Software in the Public Interest is one of the oldest and best non-profit associations (and not a foundation!) that supports free and open source software development and it will hold a public board of directors meeting on Wednesday at 20:30 UTC (21:30 UK). SPI meetings are held on irc.spi-inc.org (the OFTC network) in channel #spi. See the OFTC site for more information about connecting to OFTC. The agenda for the meeting is available on the web. A single resolution regarding ankur.org.in joining as an SPI associated project has been received. Please, come along and support SPI and thank its volunteers for their efforts.

Particularly around local government, but also some not-for-profits and universities, I m trying to persuade people to stop using huge Blind Carbon Copy (BCC) lists that they keep in their address book and switch over to using mailing list manager software. Our co-op even gives some simple mailing list hosting away with web hosting. I think good mailing list software is better because:

1. List members can help themselves they can subscribe, unsubscribe and set options by sending email to the software or visiting its website, which reduces the worker time required to manage the list. But you can still manage it directly if you prefer.
2. Your address book is smaller because you don t need every address on the mailing list cluttering up your email software s address book any more
3. Errors are handled automatically if an address doesn t work any more, the software will unsubscribe it, usually with some safeguards against one-off problems
4. Privacy is safeguarded dedicated email list software will not put all the mailing list addresses in the To-line by mistake (as often happens with Address Book announcement lists)
5. Spam is filtered rules can be set centrally and they can be different to the rest of your organisation
6. Messages can be moderated if needed, the list managers can be asked to pre-approve the messages, or you can set rules to allow some automatically.
7. Emails can be archived most list software can save copies of messages for you, or put them on the web
8. You can offer digests offer members the choice between getting every message or daily or weekly batches
9. Multiple versions can be sent some list software can send different versions of the same email (like rich and plain text, or different languages) as chosen by the user
10. You can syndicate news some list software can also put your announcements on content management systems or social media
11. (OK, I ve done 10 there are two more which matter to a tech worker like me which I m going to mention as free extras.) It s more efficient most list software is designed to handle hundreds or thousands of recipients and sends email with more robust settings than a typical desktop email client. It is less likely to fail after recipient 373 and ask you to resend them all.
12. Comply with standards good list software either follows standards for things like self-service and digests automatically or can be told to do it. Some desktop email software (Outlook?) usually can t.

Do you think these are good reasons? Are there other reasons you would include above some of these? Would they persuade you to stop using your computer s address book?

Software in the Public Interest (the organisation behind debian and many more) will hold a public board meeting later today (Wednesday) at 20:30 UTC (=21:30 BST, 22:30 CEST or date -d @1305145800 to you). SPI meetings are held in #spi on irc.spi-inc.org (the OFTC network). The agenda for the meeting is available at http://www.spi-inc.org/meetings/agendas/2011/2011-05-11/ At the time of writing, there s a single resolution regarding Jenkins joining as an SPI associated project. Jenkins (formerly known as Hudson until the Oracalypse) monitors execution of jobs like software builds or scheduled tasks. Its website is http://jenkins-ci.org/ Why not come along and wish Jenkins well? Or just see if I m awake after a #koha meeting at 3am UK time?

It s a bit quiet on this blog recently because I m busy with lots of non-software tasks, including:

1. I am standing for election to the UK Worker Co-operative Council. Thank you to software.coop for the nomination and help. Voters can ask me questions on the uk.coop site.
2. I was renominated to Kewstoke Parish Council and even though there s no contest (just enough candidates to fill the council), I ve another 16 pages of legally-required forms to complete to take up office. I hate bureaucracy and I think it deters a lot of good people from helping their villages.
3. I m contemplating standing in the co-operative group area committee elections again.

So, I m far from idle. I m still developing software for clients of our co-op but not finding time to write about it just now. Maybe this would be more interesting to readers: I ve moved my wifi antenna out of the metal box it s been in for a while. Now it covers a half-decent area, I m looking at installing CoovaAP to offer some free public access wifi while trying to limit the risk of illegal activity. Would you do it? Do you run a public wifi point? What should I watch out for?

I mourn the loss of thousands of precious lives, but I will not rejoice in the death of one, not even an enemy. Returning hate for hate multiplies hate, adding deeper darkness to a night already devoid of stars. Darkness cannot drive out darkness: only light can do that. Hate cannot drive out hate: only love can do that. anonymous (often attributed to Martin Luther King, Jr.)

Seen many times today.

