• extplorer to fix CVE-2015-0896
• inspircd to fix CVE-2015-8702
• libmatroska to fix CVE-2015-8792
• libstruts1.2-java to fix CVE-2015-0899
• fuseiso to fix two temporary issues
• minissdpd to fix CVE-2016-3178 and CVE-2016-3179
• tlslite to fix CVE-2015-3220

The paths of life to guide us towards the knowledge are many and a straight; well-defined line does not always represent them. Among these, the theory of Fuzzy Logic can help us to better understand some of the methods that maybe for too long we have lost the habit to use, if not even forgotten, because of the residuals of the positivist scientism.

Brief mathematical introduction

All the elements making up the majority of the categories of everyday life (feelings, emotions, opinions, values, quality, etc.) cannot be defined in a unique or exact way. Let s try to define an event that causes severe pain: a hammer blow on the finger? The loss of a loved one? Tooth extraction? It is evident that the answer can vary in a very consistent way, based on the subjectivity of the individual, the environment, boundary conditions and the general context. This is because the Strong Pain is a fuzzy set (which we will call SP), characterized by a function of degree of membership which maps the elements of a universe in a real continuous interval between 0 and 1. In practical terms

<Read More [by Fabio Marzocca]>

When playing PWADs with classic Doom, you always got the "this game has been modified" banner and had to hit enter to continue. If you played a lot of PWADs, you got used to hitting enter regularly. It became a core part of the Doom-playing experience. Even if you used one of those lovely launchers that came on the shovelware CDs which streamlined the PWAD choosing experience, you always had to hit the enter key. This commit restores this classic behaviour and allows those who still have the muscle-memory "hit enter" behaviour permanently burned into their nervous systems to finally be at peace. TODO for a future commit: the coloured top-line of text (red for 1.666, blue for 1.9 iirc)

<Linguica> its funny because its nearly indistinguishable from real chocolate doom feature requests <jmickle> i actually first thought "huh, kinda surprised this isn't in already <ryan> best chocolate-doom feature yet!

Browsing Protection The main part of the Safe Browsing system is the one that watches for bad URLs as you're browsing. Browsing protection currently protects users from:

• malware sites,
• deceptive sites (including phishing and social engineering sites), and
• sites hosting potentially unwanted software.

If a Firefox user attempts to visit one of these sites, a warning page will show up instead, which you can see for yourself here:

• fake malware page
• fake unwanted software page
• fake phishing page

The first two warnings can be toggled using the browser.safebrowsing.malware.enabled preference (in about:config) whereas the last one is controlled by browser.safebrowsing.enabled.

List updates It would be too slow (and privacy-invasive) to contact a trusted server every time the browser wants to establish a connection with a web server. Instead, Firefox downloads a list of bad URLs every 30 minutes from the server (browser.safebrowsing.provider.google.updateURL) and does a lookup against its local database before displaying a page to the user. Downloading the entire list of sites flagged by Safe Browsing would be impractical due to its size so the following transformations are applied:

1. each URL on the list is canonicalized,
2. then hashed,
3. of which only the first 32 bits of the hash are kept.

The lists that are requested from the Safe Browsing server and used to flag pages as malware/unwanted or phishing can be found in urlclassifier.malwareTable and urlclassifier.phishTable respectively. If you want to see some debugging information in your terminal while Firefox is downloading updated lists, turn on browser.safebrowsing.debug. Once downloaded, the lists can be found in the cache directory:

• ~/.cache/mozilla/firefox/XXXX/safebrowsing/ on Linux
• ~/Library/Caches/Firefox/Profiles/XXXX/safebrowsing/ on Mac
• C:\Users\XXXX\AppData\Local\mozilla\firefox\profiles\XXXX\safebrowsing\ on Windows

Resolving partial hash conflicts Because the Safe Browsing database only contains partial hashes, it is possible for a safe page to share the same 32-bit hash prefix as a bad page. Therefore when a URL matches the local list, the browser needs to know whether or not the rest of the hash matches the entry on the Safe Browsing list. In order resolve such conflicts, Firefox requests from the Safe Browsing server (browser.safebrowsing.provider.mozilla.gethashURL) all of the hashes that start with the affected 32-bit prefix and adds these full-length hashes to its local database. Turn on browser.safebrowsing.debug to see some debugging information on the terminal while these "completion" requests are made. If the current URL doesn't match any of these full hashes, the load proceeds as normal. If it does match one of them, a warning interstitial page is shown and the load is canceled.

