No. Time. To. Blog. But these few lines I wanted to post nevertheless: there's some neat new packages in Debian since today: Nexuiz (nice ego shooter), rcov (code coverage for Ruby), and Democracy Player (RSS video downloader/viewer for videoblogs, packaged by yours truly, as promised). That's all.

I've noticed many times that people don't really use pbuilder with all the power and flexibility it allows. A lot of people don't want to mess up with the configuration files or write their own hooks, whereas it's quite simple, and powerful. Here are the dotfiles I use with my pbuilder install:

• the .pbuilderrc ;
• the .pbuilder/ hooks.

The features those files provides are:

• the built packages are in ~/debian/results/$(pkg_name)_$(pkg_version) instead of the whole mess in /var/cache/pbuilder/results;
• this directory is used as an extra local apt source (useful to build packages depending upon not already available packages and test build-depends);
• use of ccache (thanks to isaac's idea);
• automatic launch of a shell in the pbuilder chroot if the build fails (installing zsh and vim before);
• automatic run of the list-missing target (for cdbs-aware packages that include /usr/share/cdbs/1/rules/utils.mk);
• automatic run of lintian over the packages, and stores the lintian report in ~/debian/results/$(...)/lintian.

There is nothing very new here, but it's a complete setup that some recent/lazy pbuilder users may find useful (it should not need any big modification to be used on anyone's computer). Also note that the linked files are the one I really use, and that it's meant to evolve with time.

Last month I went to Mexico to attend Debconf6 and then I traveled with 4 geeks to Oaxaca. Here are a few photos from the trip, which was quite lovely, though I stalled writing anything about it here because I was thrown into a strom of sickness during my last week there and into my first week here. I have been to Mexico a few times before though usually in passing or in Baja, which is somewhat nice but desolate. This was the first time I had any sustained exposure to Mexico and it was quite nice. Some of my favorite things about the country and my visit are perhaps a little odd but they are what took me in and here are some of them… For example, during Debconf proper, I feel in love with the following reptile and very surprisingly, because, when it comes to animals, I usually like the soft and cuddly and not the scaly and spiny. But…. this lizard was…. special. Here is how I found him: We were eating at a restaurant after a visit to some ruins and there we found this little guy caged at the back of the restaurant. I was more than a little miffed that he was trapped (and by butting his head against the cage, he clearly was saying I WANT OUT) and so was about to pull a “PETA move” and just let him out. But I decided that was not such a good idea so instead I went over to the owners to ask why the little one was caged. In answer to my query, they promptly pulled him out and told me he first that he was a chameleon (which does not seem right to me) and was usually free to roam but when there are a lot of folks (as there were) they lock him up. He plopped the little one on my arm and alas, what I pleasantly found out was that a lizard can act an awful lot like a dog. He LOVED to be pet and basically had a look of all-out-pleasure when you stroked his back. And at times, with a particularily good stroke, he would even subtly smile and flutter his hind leg a little just like a doggie. Aside from a special dog-like reptile, there were many other things that I loved about Mexico. The food at the market was divine, divine, especially the corn smut a.k.a huitlacoche and all the salsas were better than you could imagine. It is tragic that every city does not have a local market with such divine food. The architecture of Oaxaca was especially stuning as was the whole city center. It reminded me of viejo San Juan in Puerto Rico but the buildings were a little lower (apparently because of earthquakes) and the environment was dryer and more expansive. Our hostel was courtyard style (as were many houses there) and I think the courtyard should be revived as the defacto style for housing as this is probably one of the most enticing and smart architectural styles ever (at least in warm places). While a home is suppsed to provide shelter to enclose, the courtyard brings some of the outside inside and some of the inside outside. While in Oaxaca we met some folks from espora, walked a lot in the city, met up with other Debian folks traveling about, and cleaned out Vagrant’s ear which was truly … well I won’t go into that. We also drove for a few hours up to the mountains for a few nice hikes. The town hoped we happy trip and I think we did. Mexico city, by a number of measures, is one of the largest in the world and I unfortunately only got to see the Zocalo area as well as the subway. The center was quite impressive and especially nice before a thunderous storm One night at the Zocalo we happened upon a free concert, the lineup including the Tijuana Nortec Collective. One of the most dynamite parts of Mexico City is its impressive and I mean impressive subway system. In a nutshell, the system is large, clean, efficient, cheap, and quiet (thanks to thick and black rubber tires). The trains come quickly, ferrying the millions of riders who pay 20 cents for a ride on a lovely bright orange train. Every time I rode it, without fail, a vendor entered the car, loaded with a backpack that doubled as a radio/stereo, who was selling pirated music. I appreciated the sample and bought one disc chock full of mp3s. Like most urban trains, the riders are silent and I have always wondered why this is so. When I go to PR, I ride the busses much more and there, as in the states on the busses, there seems to be more open flow of chatter. Perhaps it is because trains are quite comfortable and they lull already tired riders into a state of quite contemplation. Who knows. So these are some of the things that I liked about Mexico but perhaps the most exciting part about the country was the clear political heatwave passing through, just as it is with much of Latin America. In the zocalo of Mexico City there were various stands protesting the attacks in Atenco, as well as general protests against neoliberal policies. The city of Oaxca was also filled to the gills with protesting teachers, demanding a pay raise. Thousands of them were camped out all over the city center, which is apparently a year rite. Sadly, in the last week the police broke up the protest, violently…

