Search Results: "xam"

2 April 2014

Joey Hess: propellor type-safe reversions

Propellor ensures that a list of properties about a system are satisfied. But requirements change, and so you might want to revert a property that had been set up before. For example, I had a system with a webserver container:
Docker.docked container hostname "webserver"
I don't want a web server there any more. Rather than having a separate property to stop it, wouldn't it be nice to be able to say:
revert (Docker.docked container hostname "webserver")
I've now gotten this working. The really fun part is, some properies support reversion, but other properties certianly do not. Maybe the code to revert them is not worth writing, or maybe the property does something that cannot be reverted. For example, Docker.garbageCollected is a property that makes sure there are no unused docker images wasting disk space. It can't be reverted. Nor can my personal standardSystem Unstable property, which amoung other things upgrades the system to unstable and sets up my home directory.. I found a way to make Propellor statically check if a property can be reverted at compile time. So revert Docker.garbageCollected will fail to type check! The tricky part about implementing this is that the user configures Propellor with a list of properties. But now there are two distinct types of properties, revertable ones and non-revertable ones. And Haskell does not support heterogeneous lists.. My solution to this is a typeclass and some syntactic sugar operators. To build a list of properties, with individual elements that might be revertable, and others not:
 props
        & standardSystem Unstable
        & revert (Docker.docked container hostname "webserver")
        & Docker.docked container hostname "amd64-git-annex-builder"
        & Docker.garbageCollected

Francesca Ciceri: On translations

"Take, for example, the opening to Eleanor Catton's The Luminaries: 'The twelve men congragated in the smoking room of the Crown Hotel gave the impression of a party accidentally met.' This is emphatically not the same as starting a novel with 'So there they were: a dozen men in the Crown Hotel, all together in the smoking-lounge, looking like they'd only met there by chance.' Yes, the explicit narrative data conveyed in the two are the same, but just as you wouldn't be happy with your publisher simply producing a sort of casual paraphrase of your writing and publishing that under your name, so your foreign-language publishers are hiring people to write exactly the same book as the one you've written. (Except for all the words, obviously.) Sound difficult? The reality is harder still. Every language is different. There's no single word in one language that maps perfectly onto a word in another - not one. And every language has things it can do, and things it can't."
[...]
"Once the contract is signed, the translator takes a deep breath and dives in. Their job is two-fold, and simple: they read you, then they write you.
They read you with more care than anybody else will, more demandigly, more inquiringly. Yes, your editor might take a moment to consider your punctuation if it doesn't work and needs rethinking, but translators have to think hard about it even - or especially - if it does."
A beautiful piece on translators: "The curious condition of being a translator" by Daniel Hahn via Paula G es on GV-Authors mailing list.

1 April 2014

Marco d'Itri: Real out of band connectivity with network namespaces

This post explains how to configure on a Linux server a second and totally independent network interface with its own connectivity. It can be useful to access the server when the regular connectivity is broken. This can happen thanks to network namespaces, a virtualization feature available in recent kernels. We need to create a simple script to be run at boot time which will create and configure the namespace. First, move in the new namespace the network interface which will be dedicated to it:
ip netns add oob
ip link set eth2 netns oob
And then configure it as usual with iproute, by executing it in the new namespace with ip netns exec:
ip netns exec oob ip link set lo up
ip netns exec oob ip link set eth2 up
ip netns exec oob ip addr add 192.168.1.2/24 dev eth2
ip netns exec oob ip route add default via 192.168.1.1
The interface must be configured manually because ifupdown does not support namespaces yet, and it would use the same /run/network/ifstate file which tracks the interfaces of the main namespace (this is also a good argument in favour of something persistent like Network Manager...). Now we can start any daemon in the namespace, just make sure that they will not interfere with the on-disk state of other instances:
ip netns exec oob /usr/sbin/sshd -o PidFile=/run/sshd-oob.pid
Netfilter is virtualized as well, so we can load a firewall configuration which will be applied only to the new namespace:
ip netns exec oob iptables-restore < /etc/network/firewall-oob-v4
As documented in ip-netns(8), iproute netns add will also create a mount namespace and bind mount in it the files in /etc/netns/$NAMESPACE/: this is very useful since some details of the configuration, like the name server IP, will be different in the new namespace:
mkdir -p /etc/netns/oob/
echo 'nameserver 8.8.8.8' > /etc/netns/oob/resolv.conf
If we connect to the second SSH daemon, it will create a shell in the second namespace. To enter the main one, i.e. the one used by PID 1, we can use a simple script like:
#!/bin/sh -e
exec nsenter --net --mount --target 1 "$@"
To reach the out of band namespace from the main one we can use instead:
#!/bin/sh -e
exec nsenter --net --mount --target $(cat /var/run/sshd-oob.pid) "$@"
Scripts like these can also be used in fun ssh configurations like:
Host 10.2.1.*
 ProxyCommand ssh -q -a -x -N -T server-oob.example.net 'nsenter-main nc %h %p'