Download Protection The second part of the Safe Browsing system protects users against malicious downloads. It was launched in 2011, implemented in Firefox 31 on Windows and enabled in Firefox 39 on Mac and Linux. It roughly works like this:

1. Download the file.
2. Check the main URL, referrer and redirect chain against a local blocklist (urlclassifier.downloadBlockTable) and block the download in case of a match.
3. On Windows, if the binary is signed, check the signature against a local whitelist (urlclassifier.downloadAllowTable) of known good publishers and release the download if a match is found.
4. If the file is not a binary file then release the download.
5. Otherwise, send the binary file's metadata to the remote application reputation server (browser.safebrowsing.downloads.remote.url) and block the download if the server indicates that the file isn't safe.

Blocked downloads can be unblocked by right-clicking on them in the download manager and selecting "Unblock". While the download protection feature is automatically disabled when malware protection (browser.safebrowsing.malware.enabled) is turned off, it can also be disabled independently via the browser.safebrowsing.downloads.enabled preference. Note that Step 5 is the only point at which any information about the download is shared with Google. That remote lookup can be suppressed via the browser.safebrowsing.downloads.remote.enabled preference for those users concerned about sending that metadata to a third party.

Types of malware The original application reputation service would protect users against "dangerous" downloads, but it has recently been expanded to also warn users about unwanted software as well as software that's not commonly downloaded. These various warnings can be turned on and off in Firefox through the following preferences:

• browser.safebrowsing.downloads.remote.block_dangerous
• browser.safebrowsing.downloads.remote.block_dangerous_host
• browser.safebrowsing.downloads.remote.block_potentially_unwanted
• browser.safebrowsing.downloads.remote.block_uncommon

and tested using Google's test page. If you want to see how often each "verdict" is returned by the server, you can have a look at the telemetry results for Firefox Beta.

Privacy One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe. While this was an option in version 1 of the Safe Browsing protocol (as disclosed in their privacy policy at the time), support for this "enhanced mode" was removed in Firefox 3 and the version 1 server was decommissioned in late 2011 in favor of version 2 of the Safe Browsing API which doesn't offer this type of real-time lookup. Google explicitly states that the information collected as part of operating the Safe Browsing service "is only used to flag malicious activity and is never used anywhere else at Google" and that "Safe Browsing requests won't be associated with your Google Account". In addition, Firefox adds a few privacy protections:

• Query string parameters are stripped from URLs we check as part of the download protection feature.
• Cookies set by the Safe Browsing servers to protect the service from abuse are stored in a separate cookie jar so that they are not mixed with regular browsing/session cookies.
• When requesting complete hashes for a 32-bit prefix, Firefox throws in a number of extra "noise" entries to obfuscate the original URL further.

On balance, we believe that most users will want to keep Safe Browsing enabled, but we also make it easy for users with particular needs to turn it off.

Learn More If you want to learn more about how Safe Browsing works in Firefox, you can find all of the technical details on the Safe Browsing and Application Reputation pages of the Mozilla wiki or you can ask questions on our mailing list. Google provides some interesting statistics about what their systems detect in their transparency report and offers a tool to find out why a particular page has been blocked. Some information on how phishing sites are detected is also available on the Google Security blog, but for more detailed information about all parts of the Safe Browsing system, see the following papers:

• All Your IFrames Are Belong to Us
• Content-Agnostic Malware Protection
• Ghost in the Browser

• Confidentiality: Messages are encrypted, so they cannot be read by someone eavesdropping.
• Integrity: Messages are protected against corruption, whether random or malicious.
• Authentication: You know who sent a given message (although you'll need to verify this out-of-band, of course). Note that while this usually implies non-repudiation, see below.
• Participant consistency: In a group chat, everybody sees the same list of people.
• Destination validation: Messages you got were intended for you.
• Forward secrecy: If someone gets to your keys (including long-term and current session keys), they can't decrypt earlier messages.
• Backward secrecy (aka future secrecy): If someone gets to your keys, they can't decrypt later messages.
• Causality preservation: Messages cannot come out-of-order.
• Message repudiation: You cannot cryptographically prove to others that someone sent a given message, even though you know it yourself. (This is possible because at the same time you get a signed message, you also get what would be needed to fake that signature yourself.)
• Message unlinkability: Even if you could prove to others that someone sent a given message (e.g. by arguing only they had that information), that doesn't help proving it for any other messages.
• Participation repudiation: There's no way to cryptographically prove you were in a group chat, even if all the other members of it conspire.
• Asynchronicity: Clients don't need to be online at the same time to send messages.

