To quote the ftp-masters REJECT-FAQ :

• Write manpages. Yes. Really. Write them. Well. It s basically: If your program/tool has a help and version commandline option you can simply run help2man and have a working start.

What may not be obvious to the recently REJECTed developer is actually how to use help2man. To try t0 explain the process a bit more verbosely, I took the liberty of writing a tutorial on the Debian wiki. Comments and corrections are welcome.

Of course, help2man-generated manpages are no substitute for real, hand-written manpages made of sweat, blood, and the Maintainer s tears, and it won t work for all packages. This is just a start, and is much better than no manpages at all.

There was a discussion on #debian-devel a couple of days ago when I brought up my creation of the above, and some wondered if it wouldn t be better to add hooks to man-db to allow package maintainers to enable manpage generation at runtime. I m not sure if that idea will ever make it into a proposal, but, if the details of the implementation were worked out, would be much better than the above, manually generated method.

Selecting a DebConf location hard, and can certainly get intense at times. This is an area where the DebConf team and the Debian project can work to improve our processes. There is a wiki page to collect our thoughts in preparation for a discussion later, as planned during the DebConf&Debian BOF.
First off, there is a time at DebConfN-2 for interested localteams to describe their rough plans. These are videoed, and you can view the events online if you would like: for dc11 at dc9, for dc12 at dc10 .There has been a nominal deadline of December 31, 20XX-2 for submitting a bid (not finalizing), but this has been bent in the past.While teams are preparing their bids, they should look at the location checklist. This summarize what past organizers know to look for in a location. There are questions sorted by category and priority.To organize their information so that people can understand, teams prepare bid documents on the wiki (DC10, DC11, here are the winning bid documents: DC10-New York City, DC11-Banja Luka). These start off by just answering all of the questions in the location checklist, but then get a lot of work to make the pages clear and complete. Anyone can browse the pages and ask questions of the teams anytime.There are several mini-meetings where teams describe their progress, and organizers and other interested people can ask questions. In these meetings, the channel is not moderated. Questions tend to be about the location checklist criteria related things.In February/March, there is a big selection meeting. This is the only DebConf meeting where the channel is moderated and only voiced people can speak. The voiced people historically are two moderators who keep things moving, two other past DebConf organizers to ask questions and relay questions from the audience discussion channel. (These facilitators have been self-selected in the past, usually in the minutes leading up to the meeting.) Then, there are two people per location whom are voiced. There is a audience channel for everyone else to discuss, and the moderators/helpers will look there for questions and relay them to the main channel. There have been unvoiced Q&A periods and periods which are designated for relaying questions from the discussion channel.These meetings are logged (dc10 selection, dc11 selection)Teams are rated based on the priority list. There has been a simple point list the last two years, -1 to +1 for each point on that list. For each item, there are debates on how many points each location should get. Points are added up, and a result appears. In the past, this has been a simple arithmetic sum, so all items are weighted the same (despite nominally having different weights). In the case of a tie or close call, there is more discussion. For DC10, there was a tie, and NYC won after opening the meeting to the audience and getting their opinions. I didn't pay enough attention to the DC11 selection process to be able to say how that close call was resolved.While this isn't really part of the selection process, local teams can give presentations at DebConfN-1 about their location and encourage attendance: dc10 at dc9, dc11 at dc10
So, there it is. Overall, there is a lot of openness in the process, but the exact rating schemes in the decision meeting could use discussion. The criteria are established, but can be refined each year based on what we learn.If you would like to comment on how to improve this in the future, please use the selection process wiki page (first person create it). We can follow up with a list discussion after our ideas have been fleshed out.Tags: debconf

DebConf10 ended 2 weeks ago, I m back in Bosnia and I needed some time to recalculate everything that happened to me in last month This was my third time in NYC, and NYC as a city never left me empty handed, in every possible sense! And am seriously considering option of moving back one day, whether to get my Masters/phD or just do work we ll see what future holds for me DebConf10 I was in organization team for DebConf10, but if you put me aside, what s particularly interesting is that there was a total number of 7 Bosnians on DebConf10, two of which were government officials. I must note this wasn t our complete team, and what s most important of all is that they all pretty much volunteered as much as they could, of course, besides good will to help Debian, but also to at least somehow prepare themselves for organization of DebConf11. It s also worth noting that this was their first DebConf, and I as a leader of the team must say I m proud on how well they performed. I m sure by being highly active in volunteering they have learned as much as they could when it comes to how it s done and were able to see good and bad sides of DebConf10 organization team. Of course, I d also like to thank DebConf10 team for their superb work, perfect Venue selection, their hospitality and being incredibly friendly and helpful to all of us. As I said in one of my lectures, it s kinda unwritten rule that every next DebConf has to top the previous one, and that being said it s going to be almost impossible to compete with this year bid, but being Bosnians we re up for the challenge My DebConf10 Pictures: Semi-private album FaceBook public link (no registration required) DebConf11 DebConf10 was busy period for all of us, but I don t want to start complaining since even though we ve done enormous amounts of work so far, the real challenge lays ahead of us. With DebConf10 behind us, the thing we should process now is it s our turn now, we re next Before anything, I d like to thank Government of Republika Srpska for their full financial support, which was one of the preconditions to even get this bid. With their full support + sponsors, we ll be able to get great amount for sponsorships, for you to come to Banja Luka from the most remote places, and also in case you need visa for them to help you in getting one. Government support is just too precious in any way you want to take it. We would also like to invite you to DebConf11 in Bosnia (Banja Luka) next summer, we also invite all of you to our communication channels (mailing list, irc) since we would really like to get involved as many people as we can. Besides all of you enjoying DebConf11 next year, we would like you to help us in giving directions since we re a young team Besides Debian people, I d like to invite anyone who think he/she could help, or want to get involved, especially individuals/organizations/LUG from whole region! It s also important to stress that in all of our communication means, we do speak English, so please do not hesitate if you have any sort of question/suggestion/whatever. For those interested in next DebConf11, most important page you should follow is our wiki page, where you can find all information and which we keep updated in timely manner: http://wiki.debconf.org/wiki/DebConf11/BanjaLuka Communication/Links Languages we officially support are: English, Bosnian, Serbian and Croatian Mailing list:
http://lists.debconf.net/mailman/listinfo/debconf11-bosnia IRC:
#debconf11-bosnia on irc.debian.org / irc.oftc.net Twitter:
#debconf11 tag
http://twitter.com/absinthesyringe (shameless self promotion ) Facebook:
Official DebConf11 FaceBook group DebConf10 Adnan Hodzic DebConf11 in Bosnia (Introduction and Invitation):
Lecture video high quality (205mb)

See you next year!

