

Well it's been a busy week. Work is truly underway, as I have just about finished the first release of debtorrent. The first step in the process, adding variable-sized pieces the size of each file, has been completed and seems to work properly. I've tested it using a single seed, and with 3 downloaders. All were able to contact each other, and all downloaded the entire archive successfully. The archive I tested it on was stable/contrib/i386, as it is only 112MB. There's just a few more modifications to make to polish the code, and then the 0.1.0 version of debtorrent should be released in the next week. It would be out already, but I've been plagued with a cold for the last week. I had a lengthy discussion with Anthony about the eventual need for some modifications to the apt-ftparchive program to support some of the proposed advanced debtorrent functionality. More investigation is needed on the implications of these changes, which will probably require larger Packages/Release files to be generated, and some extra computation time. To collect information about these changes and their implications, I've created a new wiki page.

1 May 2007

Miriam Ruiz: Debian multiple binary packages: example

I remember that when I started making Debian packages, one of the things I found more difficult was to get information about how multiple binary packages should be done. It’s quite an important topic when packaging games, as most of games often consist of a small arch-dependent binary executable and a big bunch of arch-independent data that includes images, maps, models, textures, sound, music, fonts and so on. I order to make it Debian-mirror-friendly, there’s no sense in multiplying all this arch-independent data by the number of architectures in Debian, and thus, most of the games shall be packaged as a small arch-dependent (any) package that includes the game itself, and a bigger arch-independent (all) one with all the data. I’ve made a small hello-world example to ilustrate how to achieve that. The example uses autotools (1, 2, 3) for building, and consists of a small program that reads an arch-independent text file and prints it to the screen. Small enough to be a nice example, and with all the features needed to show what i mean to. I won’t comment it in detail right now, but what rules do is to build the program with the default building system (./configure && make), install it in debian/tmp (make install DESTDIR= pwd /debian/tmp), and afterwards installing the files in their proper binary package directory. The resulting packages are described in debian/control. The example also includes menu and desktop descriptions and how to install an icon. We should still find a way to avoid having to release a newer version of the data (usually much bigger in size than the code) when only a change in the code is done, but I doubt if there’s a global solution for that, or if it should be done in an individual per-package way.
Files:

27 April 2007

Biella Coleman: Eugenics and Sterilization in Alberta 35 Years Later

Eugenics is considered to be a technology and social practice of the past, swept away in our closest of all things ugly and bad. But the past is, in fact, quite recent, especially in the Alberta region in so far as forced sterilization was only outlawed in 1972–yes 1972. If your physical body is here in Edmonton and are interested in the ways in which science and technology can has been placed on a truly “mad path” in the name of progress and how we are in danger of repeating the past via new genetic technologies, do check out this conference Eugenics and Sterilization in Alberta
35 Years Later
. Free and open to the public, it kicks off tonight and continues all day tomorrow. The line-up of speakers is great and most important is that it includes talks by some of those who were caught by the very unfortunate web of eugenic laws.

John Goerzen: Online Internet Bank Review

Back in mid-2000, I set up my first Internet bank account. I have been using the same bank ever since. The whole notion of Internet banks has changed a lot since then, since virtually every bank offers varying degrees of online access these days. Lately I checked on banks to see if I was still using the best one. Here are my reviews of the two banks.

Internet Banks

Let's first talk about what makes a bank an "Internet bank" or "online bank". So many banks let you manage your account online now, that the distinction is blurry. But generally, I would say that unique features of Internet banks are:



There are a few to highlight.

Real-time transaction posting is a great thing to have. If you go to the website and transfer money from your savings to your checking account, you can go to the ATM *now* and withdraw it, and when you get back to your desk, the ATM transaction shows up. There are none of these confusing "business day" rules with cutoff times that traditional banks seem to love. And none of this annoying "process all withdrawals first" business that large traditional banks (hello, Bank of America) love to do in order to screw with customers.

High interest rates. Don't even bother with an online bank if the savings interest rate is less than 3% (or checking less than 1%, in my opinion). It is almost impossible to find a traditional bank with these rates.

Note: if you're reading this after April, 2007, these guidelines may no longer apply due to interest rate changes.

Electronic transfers from other banks. Another great feature. A number of banks let you set up, and then initiate, electronic transfers to and from your accounts at other banks. This is usually free if you are using the feature to transfer money into your account, and with a flat per-transaction fee (usually about the same as a foreign ATM fee) for transferring money out.

Ability to do all business without visiting a branch. Not only should this be possible, but routine business (such as making deposits) should be easy to do without visiting a branch. You should be able to order new checks online.

Now let's look at the individual banks.