• Submitted a number of pull requests to the Ansible sever configuration tool:
  • Add the ability to specify the --allow-unauthenticated to APT. (#2023)
  • Ignore EPIPE when flushing standard input and output to avoid unnecessary and ugly tracebacks. (#14774)
  • Add an option for ansible-playbook to exit with an error if no plays were matched. (#14742)
• Various improvements to django-slack, a library to easily post messages to the Slack group-messaging utility from projects using the Django web development framework:
  • Merged a patch from Joshua Blum to update the logging integration documentation. (#39)
  • Fixed an issue when rendering various exceptions would in themselves raise an exception. (#40)
  • Improved and merged a patch from Patrick Cloke to actually allow settings to be overriden using the @override_settings decorator. (#37)
• Updated local-debian-mirror, a package that attempts to make it easy to maintain a partial local mirror of the Debian archive:
  • Added an option to exclude DEP-11 files. (ee03b21)
  • Added an option to exclude Translation-* files. (28bbf34)
  • Corrected the phrasing of the debconf prompt to not ask a direct question to appease Lintian. (13fccc7b)
• Updated django-keyerror a library to post exceptions to the KeyError.com error tracking service to support pushing tracebacks from the Celery queue processor using the task_failure signal. (#1)
• Submitted a number of pull requests for django-zebra, a collection of utilities that make it easier to integrate the Stripe payment processor and the Django web development framework:
  • Add the ability to test an incoming Stripe webhook. (#44)
  • Prefer @require_POST over an explicit check in the view. (#43)
  • Move away from the deprecated django.conf.urls.patterns method. (#45)
• Updated django-template-tests, a tool to perform simple static analysis on Django templates prior to production to improve the robustness of dynamic test generation. (e98f9fc)
• Fixed django-force-logout a library to allow administrators to log user's out of Django projects to not require a custom JSON serialiser. (c0e5d64)
• Corrected the documentation for travis.debian.net my hosted script to easily test and build Debian packages on the Travis CI continuous integration platform to reflect the actual default mirror. (4c862f0)
• Blogged about generating dynamic Python tests using metaclasses.

• geoip-database
  • Regular monthly update to 20160317-1 in wheezy-backports-sloppy and jessie-backports
• otrs2
  • Updated to current version 5.0.8-1~bpo8+1
• glusterfs
  • Updated to version 3.7.9-1~bpo8+1
• icinga2
  • After my last upload to bring icinga2 2.4.1 online in jessie-backports, I have updated the packaging now up to version 2.4.4-1~bpo8+1

Ich bin was ich bin
F nf Worte mit wahrem Sinn:
Ich bin was ich bin Du denkst: "Mann im Rock?
Das ist ja wohl l cherlich,
der ist sicher schwul." "Fingernagellack?
Na da schau ich nicht mehr hin,
wer will das schon seh'n." Jedoch liegst du falsch,
Mit all deinen Punkten, denn:
Ich bin was ich bin. Ich bin Transgender
Und erlebe mich selber,
ich bin eine Frau. "Haha, eine Frau?
Wem willst du das weismachen?
Heb mal den Rock hoch!" Und wie ist's bei dir?
Was ist zwischen den Beinen?
Geht mich das nichts an? Warum fragst du mich?
Da ist's dann in Ordnung?
Oder vielleicht nicht? Ich bin was ich bin
F nf Worte mit ernstem Sinn:
Ich bin was ich bin Ich steh weiblich hier
Und das hier ist mein K rper
Mein Geschlecht ist's auch Oberfl chlichkeit
Das ist mein gr tes Problem
Schl gt mir entgegen Wenn ich mich ffne
Verst ndnis fast berall
Es wird akzeptiert Doch gelegentlich
und das schmerzt mich am meisten
sagt doch mal wer "er" Von Fremden? Egal
Doch hab ich mich ge ffnet
Ist es eine Qual "Ich seh dich als Mann"
Da ist, was es transportiert
Akzeptanz? Dahin Meine Pronomen
Wenn ihr ber mich redet
sind sie, ihr, ihres Ich leb was ich leb
F nf Worte mit tiefem Sinn:
Ich bin was ich bin "Doch, wie der erst spricht!
Ich meinte, wie sie denn spricht!
Das ist nicht normal." Ich schreib hier Haikus:
Japanische Gedichtsform
Mit fixem Versmars Sind f nf, sieben, f nf
Silben in jeder Zeile
Haikus sind simpel Probier es mal aus
Transportier eine Message
Es macht auch viel Spa Wortwahl ist wichtig
Ein guter Thesaurus hilft
Sei kurz und pr gnant Ich sag was ich sag
F nf Worte mit klugem Sinn:
Ich bin was ich bin Doch ich schweife ab
Verst ndnis fast berall?
Wird es akzeptiert? Erstaunlicherweise
Doch ich bin auch was and'res
Und hier geht's bergab Eine Sache gibt's
Die erw h'n ich besser nicht
f r die steck ich ein "Deshalb bin ich hier"
So der Titel eines Lieds
verfasst von Thomas D "Wenn ich erkl re
warum ich mich wie ern hr"
So weit komm ich nicht Man erw hnt Vegan
Die Intoleranz ist da
Man ist unten durch "Mangelerscheinung!"
"Das Essen meines Essens!"
Akzeptanz ade Hab 'ne Theorie:
Vegan sein: 'ne Entscheidung
Transgender sein nicht Mensch f hlt sich dann schlecht
dass bei sich selbst die Kraft fehlt
und greift damit an "Ich k nnte das nicht"
Ich verurteile dich nicht
Iss doch was du willst Ich zwing es nicht auf
Aber R cksicht w r schon fein
Statt nur Hohn und Schm h Ich ess was ich ess
F nf Worte zum nachdenken:
Ich bin was ich bin