I was in New York for three full weeks, before, during and after DebConf 10 took place. Unfortunately, I wasn't able to attend talks or go hang out with folks as much as I would've wanted. Most of the time I was busy at the office with a new product launch we have been preparing for the last few months. However, I was able to come and say hi to a few people, attend the C&W party and talk with friends and ran into. I was, however, following all conversations on IRC so I was pretty informed of all of what was going on. Some random thoughts:

• Being surrounded by so many amazing Debian people made me realize how much I've been apart from the project. My involvement decreased pretty much since I moved to New York. But because of that, I'm now slowly retaking my activity, trying to work on actual things that I use on my daily work instead of just packaging tons of shit that nobody really cared about.
• DebConf is pretty awesome. After attending six out of the last seven Debian conferences, you get to establish a nice connection with people and they become your friends. This year, even if I only came a couple of nights, I made stronger friendships, and for that I'm thankful. It is only within Debian that this human part of bonding really takes place.
• I really regret missing a couple of events: First, the Day trip to Coney Island and the Cyclones game; and the group photo. Both because of work, yes.
• It was interesting to hear the thoughts from one of the Bosnian attendees about next year's DebConf there. I'm really sorry I can't recall his name, but it shocked a bit that he stated that they might try to find better speakers next year, because a lot of them "sucked a lot" here. All I can say is that, even though everybody's opinions are valid, this might come from an outsider, not used to Debian conferences. Where are you going to find better speakers? Us developers are the only speakers out there, good or bad, we are the ones making the conferences by and for.
• I like Zach's attitude as DPL, even when I introduced him to a very nice friend of mine that came to the party to hang out.

DebConf 10 rocked and I appreciate everybody's participation in it. See you in Banja Luka, next year!

As SPI secretary I announced that nominations for the SPI board were open at the start of the month. The nomination period closes this Tuesday (13th July) with voting opening up on Thursday 15th. This year over half the board is up for election - 5 seats (currently held by Luk Claes, Joshua D. Drake, Bdale Garbee, Joerg Jaspert & Martin Zobel-Helas). So far I've received only 2 nominations, though I'm aware these things are often left to the last minute, so hopefully more will appear in the next few days. All anyone who wants to stand needs to do is drop secretary@spi-inc.org a (preferably PGP signed) email nominating yourself and providing a position statement (which will all be published once the nomination period is over).

Oh, and if you're a contributing SPI member please do remember to vote once voting is open!

I m a Debian Maintainer currently undergoing the New Maintainer process. I m also an Ubuntu MOTU as of recently. I have several packages in a variety of categories, but I specialize in Python-based software. I m interested in exploring more ways to improve cross-distribution coordination, specifically as it relates to the Debian Sugar packages. I m working to get all of the Ubuntu-specific Sugar packages included in Debian, which will probably be a summer-long effort.

I got this neat little Chinese netbook after a mail to the debian-arm list where one machine was offered in exchange for porting Debian to it. So I offered to get Debian Installer running on it. In total 20 of these ChiTech PC89E netbooks were bought as a group by various people in different countries. The netbook is based on an ARM S3C6410 SoC, has 256 MB RAM and an excellent 8.9" 1024x600 LCD display. The machine itself is 11" and weighs under 800 grams. Most of the weight is the LCD display; they've even had to add a small extra weight in the base to avoid it toppling over backwards. The goal of getting D-I running was achieved last week, though not without needing to overcome some steep hurdles. Our main problem is that we don't have the source code to either the kernel they use (2.6.24.2 with patches from Samsung and others), or the u-boot bootloader. SSH was available without password for the user account and various basic errors allowed us to root the system relatively quickly. Brute force cracked the root password a few days later. The only information we did have was from the provided desktop system (which is really quite good and certainly looks very polished, but in the end still way too limited), what's on the flash memory and the contents ofa "firmware upgrade" image they provided. Having that firmware upgrade image proved very important as it gave us a good idea how to boot the system from SD card and made it possible to locate the kernel, u-boot bootloader and other files in flash memory. Googling for some boot messages we found two kernel source trees (for a different device: SmartQ) that looked promising as a basis. After some disassembly work by Luke Kenneth Casson Leighton on the kernel to get LCD timings and correct GPIO data we managed to get a basic working kernel: LCD, USB (and thus keyboard and touchpad), and wired networking. Although there are still loads of things that need improving/fixing, that gave me enough to work with to try to get Debian Installer going. The main limitations for running D-I are that we cannot change the bootloader configuration and that their boot procedure does not use an initrd. But we did work out how to boot a custom kernel from an external SD card by making creative use of their "firmware upgrade" procedure. Essentially I needed to find a way to run D-I by only booting a kernel. Piggy-backing an initrd onto a kernel is possible (using the 'bootpImage' target from the upstream kernel build system), but then the size of kernel plus initrd is limited to 4 MB and that is really too limited for a decent D-I initrd (especially if you want full i18n support). I ended up creating a micro-initrd (only 66 kB!) which only function is to mount the external SD card, load the real D-I root initramfs (which now no longer has any real size limitation) and then run init in that. After adding some relatively minor customizations for this netbook (such as installing the kernel from a custom repository on alioth), the installer was up and running. As the framebuffer worked without problem for the newt frontend, I next wondered if it would be possible to also get the graphical installer working. This should be easier for non-x86 systems after the recent switch from DirectFB to X.Org as backend for the graphical installer. And the image below shows it was. I had to create an /etc/xorg.conf to get the USB keyboard and touchpad working (apparently auto-detection does not quite work for less standard hardware), but that was basically it. So now all we have to do is get all the remaining kernel issues sorted out...