First Internet Bank of Indiana

FirstIB (they provide nationwide service, despite the name) is the bank I signed up with in 2000. I had found a bank in Dallas that I really liked, but when I moved to Indianapolis, I tried two and liked neither. They all seemed to have really poor interest rates, offer few useful services, and fees for so many conditions that it was hard to avoid them. (More on that in the traditional banks section below)

I looked at the online banking scene at the time, and wound up opening a checking and savings account with FirstIB. FirstIB started as an online-only bank, but recently acquired a bricks-and-mortar bank as well.

I found FirstIB's customer service at the time to be top-notch; I would dial their toll-free number, select *one* option from a menu, and a rep would answer *immediately*. (Take that, Bank of America, with your 45-minute hold times...) Since FirstIB was based in Indianapolis, I actually visited their offices a couple of times. They had a locked lobby. You picked up a phone, pressed 0, and went into the same queue that callers to the 800 number did, then just asked them to come to the lobby and transact your business. (They would not give out cash there, but could take new account paperwork and deposits and the like)

Their interest rates have consistently outperformed traditional banks, and they offer all the online banking amenities listed above. They did not offer online statements at first, but these days online statements are the norm (there is a fee if you want paper statements). Check ordering is accomplished using a linking with the Deluxe check printers. The web interface uses Digital Insight, and the ACH transfer interface uses CashEdge.

FirstIB will actually reimburse you, at the end of the month, for ATM fees that other banks charge you, up to $6/mo. They also provide an unlimited supply of free postage-paid deposit envelopes, and have a PDF of deposit slips that you can print out should you run out.

FirstIB's customer service has slipped in recent times. I know of some people that have been impacted by some errors that FirstIB has made (simply not processing paperwork that they should have processed). Wait times have gone up for the phone line, and a lot of the great "small bank" feel (where they actually knew their customers, and you might actually know the reps) is gone.

Presidential Bank, FSB

Presidential Bank is the bank I'm looking at now. I was initially drawn to them by their extraordinarly high interest rates (5.25% for savings!), but some other things have convinced me to use them.

Initially, I was suspicious. Presidential is a bricks-and-mortar operation that has been around for awhile, and was one of the very first Internet banks. Their website says that they started offering Internet accounts in 1995, and very much looks like it hasn't been updated since. (Thankfully, the account management interface is more modern). I almost thought the site was a fraud up front, a "too good to be true" deal with the high interest rates and bad-looking website. But after doing some research, realized that it is quite real.

Before setting up accounts with them, I had a few questions (such as whether or not transactions post in real time). Presidential has a simple email address for people that want to send in questions (unlike FirstIB's obvious queue system). I sent an email, and got a response an hour or two later, from a real person with a first and last name, and a personal e-mail address I could use to follow up. Nice. I also had occasion to talk to people on the phone. They were polite, speedy, and helpful.

So I set up my accounts with them. I activated the online access, bill payment, and money transfer features. All worked as expected. I did have a couple more occasions to call them after the account was set up (a more crucial test than the pre-account calls), and they remained helpful. Strangely, this bank, which seems to be a much larger operation than FirstIB, had a more small bank feel. Several times, as I started talking to a rep, he or she would say something like "Oh, I remember processing the setup paperwork on this account last week" or "I think I talked to you about this before?"

Customer service is one of those things you rarely need after the first month or so of an account. But with your bank, it is vital that the reps know what they are doing and are willing to help you when you call -- which Presidential is doing better than FirstIB these days.

Presidential does not rebate ATM fees like FirstIB does. They do provide a few deposit envelopes with your initial account setup packet, but they are not postage paid or unlimited. However, because Presidential's interest rates are so much better than FirstIB's, it doesn't take much in your account to more than balance out that difference. Plus, with so many retail stores offering "cash back" when you use an ATM or debit card, it isn't too bad to get cash for free with Presidential. (And, most employers offer direct deposit, so we rarely use deposit-by-mail) One other trick is to find some local bank and open a no-minimum free checking account with them. You can deposit checks there and withdraw cash from their ATM, and use Presidential's free incoming ACH to electronically transfer the funds to Presidential when you get too much in the local account. (Chances are that these local accounts will not pay any interest)

Presidential offers a few features FirstIB does not. First, they scan all your deposits (not just your canceled checks) and offer to let you view them online. Secondly, they automatically send you an email when they've received a bank-by-mail deposit (you can opt out of that, of course). Third, they let you view *all* of your old statements online (FirstIB only lets you view the last 6 months worth, though both have the complete history available in the web interface).

Like FirstIB, Presidential uses DigitalInsight for the web interface and CashEdge for the ACH feature.

Internet Bank Comparison Both banks offer two primary checking and two primary savings accounts. This table compares all four accounts.