One new boot process hotspot was tested yesterday: using dash instead of bash. Got a good reduction of 3 seconds in the boot time. The results and method used are in the project webpage. Nevertheless, this was different from the 6 seconds obtained by Margarita Manterola in her slides from debconf6.
On the other side, with the aim of having a script for checking lintian rules and LSB compliance, I've started to take a look to the script written by Petter Reinholdtsen. It is written in perl so I took a quick tutorial of perl first :)

There are three reviews this week, because I neglected to review one which I watched earlier. I'm also trying to decide whether the links at the end are of any use, and whether it's useful to syndicate this to Planet Debian. Feedback is encouraged!

Jawbreaker

The whole premise of Jawbreaker gets laid out right at the beginning - after a opening sequence in which we see the title candy being made, a couple of girls kill a friend by surprising her and using a jawbreaker as a gag. The movie then degenerates into a formulaic nerdy girl gets to be pretty storyline. Unfortunately Jawbreaker doesn't pull it off as well as Mean Girls does, and ends up falling pretty flat. One saving grace of this movie is that it is very short at just 87 minutes. One small treat is that Rose McGowan is playing a decent role, although I do have a much older vision whenever I see her from her work on Charmed. One thing which keeps bugging me is how the movie reminds me of But I'm a Cheerleader, even though the plots and premises are very different. The soundtrack is very well done with good placement of good songs. Jawbreaker is bittersweet at a 5. (imdb, amazon)

Real Genius

I have always heard good things about Real Genius, but never saw it all the way through. Supposedly this is a tragedy. Apparently ceilingsarecool saw it before, but didn't remember a bunch of the plot. A whiz kid enters college early and starts working for a professor. The premise is setup in the first 10 minutes or so, which is that Herr Professor is really corrupt and working to provide a laser weapon to the military. This leaves ample time for the comedy in the movie to play out, as Whiz Kid gets to experience all the wild antics of college with a high-IQ twist. Lasers are used fairly extensively in the movie (mostly as part of the plot) and get a nice chunk of credits in the end. The movie unfortunately doesn't really age well with time, unless you're a fan of 80's movies. There are no less than 2 montages with music, and the ultimate 80's end-of-movie song "Everybody wants to rule the world" by Tears for Fears is playing at the end. Real Genius still is smarter than many movies you'll see nowadays, so it burns in a 7. (imdb, amazon)