Russ Allbery: Review: Asimov's, September 2011

Review: Asimov's Science Fiction, September 2011
Editor: Sheila Williams
Issue: Volume 35, No. 9
ISSN: 1065-2698
Pages: 112
Due to various other life priorities, it's been quite a while since I read this magazine. Let's see if I can remember the contents well enough to review it properly. The editorial this issue was about the Readers' Awards. Vaguely interesting, but Williams didn't have much to add beyond announcing the winners. I'm very happy to see Rusch's "Becoming One with the Ghosts" win best novella, though. The Silverberg column was more interesting: some musings and pop history about the Japanese convention of a retired emperor and how that fit into national politics. Di Filippo's book review column is all about short story collections, continuing the trend of Di Filippo mostly being interested in things I don't care about. "The Observation Post" by Allen M. Steele: A bit of alternate history set during the Cuban Missile Crisis, but with airships. The protagonist was a radioman aboard a blimp that was patrolling the ocean for Russian vessels sailing to Cuba. A storm forces them down on an island, resulting in an encounter with some claimed tourists who may be Russian spies. The SFnal twist is unlikely to come as much surprise to an experienced reader, and the barb at the end of the story suffers from the same problem. I appreciate the ethical dilemma, but I've also seen it in lots of stories and have a hard time getting fully invested in another version of it. But the story is otherwise competently written. (6) "D.O.C.S." by Neal Barrett, Jr.: Everyone has an author or two that they just don't get. Barrett is one of mine, although this story is a bit less surreal than most of his. I'm fairly sure it's an odd twist on the "death panel" conspiracy theory given a fantastic twist, but it's not entirely forthright about what's going on. Possibly of more interest to those who like Barrett better. (5) "Danilo" by Carol Emshwiller: Emshwiller's stories are always distinctive and not quite like anyone else's, involving odd outsiders and their attempts to make sense of their world. This one involves, as is common, an out-of-the-way village. Lewella claims that she's going to be married to a stranger from the north. No one believes her, although they give her bridal gifts anyway, and then one day she takes her gifts and leaves. The protagonist follows her, to look after her. The rest of the story walks the boundary that Emshwiller often walks, leaving the reader unsure whether the characters are in touch with some deeper reality or insane and suffering, but the ending is even more ambiguous than normal and, at least for me, entirely unsatisfying. (4) "Shadow Angel" by Erick Melton: This is another retread of an old SF idea. This time, it's that piloting through hyperspace involves alternate modes of consciousness and has profound effects on the pilot. The risk of this sort of story is that it turns hallucinatory and a bit incoherent, and I think that happened here. I like the world-building; the glimmers of future politics and trade and the way he weaves alternate timelines into the story caught my interest. But the story wasn't quite coherent enough (although part of this may be reviewing it quite some time after I originally read it). Promising, but not clear, and without quite enough agency for the protagonist. (6) "The Odor of Sanctity" by Ian Creasey: I found this story more memorable. The conceit is that a future society has developed technology that allows the capture and replay of scents, which has created a huge market for special scent experiences and the triggering of memories. The story is set in the Philippines and revolves around a Catholic priest who takes the mission to the poor seriously. He's dying, and several people wonder if it is possible to capture the mythical odor of scantity: the sweet scent said to follow the death of a saint rather than the normal odor of human death. Creasey handles this idea well, blending postulated future technology, the practical and cynical world of the poor streets, and a balance between mystical belief and practical skepticism. Nothing in the story is that surprising, but I was happy with the eventual resolution. (7) "Grandma Said" by R. Neube: This story's protagonist is a cleanser on a frontier planet made extremely dangerous by a virulent alien fungus. It is almost always fatal and very difficult to eradicate. Vic's job is to completely sanitize anything that had been in contact with a victim and maintain the other rules of strict quarantine required to keep the fungal infection from spreading uncontrolled. Nuebe weaves world-building together with Vic's background and adds a twist in the form of deeply unhealthy responses to the constant stress of living near death. Well told, if a bit disturbing. (7) "Stalker" by Robert Reed: Reed has a knack for fascinating and disturbing stories, and this is an excellent example of the type. The protagonist is a manufactured companion who is completely devoted to its owner. Their commercial name is Adorers, but everyone calls them Stalkers. In this case, the protagonist's owner is a serial rapist and murderer; given that, and given how good Reed is at writing these sorts of stories, you can probably imagine how chilling it is. As usual, there is a sharp barb in the ending, and not the one I was expecting. Good if you can handle the graphic violence and disturbing subject material. (7) "Burning Bibles" by Alan Wall: This is an interesting twist on the spy thriller. A three-letter agency in charge of investigating possible terrorist plots becomes suspicious after a warehouse of Bibles burns in mysterious circumstances. The agent they send in is a deaf-mute with special powers of intuition. This prompted some eye-rolling, and there's a lot of magic disability powers here to annoy, but it's played mostly straight after that introduction. The rest is a fairly conventional spy story, despite special empathic powers, but it's one I enjoyed and thought was fairly well-written. (7) Rating: 6 out of 10

31 March 2014

Laura Arjona: MiniDebConf Barcelona 2014

Wow, I cannot believe it has already been 2 weeks from MiniDebConf Barcelona.
It has been the first Debian event (and free software conference) that I have attended in person, and I took the opportunity to get more involved, giving a talk about translations together with Francesca Ciceri, and two lightning talks about two free software projects that I use and love and I d like to see them packaged for Debian: Pump.io and GNU MediaGoblin (videos coming soon). I also somehow-promoted Keysigning during the conference (well, in fact, I just sent some two emails to the mailing list before, and printed stickers with May I sign your key? slogan so we could keysign easily in the freetime between talks). The people I ve met some people in person, who I was following in the Debian mailing lists and identi.ca for long time (years, in some cases \o/). It has been amazing to meet Francesca Ciceri and Enrico Zini, since their blogposts and vision about Debian diversity skills have influenced very much in my involvement in Debian. It has been very important to me to be able to say THANK YOU to Tiago from the Debian video team (sorry Holger, I couldn t manage to meet you face to face), because I have learned so many things watching videos from Debconfs! Videos helped me to feel that I m part of the community, even when I cannot attend to the events, by following the streaming and being able to recognize the faces of the people and the work they do in Debian. I ve met many Debian Women, of course. I m so fan of all of them! I m enjoying a welcoming and diverse community thanks to many of them that worked since many years ago to make Debian what it is now, and faced bitter moments too. I cannot say that I engaged in many deep conversations (well, maybe some 2 or 3, and me mostly listening), but the most important thing that I keep from them was simply being there , watching and listening, enjoying the voices of the experience like Ana and Miriam, and the freshness and joy of Tassia, Solveig and Elena, for example. I ve tried to be welcoming too, I m not a newbie anymore as new people come to the group :) New projects (and renewing forces for other) Debian contributors I wanted to get more involved in the Debian contributors project and it has been a perfect opportunity to understand better all what I had read and watched about it before going to Barcelona. My plan is, apart of doing promotion as with all the projects that I use and love, to try to get translator work credited via Debian Contributors. That means to hack the l10n bot that now gathers info from the mailing lists to build the coordination pages for translators. It shouldn t be difficult to make it send that info to contributors.debian.org site, but I ll try to understand how it works and propose an elegant patch. No idea about Perl, btw, but anyway, it s a good excuse to start learning. Mediagoblin and pump.io packaging I m not sure I can help on this, but I ll keep an eye in the evolution of the Debian packaging of GNU MediaGoblin and the Pumpiverse software. I ll give moral support, at least, to the people actually working on that :) Website and Publicity team After Solveig s talk about bug triaging I ve been thinking about some bugs that I reviewed in the Website and Publicity team, and I think I should make a new round on the pending bugs to close them if they don t apply anymore, or to try to push a bit more towards a solution, if I can. Tails website translation Tails is a Debian derivative preconfigured to work out-of-the-box with privacy and anonymity features, since uses the Tor network for all the outgoing and ingoing connections.
Solveig proposed me to join the Spanish translators team at Tails. I just joined the translators mailing list, in order to help translating the Tails website into Spanish (the software is already translated, under the Tor Project). This is a new challenge from the translation point of view, since they work with PO files. And now, what? Well, first, I ll try to clean a bit my TODO list, mainly about translations, and other things not related to Debian. From now on until summer, I ll keep an eye and a hand on all the projects in which I am involved, and also I ll try to keep on engaging with the community via pump.io, the mailing lists, and IRC channels. Next summer, if I can put in order my GPG keys (long story), I ll try to join the Debian New Member process. If not, I ll try to get new keys and some signs, and then I ll apply. OTOH, thanks to the end of Windows XP support, it seems that some people are willing to migrate to any GNU/Linux distribution, and of course I m recommending Debian. Expect some blog posts about these migrations (wow, I should migrate some servers that still run Squeeze too ) and my new role of Debian help desk at job, if finally some people decide to migrate. I have gathered Debian stickers to proudly give to anyone that installs Debian in their computer!
Filed under: Events, My experiences and opinion, Videos Tagged: Communities, Contributing to libre software, Debian, English, Free Software, libre software, MediaGoblin, Moving into free software, pump.io, translations