FeatureCheckingSavings
FirstIBPresidentialFirstIBPresidential
AccountInterestFreeInternet PlusInternetMoney MktRegPremierInternet
APY1.26%0%4.50%1.25%3.90%2.75%5.25%1.50-2.50%
Min Balance$500$0$1000$500$4000$1000$0$100
Min MethodAvg DailyDailyAvg DailyDaily
Min to Open$100$25$1500$500$100$100$5000$100
Online Bill Pay$0$4.95/mo$0$5.95/mo (up to 10 payments)Not available
ATM surchage rebate$6$0$0$0
Online Canceled Check ImagesFreeN/A
Online Deposit ImagesNoFreeNoFree
Email Deposit NotificationsNoFreeNoFree
Email Balance AlertsFree
ACH policyFree when initiated at other end; free for deposits when initiated at the bank's website; small fee for withdrawals when initiated at bank's website




Online options at traditional banks

As I mentioned, Presidential is a traditional bank that has offered Internet accounts for some time now. Some other traditional banks do that as well, but look carefully at them, especially if they're a big nationwide bank.

I looked at options from Bank of America, Citibank, HSBC USA, ETrade Bank, and some other large national banks. In general, these were just regular bank accounts with a web interface (HSBC and ETrade being somewhat of exceptions). Read the fine print and you'll find poor interest rates and traditional banking hassles (lack of immediacy in transactions, predatory posting practices, fees for just about everything).

Plus I can tell from personal experience that Bank of America customer service is downright awful. One example: they used to pressure me to open a credit card with them every time I visited a branch. I declined every time, and had to be forceful about it sometimes. Then one day, not long after a visit with a particularly annoying employee, I got a Bank of America credit card -- which I had specifically refused -- in the mail. Hmmmmmm.

They also, unlike any other bank I've ever used, charged a fee to receive wire transfers. Which they had not disclosed. Then, of course, they apply withdrawals before deposits, and caused an overdraft from the undisclosed fee, even though the wire transfer was a *deposit* that would have very easily covered it. That was the last straw for me. After nearly an hour on the phone with them, I got them to agree to reverse both the fee and the overdraft charge. THEN I said I wanted to close my account.

When traditional banks are better

There are a few situations where Internet banks don't work out so well:

Living paycheck to paycheck. If you are constantly running out of money, and it is vital that any deposits get posted *NOW*, you probably don't want an Internet bank (and wouldn't benefit from their higher interest anyway). When you mail in a check, it can take some time before you have access to the money; the postal service has to deliver it, and then most of your checks will be subject to the "non-local" availability policy and held for about a week (though interest will start to accrue immediately).

Not being able to meet minimum balances. Internet banks do tend to offer a variety of accounts, but if you aren't able to regularly maintain $500 to $1000 in your checking account or $2000 to $5000 in your savings, you will likely fall into a category with lower interest and fewer free benefits. These accounts may not have many benefits over traditional banks, and may in fact be worse in some ways. The interest rate gap won't make that much of a difference either. There are several online banks that offer savings accounts only, with high interest rates and low minimums, that you may want to investigate -- though you will have availability into your checking account measured in days, not seconds. Presidential's savings has no minimum, but requires $5000 to open. (They do have lower-interest savings accounts without that requirement) Watch out for FirstIB's accounts; you can open an account with less than the monthly minimum balance, and will run into fees unless you deposit enough to meet the minimums.

26 April 2007

Miriam Ruiz: Debian packages for Gnash

As it’s quite predictable that we’ll have a newer version of Gnash in one or two months, I’ve created a newer experimental set of packages from the CVS, so that everything is ready when the release comes out. There is really much more to do before they’re in a decent state, mainly making them work out-of-the box for Konqueror, and decide how to handle the shared objects that are being built right now. The plugin for iceweasel works out-of-the-box for me. Do not expect a stable program for the moment anyway, it’s still under heavy development. I’ve been reported some more bugs about these packages anyway, so be careful with them. Chipi has built the packages for amd64 for me, so if you want them, they’re available online. According to one of the developers: “gnash should not have shared objects, they have been enabled again recently to allow builds on Darwin, altought I think we should disable them again”, so I think that matter about shared objects is likely to be solved soon. As it is right now, I’m pretty sure it wouldn’t be compliant with The Policy. As there’s no API for gnash yet, it doesn’t really make sense to create a -dev package for the moment, even though there seem to be some demand for it. Somewhere in the future we will likely have one. For those who want to experiment with later versions, I’m using SVN for handling the packaging, so it’s quite easy to create some really extreme latest version of the packages: svn co svn://svn.debian.org/svn/pkg-flash/packages/gnash/trunk/ latest-gnash
cd latest-gnash
fakeroot debian/rules get-orig-source
cd gnash-0.7.2+cvs*.????
dpkg-buildpackage -rfakeroot

Axel Beckert: FTP and port 80?