/personal permanent link Comments: 2 Flattr this

• There were 263 responses in total. I have no idea of knowing if the total number of Obnam users is about that, but the number correlates fairly well with the Debian popcon numbers, so I'm assuming Obnam has on the order of a few hundred users total. A larger number might be more impressive, but it'd also mean that I would be responsible for much more data loss if I make a horrible mistake. That said, it is probably time to start spending some effort on growing the developer base of Obnam.
• People seem to hear about Obnam primarily from my blog posts, or by searching the web for backup software. Also, from the Arch Linux or Gentoo wikis, or Joey Hess.
• People use Obnam mostly for personal machines, but also at work.
• Those who have tried Obnam, but don't use it, rejected it primarily for speed or because it's unstable or buggy. I hope that the bad bugs have mostly been fixed, and I'm working on improving the speed.
• People seem to use either the latest version, or the version included in the release of their operating system (e.g., Debian jessie). Other versions are relatively rare.
• Most people started using Obnam in the past two years.
• People use Obnam on a variety of Linux based operating systems, but also others. Obnam users are especially skewed towards Debian and Ubuntu, which is not surprising, as I'm involved in Debian and have been publicising it there, and provide package for Debian myself.
• About half the people have at least hundreds of thousands of files, containing hundreds of gigabytes of data. All extremes (very few or very many files, very little or very much data) are represented, though. A couple of people have at least a hundred million files, or at least ten terabytes of data.
• Most people don't have a backup strategy, or at least not a documented one, and if they do, it's not regularly tested. This isn't a good thing.
• Most people had backed up within the past week as of the time of filling in the survey. This hopefully indicates that they back up frequently. Only one respondent said they'd never backed up. Rather more people hadn't tested their backups, however, with about a fifth of the people having never tested their backup. This is also not good.
• Most people only back up one machine to each repository, or at most a few. A total of 17 respondents reported that they don't have a backup, and do not fear clowns.
• About half the people back up to a local drive, and nearly two thirds to an SFTP server. People ask for more remote storage options, such as support for services like Amazon S3.
• The things people like most about Obnam are on its list of core features: de-duplication, encryption, and ease of use / simplicity. FUSE is also well-liked, as are snapshot backups.
• I didn't tabulate the reasons why people don't like Obnam, but performance and stability seem to be the most common reasons. My favourite response to this question is "the name obnam, does not sounds like a backup program".
• Speed is also the pet bug people seem to have.
• People seem to generally find Obnam documentation adequate. There's room for improvement, of course.
• Nearly everyone finds it easy to get help if they have a problem with Obnam, but almost no-one uses the Obnam support mailing list or IRC channel.
• Some people read the NEWS file, others do not. Few have sent patches, but some would like to. There's a bunch of suggestions for new features. None of this is surprising to me, except perhaps that so many Obnam users actually do read the NEWS file, as it's been my experience in other projects that that's rare.
• About half the people have heard of the green albatross. It's the name of the new way in which Obnam will be storing data on disk, which is a big factor in how fast or slow Obnam is. When the green albatross soars, Obnam will fly faster.
• People use other backup software as well, which is sensible: no point in having all one's eggs in one basket. The top choices are rsync, duplicity, attic, and rsnapshot, but the list seems to mention most free backup software.
• There's some interest in helping Obnam development, either by direct contributions, donations, paying for support or development, or by buying merchandise. Nearly no-one wants a printed version of the manual, but stickers and t-shirts might sell well enough. A lot of people don't really want to, or are not able to, contribute, especially not by doing things, and that's OK. (They did contribute, however, by filling in the survey.)
• When given an opportunity to say whatever they want to Obnam developers, most people say "thank you" in some form or another. This was very heartwarming.