Francesca Ciceri: Random notes from MiniDebconf Barcelona 2014

First of all, let me say this: Barcelona MiniDebconf was awesome. So the most important part of this post is a very big thank you to the organizers, volunteers, speakers, sponsors and attendees. Now, down to business. Day 0 Day 0 was a day of travelling, more or less: the Italian Cabal (me, Enrico, Elena and Diego) left in the early morning from Varese (where we had an epic Munchkin Apocalypse game the night before), and we travelled by car across Liguria and France and finally reached Barcelona in the evening. (Boring! Even more if you don't drive. I hate long trips by car) We reached Barcelona in time for the pre-registration event at Falstaff Bar, eat a great Falafel and hugged lots of people. Day 1 To me the highlight of Day 1 was to finally meet in person Laura Arjona, Spanish translator, publicity volunteer, pump.io and mediagoblin contributor. We had decided to have a workshop together about translations and we spent the morning more or less tweaking our presentation and chatting :). So, save for Elena's talk on 3d printing in Debian ("The Universal OS: now making tabletop games and cookie cutters!" -- which was great!) I missed all the talks in the morning. But thanks to the always amazing videoteam, I'll be able to watch them later, when the recordings will be published :). For me, the best talk of the day - well, no, actually of the conference! - was that afternoon: Ana Isabel Carvalho told us about the Libre Graphics Magazine project. Libre Graphics Magazine is a well written and designed magazine at the crossroad between Free Software tools and ideals and graphic arts and design. A crossroad not very much frequented, I'd say. But then, maybe I'm wrong: it's not that graphic artists don't use Free Software tools, it's more like the one who do are invisible.
This is one purpose of a Libre Graphics Magazine: to serve as a catalyst for discussion, to build a home for the users of Libre Graphics software, standards and methods. In such a magazine, we may unite all our previously disparate successes, all the successes which have, until now, stood alone as small examples, disjointed from the larger community. We have the opportunity to elevate the discourse around Libre Graphics as a professionally viable option, to raise previously unmentioned issues and to push forward the conception of just what Libre Graphics can produce.
If you are even only vagued interested in typefaces, fonts, design and graphic art take a look at the magazine: it's CC-BY-SA licensed and you can download it for free, or buy a paper copy (which is amazing, really!). And it's not just about graphic arts: if you skim over the titles of the issues, you can find that they've talked about things like "Localisation/Internationalization", "Use Cases and Affordances" and, my favourite, "Gendering F/LOSS". On a similar topic, Siri's talk about "Why aren't more designers using Debian or working for Debian?" tried to shed a light on the difficult relationship between Free Software tools and graphic artists. These are the voices we need to listen to if we want to bring more graphic artists to Debian, and $deity knows that Debian needs them a lot :). After Solveig's talk about bug triaging and Miriam's one on packaging, it was time for the l10n workshop. I think it went well: we tried to briefly explain the translation workflow in Debian, and to translate together with the audience a po-debconf message. It wasn't maybe enough to complete and submit a translation, but hopefully it gave the audience an idea about how to do it. The day ended with a party for Debian Women 10th anniversary. And the cake wasn't a lie, beside being very good. Day 2 This, I'll remember as "the day I exited my comfort zone". Ok, I'm making a bit of fuss about it, but it was my first talk in English all alone. I spoke about the non-uploading DD process and how to keep your (and others') sanity in a big community project (slides here). I think it's very important to remind people that not all DDs are coding persons. And you don't need to be a developer to love Debian, contribute to it and become an official member of the project. But writing this presentation was for me also the occasion to take stock of my experience in Debian so far: in that talk slipped many of my demons, as impostor syndrome or overcommitment. But all the things I said are more or less, common sense - nothing new! - and lesson learned on the road: it's been now 2 years as DD and 4 as contributor. I'm pretty sure it's thanks to the special conditions of this conference (only speakers identifying themselves as female, a safe and very friendly environment) that I had the courage to give a talk. So the conference was a complete success on that regard, too. In the afternoon I was able to do one of the things I love: videoteam duty. Though I convinced Riccio to switch roles and to give me the camera: my experience in directing during last DebConf left me a bit scarred. Special mention for Laura speaking of pump.io and MediaGoblin and Solveig of Tails during the "Lightning Talks" and the people from LelaCoders during the "Bits from Local Communities" session. The Day(s) after: a Debian Contributors hackathon In my experience a measure of a conference's success is the burst of activity in pet projects just afterwards. In this, also, Barcelona MiniConf was a success: during the weekend, Enrico, Laura and I had the chance to talk together about Debian Contributors and make some plans.
So, as soon as we got in Italy again, I took possession of Enrico's couch for a couple of days and we did a little bit of hacking on Contributors. For my part, I mostly worked in trying to add more data sources to the site: my (not so) secret agenda is to map most of the non-coding contributions. That basically means: translators, publicity editors, event organizers and volunteers, etc. Being in the same room as Enrico, gave me the chance to ask him how to add data sources and to test the existing code (we spot a little problem in the prototype for svn repository mining he made a while ago). At the end of the hackathon, I had managed to: Please note that if you have contributed to one of the repo above and you are not listed there, it means that the automatic recognition of your email address didn't work. We still need to implement a manual interface for the recognition of email addresses: patches are very much welcome! Meanwhile Enrico: If you care about recognition of diverse contributions in Debian, help us: read the project todo list and subscribe to the low traffic mailing list or browse the project Git repository.

30 March 2014

Petter Reinholdtsen: Debian Edu interview: Roger Marsal

Debian Edu / Skolelinux keep gaining new users. Some weeks ago, a person showed up on IRC, #debian-edu, with a wish to contribute, and I managed to get a interview with this great contributor Roger Marsal to learn more about his background. Who are you, and how do you spend your days? My name is Roger Marsal, I'm 27 years old (1986 generation) and I live in Barcelona, Spain. I've got a strong business background and I work as a patrimony manager and as a real estate agent. Additionally, I've co-founded a British based tech company that is nowadays on the last development phase of a new social networking concept. I'm a Linux enthusiast that started its journey with Ubuntu four years ago and have recently switched to Debian seeking rock solid stability and as a necessary step to gain expertise. In a nutshell, I spend my days working and learning as much as I can to face both my job, entrepreneur project and feed my Linux hunger. How did you get in contact with the Skolelinux / Debian Edu project? I discovered the LTSP advantages with "Ubuntu 12.04 alternate install" and after a year of use I started looking for an alternative. Even though I highly value and respect the Ubuntu project, I thought it was necessary for me to change to a more robust and stable alternative. As far as I was using Debian on my personal laptop I thought it would be fine to install Debian and configure an LTSP server myself. Surprised, I discovered that the Debian project also supported a kind of Edubuntu equivalent, and after having some pain I obtained a Debian Edu network up and running. I just loved it. What do you see as the advantages of Skolelinux / Debian Edu? I found a main advantage in that, once you know "the tips and tricks", a new installation just works out of the box. It's the most complete alternative I've found to create an LTSP network. All the other distributions seems to be made of plastic, Debian Edu seems to be made of steel. What do you see as the disadvantages of Skolelinux / Debian Edu? I found two main disadvantages. I'm not an expert but I've got notions and I had to spent a considerable amount of time trying to bring up a standard network topology. I'm quite stubborn and I just worked until I did but I'm sure many people with few resources (not big schools, but academies for example) would have switched or dropped. It's amazing how such a complex system like Debian Edu has achieved this out-of-the-box state. Even though tweaking without breaking gets more difficult, as more factors have to be considered. This can discourage many people too. Which free software do you use daily? I use Debian, Firefox, Okular, Inkscape, LibreOffice and Virtualbox. Which strategy do you believe is the right one to use to get schools to use free software? I don't think there is a need for a particular strategy. The free attribute in both "freedom" and "no price" meanings is what will really bring free software to schools. In my experience I can think of the "R" statistical language; a few years a ago was an extremely nerd tool for university people. Today it's being increasingly used to teach statistics at many different level of studies. I believe free and open software will increasingly gain popularity, but I'm sure schools will be one of the first scenarios where this will happen.