Primer

Small budget films are usually interesting to watch, because either they are simple masterpieces, or they try to be way more than they can be and end up being a trainwreck which you just can't stop watching. Primer is the rare gem which found a happy medium between complex and simple. At the start, a garage business is introduced with four tech friends making a bit of money selling to hobbyists. Apparently they have some sort of deal about who gets to pick the next thing they try, and one of them wants to try something related to physics. Two decide to attempt it on their own and they create a device which apparently lowers density, or gravity, or something. Then they discover it does much more than that - it can manipulate time. Fortunately there is still much of the movie left after this. The acting is not top notch by any means, and comes off as cardboardish, but it seems well-placed in this script because most techies that I know are not the best with social skills. It's important to note that the main focus doesn't lie on the device, but on the implications and ramifications. As the movie approaches it's end, the pace and convolution increases quickly. A rewatch is in order for Primer - and even then you still may be missing parts in the giant puzzle which is laid out before you. Shane Carruth directs, writes, and produces an amazing film, especially considering the sub-10k budget. Primer scores e^2.30258509. (imdb, amazon)

Right it is 23:43 and I’m just back from a dodgy metal night - picture the winners of the Eurovision song contest but with a lesser budget. Normally this would be described upon my real blog which contains adult language, and a mixture of random trivia, sadism, and geekyness in more detail than is displayed here. (You might think this is a hard mix, but I’ll tell you it isn’t suprising if you’ve ever programmed Gtk 2.x in raw C ) Anyway the reason I went to the gig in the first place was that last year one of my partners was a bass-player, and she was often playing gigs in different locations. Unfortunately for the duration of our relationship I managed to never actually hear her play. Not deliberately - it was just the way things worked out. We kinda tailed off seeing each other because I was sleepy and she lived in a different city. Actually this is a common theme with me. I once lived with a concert chello player and for the entire 2.5. years of our relationship I managed to never hear her play, or practise (and we lived together!). Again not deliberate, it was just the way things worked out. (Even now I don’t think she’s ever heard me play the guitar.) Later I had a relationship with a Swedish dentist and for the duration of our relationship I refused to let her look inside my mouth [mostly ]. It was only after we’d ceased being .. close .. that I let her extract some wisdom teeth of mine. Of course she was Swedish, living abroad, and all her friends were Swedish too - so I had a lot of Swedish “friends” around that time. Maybe one day I’ll even meet a genuine blonde Swede. (I can say “hello”, “goodbye”, “I love you”, “marry me”, and “you’re cute” in Swedish!) (I’m not a slut; I just know what I like.) Anyway .. enough side-tracking. The only reason this is coming up at all is because I think context is important when writing about people that aren’t known - I hate seeing people in blogs write about “J”, or “C”, with no hint of the nature of the relationship, or why we should know/care about their actions - people are important, and if you’re going to bring them up you should explain who they are, and why they are relavent. The fact that I’ve drunk 5 bottles of cider now is also helping extend this entry If it helps I almost promise not to mention these people again. So, to recap, I’m at this metal gig, and damn they were a fantastic band. Miranda (the woman I was “with”, previosuly if not recently) was a total camera-slut, and she was technically extremely competant. I guess I shouldn’t have been suprised but I was. So, why do I mention any of this? Well I was standing outside before the band started as it is illegal to smoke in public enclosed places in Scotland (since Marche this year) and this obviously rules out smoking in a pub in the basement bar. (The bar was unstaffed since the bands playing tonight were “too loud”. Sucky having to walk upstairs to find beer.) So .. stood outside, totally under-dressed for the occasion. Almost everybody else in the (very sweaty) basement bar was dressed in monochrome and I had shiny white shoes and colourful t-shirt. Still I was one of the tattoo’d + pierced people so all was good. “Excuse me, you look like Steve Kemp”. For the first time ever somebody recognised me from my planet debian hackergotchie. Neat huh? And now it is 23:58 and I’m going to listen to some nice Rammstein and go sleep. Tomorrow I must do some Debian work, and tidy a friends flat - since they just moved out and want their deposit back. In the future I will try to keep the entries here more on-topic, unless people actually care about this kind of entry …