I use USAA for some of my finances. They specialize in remote banking (i've never been in a physical branch). Sadly, they can still be pretty clueless about how to use the web properly. My latest frustration with them was trying to use their Deposit@Home service, where you scan your checks and upload them. No problem, right? I've got a scanner and a web browser and i know how to use them both. Ha ha. Upon first connecting, i'm rejected, and i find the absurd System Requirements -- only Windows and Mac, and only certain versions of certain browsers. You also need Sun's Java plugin, apparently. Deliberately na ve, i call their helpdesk and ask them if they could just give me a link to let me upload my scanned checks. They tell me that they want 200dpi images, and then give an absurd runaround that includes references to the Gramm-Leach-Bliley Act as the reason they need to limit the system to Windows or Mac, and that security is the reason they need to control the scanner directly (apparently your browser can control your local scanner on Windows? yikes). But they let slip that Mac users don't have the scanner controlled directly, and can just upload images (apparently the federal law doesn't cover them or something). Preposterous silliness. The Workaround Of course, it turns out you can get it working on Debian GNU/Linux, mainly by telling them what they want to hear ("yes sir, i'm running Mac OS"), but you'll also have to run Sun's Java (non-free software) to do it, since their Java uploader fails with nasty errors when using icedtea6-plugin. I set up a dedicated system user for this goofiness, since i'm going to be running apparently untrustworthy applets on top of non-free software. I run a separate instance of iceweasel as that user; all configuration described is for that user's homedir. If you do this yourself, You'll need to decide if you want the same level of isolation for yourself. So i have the choice of installing sun-java6-plugin from non-free and having the plugin installed for all web browsers, or just doing a per-user install of java for my dedicated user (and avoiding the plugin for my normal user). I opted for the latter. As the dedicated user, I fetched the self-extracting variant from java.com, unpacked it, and added it to the iceweasel plugins:

chmod a+x ~/Download/jre-6u25-linux-i586.bin
mkdir -p ~/lib ~/.mozilla/plugins
cd ~/lib
~/Download/jre-6u25-linux-i586.bin
ln -s ~/lib/jre*/lib/*/libnpjp2.so ~/.mozilla/plugins/

Then i closed iceweasel and restarted it. In the relaunched iceweasel sesson, I told Iceweasel 4 to pretend that it was actually Firefox 3.6 on a Mac. I did this by going to about:config (checking the box that says i know what i'm doing), right-clicking, and choosing "new >> string". The new variable name is general.useragent.override and i found that setting it to the following (insane, false) value worked for me:

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9.2.3) Gecko/20060426 Firefox/3.5.18

Note that this configuration might make hotmail think that you are a mobile device. :P If you try to use this browser profile for anything other than visiting USAA, you might want to remove this setting, or install xul-ext-useragentswitcher to be able to set it more easily than using about:config. Once these changes were made, I was able to log into USAA, use the Deposit@Home service to upload my 200dpi grayscale scans. I guess they think i'm a Mac user now. The Followup After completing the upload, I wrote them this review (i doubt they'll post it):

The Deposit@Home service has great potential. Unfortunately, it currently appears to be overengineered and unnecessarily restrictive. The service requires two scans (front and back) of the deposited check, at 200dpi, in grayscale or black-and-white, in jpeg format, reasonably-cropped. The simplest way to do this would be to show some examples of good scans and bad scans, and provide two file upload forms. Once the user uploaded their images, the web site could run its own verification, and display them back for the user to confirm, optionally using a simple javascript-based image-cropper if any image seems wrong-sized. This would work fine with any reasonable browser on any OS. Instead, Deposit@Home requires the user to present a User-Agent header claiming to be from specific versions of Mac or Windows, running certain (older) versions of certain browsers, and requires the use of Sun's Java plugin. Entirely unnecessary system requirements to do a simple task. Disappointing. :(

Acknowledgements I found good background for this approach on the ubuntu forums. The Takeaway I continue to be frustrated and annoyed by organizations that haven't yet embraced the benefits of the open web. Clearly, USAA has spent a lot of money engineering what they think is a certain experience for their users. However, they didn't design with standard web browsers in mind, so they appear to have boxed themselves into a corner where they think they have to test and approve of the entire software stack running on the end-user's machine. This is not only foolish -- it's impossible. When you're designing a web-based application, just design it for the web. Keep it simple. If you want to offer some snazzy java-hooked-into-your-scanner insanity, i will only have a mild objection: it seems like a waste of time and engineering effort. My objection is much stronger if your snazzy/incompatible absurdity is the only way to use your service. A simple, web-based, browser-agnostic interface should be available to all your clients. Even more aggravating is the claim that they don't think they should engineer for everyone. I was told during the runaround that they would only support Linux if 4% of their users were using Linux (which they don't think is the case at the moment -- if you are a USAA customer, and you use something other than Mac and Windows, please tell them so). I tried to tell them that I wasn't asking for Linux support; i was asking for everyone support. If you just use generic engineering in the first place, there's no extra expense for special-casing other users. But they couldn't understand. And now, since i'll need to lie to them in my User Agent string every time i want to deposit a check online, those visits won't even show up in their logs to be counted. "Our web site deliberately disables itself for $foo users; we haven't written it for them; but that's OK, we don't have any $foo users anyway" is a nasty self-fulfilling prophecy. Why would you do that?