Joey Hess: propellor

Whups, I seem to have built a configuration management system this evening! Propellor has similar goals to chef or puppet or ansible, but with an approach much more like slaughter. Except it's configured by writing Haskell code. The name is because propellor ensures that a system is configured with the desired PROPerties, and also because it kind of pulls system configuration along after it. And you may not want to stand too close. Disclaimer: I'm not really a sysadmin, except for on the scale of "diffuse administration of every Debian machine on planet earth or nearby", and so I don't really understand configuration management. (Well, I did write debconf, which claims to be the "Debian Configuration Management system".. But I didn't understand configuration management back then either.) So, propellor makes some perhaps wacky choices. The least of these is that it's built from a git repository that any (theoretical) other users will fork and modify; a cron job can re-make it from time to time and pull down configuration changes, or something can be run to push changes. A really simple configuration for a Tor bridge server using propellor looks something like this:
main = ensureProperties
    [ Apt.stdSourcesList Apt.Stable  onChange  Apt.upgrade
    , Apt.removed ["exim4"]  onChange  Apt.autoRemove
    , Hostname.set "bridget"
    , Ssh.uniqueHostKeys
    , Tor.isBridge
    ]
Since it's just haskell code, it's "easy" to refactor out common configurations for classes of servers, etc. Or perhaps integrate reclass? I don't know. I'm happy with just pure functions and type-safe refactorings of my configs, I think. Properties are also written in Haskell of course. This one ensures that all the packages in a list are installed.
installed :: [Package] -> Property
installed ps = check (isInstallable ps) go
  where
        go = runApt $ [Param "-y", Param "install"] ++ map Param ps
Here's one that ensures the hostname is set to the desired value, which shows how to specify content for a file, and also how to run another action if a change needed to be made to satisfy a property.
set :: HostName -> Property
set hostname = "/etc/hostname"  File.hasContent  [hostname]
         onChange  cmdProperty "hostname" [Param hostname]
Here's part of a custom one that I use to check out a user's home directory from git. Shows how to make a property require that some other property is satisfied first, and how to test if a property has already been satisfied.
installedFor :: UserName -> Property
installedFor user = check (not <$> hasGitDir user) $
        Property ("githome " ++ user) (go =<< homedir user)
                     requires  Apt.installed ["git", "myrepos"]
  where
    go ... -- 12 lines elided
I'm about 37% happy with the overall approach to listing properties and combining properties into larger properties etc. I think that some unifying insight is missing -- perhaps there should be a Property monad? But as long as it yields a list of properties, any smarter thing should be able to be built on top of this. Propellor is 564 lines of code, including 25 or so built-in properties like the examples above. It took around 4 hours to build. I'm pretty sure it was easier to write it than it would have been to look into ansible and salt and slaughter (and also liw's human-readable configuration language whose name I've forgotten) in enough detail to pick one, and learn how its configuration worked, and warp it into something close to how I wanted this to work. I think that's interesting.. It's partly about NIH and I-want-everything-in-Haskell, but it's also about a complicated system that is a lot of things to a lot of people -- of the kind I see when I look at ansible -- vs the tools and experience to build just the thing you want without the cruft. Nice to have the latter!

29 March 2014

Steve Kemp: Some things on DNS and caching

Although there wasn't too many comments on my what would you pay for? post I did get some mails. I was reminded about this via Mario Langs post, which echoed a couple of private mails I received. Despite being something that I take for granted, perhaps because my hosting comes from the Bytemark, people do seem willing to pay money for DNS hosting. Which is odd. I mean you could do it very very very cheaply if you had just four virtual machines. You can get complex and be geo-fancy, and you could use anycast on a small AS, but really? You could just deploy four virtual machines0 to provide a.ns, b.ns, c.ns, d.ns, and be better than 90% of DNS hosters out there. The thing that many people mentioned was Git-backed, or Git-based DNS. Which would be trivial if you used tinydns, and no much harder if you used bind. I suspect I'm "not allowed" to do DNS-things for a while, due to my contract with Dyn, but it might be worth checking... ObRandom: Beat me to it. Register gitdns.io, or similar, and configure hooks from github to compile tinydns records. In other news I started documenting early thoughts about my caching reverse proxy, which has now got a name stockpile. I wrote some stub code using node.js, and although it was functional it soon became callback hell: Expressing the rules neatly is also a challenge. I want the server core to be simple and the configuration to be something like:
is_cachable ( vhost, source, request, backened )
 
    /**
     * If the file is static, then it is cachable.
     */
    if ( request.url.match( /\.(jpg png txt html? gif)$/i ) )  
        return true;
     
    /**
     * If there is a cookie then the answer is false.
     */
    if ( request.has_cookie? )   return false ;  
    /**
     * If the server is alive we'll now pass the remainder through it
     * if not then we'll serve from the cache.
     */
    if ( backend.alive? )  
        return false;
     
    else  
        return true;
     
 
I can see there is value in judging the cachability based on the server response, but I plan to ignore that except for "Expires:", "Etag", etc ,etc) Anyway callback hell does make me want to reexamine the existing C/C++ libraries out there. Because I think I could do better.

27 March 2014

Wouter Verhelst: GSS-TSIG

While reading up on dnssec-keygen and other related stuff in order to update my puppet bind module to support DNSSEC transparently, I accidentally stumbled across something in the BIND Administrator's Reference Manual called GSS-TSIG. Intrigued, I set out to learn more, and found that this is terribly easy to set up with BIND: There are a few more interesting features; e.g., krb5-self can be used to allow the host/machine@REALM principal to update the A record for machine, and there are ways to specify ACLs by wildcard. For more information, see the BIND administrator's reference manual, chapter 6, in the section entitled "Dynamic Update Policies".