Ok, it may not be ready yet, it might be lacking too many details. It might even make sense to make this initial announcement in Spanish - But a long time ago, I decided my blog would be English-only, as most of the people who read it are not Spanish speakers. Anyway, here I go.
We are less than one month away of the presidential elections in Mexico. We are facing the choice between two candidates (the others won't really make a difference this time): Felipe Calder n, a conservative member of the right-wing PAN party (currently ruling), and Andr s Manuel L pez Obrador, from the center-leftist PRD party.
There are way too many reasons for me, and for my friends, to prefer and promote the L pez Obrador project. No, that is not the definitive leftist stance we want, but it is a good step in the right direction. He was the major for Mexico City from 2000 to 2005, and his government showed he knows how to push social programs, he knows how to improve the conditions of the mass of the population, he knows he must start acting from below, reducing the terrible gap that exists in my country between poor and rich people, among the steepest differencies in the world.
So... Instead of flooding my personal blog with things that are not directly relevant to most of us, some friends and I have started setting up www.fecal.org.mx, the unofficial site of Felipe Calder n.
Yes, we took some of the steps we often criticize about the right-wing propaganda: Attacking instead of proposing. L pez Obrador has lost some points as he is centered more in proposing and spreading his government plan than in destroying Felipe Calder n - While Calder n has been working on creating fear, on tying L pez Obrador's figure to that of an authoritarian dictator (Hugo Ch vez has often been quoted, although it has been proven over and over no link or similarity exists), on dismissing his economic program saying he only knows how to create debt (while Mexico City's economy was strongly reactivated during L pez Obrador's period, and the city's public debt has not grown considerably compared to what previous governments did), and simply ignoring any criticism to his own project dismissing them as baseless propaganda.
Originally, we intended FeCal to become just a parody of Felipe's official site, emphasizing on what a shitty candidate he is (no wonder he carries such a name!), but we decided to be more propositive than him - We will post news following Felipe's intransigency, erroneous economic decisions and incoherences, yes, but we will also write articles by ourselves, trying to provide more interesting content, something that can objectively be used as a reference on why Felipe Calder n's project cannot be seen as socially responsable, as something that will benefit anybody but the current ruling elite - Just giving six more years to the already too long 24 year old marriage with neoliberalism we have seen, just continuity with the current government's failures, just more white-collar corrupt thieves which never recieve any kind of punishment and discourage people from pushing together towards a better country.
So, I stop flooding here. If you want to take part in the FeCal project, please contact me. If you agree with what we say, link us from your page, from your texts, from whatever you do.