Note: This post was written in March 14-15 and posted after our return. When I think about L beck, the first thing that strikes me is the feeling of history underfoot. It struck me most when we set foot inside the Marienkirche. I had never quite felt a wave of a feeling of stepping back in time like that before. The stones on the floor were uneven and imperfect. L beck has had a wet and snowy winter, so the city had spread sand everywhere: sidewalks and roads. Walking into any grand church, I could hear the sound of sand under the shoes of everyone nearby, and feel it under my own shoes. I think I will long associate with L beck the feeling of walking into a grand old church, looking up at the top of the old building at seemingly impossible heights, while feeling the grit of sand and uneven stone beneath my feet. Marienkirche isn t perfect, like some American churches I ve been in, such as the Basilica of Notre Dame. It doesn t have a lot of gold, either, and both of these attributes are wonderful. Look at a column of bricks, and you can see that each brick isn t exactly like its neighbor, and the entire column isn t perfectly straight. Lots of things in L beck are so old that they aren t perfectly straight, and it made me think that our American notion of always having to fix such things might be somewhat off sometimes. Look up, and you see the frescos from the 1300s, revealed after many years after the building was struck by an allied bombing raid in 1942. This heavily damaged the building and knocked down plaster from the walls and ceiling, revealing the old artwork. Many parts of Marienkirche were lost as a result of the bombing, which perhaps adds to its slightly sparse and ancient feel. The church bells were sadly melted and crashed to the ground due to the bombing, and have been left exactly where they fell as a memorial. Look down, and you see the uneven floor, and the concrete slabs above where important people were buried under the floor an attribute common to many of the churches we visited. It was common to see dates of graves from the 1600s and 1700s, though in some places it would go as far back as the 900s. The main part of the church has no heating or cooling, and visiting it on a day just a bit above freezing adds to the feeling of, well, old. Marienkirche has to be my favorite sight in L beck. Walking around the city, I get a similar feel. Many streets and sidewalks are made of stone. The streets that weren t damaged in the war have rows of beautiful old facades. Walk down many streets, and every so often I d see a little tunnel ( just wide enough for a coffin ) that goes under the street-facing houses to a nice little inner courtyard. These are open to the public, but tend to be very quiet and somewhat private. In the courtyard are smaller houses, which would have originally been used by the less wealthy. We also saw the L beck Dom (cathedral), which had a small museum about the destruction due to the Royal Air Force bombing in 1942. It was very sad to see the photo of the Dom in ruins, still smoking, even now. I can only imagine what it must have felt like to residents of L beck to wake up to see many of their priceless centuries-old landmarks and places of worship so horribly destroyed and all of this for little strategic purpose really focused on the morale of the enemy civil population . It s sad that the allies would do such a short-sighted and terrible thing. Europeans have long had to live with the legacy of war upon war, while we Americans have rarely had to see the consequences of war up close. I think it would be good for more of us to visit these sites and come up face to face with what a bomb can do, and then perhaps we will be more judicious with them in the future. Shifting gears now to where we stayed: Andreas & Sigrid, with whom we stayed, have a beautiful 500-year-old house, with lots of original wood beams exposed, and some very old paintings on the walls and ceilings. Nearby were excellent bakeries and a chocolate shop. Terah and I visited it today and bought some very good chocolate. And this brings me to the second thing I ll remember: Andreas & Sigrid s children, Lukas and Rahel. Now, Terah knows no German, I know only a little bit, and the children know no English. So it was a bit slow getting to know each other to start out, but we managed to work around the communication barrier and had a great time. Terah played board games with Rahel, while with me, she kept inventing games to play: hiding somewhere, saying Hallo! , and laughing at how many unsuccessful attempts I might make to find her. I showed Lukas the camera on my Droid, which he used a lot, though a racing game on Terah s iPod Touch was more exciting. They both enjoyed looking at videos of American trains a bit, but especially pictures of our house and yard with Jacob and Oliver. They tried to teach me the German words for things, and also made futile attempts to correct my pronunciation! When we were leaving today, Rahel came over and gave me a kiss on the hand, then the same to Terah s hand, then a little kiss on one of our suitcases. It was touching and sweet. This was one of those experiences no guidebook prepared me for, and no tour bus would have provided. It is something neat to make friends with children despite the large language barrier. On to the rest of the visit We had arrived a little late into Hamburg. After getting our bags and some Euros at an ATM, the next step was to find the bus to L beck. No signs for it were evident, so I found an information desk. The person at the desk was carrying on a conversation in German with the person ahead of me in line. I figured an information desk person in a busy airport would speak English, and was all ready to ask Sprechen Sie Englisch? , but when I walked up, he got a polite smile, and said, Good morning! How can I help? Guess I m obvious. He directed me to the bus, gave me a brochure about it, and told me what time it would leave. Terah and I found the spot to wait, and for a moment I stepped inside the airport terminal. Terah won t let me forget that someone came up to her and asked a question in German, whereas I was spoken to in English. Anyhow, we found the bus, managed to communicate with the driver that doesn t speak English, and sat next to the friendly person that was talking to Terah. He turned out to be a violin player from Munich, and we had a great conversation for the next hour he asking questions about the USA, us asking questions about Germany and Munich. At one point, he commented, You two are so open minded and you re also Americans! He sounded surprised. We exchanged email addresses at the train station. Andreas found us there, and we walked through the city to his house, with him pointing out the sights along the way. L beck is a beautiful city, and though it was damaged in World War II, much of the really old parts still remain. The famous Holstentor Gate has a museum inside, which was fascinating to visit. On Sunday, we went to church with the family we were staying with, Andreas helpfully translating for us. There I met a British Python programmer, which was fun. His wife is a social worker, which was fun for Terah. Monday it was time to get on the train to Berlin. We again walked through a cold and rainy city to the Hauptbahnhof, ready to head to Berlin. There we got on a train to Hamburg, then an ICE train to Berlin. Despite having just a few minutes for a connection in Hamburg, it all went perfectly smoothly. The train left Leipzig about 10 seconds late the clock inside turned over to the minute, then the doors closed and we were off. Impressive. Note: the rest of my photos from L beck are available on Flickr.