26 March 2014

Russell Coker: The Aspie Accent

I am often asked about my accent . The most common guess is that it s a British accent, while I lived in London for about a year I don t think that my accent changed much during that time (people have commented on the way I speak since I was in primary school). Also there isn t a British accent anyway, the Wikipedia page of Regional Accents of English has the first three sections devoted to accents in the island of Britain (and Northern Ireland is part of the United Kingdom which people often mean when they sat Britain ). The Received Pronounciation is the main BBC accent and the accent that is most associated with Britain/England/the UK (which are three different things even though most people don t know it) and I don t think that I sound like that at all. I ve had various other guesses, the Netherlands (where I lived for a few years but mostly spoke to other foreigners), New Zealand (which I ve visited a couple of times for conferences), Denmark (the closest I got was attending a conference in Sweden), and probably others I can t remember. If I actually had developed an accent from another country then it would probably be from the US. The amount of time I ve spent watching Hollywood movies and watching US TV shows greatly exceeds the amount of time I ve spent listening to people from all other countries. The fact that among all the people who wanted to try and guess where my accent supposedly originated none have ever included the US seems like strong evidence to suggest that I don t have any sort of accent that really derives from another country. Also I have never had someone mistake me for being a resident of their own country based on accent which seems like clear evidence that all claims about me having a foreign accent are bogus. Autism forums such as WrongPlanet.net [1] always turn up plenty of results for a search on accent . In such discussions it seems that a British accent is most common mistake and there are often theories raised about why that is often related to speaking in a formal or precise way or by using a large vocabulary. Also in such discussions the list of countries that people supposedly have accents from is very inclusive, it seems that any country that the listener has heard of but doesn t know that well is a good candidate. The fact that Aspies from outside the US are rarely regarded as having an American accent could be due to the fact that Hollywood has made most of the world population aware of what most American accents sound like. Also if I really had some sort of accent from another country then probably someone would comment on that when I m outside Australia. When I m travelling people tend to recognise my accent as Australian, while it doesn t please me when someone thinks that I sound like Crocodile Dundee (as happened in the Netherlands) it might not be entirely inaccurate. This is Annoying The way the issue of accent is raised is generally in the form of people asking where I m from, it seems to imply that they don t think I belong in Australia because of the way I speak. It s particularly annoying when people seem unable to realise that they are being obnoxious after the first wrong guess. When I reply no to the first are you from $COUNTRY question and don t offer any further commentary it s not an invitation to play 20 questions regarding where I m supposedly from, it s actually an indication that I m not interested in a conversation on that topic. A Social Skills 101 course would include teaching people that when someone uses one-word answers to your questions it usually means that they either don t like your questions or don t want to talk to you. Social Skills vs Status The combination of persistence and misreading a social situation which are involved when someone interrogates me about my supposed accent are both parts of the diagnostic criteria for Autism. But I generally don t get questions about my accent in situations where there are many Aspies (IE anything related to the Free Software community). I think that this is because my interactions with people in the Free Software community are based around work (with HR rules against being a jerk) and community events where no-one would doubt that I belong. I mostly get questions about my accent from random middle-class white people who feel entitled to query other people about their status who I meet in situations where there is nothing restraining them from being a jerk. For example random people I meet on public transport.

25 March 2014

Petter Reinholdtsen: Public Trusted Timestamping services for everyone

Did you ever need to store logs or other files in a way that would allow it to be used as evidence in court, and needed a way to demonstrate without reasonable doubt that the file had not been changed since it was created? Or, did you ever need to document that a given document was received at some point in time, like some archived document or the answer to an exam, and not changed after it was received? The problem in these settings is to remove the need to trust yourself and your computers, while still being able to prove that a file is the same as it was at some given time in the past. A solution to these problems is to have a trusted third party "stamp" the document and verify that at some given time the document looked a given way. Such notarius service have been around for thousands of years, and its digital equivalent is called a trusted timestamping service. The Internet Engineering Task Force standardised how such service could work a few years ago as RFC 3161. The mechanism is simple. Create a hash of the file in question, send it to a trusted third party which add a time stamp to the hash and sign the result with its private key, and send back the signed hash + timestamp. Both email, FTP and HTTP can be used to request such signature, depending on what is provided by the service used. Anyone with the document and the signature can then verify that the document matches the signature by creating their own hash and checking the signature using the trusted third party public key. There are several commercial services around providing such timestamping. A quick search for "rfc 3161 service" pointed me to at least DigiStamp, Quo Vadis, Global Sign and Global Trust Finder. The system work as long as the private key of the trusted third party is not compromised. But as far as I can tell, there are very few public trusted timestamp services available for everyone. I've been looking for one for a while now. But yesterday I found one over at Deutches Forschungsnetz mentioned in a blog by David M ller. I then found a good recipe on how to use the service over at the University of Greifswald. The OpenSSL library contain both server and tools to use and set up your own signing service. See the ts(1SSL), tsget(1SSL) manual pages for more details. The following shell script demonstrate how to extract a signed timestamp for any file on the disk in a Debian environment:
#!/bin/sh
set -e
url="http://zeitstempel.dfn.de"
caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
cafile=chain.txt
if [ ! -f $cafile ] ; then
    wget -O $cafile "$caurl"
fi
openssl ts -query -data "$1" -cert   tee "$reqfile" \
      /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
openssl ts -reply -in "$resfile" -text 1>&2
openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
base64 < "$resfile"
rm "$reqfile" "$resfile"
The argument to the script is the file to timestamp, and the output is a base64 encoded version of the signature to STDOUT and details about the signature to STDERR. Note that due to a bug in the tsget script, you might need to modify the included script and remove the last line. Or just write your own HTTP uploader using curl. :) Now you too can prove and verify that files have not been changed. But the Internet need more public trusted timestamp services. Perhaps something for Uninett or my work place the University of Oslo to set up?

Sylvain Le Gall: Release of OASIS 0.4.3

I am happy to announce the release of OASIS v0.4.3. Logo OASIS small OASIS is a tool to help OCaml developers to integrate configure, build and install systems in their projects. It should help to create standard entry points in the source code build system, allowing external tools to analyse projects easily. This tool is freely inspired by Cabal which is the same kind of tool for Haskell. You can find the new release here and the changelog here. More information about OASIS in general on the OASIS website. Here is a quick summary of the important changes: Features: This new version closes 4 bugs, mostly related to parsing of _oasis. It also includes a lot of refactoring to improve the overall quality of OASIS code base. The big project for the next release will be to setup a Windows host for regular build and test on this platform. I plan to use WODI for this setup. I would like to thanks again the contributor for this release: David Allsopp, Martin Keegan and Jacques-Pascal Deplaix. Their help is greatly appreciated.

23 March 2014

Dominique Dumont: Easier Lcdproc package upgrade with automatic configuration merge

Hello This blog explains how next lcdproc package provide easier upgrader with automatic configuration merge. Here s the current situation: lcdproc is shipped with several configuration files, including /etc/LCDd.conf. This file is modified upstream at every lcdproc release to bring configuration for new lcdproc drivers. On the other hand, this file is always customized to suit the specific hardware of the user s system. So upgrading a package will always lead to a conflict during upgrade. User will always be required to choose whether to use current version or upstream version. Next version of libconfig-model-lcdproc-perl will propose user whether to perform automatic merge of the configuration: upstream change are taken into account while preserving user change. The configuration upgrade shown is based on Config::Model can be applied to other package. Current lcdproc situation To function properly, lcdproc configuration must always be adapted to suit the user s hardware. On the following upgrade, upstream configuration is often updated so user will often be shown this question:
Configuration file '/etc/LCDd.conf'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** LCDd.conf (Y/I/N/O/D/Z) [default=N] ?
This question is asked in the middle of an upgrade and can be puzzling for an average user. Next package with automatic merge Starting from lcdproc 0.5.6, the configuration merge is handled automatically by the packaging script with the help of Config::Model::Lcdproc. When lcdproc is upgraded to 0.5.6, the following changes are visible:
* lcdproc depends on libconfig-model-lcdproc-perl
* user is asked once by debconf whether to use automatic configuration upgrades or not.
* no further question are asked (no ucf style questions). For instance, here s an upgrade from lcdproc_0.5.5 to lcdproc_0.5.6:
$ sudo dpkg -i lcdproc_0.5.6-1_amd64.deb 
(Reading database ... 322757 files and directories currently installed.)
Preparing to unpack lcdproc_0.5.6-1_amd64.deb ...
Stopping LCDd: LCDd.
Unpacking lcdproc (0.5.6-1) over (0.5.5-3) ...
Setting up lcdproc (0.5.6-1) ...
Changes applied to lcdproc configuration:
- server ReportToSyslog: '' -> '1' # use standard value
update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults
Starting LCDd: LCDd.
Processing triggers for man-db (2.6.6-1) ...
Note: the automatic upgrade currently applies only to LCDd.conf. The other configuration files of lcdproc are handled the usual way. Other benefits User will also be able to:
* check lcdproc configuration with sudo cme check lcdproc
* edit the configuration with a GUI (see Managing Lcdproc configuration with cme for more details) Here s a screenshot of the GUI: GUI to edit lcdproc configuration More information * libconfig-model-lcdproc-perl package page. This package provides a configuration model for lcdproc.
* This blog explains how this model is generated from upstream LCDd.conf.
* How to adapt a package to perform configuration upgrade with Config::Model Next steps Automatic configuration merge can be applied to other packages. But my free time is already taken by the maintenance of Config::Model and the existing models, there s no room for me to take over another package. On the other hand, I will definitely help people who want to provide automatic configuration merge on their packages. Feel free to contact me on:
* config-model-user mailing list
* debian-perl mailing list (where Config::Model is often used to maintain debian package file with cme)
* #debian-perl IRC channel All the best
Tagged: config-model, configuration, debian, Perl, upgrade