Changes in Rcpp version 0.12.4 (2016-03-22)

• Changes in Rcpp API:
  • New accessors as() and clone() were added to the Nullable class (Dan in PR #423 closing #421)
  • The Nullable<>::operator SEXP() and Nullable<>::get() now also work for const objects (Kirill Mueller in PR #417).
  • A subsetting error was fixed (Qiang via #432 closing #431).
• Changes in Rcpp Sugar:
  • Added new Sugar function median() (Nathan in PR #425 closing #424)
  • Added new Sugar function cbind() (Nathan in PR #447 closing #407)
• Changes in Rcpp Attributes:
  • A plugin for C++14 was added (Dan in PR #427)
• Changes in Rcpp Documentation:
  • An entry was added to the Rcpp-FAQ vignette describing the required packages for vignette building (#422).
  • Use on OS X was further detailed (James Balamuta in #433 with further review by Bob Rudis).
  • An entry was added concerning the hard-code limit of arguments to some constructor and function (cf #435).
  • The Rcpp-FAQ vignette now contains a table of content.
  • Typos and indentation were corrected in the Rcpp Sugar vignette (#445 by Colin Gillespie).

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

• DebCamp: 2016-06-23 to 2016-07-01
• DebConf: 2016-07-02 to 2016-07-09
• Open Weekend is taking place during the cross-over from DebCamp to DebConf.
• To sign up, go to https://debconf16.debconf.org/ for the latest information which includes an FAQ and direct sign-up link.
• If you re requesting sponsorship, you must be registered by 2016-04-10.

• Events aren t limited to talks or BoF sessions, we welcome submissions of tutorials, performances, art installations, debates, or any other format of event that you think would be beneficial to the Debian community.
• Submit a talk at https://debconf16.debconf.org/talks/new/
• First batch of talks/events wil be announced during April, cut-off is on 1 May.

• Debian Packaging, Policy, and Infrastructure
• Security, Safety, and Hacking
• Debian System Administration, Automation and Orchestration
• Containers and Cloud Computing with Debian
• Debian Success Stories
• Debian in the Social, Ethical, Legal, and Political Context
• Blends, Subprojects, Derivatives, and Projects using Debian
• Embedded Debian and Hardware-Level Systems

#!/usr/bin/python3
import sys
years = int(sys.argv[1])
# How many 18 months intervals we spent
count = 0
# How many original-computation-time-months we compute each 18 months interval
step = 18
# How many original-computation-time-months we computed so far
total = 0
# How many original-computation-time-months we need
target = years * 12
# Iterate each 18 months interval
while True:
    count += 1
    total += step
    if total > target: break
    step *= 2
print(" :.2f  years needed".format(count / 12 * 18))

$ ./actual_years 15200
9.33 years needed

$ ./actual_years 15200
21.00 years needed

There are two cars (remember phisics in primary school?). They both have the same speed V0. It is going to take "54.697 centuries" for car A to travel the desired distance at constant speed. Car B is accelerating, its speed is 2^(t/18m)*V0 (18 [m]onths). s = V0 * T (car A, T is 54.697 centuries) s = 2^(t/18)*V0 dt (car B, we're looking for t) It's been some time but as far as I can tell it is s = V0 * 2^(t/18) * 1/((1/18) * ln 2) 2^(t/18) * 1/((1/18) * ln 2) = 54.697 * 100 * 12 [months] 2^(t/18) = 2527.54 t = 18*log2(2527.54) t = 16.96 years (still reasonable strength).

Changes in RcppArmadillo version 0.6.600.4.0 (2016-03-15)

• Upgraded to Armadillo 6.600.4 (Catabolic Amalgamator)
  • expanded sum(), mean(), min(), max() to handle cubes
  • expanded Cube class to handle arbitrarily sized empty cubes (eg. 0x5x2)
  • added shift() for circular shifts of elements
  • added sqrtmat() for finding the square root of a matrix
  • fix for gmm_diag when using Mahalanobis distance
• The configure script now reflects the full LAPACK fallback offered by R 3.3.0 or later (PR #81)

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.