Hmmm, I never thought that a URL could look some kind of schizophrenic or paradox, but this one truly does: ftp://ftp.port80.se/. (Found in ftp://ftp.*.debian.org/debian/README.non-US.)

25 April 2007

Marc 'Zugschlus' Haber: Automatic Wikification of Configuration Files

In the company I work for, most documentation is maintained in Word format. Except mine. I have a dokuwiki and am thankfully allowed this exception as I am the only Linuxer in the company. Since Windows systems need external documentation (being hindered by the absence of commentable text configuration files), there is a policy that all configuration data needs to be explicitly documented. I hate that idea, since documentation is always outdated, and documenting configuration changes doubles the work that needs to be done. After finding out that dokuwiki has a command line interface, I implemented a mechanism that can run from cron and keeps wiki pages of configuration files up to date on an automated basis. On the target systems (the ones that need to have their configuration documented), I installed a script which generates a tarball containing the relevant configuration files on standard output. For more sensitive data, the script could do some basic sanitazion such as removing passwords from the configuration files before putting them into the tarball. On the system running the cron job, the following script runs:
#!/bin/bash
set -e
set -C
set -u
JOBNAME=“update-wiki-firewall-config”
DWPAGE=“php4 /usr/share/dokuwiki/bin/dwpage.php”
TMPBASE=“/tmp”
SSHID=“$HOME/.ssh/$USER-passphraseless-$(hostname)”
REMOTEHOST=“remote.fqdn.example”
REMOTEJOB=“pull-netfilter-init-config-tar”
SHAREDIR=“$HOME/share/$JOBNAME”
WIKINAMESPACE=“pointer:to:namespace”
start=’/*BEGIN generated firewall rules */’
end=’/*END generated firewall rules */’
insert=’/*INSERT generated firewall rules */’
umask 077
if ! TMPDIR=“$(mktemp -d $TMPBASE/fwconfig.XXXXXXXXXX)”; then
        echo >&2 “ERR: cannot create temp dir in $TMPBASE”
        exit 1
fi
cd $TMPDIR
mkdir remote
ssh -i $SSHID root@$REMOTEHOST $REMOTEJOB   \
 tar --extract --gzip --file - --directory remote
mkdir workdir
touch workdir/rulelistfile
echo “$start” >> workdir/rulelistfile
for fwfile in $(find $TMPDIR/remote/rules/up -type f   sort); do
  MTIME=“$(stat --format=”%y“ $fwfile)”
  PROSEEXPLANATION="$( $fwfile sed -n '/^#::#/ s/^#::#[[:space:]]*//;p;q; ')"
  if [ -z "$PROSEEXPLANATION" ]; then
    PROSEEXPLANATION="netfilter-init internal code"
  fi
  rm -f workdir/newwikipage
   $SHAREDIR/wikipagetemplate \
    sed \
        -e "s PLHfilenamePLH $(basename $fwfile) " \
        -e "s PLHproseexplanationPLH $PROSEEXPLANATION " \
        -e "s PLHmtimePLH $MTIME " \
        -e "/PLHcontentsPLH/r$fwfile" \
        -e "s/PLHcontentsPLH//" \
  > workdir/newwikipage
  WIKIPAGENAME=“$WIKINAMESPACE:regeln:$(basename $fwfile .rul)”
  $DWPAGE checkout $WIKIPAGENAME workdir/wikipage
  if ! cmp --quiet workdir/wikipage workdir/newwikipage; then
    cp workdir/newwikipage workdir/wikipage
    $DWPAGE -m “new contents imported from $fwfile” commit workdir/wikipage $WIKIPAGENAME
  fi
  echo “  * [[$WIKIPAGENAME $(basename $fwfile)]] - $PROSEEXPLANATION” >> workdir/rulelistfile
done
echo “$end” >> workdir/rulelistfile
$DWPAGE checkout $WIKINAMESPACE workdir/contentspage.txt
 workdir/contentspage.txt \
  sed -e "\ ^$ start//\\*/\\* \$ ,\ ^$ end//\\*/\\* \$ d; "   \
  sed -e "\ ^$ insert//\\*/\\* \$ rworkdir/rulelistfile" \
  > workdir/newcontentspage.txt
if ! cmp --quiet workdir/contentspage.txt workdir/newcontentspage.txt; then
  cp workdir/newcontentspage.txt workdir/contentspage.txt
  $DWPAGE -m “new contents page” commit workdir/contentspage.txt $WIKINAMESPACE
fi
cd /
rm -rf “$TMPDIR”
Yes, this needs some more documentation and generalization. But it’s just a proof of concept that needs some polishing before being put into real life use. Here are the two template files for wiki page and contents page:
====== Firewallregeln PLHfilenamePLH ======
Last changed on target system: PLHmtimePLH
PLHproseexplanationPLH
<code>
PLHcontentsPLH
</code>
===== Dump of firewall rules =====
/*INSERT generated firewall rules */
/*BEGIN generated firewall rules */
/*END generated firewall rules */
The index page template relys on the HiddenComment dokuwiki plugin to be installed, or the placeholders show up in the rendered wiki page. The code uses the first comment line marked with #::# to generate a short explanation of the file being pulled into the wiki. dwpage.php is a fully-fledged command line interface to dokuwiki, committed new pages are fulled versioned as if entered through the wiki web front end. This way, the documentation in the wiki is guaranteed to be current and to fit the configuration found on the live system - it is directly pulled from the live system. Yes, rendering of the code is currently suboptimal. Working on it.