• Luk Claes resigned as Release Manager. Thanks Luk for all of your hard work!
  The rest of the release team keeps working in the release of Squeeze and they have sent a small update. A longer update will follow soon.
• Other teams has also sent updates to debian-devel-announce: ftp-master and new maintainer teams.
  If you are interested on them, you should be already subscribed to this list
• Eclipse 3.5.2 is now in Debian unstable. Special kudos to Niels Thykier.
• The Debian Kernel team is working in the kernel for Squeeze and Ben Hutchings has blogged some details about it.
• In the past week, there were two Debian mini-DebCamps in so distant places as Thailand and Panama.
  This week, Debian will have a booth in the OpenExpo 2010 in Bern and the Spanish Debian community will meet in the third edition of the Dudesconf in April 9-11.

The movie ' Fight Club' had a profound effect on me when I first saw it in 1999. I wasn't as fond of the originating novel, although there was something about the prose that Palahniuk used which I did enjoy. Since then I've read more of Palahniuk's work. My favourite of his books is actually Non-Fiction (a.k.a. Stranger than Fiction ): a collection of essays and interviews. Reading some of the stories in that collection, it becomes very clear where some of the concepts in his fiction originate. There are also a number of pieces on the craft of writing. He writes some really gushing praise about Amy Hempel:

When you study Minimalism in the novelist Tom Spanbauer's workshop, the first story you read is Amy Hempel's The Harvest. After that, you're ruined every other book you ever read will suck.

I recently read a couple of novels, both of which reminded me a lot of Fight Club. 'Generation X: Tales for an Accelerated Culture' by Douglas Coupland is an interesting tale of three or more societal drop-outs. Fight Club was written five years after Generation X and owes it a lot. 'Generation X' has curt, clipped passages and many dictionary-definition-esque side notes decoding hipster-slang, which add a lot of colour to the non-events of the story. These remind me both of the copous asides in Pratchett novels, or the chapter introductions in Philip K Dick's excellent 'Ubik'.

Historical Overdosing: To live in a period of time when too much seems to happen. Major symptoms include addiction to newspapers, magazines, and TV news broadcasts.

The novel goes absolutely nowhere, but that's actually one of the appealing things about it. When I mentioned this to my partner (who, as far as I know, has not read the book), she said that it sounded like the perfect tonic to a stressful life: imagine lying on a sunbed, doing nothing, reading about people lying on sunbeds, doing nothing. This is the first of Coupland's novels that I have read, but I managed to pick up a copy of 'Generation A' (so far as a I can tell, not a sequel, as such) 70% off as part of the closing-down sale at my local Borders store, so I will probably read that too. I also recently finished The Dice Man , by Luke Reinhart. It's a tongue-in-cheek pseudo-autobiography written under a pen-name about a psychiatrist who opts to delegate all life decisions to the throw of dice. Once again, Fight Club owes a lot to this book. The unhinged situations that occur are used to shine a satirical light on modern society. 'modern society' in the book is the 1970s. The distance between society then and now adds something to the novel's value now. Having said that, the narrator is not a particularly likeable character and it's hard to relate to him. Coincidentally my dad recently read this book and described it as 'misogynistic', which might be an understatement. Mind you, most of the characters, female or otherwise, are fairly 2D: perhaps intentionally the only fleshed out human is the narrator. In my favourite scene of the book, the narrator is in a situation under the influence of more than one drug. A TV set is on in the background. As the scene progresses, the events taking place on the TV are written about with increasing prominence compared to the main events of the scene. This escalates to a point where they are of equal importance and you can no longer easily distinguish the events taking place in the real world from those taking place on the television. This is the only part of the book that I can recall that employed any narrative tricks. The rest is by-the-numbers, and mostly internal monologue. The book is also at least 50% too long: the concept just doesn't stretch as far as it's forced to.

Debconf 10

As previously announced, DebConf 10 will take place from August 1st to 7th, 2010, at Columbia University, in New York City, USA.

If you have an interesting proposal for an event, the Call for Contributions is already open. Submit your proposal before May 1st.

Also, if you want to request sponsorship for lodging and/or travel, you must submit your request in pentabarf before April 15th.

Debconf 11

The DebConf Team has decided to hold DebConf11 in Banja Luka, Bosnia & Herzegovina. DebConf 11 will take place in 2011 in a date to be defined.