22 March 2014

Keith Packard: glamor-core

Core Rendering with Glamor I ve hacked up the intel driver to bypass all of the UXA paths when Glamor is enabled so I m currently running an X server that uses only Glamor for all rendering. There are still too many fall backs, and performance for some operations is not what I d like, but it s entirely usable. It supports DRI3, so I even have GL applications running. Core Rendering Status I ve continued to focus on getting the core X protocol rendering operations complete and correct; those remain a critical part of many X applications and are a poor match for GL. At this point, I ve got accelerated versions of the basic spans functions, filled rectangles, text and copies. GL and Scrolling OpenGL has been on a many-year vendetta against one of the most common 2D accelerated operations copying data within the same object, even when that operation overlaps itself. This used to be the most performance-critical operation in X; it was used for scrolling your terminal windows and when moving windows around on the screen. Reviewing the OpenGL 3.x spec, Eric and I both read the glCopyPixels specification as clearly requiring correct semantics for overlapping copy operations it says that the operation must be equivalent to reading the pixels and then writing the pixels. My CopyArea acceleration thus uses this path for the self-copy case. However, the ARB decided that having a well defined blt operation was too nice to the users, so the current 4.4 specification adds explicit language to assert that this is not well defined anymore (even in the face of the existing language which is pretty darn unambiguous). I suspect we ll end up creating an extension that offers what we need here; applications are unlikely to stop scrolling stuff around, and GPUs (at least Intel) will continue to do what we want. This is the kind of thing that makes GL maddening for 2D graphics the GPU does what we want, and the GL doesn t let us get at it. For implementations not capable of supporting the required semantic, someone will presumably need to write code that creates a temporary copy of the data. PBOs for fall backs For operations which Glamor can t manage, we need to fall back to using a software solution. Direct-to-hardware acceleration architectures do this by simply mapping the underlying GPU object to the CPU. GL doesn t provide this access, and it s probably a good thing as such access needs to be carefully synchronized with GPU access, and attempting to access tiled GPU objects with the CPU require either piles of CPU code to de-tile accesses (ala wfb), or special hardware detilers (like the Intel GTT). However, GL does provide a fairly nice abstraction called pixel buffer objects (PBOs) which work to speed access to GPU data from the CPU. The fallback code allocates a PBO for each relevant X drawable, asks GL to copy pixels in, and then calls fb, with the drawable now referencing the temporary buffer. On the way back out, any potentially modified pixels are copied back through GL and the PBOs are freed. This turns out to be dramatically faster than malloc ing temporary buffers as it allows the GL to allocate memory that it likes, and for it to manage the data upload and buffer destruction asynchronously. Because X pixmaps can contain many X windows (the root pixmap being the most obvious example), they are often significantly larger than the actual rendering target area. As an optimization, the code only copies data from the relevant area of the pixmap, saving considerable time as a result. There s even an interface which further restricts that to a subset of the target drawable which the Composite function uses. Using Scissoring for Clipping The GL scissor operation provides a single clipping rectangle. X provides a list of rectangles to clip to. There are two obvious ways to perform clipping here either perform all clipping in software, or hand each X clipping rectangle in turn to GL and re-execute the entire rendering operation for each rectangle. You d think that the former plan would be the obvious choice; clearly re-executing the entire rendering operation potentially many times is going to take a lot of time in the GPU. However, the reality is that most X drawing occurs under a single clipping rectangle. Accelerating this common case by using the hardware clipper provides enough benefit that we definitely want to use it when it works. We could duplicate all of the rendering paths and perform CPU-based clipping when the number of rectangles was above some threshold, but the additional code complexity isn t obviously worth the effort, given how infrequently it will be used. So I haven t bothered. Most operations look like this:
Allocate VBO space for data
Fill VBO with X primitives
loop over clip rects  
    glScissor()
    glDrawArrays()
 
This obviously out-sources as much of the problem as possible to the GL library, reducing the CPU time spent in glamor to a minimum. A Peek at Some Code With all of these changes in place, drawing something like a list of rectangles becomes a fairly simple piece of code: First, make sure the program we want to use is available and can be used with our GC configuration:
prog = glamor_use_program_fill(pixmap, gc,
                               &glamor_priv->poly_fill_rect_program,
                               &glamor_facet_polyfillrect);
if (!prog)
    goto bail_ctx;
Next, allocate the VBO space and copy all of the X data into it. Note that the data transfer is simply memcpy here that s because we break the X objects apart in the vertex shader using instancing, avoiding the CPU overhead of computing four corner coordinates.
/* Set up the vertex buffers for the points */
v = glamor_get_vbo_space(drawable->pScreen, nrect * (4 * sizeof (GLshort)), &vbo_offset);
glEnableVertexAttribArray(GLAMOR_VERTEX_POS);
glVertexAttribDivisor(GLAMOR_VERTEX_POS, 1);
glVertexAttribPointer(GLAMOR_VERTEX_POS, 4, GL_SHORT, GL_FALSE,
                      4 * sizeof (GLshort), vbo_offset);
memcpy(v, prect, nrect * sizeof (xRectangle));
glamor_put_vbo_space(screen);
Finally, loop over the pixmap tile fragments, and then over the clip list, selecting the drawing target and painting the rectangles:
glEnable(GL_SCISSOR_TEST);
glamor_pixmap_loop(pixmap_priv, box_x, box_y)  
    int nbox = RegionNumRects(gc->pCompositeClip);
    BoxPtr box = RegionRects(gc->pCompositeClip);
    glamor_set_destination_drawable(drawable, box_x, box_y, TRUE, FALSE, prog->matrix_uniform, &off_x, &off_y);
    while (nbox--)  
        glScissor(box->x1 + off_x,
                  box->y1 + off_y,
                  box->x2 - box->x1,
                  box->y2 - box->y1);
        box++;
        glDrawArraysInstanced(GL_TRIANGLE_STRIP, 0, 4, nrect);
     