Yesterday, the right-wing PAN candidate for the presidency of Mexico, Felipe Calder n, made a declaration that shadows the current president, Vicente Fox (from his same political party) almost look like a genuine statesman. (some links, La Jornada, El Universal) - And that's no easy feat, given that Mr. Fox is -so far- the nation's most prolific president... When it comes to stupid sayings.
How come Calder n rose so quickly to become a statesman? Let me first go through a bit of history. Not much, promise. Well, I'll do my best.
Twelve years and one month ago, Mexicans woke up with the frightening news we had a violent guerrilla group in Chiapas, one of Mexico's richest states, but one with the highest percentages of poor people - and, not coincidentally, of indigenous population as well. This uprising was very soon known all over the world - And its leaders quickly learned how to ensure they would not be prosecuted and exterminated: Simultaneously with the fighting, they made as large a media coverage as they could, strongly supported in the Internet democratization of the information that had just begun. Thousands of people all over the world understood their ideas -at least what they said at that time- and spread the word. I had my first trip in Europe with my (now) wife in 1996, and we saw many grafittis stating Viva Chiapas, Viva EZLN... It was amazing.
EZLN was (is) specially hard for the government to kill. As they don't do military sabotages, terrorism or so on, it is very hard to justify military action. After 12 days of fighting, a truce was decreed. The truce was broken once, in the early years of the Zedillo government, but officially there is a cease-fire, observed by both sides. The Zapatistas have took the ideas and further promoted them, with action. My Chiapas-born friend Alex Ju rez often tells me about the tremendous cultural difference between the Zapatista territories and the paramilitary ones - In the Zapatista areas, you see indians reading books, working their land, organizing themselves in the Fair Government councils, and strongly opposing alcohol and drugs. Just the opposite from the other areas.
EZLN shifted their strategy some months ago, going beyond stating their wishes for a fair regime and waiting for the government to look at them. I still don't really understand where they are heading, but the Sixth Declaration of the Lacandon Rainforest turns them into a political movement, clearly separated from the existing regime. They do not seek to be elected, they oppose every party and candidate. They define themselves as an anticapitalist movement, located down and to the left - Lets see where this goes to.
Well, back on track... One of the president's most famous stupid quotes is that, during his campaign, he promised to solve the Chiapas conflict in fifteen minutes. Well, it's been either fifteen very long minutes, or he just hasn't had any time to devote to those dirty indians. Mexicans are very frustrated by the lack of importance this man gave to one of our country's longest and most desperate needs.
Of course, Felipe Calder n must do something in this regard. Fox's shadow is a big one, and this little man must try to escape from Fox's biggest mistakes. So he just came with a formula that I don't know why no statesman thought of before: Instead of negotiating, instead of working to solve a very difficult problem, he declared he will unilaterally declare peace with EZLN.
I wonder if this year's Nobel prize will go to such an abnegated, smart and selfless person. Man, we could take this same solution to Darfur, to Israel/Palestine, to Congo, to Chechnya... If rulers all over the world start declaring peace unilaterally, all of the world's problems will be solved! What comes next, he will declare (maybe as Salinas did) that we are a first world country? Poor people are only sad reflections in the sand but don't exist in his reality?
Please, Mexicans: The man is clearly schizoid. Are you happy with Foxilandia? It seems that alternate realities are part of the PAN's action program. If you are not satisfied with Fox's results (who is?), don't vote for this guy. We will all regret it.