MeeGo Summit FI is now nearing completion, with several keynotes and other presentations, Meegathon 24h contest just coming to an end and a lot of interesting discussions had. See full program for details. Yesterday was a hugely energetic day, but today the lack of sleep starts to kick in a bit at least for me.

Some highlights via photos:



Keynote venue was a movie theater




MeeGo status update by Valtteri Halla / Intel - talking among else about tablets, IVI, and the 20 person team at Nokia doing MeeGo(.com) for N900 phone





Mikko Terho / Nokia - "Internet for the next billion => Qt good candidate", "code wins politics and standards"




Carsten Munk / Nomovok - "Hacking your existence: the importance of open-ended devices in the MeeGo world"




In addition to MeeGo tablet demonstrations a Wayland compositor was demoed by a Nomovok employee.



One of the many Qt / QML related talks was held by Tapani Mikola / Nokia



Evening party




Day 2 started with a few more presentations and Finhack event launching in the Protomo room as well

Still remaining for the day are Meegathon demonstrations (well actually I'm right now already following those while finishing this - cool demos!) , Meegathon awards, a panel discussion on "MeeGo, Nokia, Finns - finished? Can MeeGo be important in Finland without being inside Nokia's core?", BoF sessions and finally Intel AppUp Application Lab including some MeeGo table give-outs.

Thanks to organizers, many of whom were volunteers. The event has been running completely smoothly, coming not as a big surprise after the hugely successful last summer's Akademy 2010 also held in Tampere.

I just received a strange call. Basically, someone phoned me up and tried to convince me to change my computer s settings. They called my direct line (not the co-op switchboard), so I think they might be calling other numbers in the Weston-super-Mare area. Watch out for this attack. I d heard about these calls from Box Bush Farm a year or so ago, but this is the first one I ve had. They introduced themselves as calling from Kilman IT Services (if I heard it correctly I didn t find it in a web search, so hopefully they re not defaming a real company) and say they re calling about the critical error that I reported from my computer (I guess they mean the dialogue that some applications pop up when they crash). I said something non-commital like riiight and they continued. Apparently, that error has been registered in my computer s files and could cause damage at any time! So, they need me to edit my computer s registers to remove the error. Then they started trying to talk me through the process of running regedit. I m guessing the changes would have allowed them to control a Windows computer somehow. At this point, I introduced myself and hung up the phone. Of course, there was no caller ID shown. If only I d picked up the call from a phone with a record button, I would post a recording! It sounded like a call centre and the caller spoke English with a far-eastern accent, but of course it could be from anywhere. This is a crude social engineering attack. Don t fall for it. As it says on Get Safe Online: How to spot social engineering: You get an unexpected call, email or visit from a technical support person . Better yet, make sure you know the names of your tech support providers and refer any unsolicited repair calls to them. I think real IT services would talk to your lead support provider. This sort of obnoxiousness is part of the reason why our co-op doesn t publish our client list. I m posting this mainly so if anyone searches for Kilman IT Services they ll find details of the call.

A new comment on the Samsung N150 Ubuntu Netbook Remix reminded me that maybe I should post this here: I ve just seen a report of lost files in a dual-boot Windows 7 situation. One suggestion is that you shouldn t suspend Windows, boot GNU, edit files on the Windows disks, shutdown GNU, then resume Windows. I ve not dual-booted for over a decade, but friends and clients do and they re slowly moving to Windows 7 as it comes on new PCs. Is this a new twist on the old Windows-expects-one-user-at-a-time sharing problems, perhaps?