The Threat Bruce Schneier s blog post about the Mariposa Botnet has an interesting discussion in the comments about how to make a secure system [1]. Note that the threat is considered to be remote attackers, that means viruses and trojan horses which includes infected files run from USB devices (IE you aren t safe just because you aren t on the Internet). The threat we are considering is not people who can replace hardware in the computer (people who have physical access to it which includes people who have access to where it is located or who are employed to repair it). This is the most common case, the risk involved in stealing a typical PC is far greater than the whatever benefit might be obtained from the data on it a typical computer user is at risk of theft only for the resale value of a second-hand computer. So the question is, how do can we most effectively use free software to protect against such threats? The first restriction is that the hardware in common use is cheap and has little special functionality for security. Systems that have a TPM seem unlikely to provide a useful benefit due to the TPM being designed more for Digital Restrictions Management than for protecting the user and due to TPM not being widely enough used. The BIOS and the Bootloader It seems that the first thing that is needed is a BIOS that is reliable. If an attacker manages to replace the BIOS then it could do exciting things like modifying the code of the kernel at boot time. It seems quite plausible for the real-mode boot loader code to be run in a VM86 session and to then have it s memory modified before it starts switches to protected mode. Every BIOS update is a potential attack. Coreboot replaces the default PC BIOS, it initialises the basic hardware and then executes an OS kernel or boot loader [2] (the Coreboot Wikipedia page has a good summary). The hardest part of the system startup process is initialising the hardware, Coreboot has that solved for 213 different motherboards. If engineers were allowed to freely design hardware without interference then probably a significant portion of the computers in the market would have a little switch to disable the write line for the flash BIOS. I heard a rumor that in the days of 286 systems a vendor of a secure OS shipped a scalpel to disable the hardware ability to leave protected mode, cutting a track on the motherboard is probably still an option. Usually once a system is working you don t want to upgrade the BIOS. One of the payloads for Coreboot is GRUB. The Grub Feature Requests page has as it s first entry Option to check signatures of the bootchain up to the cryptsetup/luksOpen: MBR, grub partition, kernel, initramfs [3]. Presumably this would allow a GPG signature to be checked so that a kernel and initrd would only be used if they came from a known good source. With this feature we could only boot a known good kernel. How to run User Space The next issue is how to run the user-space. There has been no shortage of Linux kernel exploits and I think it s reasonable to assume that there will continue to be a large number of exploits. Some of the kernel flaws will be known by the bad guys for some time before there are patches, some of them will have patches which don t get applied as quickly as desired. I think we have to assume that the Linux kernel will be compromised. Therefore the regular user applications can t be run against a kernel that has direct hardware access. It seems to me that the best way to go is to have the Linux kernel run in a virtual environment such as Xen or KVM. That means you have a hypervisor (Xen+Linux or Linux+KVM+QEMU) that controls the hardware and creates the environment for the OS image that the user interacts with. The hypervisor could create multiple virtual machines for different levels of data in a similar manner to the NSA NetTop project, not that this is really a required part of solving the general secure Internet terminal problem but as it would be a tiny bit of extra work you might as well do it. One problem with using a hypervisor is that the video hardware tends to want to use features such as bus-mastering to give best performance. Apparently KVM has IOMMU support so it should be possible to grant a virtual machine enough hardware access to run 3D graphics at full speed without allowing it to break free. Maintaining the Virtual Machine Image Google has a good design for the ChromiumOS in terms of security [4]. They are using CGroups [5] to control access to device nodes in jails, RAM, CPU time, and other resources. They also have some intrusion detection which can prompt a user to perform a hardware reset. Some of the features would need to be implemented in a different manner for a full desktop system but most of the Google design features would work well. For an OS running in a virtual machine when an intrusion is detected it would be best to have the hypervisor receive a message by some defined interface (maybe a line of text printed on the console ) and then terminate and restart the virtual machine. Dumping the entire address space of the virtual machine would be a good idea too, with typical RAM sizes at around 4G for laptops and desktops and typical storage sizes at around 200G for laptops and 2T for new desktops it should be easy to store a few dumps in case they are needed. The amount of data received by a typical ADSL link is not that great. Apart from the occasional big thing (like downloading a movie or listening to Internet radio for a long time) most data transfers are from casual web browsing which doesn t involve that much data. A hypervisor could potentially store the last few gigabytes of data that were received which would then permit forensic analysis if the virtual machine was believed to be compromised. With cheap SATA disks in excess of 1TB it would be conceivable to store the last few years of data transfer (with downloaded movies excluded) but such long-term storage would probably involve risks that would outweigh the rewards, probably storing no more than 24 hours of data would be best. Finally in terms of applying updates and installing new software the only way to do this would be via the hypervisor as you don t want any part of the virtual machine to be able to write to it s data files or programs. So if the user selects to install a new application then the request please install application X would have to be passed to the hypervisor. After the application is installed a reboot of the virtual machine would be needed to apply the change. This is a common experience for mobile phones (where you even have to reboot if the telco changes some of their network settings) and it s something that MS-Windows users have become used to but it would get a negative reaction from the more skilled Linux users. Would this be Accepted? The question is, if we built this would people want to use it? The NetTop functionality of having two OSs interchangeable on the one desktop would attract some people. But most users don t desire greater security and would find some reason to avoid this. They would claim that it lowered the performance (even for aspects of performance where benchmarks revealed no difference) and claim that they don t need it. At this time it seems that computer security isn t regarded as a big enough problem for users. It seems that the same people who will avoid catching a train because one mugging made it to the TV news will happily keep using insecure computers in spite of the huge number of cases of fraud that are reported all the time.

• [1] http://www.schneier.com/blog/archives/2010/03/mariposa_botnet.html
• [2] http://www.coreboot.org/Welcome_to_coreboot
• [3] http://grub.enbug.org/FeatureRequests
• [4] http://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/system-hardening
• [5] http://lxr.linux.no/linux+v2.6.30/Documentation/cgroups/

Blogger has no feature to highlight code syntax in blog posts. But google-code-prettify comes to rescue.

The information in their README are quite generic, and treat the situation where you're directly managing the website files, which is not the case for Blogger.

Luka Marinko wrote a very nice blog post describing how to use google-code-prettify on Blogger; I'm going to follow his advices right away!

This moment has finally arrived! Last Saturday (27-th) on #debconf-team decision was made, DebConf11 is coming to Bosnia and Herzegovina! Our team and myself were working on this whole candidature for last ~9 months, and even though we put incredibly amounts on energy, hard work, enthusiasm and everything else that goes along with it, suspense and uncertainty were there until the very last minute! One of our local team members (trip0d s) wife almost gave a birth to their child during the decision process that lasted full 4 hours As a remainder we were competing with Ecuador and Germany to win this bid, whole process was excruciating and very emotionally distressful in every possible aspect for every team member; at one point Germany took a slight lead ahead of Bosnian team, while in the end by points Bosnia was in slight lead by 0.25 points, and this is exactly what touched me the most about this whole bid/decision/process. This is not a great advantage or anything for that matter, but what happened is that in decision process Debian debconf team and its developers picked Bosnia and Herzegovina as a place where they want to have DebConf11! Our main competitors from M nchen, Germany showed a real fair play and at the end even yielded to our side; really to both of you, Michael Banck (azeem) and Andreas Barth (aba) it was a pleasure and honor to compete with you guys! See you in NYC for proper handshake and possibly a hug? Also I d like to thank Jimmy Kaplowitz (Hydroxide), Moray Allan (moray) who had chairs and who did absolutely incredible job I guess I ll just have to thank the whole debconf orga team for all their amazing work ( can t name names individually because I ll definitely forget someone!) This bid really reunited whole Bosnia and Herzegovina, this whole process also united all of Balkans and whole of Ex Yugoslavia, which makes me especially happy since today (March 1st) we are celebrating the day we officially separated from Yugoslavia. Now this just one small step forward, since the real work is ahead of us and we re starting it all as soon as tomorrow since there s really a lot that needs to be done. Again thank you all, we ll give our best for this to be a DebConf you ll remember (as a great one of course!), in the meantime see you in New York City! Adnan Hodzic aka AbsintheSyringe team leader on behalf of whole debconf11-team. DebConf11 Banja Luka wiki Debconf11 decision log (#debconf-team log)