Over one month ago, I truly hoped an evasive network misbehavior issue was solved. In the institute, we had a strange situation which caused a (seemingly random) stack of switches to go out to lunch and leave one of the floors without network access until it decided to restore itself (usually power-cycling it was not enough). The equipment, ten 4200 SuperStack switches, is new, we got it ~September, so I expected 3Com to give me at least some support on the issue. The behavior was apparently random, and I could not track it down, only (thanks to the very nice Cacti) prove it existed.
December 5 was terrible. The whole building's network refused to work. Switches were able to reply to my pings for no more than a minute after booting before they got flooded with "Spanning Tree CTRL MAC PAUSE: Quanta 65535" (according to another great tool, the Ethereal protocol analyzer).
I had been bugging the support people at 3Com for at least three weeks before this incident, they kept promising they would come soon to help us track the cause of the ellusive problem - We threatened to send the switches back and pursue reimbursement through whatever means we could (we had much better stability and performance with our old 10Mbps hubs, so my boss insisted on replacing them), so we got them to come. The answer they gave me? Upgrade your firmware to version 2.50 (not available at their website, of course) and disable spanning tree functionality at the switches.
I have to admit the big problem immediately ceased. This is not to say I was pleased with the response time or with the switches' software quality, but at least we could work.
Happily, ~7 weeks passed by with no major outages (although with a few small ones).
Yesterday, we got back the complete chaotic conditions. This time, though, I was able to get a good and useful tcpdump snapshot, passed it through Ethereal, and actually got something interesting (available to whoever requests it to me if it sounds interesting). In short: Something happens that confuses a switch (I guess it's a faulty NIC), and makes it request to all of the neighbouring switches (via spanning tree protocol - Yes, it's disabled, but still) for their complete ARP tables. But somehow, this noise or whatever keeps confusing it, so the spanning tree requests start repeating every two seconds for slightly over one minute. Then, the same switch which requested this information gets tired of too many ARP tables being thrown at it, and sends out a storm of packets (one each 0.04 seconds) asking every other switch _not_ to send updates anymore. This is broadcasted to all of each of the switches' ports, and the network dies.
My grudge against 3Com is: How come this frigging noise (at least that's what I assume it to be) on one of the ports kill all of the network? If a switch is supposed to be smart, would it be too much for it just to disable the misbehaving port?
Anyway... One and a half days went down the drain trying to find the cause for the problem, sending the report to the 3Com guy (who is very nice in person, yes, but that's by far not enough!), running up and down the stairs to reset different switches, lock down on the source of distress... And as my 3Com contact was busy with another client (who presumably had not yet given them money), I never got a call back from them.
All my good intentions to spend a nice quiet time coding for three projects we currently need to have ready soon (one of them is in production and many of you have used, my dear Comas conference management system, but requires heavy tinkering to be able to extend it) were stuck at that: Good intentions.
I seem to have locked down the problem in one of three computers (that is, network seems stable again once I disconnected them). I insist it must be a faulty NIC. My boss bets it's an ber-contaminated Windows machine. My boss' boss insists we should get the switches double-grounded just to be sure that's not the reason for failure. I am tired, bad mooded, and -again- bored you to death with a too-long blog entry.
Blame it all on 3Com.

Ok, it may not be ready yet, it might be lacking too many details. It might even make sense to make this initial announcement in Spanish - But a long time ago, I decided my blog would be English-only, as most of the people who read it are not Spanish speakers. Anyway, here I go.
We are less than one month away of the presidential elections in Mexico. We are facing the choice between two candidates (the others won't really make a difference this time): Felipe Calder n, a conservative member of the right-wing PAN party (currently ruling), and Andr s Manuel L pez Obrador, from the center-leftist PRD party.
There are way too many reasons for me, and for my friends, to prefer and promote the L pez Obrador project. No, that is not the definitive leftist stance we want, but it is a good step in the right direction. He was the major for Mexico City from 2000 to 2005, and his government showed he knows how to push social programs, he knows how to improve the conditions of the mass of the population, he knows he must start acting from below, reducing the terrible gap that exists in my country between poor and rich people, among the steepest differencies in the world.
So... Instead of flooding my personal blog with things that are not directly relevant to most of us, some friends and I have started setting up www.fecal.org.mx, the unofficial site of Felipe Calder n.
Yes, we took some of the steps we often criticize about the right-wing propaganda: Attacking instead of proposing. L pez Obrador has lost some points as he is centered more in proposing and spreading his government plan than in destroying Felipe Calder n - While Calder n has been working on creating fear, on tying L pez Obrador's figure to that of an authoritarian dictator (Hugo Ch vez has often been quoted, although it has been proven over and over no link or similarity exists), on dismissing his economic program saying he only knows how to create debt (while Mexico City's economy was strongly reactivated during L pez Obrador's period, and the city's public debt has not grown considerably compared to what previous governments did), and simply ignoring any criticism to his own project dismissing them as baseless propaganda.
Originally, we intended FeCal to become just a parody of Felipe's official site, emphasizing on what a shitty candidate he is (no wonder he carries such a name!), but we decided to be more propositive than him - We will post news following Felipe's intransigency, erroneous economic decisions and incoherences, yes, but we will also write articles by ourselves, trying to provide more interesting content, something that can objectively be used as a reference on why Felipe Calder n's project cannot be seen as socially responsable, as something that will benefit anybody but the current ruling elite - Just giving six more years to the already too long 24 year old marriage with neoliberalism we have seen, just continuity with the current government's failures, just more white-collar corrupt thieves which never recieve any kind of punishment and discourage people from pushing together towards a better country.
So, I stop flooding here. If you want to take part in the FeCal project, please contact me. If you agree with what we say, link us from your page, from your texts, from whatever you do.