jrollins and i recently did a bunch of cleanup work on debirf, with the result that debirf 0.30 can now build all the shipped example profiles without error (well, as long as debootstrap --variant=fakechroot is working properly -- apprently that's not the case for fakechroot 2.9 in squeeze right now, which is why i've uploaded a backport of 2.14). To try to avoid getting into a broken state again, we set up an autobuilder to create the images from the three example profiles (minimal, rescue, and xkiosk) for amd64 systems. The logs for these builds are published (with changes) nightly at:

git://debirf.cmrg.net/debirf-autobuilder-logs

But even better, we are also publishing the auto-generated debirf images themselves. So, for example, if you've got an amd64-capable machine with a decent amount of RAM (512MiB is easily enough), you can download a rescue kernel and image into /boot/debirf/, add a stanza to your bootloader, and be able to reboot to it cleanly, without having to sort out the debirf image creation process yourself. We're also providing ISOs so people who still use optical media don't have to format their own. Please be sure to verify the checksums of the files you download. The checksums themselves are signed by the OpenPGP key for Debirf Autobuilder <debirf@cmrg.net>, which i've certified and published to the keyserver network. What's next? It would be nice to have auto-built images for i386 and other architectures. And if someone has a good idea for a new example profile that we should also be auto-building, please submit a bug to the BTS so we can try to sort it out.Tags: debirf

I ve posted #Budget11 one #coops response on UK.coop because it s a bit long and I doubt many of the people reading this through software-related sites will want to read it. If you re interested in UK co-ops and the budget, click through to read points including:

• it s a mixed bag for co-op members and not really clear if we win or lose. The BBC reckons individuals will lose about 400 on average.
• Basically, the business measures which I can understand are bad for co-ops and seem to be aimed at private businesses, but some of the other things might be useful.
• Co-operatives UK general secretary Ed Mayo asked for changes to employee share ownership annual tax concessions, easier starts for co-operatives and encouragement for grassroots successes. I don t see any of those in this budget. Do you?

Comment here or there, as you prefer. I ll read both every day or so for the next little while.

This seems an active time for conference planning in two of the projects I like:

1. KohaCon11 is being planned for Thane, India. Registrations are open and I m helping to admin the conference system (OCS). If you d like to talk, submissions are also open now, although how we review and choose has yet to be decided (should be at the next volunteer meeting). If you d like to sponsor the event, please register as a potential sponsor.
2. DebConf12 s location will be picked at an IRC meeting today (Tuesday). Bids from Belo Horizonte, Brazil and Managua, Nicaragua are on the web and you are invited to help choose between them.

Are there any other Free and Open Source Software community conferences you d like to mention?

Software in the Public Interest, the contributor-led not-for-profit corporation that supports debian GNU/Linux, OpenVAS, OpenOffice.org and an ole load of other free software projects meets tonight (Wednesday 9th) at 20:30 UTC in #spi on irc.spi-inc.org. The agenda has been published and the main item to be discussed is adding LibreOffice as an associated project. What do you think of that, then? SPI supporting both LibreOffice and OpenOffice? A balanced position, fence-sitting or something else?

If you were watching itv1 last night (or since), you might have seen the co-operative group s Join the Revolution advert that hints at how buying from co-op shops helps to support a wide range of other co-operative efforts. This isn t unique to that co-op our co-op has been helped by the group and many others over the years, both formally and informally, and we ve helped other co-ops too but the shops are one of the biggest co-ops and it s great to see them getting the message out there. It s rather less great that my mobile phone is convinced that John the Revolution is much more probable. Got to love software. If only it was free software I could fix

Last week, I was at this event in Bristol where we heard some interesting stories from other creative co-ops. I think the oldest had been running for about the same length as time as our co-op, but with a bit of a smoother history. The organisers have posted their report on the event. What did surprise me is that it seemed that the other tech co-ops weren t as strong about free and open source software. I felt that the links between co-op values of self-help, self-responsibility, democracy, equality, equity, solidarity, honesty, openness, social responsibility and caring for others and the freedoms to use, study, adapt and share were obvious, but maybe I should try to write them out very clearly?

There s a lot of exciting activity going on around libraries at the moment. One of them is the OpenBiblio Principles, which are:

1. When publishing bibliographic data make an explicit and robust license statement.
2. Use a recognized waiver or license that is appropriate for data.
3. If you want your data to be effectively used and added to by others it should be open as defined by the Open Definition (http://opendefinition.org) in particular non-commercial and other restrictive clauses should not be used.
4. Where possible, explicitly place bibliographic data in the Public Domain via PDDL or CC0.

Happily, our co-op has decided to support these principles. I feel that the third one is particularly important: non-commercial clauses lock out many cooperatives and social enterprises from sharing and helping. If you ve got an idea for an app using open bibliographic data (you can enter the idea or a prototype app), you ve just about got time to enter the OpenBiblio Challenge before it closes on 17 February and win some money. Good luck!

So previously I talked about pictures. Having spent a while playing with some new lighting ideas I'll present three recent images:

• Two empty glasses.
• Two full glasses.
• My drink is on fire.