As some people noticed, a driver update to support a major hardware release in my day job and a long series of trivial patches motivated by Debian kernel work combined to make me joint most prolific change author for Linux 2.6.33. This was a fluke, and 2.6.34 is likely to be fairly quiet for me. Team work Meanwhile the kernel team is still working hard on fixing bugs in Linux 2.6.32. As previously announced, this kernel version will be used in both Debian 6.0 'squeeze' and Ubuntu 10.04 LTS. It is also known to be the kernel version for RHEL 6 though this has not been officially announced. If you find a serious bug that was fixed in 2.6.33 or later, please ask the author to send the fix to stable@kernel.org so that it will be included in all these distributions. Note that this happens automatically for commits with the line 'Cc: stable@kernel.org' in their description. We are also continuing to backport new drivers and new hardware support in existing drivers into Debian 5.0 'lenny' (stable). Missing support for common hardware is considered an important bug and suitable for stable updates. However, if there were major changes to a driver before those that added new hardware support, we may be unable to produce a backport. We are not able to carry out comprehensive hardware testing and do not want to risk a regression existing hardware support. libata transition - call for testing Finally, a major change I have been working on is the transition from the old IDE drivers for PATA controllers to new drivers based on libata. The old IDE subsystem is no longer developed and some drivers do not properly support all the hardware that their libata-based counterparts do. However, while the IDE drivers generate device names beginning with 'hd', libata presents PATA devices as SCSI devices and generates device names beginning with 'sd'. In a system that already has other SCSI or SCSI-like disks, names may change somewhat unpredictably. Similar problems exist for PATA CD/DVD and tape devices. So, while the transition doesn't involve any kernel hacking, it does require a complex upgrade process. Any configuration files that refer to IDE or SCSI device names may need to be changed. It is not enough to switch to only SCSI device names, since we cannot know what they are in advance and the configuration files should continue to work with kernel versions from before and after the transition. In the case of disks we can normally use the partition label or UUID: many tools understand the LABEL= and UUID= syntax, and for others we can refer to the symlinks under /dev/disk created by udev. In the case of CD/DVD devices, we can use the aliases /dev/cdrom etc. created by udev. In the case of tape devices, however, you're on your own. In experimental, kernel image packages depend on a new package linux-base which implements this transition (from 2.6.33-1~experimental.2; the previous version was broken). The postinst script will prompt you to make changes automatically or manually. It can convert most bootloader configuration files, /etc/fstab, the udev CD aliases configuration and the initramfs-tools resume partition. It can also label partitions that don't have a label or UUID. Please do test it and verify that its changes are correct. All changed configuration files are backed up with a suffix of '.old' (or '^old' in one case).

DebConf 11 will be held in Banja Luka, Bosnia and Herzegovina. Munich, Germany arrived on a close second and our bid, Quito, Ecuador, arrived last, allegedly because some points flipped over since DC 11 was meant to happen in Europe. So, after having three DebConfs hosted in America in the last four years, DebConf 11 will travel to Europe in 2011! Good news for all our fellow DDs and contributors over there. The Banja Luka team managed to get an important support from their Government. They even met with the Prime Minister and got him to sign an offer of full support. I think this becomes dangerous for a DebConf, given that I ve worked and have had mishaps while funding conferences with at least three governments (Ecuador, Venezuela and Brazil) with stronger levels of support (Law-like level) for free software and I know that at least other two governments in the World have unfortunately done this in the past. So we need backup plans and lots of follow-up activities with the stakeholders. However, this agreement sets an important milestone in government support for free and open source software as well as Debian. I ll use it in my Debian slides, and congratulations! IMO, Munich would have made a great host for DC11 in terms of air travel connectivity, at a bigger hit on local costs, but nothing that would differ that much from DC7, though! I don t think I ll be able to make it at this moment to Bosnia (struggling for NYC) and at this point it s premature to think on supporting Quito s again for DC12. People and sponsors get gradually tired, even with spiritual commitment. The DC10 decision meeting was long and lots of things needed to be improved. At that moment I thought the Project learnt useful lessons for future meetings, but we re repeating ourselves now on the DC11 decision meeting. And now, I m just hoping for the best, for the sake of the time and sanity of all us here. Ditch the priority list altogether, increase the stakeholders on the global team, filter bids early in the process and use more technology to improve the information flow before the decision!