 
GL texture size limits X pixmaps use 16 bit dimensions for width and height, allowing them to be up to 65536 x 65536 pixels. Because the X coordinate space is signed, only a quarter of this space is actually useful, which makes the useful size of X pixmaps only 32767 x 32767. This is still larger than most GL implementations offer as a maximum texture size though, and while it would be nice to just say we don t allow pixmaps larger than GL textures , the reality is that many applications expect to be able to allocate such pixmaps today, largely to hold the ever increasing size of digital photographs. Glamor has always supported large X pixmaps; it does this by splitting them up into tiles, each of which is no larger than the largest texture supported by the driver. What I ve added to Glamor is some simple macros that walk over the array of tiles, making it easy for the rendering code to support large pixmaps without needing any special case code. Glamor also had some simple testing support you can compile the code to ignore the system-provided maximum texture size and supply your own value. This code had gone stale, and couldn t work as there were parts of the code for which tiling support just doesn t make sense, like the glyph cache, or the X scanout buffer. I fixed things so that you could leave those special cases as solitary large tiles while breaking up all other pixmaps into tiles no larger than 32 pixels square. I hope to remove the single-tile case and leave the code supporting only the multiple-tile case; we have to have the latter code, and so having the single-tile code around simply increases our code size for not obvious benefit. Getting accelerated copies between tiled pixmaps added a new coordinate system to the mix and took a few hours of fussing until it was working. Rebasing Many (many) Times I m sure most of us remember the days before git; changes were often monolithic, and the notion of changing how the changes were made for the sake of clarity never occurred to anyone. It used to be that the final code was the only interesting artifact; how you got there didn t matter to anyone. Things are different today; I probably spend a third of my development time communicating how the code should change with other developers by changing the sequence of patches that are to be applied. In the case of Glamor, I ve now got a set of 28 patches. The first few are fixes outside of the glamor tree that make the rest of the server work better. Then there are a few general glamor infrastructure additions. After that, each core operation is replaced, one a at a time. Finally, a bit of stale code is removed. By sequencing things in a logical fashion, I hope to make review of the code easier, which should mean that people will spend less time trying to figure out what I did and be able to spend more time figuring out if what I did is reasonable and correct. Supporting Older Versions of GL All of the new code uses vertex instancing to move coordinate computation from the CPU to the GPU. I m also pulling textures apart using integer operations. Right now, we should correctly fall back to software for older hardware, but it would probably be nicer to just fall back to simpler GL instead. Unless everyone decides to go buy hardware with new enough GL driver support, someone is going to need to write simplified code paths for glamor. If you ve got such hardware, and are interested in making it work well, please take this as an opportunity to help yourself and others. Near-term Glamor Goals I m pretty sure we ll have the code in good enough shape to merge before the window closes for X server 1.16. Eric is in charge of the glamor tree, so it s up to him when stuff is pulled in. He and Markus Wick have also been generating code and reviewing stuff, but we could always use additional testing and review to make the code as good as possible before the merge window closes. Markus has expressed an interest in working on Glamor as a part of the X.org summer of code this year; there s clearly plenty of work to do here, Eric and I haven t touched the render acceleration stuff at all, and that code could definitely use some updating to use more modern GL features. If that works as well as the core rendering code changes, then we can look forward to a Glamor which offers GPU-limited performance for classic X applications, without requiring GPU-specific drivers for every generation of every chip.

21 March 2014

Sylvestre Ledru: Rebuild of Debian using Clang 3.4

Using the AWS donation, David Suarez and myself have been able to rebuild the whole archive with Clang 3.4.
The rebuild has been done January 10th but, with my new job, I did not find the time to publish the result.
Releases after releases, the results are getting better and better. Currently, 2193 packages in the archive are failing to build from source.
That is roughly the same number of build failures as with the precedent rebuild with Clang 3.3.
However, this is good news for two reasons:
* the number of new packages in Debian increased (18854 at time of the 3.3 release, 21204 for the 3.4)
* clang 3.4 has more checks and error detections. I also started to update clang to make it closer to gcc. For example, I transformed wrong usage of -O (> 6) error to be treated as regular warning. However, a critical bug has emerged during this release. When using -D_FORTIFY_SOURCE=2 (which is the case of many Debian packages), the binaries produced freeze (infinity loop in the ASM). This has been reported upstream as bug 16821 and concerns about 150 packages (including Firefox, gcc, LLVM, etc). Hopefully, this will be fixed in 3.5 (this is unlikely for 3.4.1). About the new build failures, now, Clang triggers an error (or warning + -Werror) on: * Wrong usage of the default argument (should be done in the definition)
16 occurrences * Usage of C++11 feature without the appropriate argument
7 occurrences * Unused static const declaration
5 occurrences * Recursive template instantiation exceeded
4 occurrences * Defitinion of a builtin function
3 occurrences * Read-only variable is not assignable
2 occurrences By the way, I proposed a Google Summer of Code Project to work faster on a support of Debian built by Clang. As requirements, I asked students to fix some bugs, they already did a great job.

Michal &#268;iha&#345;: Automatically checking pull request on GitHub

Since introduction of Developer's Certificate of Origin in phpMyAdmin, we've struggled with automatically checking pull requests on GitHub that they match this. First attempt was to integrate this check into Travis environment, but that proven to be hard to understand by potential contributors as it did not give direct feedback what went wrong. So it was still useful for us, but still we had to explain the situation. With recent flood of contributions from potential GSoC students, it became quite tedious task. So let's automate that. GitHub has quite powerful API, so it should not be that hard. Looking at Webhooks documentation, it is quite easy to get hooked on pull request creation and updates and checking commits and adding comments is just a piece of cake. The hardest choice was choosing language in which to implement it :-). While not finding binding for GitHub in any of my favorite language packaged in Debian. I've decided to hack this quickly in PHP without using any library and if this turns out to be limitation in future, it can be easily rewritten. First incarnation of our commit checker did check just Signed-Off-By lines in commit messages, but I've found that there might be some other useful checks. So the script got extended for various simple coding style violations, which we see quite often like wrong indentation or using DOS end of lines (the example of all fired checks can be found in pull request 1081). You can find the code for it in our scripts repository.

Filed under: English phpMyAdmin 0 comments Flattr this!