Now that's out of the way lets talk software. There are two specific things I think would be useful to me right now:

Opportunistic "cron"

I've got a few jobs that don't take long to run, and I schedule for once a day when my systems are idle. It'd be nice to have some long-running daemon which could trigger these odd-jobs (which do things like update my list of mutt mailboxes) when the system has been idle for >30 minutes, or some similar criterion. Ideally I'd say "Run this job when the system is idle, but if the system is never idle run it once a day, or once an hour regardless".

Content-aware tracking software

I use rsync to archive images across a number of systems. Imagine I rename a few images locally, I have to re-rsync even though ideally all I need to do is rename the contents remotely. The issue is remembering what I've changed. So given:

~/Images/Stolen-Souls/2011.02/
~/Images/Stolen-Souls/2011.02/02-Borcsa
~/Images/Stolen-Souls/2011.02/02-Camilla
~/Images/Stolen-Souls/2011.02/06-Indigo
~/Images/Stolen-Souls/2011.02/07-Rosa

If I rename "06-Indigo" then it's trivial to ssh to the remote host and do the same job. But what if I rename a bunch of individual files? Ideally I'd be able to run something like:

~$ tool --snapshot ~/Images/
~$ mv Images/old.jpg Images/new.jpg
~$ tool --show-changes ~/Images
mv Images/old.jpg Images/new.jpg

I half believe git can do something like this, but it seems like you should be able to index the filename+SHA1+size to ~/.snapshot, then later do the same thing and output a list of "mv" commands.

Anyway; I'm drunk. I'm probably not making sense, and I need to sleep. Goodnight. ObQuote: "Hello Mr. Svenning how have you been?" - Mallrats

The regular monthly board of SPI (Software in the Public Interest, the contributor-run non-profit which supports debian, drupal and many other projects not beginning with the letter d) is on IRC this evening at 20:30 UTC in #spi on irc.oftc.net. If you need an Internet Relay Chat client, check what s available in your package manager, or you could do worse than adding Chatzilla to Iceweasel or Firefox. The agenda has been posted and the reports really ought to be included by the time this blog post appears. Come along and see FOSS project support infrastructure do its thing, then maybe chat a bit afterwards.

As of version 0.17, gitpkg ships with a hook called quilt-patches-deb-export-hook. This can be used to export patches from git at the time of creating the source package. This is controlled by a file debian/source/git-patches. Each line contains a range suitable for passing to git-format-patch(1). The variables UPSTREAM_VERSION and DEB_VERSION are replaced with values taken from debian/changelog. Note that $UPSTREAM_VERSION is the first part of $DEB_VERSION An example is

 upstream/$UPSTREAM_VERSION..patches/$DEB_VERSION
 upstream/$UPSTREAM_VERSION..embedded-libs/$DEB_VERSION

This tells gitpkg to export the given two ranges of commits to debian/patches while generating the source package. Each commit becomes a patch in debian/patches, with names generated from the commit messages. In this example, we get 5 patches from the two ranges.

 0001-expand-pattern-in-no-java-rule.patch
 0002-fix-dd_free_global_constants.patch
 0003-Backported-patch-for-CPlusPlus-name-mangling-guesser.patch
 0004-Use-system-copy-of-nauty-in-apps-graph.patch
 0005-Comment-out-jreality-installation.patch

Thanks to the wonders of 3.0 (quilt) packages, these are applied when the source package is unpacked. Caveats.

• Current lintian complains bitterly about debian/source/git-patches. This should be fixed with the next upload.
• It's a bit dangerous if you checkout such package from git, don't read any of the documentation, and build with debuild or something similar, since you won't get the patches applied. There is a proposed check that catches most of such booboos. You could also cause the build to fail if the same error is detected; this a matter of personal taste I guess.

I ve been a bit quiet on this blog and it s mainly been because our co-op is busy, with the annual reports and tax returns to do as well as an increasing amount of client work. It seems that we re not the only busy co-op:

Last year, whilst the UK economy as a whole contracted by 4.9%, the co-operative economy grew by 15.8% to 33.5 billion. This is partly down to the success of The Co-operative Group, but also stems from the success of over 4,990 other co-operatives in the UK which have continued to thrive. From Differences revealed in consumer views between PLCs and co-operatives Co-operatives UK

Meanwhile, I ve been testing out a couple of bits of software, including encrypted filesystems and new firmware for the FS-4400 Satellite PVR, which I could post about soon. We ve developed some Wordpress add-ons which I will package, release and announce. Finally, we re attending a couple of events next week. Busy times indeed!