(... well, I like to think I can!) So, on a completely unimportant website that I frequent, I've ended up being a moderator on the site forums. Something about knowing *nix and PHP apparently.. Anyway, I've always had a beef with the way english is used and abused on the Internet. You know, all those abbreviations, and incorrect word usage that just seethes "I'm an illiterate prick." U, 2, ur, da, r, etc etc.. and also the so incredibly common misuse of your/you're and they're/there/their. GAH. Yech. Anyway, this particular site is no exception. Some of the users have appalling habits. (Ab)using my powers as a moderator, I've started to demand some care and attention to the most glaring errors - mainly towards my most intense pet peeve, misuse of "your" and "you're". Looking for a place that describes all this stuff well, I stumbled across this site. I couldn't have said it better. Thank you Sarah D. Bunting! (I especially liked, and agree with this:

And no, in fact, I don't know what you mean when you write me a hate mail that reads, "You're site sucks," because that doesn't mean anything. Because it's grammatically incorrect. Because you've substituted a contraction of a verb phrase for an adjective, thus rendering the sentence nonsensical. And it makes you look stupid, and therefore I cannot take you seriously.

)

Wouter Verhelst wonders why you would use a firewall config tool (apart from a GUI) instead of writing iptables rules directly. While I do just use a couple of iptables statements in a shell script here on my laptop, this is not manageable for larger networks IMHO. In fact, I wrote my Pyroman firewall admin tool for the very reason that it replaced an existing iptables script which was a pain to maintain. I'm talking 300-400 lines here. Four networks, two failover firewalls, a dozen of servers in the DMZ network some of which with extra access rights into the internal network (such as accessing the LDAP directory). And no full-time admin to take care of them. So I needed a firewall script that everybody can edit and that won't fail miserably when they make a mistake. A script with extensive error checking and that prevents people from locking themselves out. With an easy syntax. The first approach was in Perl, and already worked quite good. The rewrite then was in Python, and the users (read: fellow volunteer "admins", that don't know the firewall by heart as I do) liked it a lot. They now could add new hosts and services without depending on me to update the firewall. This is a configuration file they'll immedeately understand:

# add the web server
add_host(
        name="web",
        ip="10.100.1.2",
        iface="dmz"
)
# offering, well, web service.
allow(
        server="web",
        client="ANY DMZ INT",
        service="www ssh ping"
)

In contrast to any pure iptables script. It also helps to require them to commit their changes to a SVN repository (for getting the changes synched to the failover firewall) - that way you have version control and undo.

A few recent posts on Planet Debian make me wonder why some people seem to insist on using someone else's "firewall scripts", yada yada. Personally, I just have my own #!/bin/sh in /etc/init.d which runs iptables with some appropriate options. And that's it. Well, no, I'm lying. It also has some ip6tables lines in it. An tc. But that's really it, I swear. So, indulge me, please. What's the great thing about these firewall ruleset generators? Apart from the fact that some of them provide a GUI to change the ruleset, which I don't care for.