Debconf11 This evening, the final decision on which city will host Debconf11 next year will be taken. For the last half year, mostly Andreas Barth, Jan-Marek Glogowski and I have been working hard to make the Munich bid as good as possible. One thing we wanted to make clear from the beginning was that we would go for a conference in the city center - not some conference center in some nearby village or in an industrial area far away from where the city life happens. It was not easy, since the german-wide decision, we had to reshuffle venue plans a couple of times. In the end, thanks to Jan-Marek, we managed to get an excellent venue offer. Our bid consits mostly of:

• Venue: Computer Science building (recently built) of Munich University for Applied Science, we can get as much as we need, for free. The only thing we would have to pay for is additional security personell during the night.
• Network: Leibniz Rechenzentrum is the operator of the Munich Research Network (MWN), the venue is connected with at least 1 GBits fibre optics, and the MWN is connected to X-Win at the same speed. This will be free as well.
• Food: We can either take up the offer from the Studentenwerk, the organisation operating the university restaurants. Of course, the quality is not like in a Michelin-star restaurant, but I have eaten there for several years during my studies and it is on par with previous Debconf offerings. Alternatively, we could look into food catering.
• Accomodation: We tend to go for hostels, similar to Edinburgh, probably 4-6 bed dorms. Munich is pretty expensive for lodging, so this is something we decided early on to keep the costs reasonable. Again, I think this is in line with previous Debconfs. Of course, hotels at a broad price range are available.

The biggest strong points about Munich are, in my opintion:

• Our local team has lots of experience with Debian and Debconfs, as well as organizing conferences
• We have government support via the LiMux-project, and the city mayor of Munich, Christian Ude, has agreed to be the patron of the conference
• Munich is very easy to get to, both for european (via train or car) or american/asian attendees (via plane). The airport is one of the biggest in europe and has direct connections to e.g. Atlanta, New York, Boston, San Fransisco, Los Angeles, Sao Paulo and Tokio.
• Network connection via LRZ/MWN/X-WIN should be superb, especially to Debian machines hosted at euro

It the end, it seems Banja Luka seems to have the stronger bid, especially due to their 150000 EUR governemnt sponsorship. We will see who wins, I believe we did the best we could.

This is what I set up for backups recently using a cheap USB-enclosure which can house 2 SATA disks and shows them as 2 USB mass-storage devices to my system (using only one USB cable). Without any further introduction, here goes the HOWTO: First, create one big partition on each of the two disks (/dev/sdc and /dev/sdd in my case) of the exact same size. The cfdisk details are omitted here.

  $ cfdisk /dev/sdc
  $ cfdisk /dev/sdd

Then, create a new RAID array using the mdadm utility:

  $ mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdc1 /dev/sdd1

The array is named md0, consists of the two devices (--raid-devices=2) /dev/sdc1 and /dev/sdd1, and it's a RAID-1 array, i.e. data is simply mirrored on both disks so if one of them fails you don't lose data (--level=1). After this has been done the array will be synchronized so that both disks contain the same data (this process will take a long time). You can watch the current status via:

  $ cat /proc/mdstat
  Personalities : [raid1]
  md0 : active raid1 sdd1[1] sdc1[0]
        1465135869 blocks super 1.1 [2/2] [UU]
        [>....................]  resync =  0.0% (70016/1465135869) finish=2440.6min speed=10002K/sec
  unused devices: 

Some more info is also available from mdadm:

  $ mdadm --detail --scan
  ARRAY /dev/md0 metadata=1.01 name=foobar:0 UUID=1234578:1234578:1234578:1234578
  $ mdadm --detail /dev/md0
  /dev/md0:
          Version : 1.01
    Creation Time : Sat Feb  6 23:58:51 2010
       Raid Level : raid1
       Array Size : 1465135869 (1397.26 GiB 1500.30 GB)
    Used Dev Size : 1465135869 (1397.26 GiB 1500.30 GB)
     Raid Devices : 2
    Total Devices : 2
      Persistence : Superblock is persistent
      Update Time : Sun Feb  7 00:03:21 2010
            State : active, resyncing
   Active Devices : 2
  Working Devices : 2
   Failed Devices : 0
    Spare Devices : 0
   Rebuild Status : 0% complete
             Name : foobar:0  (local to host foobar)
             UUID : 1234578:1234578:1234578:1234578
           Events : 1
      Number   Major   Minor   RaidDevice State
         0       8       33        0      active sync   /dev/sdc1
         1       8       49        1      active sync   /dev/sdd1

Next, you'll want to create a big partition on the RAID device (cfdisk details omitted)...

  $ cfdisk /dev/md0

...and then encrypt all the (future) data on the device using dm-crypt+LUKS and cryptsetup:

  $ cryptsetup --verbose --verify-passphrase luksFormat /dev/md0p1
  Enter your desired pasphrase here (twice)
  $ cryptsetup luksOpen /dev/md0p1 myraid

After opening the encrypted container with cryptsetup luksOpen you can create a filesystem on it (ext3 in my case):

  $ mkfs.ext3 -j -m 0 /dev/mapper/myraid

That's about it. In future you can access the RAID data by using the steps below. Starting the RAID and mouting the drive:

  $ mdadm --assemble /dev/md0 /dev/sdc1 /dev/sdd1
  $ cryptsetup luksOpen /dev/md0p1 myraid
  $ mount -t ext3 /dev/mapper/myraid /mnt

Shutting down the RAID:

  $ umount /mnt
  $ cryptsetup luksClose myraid
  $ mdadm --stop /dev/md0

That's all. Performance is shitty due to all the data being shoved out over one USB cable (and USB itself being too slow for these amounts of data), but I don't care too much about that as this setup is meant for backups, not performance-critical stuff.