23 April 2007

Erich Schubert: SELinux and object orientation

In a previous post, I claimed that SELinux uses a kind of object-oriented approach, and that this has several advantages over path name based access.Since SELinux policy isn't actually a 'program', the term is somewhat surprising. It's just one fragement of "object oriented programming" that is available in SELinux, and actually a rather simple fragment. Also it's not how it's evaluated; but the OOP 'design pattern' of 'classes' is somewhat present in the SELinux reference policy. The syntax is kind of twisted, too.Let me give you a simple example policy fragment:
type mylog_t;
logging_log_file(mylog_t)
This fragment defines a new type, and 'inherits' from the 'log_file' class. (you can think of "logging_log_file" as com.tresys.oss.refpolicy.system.logging.log_file if you are a Java freak)The logging_log_file 'class' (which technically is a M4 macro, and maps to the SELinux 'typeattribute' 'logfile' - this would be called an abstract class in other programming languages) in turn will make mylog_t also be a "file_type" type attribute.So above line means that the new mylog_t type will 'inherit' certain access rules. Namely those defined via the logfile type attribute or file_type.This means that I can write policy to grant access on "any file" (e.g. for security scanners such as 'samhain' or the SELinux relabeling utilities, backup application, etc.) or just to any log files (e.g. for logrotate). Independend of where they live or who wrote the policy for them.So if I write policy for a custom application, add mylog_t for files living somewhere in /home/myapp/logs, I don't need to modify the logrotate policy, because that policy contains:
logging_manage_all_logs(logrotate_t)
(You can again think of this as logrotate being derived from a "log file manager" class, though it's implemented differently this time. Also note that multiple inheritance is no problem in SELinux policy)Macro names in the reference policy usually start with a namespace prefix. In this example, it's logging_. Since it uses M4 for processing the files, the syntax is largely determined by what is easy to use in M4.

19 April 2007

Adam Rosi-Kessel: Adam s Super Simple Guide to mbox->maildir conversion

There are a lot of pages out there explaining how to convert your mail from mbox to maildir. I’m going to add one more, resurrecting the “tips” section of my blog. (All the tips from my blosxom days are grouped together on one page — someday I’ll get around to breaking those up properly.) If nothing else, I’ll never have to write these instructions in an email to someone again, instead I’ll just send them the link to this entry. I hope these steps are specific enough so anyone savvy enough to even have this problem in the first place will be able to follow them. One thing I find consistently concerns people when converting to maildir is how to make sure no mail is lost in the transition. The steps below address that concern. It’s really not hard at all once you understand how maildir works. First, I’m assuming you have mb2md installed and procmail support. Also, if you plan to access your mail through IMAP, your IMAP server needs to know to use ~/Maildir if ~/Mail does not exist. This is often default behavior (at least it is for Dovecot). Finally, I assume that your inbox is in /var/mail/username, and your other mail folders are in ~/mail. So, here goes:
  1. Edit your .procmailrc. The first two lines should read:
    MAILDIR=$HOME/Maildir
    DEFAULT=$MAILDIR/

    This will cause all new mail to be delivered (after you save your .procmailrc) to be stored in maildir format under ~/Maildir. The key for procmail to know to use the maildir format is the trailing slash in the “DEFAULT” line. Note that under the new system, your inbox and all your folders are kept in ~/Maildir, rather than having an inbox in /var/mail and your folders under your home directory. (This is nice because it makes it easier to back up all your mail together, among other things).
  2. If you have any specific procmail rules in your .procmailrc, you’ll also need to change the target folders for that. For example, if you have a spam filtering rule like this:
    :0 H
    * ^X-Spam-Level: *****
    spam
    It needs to be changed to this:

    :0 H
    * ^X-Spam-Level: *****
    .spam/

    The trailing slash, again, tells procmail to use maildir rather mbox format for delivery. The leading dot will make the folder appear properly for your IMAP client (there’s a trick I suggest below for making “dot” folders easy to access with a command line client like mutt).
If you have mail being delivered to a nested mail folder, an additional change is needed because maildir has a flat hierarchy. So if your mail was being delivered to “misc/other/spam” the new target should be “.misc.other.spam/”.
  • Save your .procmailrc. From this point forward, all mail will be delivered to your maildir folders. You can now import all your old mail to the new folders without concern. Since maildir stores each individual message as a separate unique file, you don’t need to worry about any overwriting issues while you are making the transition. New mail will be delivered to newly named files; old mail will be imported to other, unique, newly named files.
  • Import your mail folders:
    mb2md -s ~/mail -R
    The -R just means to import recursively through all your folders; if your mail folder is Mail rather than mail, use that instead. No destination is needed because mb2md uses ~/Maildir by default.
  • Import your inbox:
    mb2md -m
  • Move your old inbox out of the way. Most people won’t actually be able to move or delete files in /var/mail (since they don’t have directory write privileges), so the easiest thing is probably to just open the inbox in your IMAP client or with mutt and save or delete all the messages.
  • Move your old mail folder out of the way:mv ~/mail ,.bak Once you’ve confirmed that everything is okay, you should be able to delete ~/mail.bak (or compress it and move it elsewhere.) If you saved your inbox to mail folder in step 6, that will get moved out of the way here as well.
  • That’s it, you’re done.
  • Okay, so you’re not quite done if you access your mail with mutt rather than an IMAP client. (You could just point your mutt at your local IMAP server, of course). I’ve found the most convenient way to access the “dot” folders with mutt is to create a parallel symlinked folder structure without the dots. Here’s a hacked-together shell script that will do that. This could obviously be rewritten to be much more elegant (probably in perl). But we all have our messy scripts, right?

    #!/bin/bash
  • cd ~/Maildir for x in .*
    do
    y=$ x##.
    if ( echo $y grep -q ‘.’ )
    then
    mkdir -p ~/mymail/$ y%.*
    fi
    ln -s ~/Maildir/$x ~/mymail/ echo $y sed “s/.///g”
    done for x in *
    do
    ln -s ~/Maildir/$x ~/mymail
    done
    Then, just add these lines to your .muttrc file:
    set folder="~/mymail"
    set spoolfile=”~/mymail”
    Any questions?

    17 April 2007

    Gunnar Wolf: Init followup

    First of all, sorry for the delay. Leaving just as the discussion gets started is bad, yes... But I'm only now reading Erich's and Sven's follow-ups. Both (as well as some comments in my blog) ask why not integrating the startup links in each of the packages - Well, basically because I don't think that most maintainers will take care to do this, and we will end up having a situation very close to what we have today: If I'm not interested in supporting your favorite init system in my packages, I just won't bother to make the scripts.
    Note: I'm going into braindump mode. Verbose blabber and some stupidity might follow ;-)
    Think on the webapp scene - Most webapps ship with an Apache-like snippet so that http://yourserver/thisapp just works(tm). I love that, and it's one of the little details that make Debian shine - Things usually work with the least administrator burden possible. But it happens that there are other web servers around there - They just become somehow second class citizens (I happen to sponsor/comaintain Cherokee, for instance), as nobody cares to include the equivalent snippets for them. Apache is the standard, and is good enough.
    The same goes for sysv-rc: It just rules the world. Who will work all the needed patches to support all the different init systems? As the maintainer for a simple package which requires to be started up, I probably won't care to even understand all the intimacies of every init system, at least until they all have a decent user base. But by having one package per (server,init-scheme) pair, any maintainer can come up with the needed initialization.
    Of course, this degrades quickly. First of all, as a user: if mydaemon is not correctly starting up, I will probably file bugs at mydaemon, not at mydaemon-initscheme. If mydaemon changes its parameters, we will witness transition of mydaemon-*.
    Further, remember this is Debian, and volunteer-work has its downsides. If the mydaemon maintainer is a primadonna (or just does not give a flying crap about the runit init scheme), he will just trash reports regarding a nonimportant init scheme. Bad. And, as Erich points out, we have ~1000 packages including /etc/init.d/something - It will mean 3000 or so packages for a decent (not complete!) coverage of the different schemes. And, of course, a very uncoordinated way of working. But back to my line of thought: If I'm promoting an init scheme, I cannot just push it down each maintainer's throat. I must include at least the most important init scripts somewhere. Maybe we could just group daemons by task, and then have -say- a webservers-runit package providing the init scripts for each webserver for runit? This could cut down from 3000 to some 100 packages, most probably team-maintained... But it still faces many scalability problems, and the bug-filled-somewhere-else problem seems unavoidable.
    I think something interesting could come off Sven's idea of providing several independent scripts instead of today's complete init scripts - This would make it easier to adapt startup/shutdown and similar events to different world views, and if not specifically needed, most init scripts could even be autogenerated calling the right bits here and there. That would rock - except in the corner cases (I predict no less than 10% of the packages will become corner cases ;-) ) where it will crumble apart. But maybe if a package declares it should be autostarted and provides the separate bits, the sysv-rc, upstart or runit helper can come up with an autobuilt initscript (or equivalent) - And if it does not work, it can always be overriden by a maintainer- (or user-) supplied, explicitly built script. Humh...
    The topic surely calls for a Debcamp session, as Joachim says in comments in two of our posts and Erich acknowledges. Erich, as the main instigator of this blog series, I hope you can at least join via Ekiga or such, as it can be quite interesting - But, yes, none of the people involved so far participates in any of the inits' maintenance... Anyway, please keep the ideas flowing. I want to sketch something up, as I feel this can be useful - and not only for initscripts, but for many of the areas where Debian provides several ways to do the same thing. And, once again, that's one of the best points of Debian for me.