20 March 2014

Laura Arjona: Hello, world! I m a Debian contributor

My blog is included now in Planet Debian, so this post is to say hello :) And what can be better to explain who I am, that saying that I am a Debian Contributor? What does Debian Contributor mean? There are lots of tasks that people accomplish to make Debian better, and Debian Contributor is a new hat to credit any participation in the Debian Project, of any kind (even if the contributor is not a full-member of Debian). The idea was started and promoted by Enrico Zini. In less than one year, a website with a list of Debian Contributors, data source schemes and much more pieces have been designed. The site is working, and evolving, according to a roadmap. There are some working data sources already, some other proof of concept , pending to adopt or refine. There are much more kind of contributions that still have no data source created. Everybody can help on that! An example: my contributions I m listed now as wiki editor (at least, I edit once a month when doing my spam fighting tasks), website committer (I upload translations to the Spanish part of the website), and publicity (I ve sent some news to Debian Project News from time to time). Having your name in a list may seem a small thing, but happiness is made of small things!! The website committers data source is one of the proof of concepts and it s not being updated recently. I hope that somebody in the www team takes care of that oh wait, I m part of the www team I m part of the Spam Fighting Force too, but the data source tracks the spam reports reviewers, and I don t do that, I only report spam. That s why I m not there (yet). I m also a translator, member of the Spanish team. Translators are already credited in the translation coordination pages (for example this one), but we want to include them in the main list of Debian Contributors too. That means modifying the bot that tracks the mailing lists. I have joined the i18n team and I hope I can understand how it works and try to propose the required changes. If in the meanwhile, other person comes with the solution, the better! I have given a talk (and two lightning talks) in the last MiniDebConf Barcelona 2014. Most of the speakers in Debian events are available via the Debconf website, for example: http://penta.debconf.org/dc13_schedule/speakers.en.html I m sure a data source can be created somehow! More examples of data sources As I said, these are only examples (it s not about crediting my contributions, but everybody s). So if you explore the already managed data sources, you can find the Debian Sysadmin and Security teams, package maintainers, package uploaders to FTP sites, committers to several source code repositories of Debian-related software, people helping mentoring other people in Debian, people helping in the New Member process, people subtitling talks But we need more!! Please have a look at DcSiteDevel where you can learn how to create a data source and the tools for extracting information in an easy way. If each Debian Team cares of their own data source (which allows to credit their members) it is a sustainable way and also improves those Team s visibility (and new contributions, probably!). Identity management The last updates to Debian Contributors project are about identity management. Right now the site only shows data of contributors having a @debian.org account or an account in Alioth (the Debian software forge, used for many subprojects). It also uses the email field to merge contributions made in areas where you login with other kind of user (e.g. the wiki). This is a great step towards crediting people that are not full Debian members (yet), if they want their names to appear in the Debian Contributors list (they can opt-out too, or show/hide each contribution separately). So, what next? There is a Roadmap and a TODO list. But nobody as individual can know all the roles and actual work in the Debian project. It s better that each team cares about how to send their contribution info to the site. There are some mining tools available to extract for example names of committers in source code repositories, or senders in mailing lists. Not much code is required. Please think about it and join the wave of making Debian diversity skills more visible!
Filed under: Interesting sites, My experiences and opinion, Uncategorized Tagged: Communities, Contributing to libre software, data mining, Debian, Developer motivations, English, libre software, Project Management, statistics, translations

18 March 2014

Vincent Bernat: EDNS client subnet support for BIND

To provide geolocation-aware answers with BIND, a common solution is to use a patch adding GeoIP support. A client can be directed to the closest (and hopefully fastest) web server:
view "FRANCE"  
     match-clients   geoip_cityDB_country_FR;  ;
     zone "example.com" in  
         type master;
         file "france.example.com.dns";
      ;
 ;
view "GERMANY"  
     match-clients   geoip_cityDB_country_DE;  ;
     zone "example.com" in  
         type master;
         file "germany.example.com.dns";
      ;
 ;
/* [...] */
view "DEFAULT"  
    zone "example.com" in  
        type master;
        file "example.com.dns";
     ;
 ;
However, an end user does not usually talk directly to authoritative servers. They proxy the query to a third-party recursor server which will query the authoritative server on their behalf. The recursor also caches the answer to be able to serve it directly to other clients. On most cases, we can still rely on the recursor GeoIP location to forward the client to the closest web server because it is located in the client s ISP network, as shown on the following schema: Query for www.example.com through an ISP recursor
  1. Juan is located in China and wants to know the IP address of www.example.com. She queries her ISP resolver.
  2. The resolver asks the authoritative server for the answer.
  3. Because the IP address of the resolver is located in China, the authoritative server decides to answer with the IP address of the web server located in Japan which is the closest one.
  4. Juan can now enjoy short round-trips with the web server.
However, this is not the case when using a public recursor as provided by Google or OpenDNS. In this case, the IP address of the end client and the source IP address of the recursor may not share the same locality. For example, in the following schema, the authoritative server now thinks it is in relation with an European customer and answers with the IP address of the web server located in Europe: Query for www.example.com through an open recursor Moreover, caching makes the problem worse. To solve this problem, a new EDNS extension to expose the client subnet has been proposed. When using this extension, the recursor will provide the client subnet to the authoritative server for it to build an optimized reply. The subnet is vague enough to respect client s privacy but precise enough to be able to locate it. A patched version of dig allows one to make queries with this new extension:
$ geoiplookup 138.231.136.0
GeoIP Country Edition: FR, France
$ ./bin/dig/dig @dns-02.dailymotion.com www.dailymotion.com \
>     +client=138.231.136.0/24
; <<>> DiG 9.8.1-P1-geoip-1.3 <<>> @dns-02.dailymotion.com www.dailymotion.com +client=138.231.136.0/24
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23312
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; CLIENT-SUBNET: 138.231.136.0/24/24
;; QUESTION SECTION:
;www.dailymotion.com.           IN      A
;; ANSWER SECTION:
www.dailymotion.com.    600     IN      A       195.8.215.136
www.dailymotion.com.    600     IN      A       195.8.215.137
;; Query time: 20 msec
;; SERVER: 188.65.127.2#53(188.65.127.2)
;; WHEN: Sun Oct 20 15:44:47 2013
;; MSG SIZE  rcvd: 91
$ geoiplookup 195.8.215.136
GeoIP Country Edition: FR, France
In the above example, a client located in France gets a reply with two IP addresses located in France. If we now are an US client, we will get IP addresses located in the US:
$ geoiplookup 170.149.100.0
GeoIP Country Edition: US, United States
$ ./bin/dig/dig @dns-02.dailymotion.com www.dailymotion.com \
>     +client=170.149.100.0/24
; <<>> DiG 9.8.1-P1-geoip-1.3 <<>> @dns-02.dailymotion.com www.dailymotion.com +client=170.149.100.0/24
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23187
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; CLIENT-SUBNET: 170.149.100.0/24/24
;; QUESTION SECTION:
;www.dailymotion.com.           IN      A
;; ANSWER SECTION:
www.dailymotion.com.    600     IN      A       188.65.120.135
www.dailymotion.com.    600     IN      A       188.65.120.136
;; Query time: 18 msec
;; SERVER: 188.65.127.2#53(188.65.127.2)
;; WHEN: Sun Oct 20 15:47:22 2013
;; MSG SIZE  rcvd: 91
$ geoiplookup 188.65.120.135
GeoIP Country Edition: US, United States
The recursor is expected to cache the two different answers and only serve them if the client matches the appropriate subnet (the one confirmed in the answer from the authoritative server). With this new extension, the authoritative server knows that Juan is located in China and answers with the appropriate IP address: Query for www.example.com through an open recursor with client subnet Not many authoritative servers support this extension (PowerDNS and gdnsd, as far as I know). At Dailymotion, we have built a patch for BIND. It only works when BIND is configured as an authoritative server and it doesn t expose no configuration knobs. Feel free to use it (at your own risk). Once installed, you need to register yourself to OpenDNS and to Google to receive queries with the extension enabled.

15 March 2014

Lars Wirzenius: Obnam 1.7 (backup software)

I have just released version 1.7 of Obnam, my backup program. Version 1.7, released 2014-03-15 WARNING: This release has had fairly large parts of the internals re-written. There shouldn't be any externally visible changes due to that, but there is a chance of bugs. Be careful. Make a copy of your backup repository before upgrading, if you can. Bug fixes: Internal changes:

Next.

Previous.