Almost all of wiki contents got updated, so please take your time to review it all, once again n was more of a symbolic meaning, since in meantime we solved our bids weakest links and pretty much got it mature and at the stage we were aiming it to be. We ll still make some minor changes to it until the final decision date (in 47 hours) but this is it really So without further ado, let me introduce you to our n wiki Since besides changing pretty much the whole wiki we have also added (important) new pages for: Banja Luka and Republika Srpska We have added a new pages to bring Banja Luka and Republika Srpska closer to every potential visitor. Full Government Support Today we have received the most important information when it comes to our bid. Today government council sitting was done, where one of the topics was full financial support in case Banja Luka is host to DebConf11. Proposition was accepted! To remind you, we will get free venue building wheter it s Government Building or Banski Dvori , besides that we re getting them to cover basically all of the costs needed for the conference, and besides that we re getting 5 additional members to our local team (highly capable and educated govt. officials) which even includes city Mayor. Early tomorrow we ll get scan/fax of this memorandum from Chief of Cabinet along with the local team names which will all together be added to this very wiki page. Local Team We have almost assembled our local team/supporters team whose members were wisely and thoroughly selected. Since before anything this is Balkans Debconf, and a new breakthrough to a region that has ~55 million inhabitants, we have made connections all over Balkans, especially from Serbia and Belgrade. This page might might suffer the biggest changes in next few hours, especially since we still need to add people on behalf of ETF (Faculty of Electrical Engineering) and Goverment itself. Accommodation
We have made a separate page for accommodation as well, since we have gathered a whole bunch of new information that just required us to make a new page. Internet We have made a major breakthrough in Network connectivity and technicalities as well! SARNET Academic and Research Network of Republic of Srpska has offered us with 1GB link free as in beer! Please see their Letter of Support/Memorandum, besides that we have Mtel and BHTelecom as our backup options. Besides all that, as I previously noted we made changes throughout wiki page, we have added new contents to fun and free time, as well as to the arrival. Tomorrow with last pages to our local team + govt. support memorandum being added to our wiki we are ready for the DebConf11 final decision! Remainder, decision is being made in 47 hours on #debconf-team on irc.debian.org; please come and support us for being host to DebConf11! Bosnia and Herzegovina FTW! http://wiki.debconf.org/wiki/DebConf11/BanjaLuka

I previously wrote about how the National Broadband Network (NBN) seems more suited to porn delivery than regular Internet use [1]. It doesn t seem to be of much use really. In a particularly insightful comment John Hughes suggested that the real purpose would be TV delivery. The ABC is currently delivering 640*360 resolution MPEG4 files via iView for it s TV content. To use iView on Linux you need Jeremy Visser s Python-iView program [2] in conjunction with Luke Kenneth Casson Leighton s rtmp program [3]. Note that to get this working on Debian/Lenny you need to install the python-simplejson package as well. For the current ABC service it requires 251652 of data for a 3167.6 second Torchwood episode, that averages to 79.4KB/s of data. In contrast a video of Dan Gilbert from TED.com at high quality was in 640*480 resolution and required 301652KB of data for 1276.5 seconds which averaged out to 236.3KB/s. My ADSL2+ connection is theoretically capable of something over 1MB/s and occasionally gets such speeds for unusual download situations (such as downloading multiple large files at the same time). But generally I can t rely can t rely on sustained transfer rates of more than about 200KB/s. So I could watch streaming TED talks at reasonable quality, but for the best results I have to download them and watch them from disk. Assuming the same ratio of compressed data to raw pixels used for HDTV as used for TED talks a 1920*1080 HDTV resolution MPEG4 with the same quality as a TED talk would take 1600KB/s. It is possible to vary the compression level and possibly the usage of a TV stream would permit better compression than the usage of a TED talk for the number of pixels. But it seems reasonable to assume that something like 1600KB/s is needed for best HDTV, that is more than the vast majority of ADSL2+ installations can be relied on to sustain. But 100Mb/s would allow at least two 1920*1080 HDTV transmissions to be viewed at the same time, and maybe three or four as few homes have only one TV this should be of great interest. Now the question is how much people would pay for this. Currently there are two main pay TV companies in Australia, Foxtel which charges $916 for a 12 month plan [4] and Optus who s web site is so awful that I gave up before discovering what they cost (I will assume that they are competitive with Foxtel). Now I think it s reasonable to assume that $916 is at the high end of what potential customers are prepared to pay, as they are competing with free to air TV, DVD sales, Youtube, and downloads of pirate content. The current bank interest rate on term deposits from the Commonwealth bank is 6.3%, the interest rate on raising the finance would have to be greater than that let s assume 7%. So the $5000 per household will require an interest payment of $350 per annum. If a household signs up to pay TV services at a cost of $1200 per annum that might be enough money to pay slightly more than $350 to the NBN plus make a profit for the pay TV company. So if every household in Australia signed up for pay TV over the NBN it should be profitable. But that seems unlikely. The majority of the Australian population (IE the majority of the city population) is used to paying not much more than $240 per annum for a basic phone service and not much more than $360 per annum for a basic broadband Internet service. A bundled deal of $1600 per annum for phone, Internet and pay TV should allow the pay TV company and the NBN to be barely profitable if everyone accepts the deal (unless of course interest rates rise). If half the population aren t interested then the bundled deal would have to cost $2000 to have the potential for being profitable. If three quarters of the population aren t interested then it would have to cost $2300 or more! The Australian Bureau of Statistics documents that in 2008 the median household disposable income in capital cities was $593 per week [5]. So it seems that the idea of the NBN being profitable is based on plan to have more than three weeks of household disposable income per year being spent on Internet/phone/TV services. But fortunately for the pay TV companies and the content companies there is no requirement for the NBN to be profitable, it s being paid by tax money so if it loses money then we can just pay more tax! It s the ideal public private partnership , the citizens take all the risk and the corporations reap all the profits! James Purser describes how Stephen Conroy gave the TV networks something between $250,000,000 and $500,000,000 a year for the next two years [6]. It was claimed that this huge gift would be conditional on the production of more Australian content but they ended up not putting any conditions on it. In a strange coincidence Stephen Conroy did this a month after having a meeting with Kerry Stokes (head of Channel 7). Based on this I don t believe that there was ever a serious plan to make the NBN profitable. I think that the plan was just to take our tax money and spend it on things that benefit friendly corporations. Really it s better for us if the government just hands out $500,000,000 at a time instead of spending $43,000,000,000 on a project that has the same aim of giving a few hundred million to cronies.

• [1] http://etbe.coker.com.au/2010/02/16/national-broadband-porn-network/
• [2] http://jeremy.visser.name/2009/08/30/python-iview/
• [3] http://lkcl.net/rtmp/
• [4] http://www.foxtel.com.au/
• [5] http://www.abs.gov.au/Ausstats/ABS%40.nsf/0/C5B82D434B4BB5F0CA2573D20010E735?opendocument
• [6] http://jamespurser.com.au/blog/Two_Ministers_and_a_Shadow