    Jan Wagner: Got Hardware Donation

    Last weekend I got a hardware donation from muempf. It’s a new 1U server with the following specs:
    Supermicro P8SCi Systemboard
    Intel P4 3.00GHz
    2x 512 MB DDR2 533MHz unbuffered ECC Systemmemory
    2x 160 GB SATA disk (ST3160812AS)
    2x GE Networkcard (BCM95721)
    Console Redirection
    I ordered additional 2x 1024 MB DDR2 533MHz modules and replaced an old server with this new system.
    The system was installed on a Software Raid(1). The system migration was smooth, except problems getting the NICs up and running. They was recognized as eth2 and eth3 (10 MBit and no link). After hours searching around, I was guessing the problem is anywhere related to udev. Daniel told me to wipe ‘/etc/udev/rules.d/z25_persistent-net.rules’ nearly at the same time I saw, this was the only file with different size in ‘/etc/udev/’ compared to a working (etch) system on this hardware. Removing the file did the trick. As the system is running now very well, sincere thanks are given to muempf! ,

    16 April 2007

    Benjamin Mako Hill: Undiscipline

    I think it's good exercise to write on ruled or graph paper but to attempt to ignore the lines on the paper completely.

    Benjamin Mako Hill: Undiscipline

    I think it's good exercise to write on ruled or graph paper but to attempt to ignore the lines on the paper completely.

    13 April 2007

    MJ Ray: Blog Tools 1: the Aggregator

    I just rewrote my aggregator (schcyrssmerge2) which still works roughly on this algebra from 2004 (still the basic set theory rule of blog aggregate generation: aggregate_i+1 = (blogs/aggregate_i) u (aggregate_inblogs)) but now calculates agg1 a different way. First, there's agg0 - the items from the input RSS file - and I store only the post ids of agg0 as agg0i for speed. Previously, I was reading in all the blogs and doing the above set theory calculation in one go. With a couple of ill-behaved blogs (full-content feeds of a few hundred kb), mzscheme's memory usage was just getting silly, topping out at hundreds of megabytes to merge 4Mb of feeds into a 3Mb aggregate. I think some of the problems are PLT's - reading a 3Mb RSS file in with
    "(define a (call-with-input-file "friends.rss" read-xml))"
    seems to result in mzscheme (v352) holding 100Mb. What's with that? Anyway, now I've written a newitems function which extracts new items not listed in agg0i and old items which still appear in a blog and adds them to lists. Then, there's a function which tail-recurses over all the blog filenames, parsing the RSS, calling newitems on each one and building the lists of old and new items. Finally, agg1 is the new items appended to the old items. That is only calculated as it gets written out as a RSS file. I'll give it a few days of testing, then I'll publish a tarball. I use this to build my all.rss feed from my various source feeds, in case you didn't realise, as well as to run some planets for public and private use. Anyone got a suggestion how best to reduce the read-xml memory consumption? Upgrade? Switch dialect? I'd like some XML read/write functions and the SRFI list functions.

    12 April 2007

    Russell Coker: presentations about SE Linux

    I have just read the Presentation Zen blog post about PowerPoint.

    One of the interesting suggestions was that it's not effective to present the same information twice, so you don't have notes covering what you say. Having a diagram that gives the same information is effective though because it gives a different way of analyzing the data. I looked at a couple of sets of slides that I have written and noticed that the ratio of text slides to diagram slides was 6:1 and 3:1 in favor of text, and that wasn't counting the first and last slides that have the title of the talk and a set of URLs respectively.

    So it seems that I need more and better diagrams. I'll include most of the diagrams I use in my current SE Linux talks in this post with some ideas on how to improve them. I would appreciate any suggestions that may be offered (either through blog comments or email).

    The above diagram shows how the SE Linux identity limits the roles that may be selected, and how the role limits the domains that may be entered. Therefore the identity controls what the user may do and in this example the identity "root" means that the user has little access to the machine (a Play Machine configuration). I think that the above is reasonably effective and have been using it for a few years. I have considered a more complex diagram with the "staff_r" role included as well and possibly including the way that "newrole" can be used to change between roles. So I could have the above as slide #1 about identities and roles with a more detailed diagram following to replace a page of text about role transition.

    The above diagram shows the domain transitions used in a typical system boot and login process. It includes the names of the types and a summary of the relevant policy rules used to implement the transitions. I also have another diagram that I have used which is the same but without the file types and policy. In the past I have never used both in the one talk - just used one of the two and had text to describe the information content of the other. To make greater use of diagrams I could start with the simple diagram and then have the following slide have all the detail.

    The above diagram simply displays the MCS security model with ellipses representing processes and rectangles representing files.

    The above diagram shows a simplified version of the MMCS policy. With MMCS each process has a range with the low level representing the minimum category set of files to which it is permitted to write and the high level representing the files that it may read and write. So to write to a file with the "HR" category the process must have a low level that's no higher than "HR" and a high level that is equal or greater than "HR". The full set of combinations of two categories with low and high levels means 10 different levels of access for processes which makes for a complex diagram. I need something other than plain text for this but the above diagram is overly complex and a full set is even more so. Maybe a table with process contexts on one axis, file contexts on another and access granted being one of "R", "RW" or nothing?

    I also have a MLS diagram in the same manner, but I now think it's too awful to put on my blog. Any suggestions on how to effectively design a diagram for MLS? For those of you who don't know how MLS works the basic concept is that every process has an "Effective Clearance" (AKA low level) which determines what it can write, it can't write to anything below that because it might have read data from a file at it's own level and it can't read from a level higher than it's own level. MLS also uses a high level for ranged processes and filesystem objects (but that's when it gets really complex).

    This last one is what I consider my most effective diagram. It shows the benefits of SE Linux in confining daemons in a clear and effective manner. Any suggestions for improvement (apart from fixing the varying text size which is due to a bug in Dia) would be appreciated.

    The above diagrams are all on my SE Linux talks page, along with the Dia files that were used to create them. They may be used freely for non-commercial purposes.

    If anyone has some SE Linux diagrams that they would like to share then please let me know, either through a blog comment, email, or a blog post syndicated on Planet SE Linux.

    11 April 2007

    MJ Ray: Satellite TV and Media Links for 2007-04-11

    Ofcom publishes research on media literacy
    Analysis of a research report: "Certainly a useful document to have on hand, if only to deconstruct."
    Karen Bremner - The Apprentice Series 2
    A new art form: go on a reality TV show, start blogging to raise profile, get hired by Old Media, then leave the site to bit-rot. How many of these "reality TV star headstones" sites are there now?
    predicts problems and confusion for consumers
    If anyone doubts how much big media gets bad PR from trying to use their big influence to direct the market (such as making their films only available in their format), check the first comment: "I'm waiting for the corporate idiots to decide"
    xmltv, was: [Debian-uk] Getting wired in Manchester
    Another thing on my "must try that when I get my DVR built" list.
    theLargePrint.com The New Media Landscape and the BBC's Lost Horizon
    Nice criticism of BBC's link-up with anti-competitors. I recently wrote about the BBC-Google link, which raises some similar problems.
    BBC NEWS Business Fewer charges for website content
    Figures from 2006 (I'll do media linkposts more often in future).
    Time to read the papers?
    I only get time to read one paper per week, unless I'm travelling.
    Number 10: Tony Blair Interview with Stephen Fry
    Fantasy TV shows number 10: A bit of Fry and Blairie.
    BBC NEWS Technology Broadband switching set to ease
    They say new rules came in on 14 February, but sites like moneySavingExpert.com are still full of tales of woe.
    We the undersigned petition the Prime Minister to ban tv competitions/quizzes which charge extortionate caller rates (eg The Mint).
    Sign this to clear UK digital TV of all these scam quizzes. I see that after just a taste of humble pie, itv play is back on air overnight on itv1.

    10 April 2007

    Benjamin Mako Hill: Undiscipline

    I think it's good exercise to write on ruled or graph paper but to attempt to ignore the lines on the paper completely.

    Next.

    Previous.