I think the current brouhaha surrounding PDF functionality in Office 2007 is an excellent object lesson in why software patents shouldn’t be allowed anywhere near an Open Standard (and software in general!). I’m not sure if a patent is the tool of choice that Adobe is wielding in this particular example, but even if it’s not Patent’s present a large risk to Open Standards and should be resisted. It’s the same as the distinction between a Shared Source program and Open Source or Free Software. You may have the source code for a shared source program and be able to see how it is implemented and how it operates, but there are restrictions preventing you from doing anything with that information. Likewise a standard shouldn’t be called Open simply because you have details on how it is implemented (although that is undoubtably a critical part of openness). An Open Standard should be one which is openly specified and completely free of any other encumberances (such as patents). Unfortunately I don’t see any of the standards bodies making this a priority. My understanding of the IETF RFC process is that you have to file a statement stating any IP claims but you’re not prevented from standardising somethign that you hold a patent on. W3C and the IEEE seem slightly less prone to this problem as they tend to have committee oriented standards process that require more interaction, but I’m still not aware of any direct efforts to prevent parts of the resulting standard from becoming patent encumbered. If the lack of truly Open Standards can bite Microsoft it can bit any of us. It’s not an issue we should be ignoring.

I was quiet about it for a long time, but here it is: my first Summer of Code status report. For a bigger picture: I am working on a graphical front-end to the bug tracking system Debian uses. Well, at least I am supposed to work on it. First on my list was something else: a Gtk2 graphical front-end for the well-known bug reporting tool "reportbug", which might later be integrated somehow into Debian's Gnome environment. According to the list of milestones I created when I drafted the application in less than an hour (due to the deadline approaching) I need to release a first prototype of such a GUI today. It took more time than expected to work on it, so I have not yet started any work on the main graphical front-end. I started a few days later than expected, due to some delay until the approved applications were published and I also had to learn Python from scratch. This task was not too hard, but I am still often confused by the lack of consistency throughout the language. Compared to Ruby, a language I know reasonably well and in which I already coded much, Python has much more syntactic constructs for primitives and in my opinion this leads to a lack of consistency. But well, one gets used to it... There was once a "original" Gnome front-end, but it is discontinued since some years already. I did not look much at it, neither at the patch in the BTS which should basically bring it to the current Gnome2 libraries. To properly understand the hooks I need to provide for an interface plugin I started from scratch, only reusing the core idea of the old front-end: the use of the GnomeUI Druid. The new GtkAssistant is not yet ready to be deployed, being introduced with the upcoming Gtk 2.10 release. Still I have a weird feeling about the Gnome Druid, because I abuse it just to provide a consistent look. reportbug does not support backing up to a previous question, so the Back button is generally deactivated. I tried to modify core code as few as possible, as I have not yet talked with the reportbug maintainer Chris Lawrence. I will do so in due course. However after the old GUI front-end code was basically discarded (its usage is discouraged with a prominent notice), many changes to the core code did only take the text interface into account. (Well, I just suppose this, I did not do much research into reportbug's past.) So some tiny changes were needed to provide a few more hooks. There are, however, more to come, especially in connection with one input type (select_options, which could often be implemented as presenting a simple yes/no dialogue). The configuration basically works already, as seen below. What does not work are spawing the right editor and getting a filename from the user interface. But those are minor quirks and not too hard to fix. I need to develop in the open, as specified by the Summer of Code ruleset, and now I could do so, after about four rewrites of the GUI code. The main GUI loop is now in a thread, receiving commands from the main thread running the logic and sending the input back through a queue. (I used a pipe-based approach first, using an IO selector provided by glib, but it did not work well enough and this approach is far simpler.) So the current version is not vapourware, but there is still some more work to do to get it really usable. I will put my work into the Summer of Code Subversion repository as soon as the necessary access privileges are synced onto costa, an Alioth machine. Hopefully it will be merged into reportbug when I completely finished off this project.

Martin F. Krafft blogged about how to rollback firewall changes in the case you managed to lock yourself out from the box It's even easier if you use my Pyroman firewall config tool. (apt-get install pyroman). If you run pyroman safe it will execute the new firewall rules - and if you don't type OK within 30 seconds, it will undo all changes. Note that it can also restore to a configuration set by a different firewall app. (It just restores the old iptables state and feeds it back to iptables - it will support anything your iptables version does.) Oh, and it's much faster than the other firewall scripts I've tested so far, since it doesn't spawn hundreds of iptables processes, but only one iptables-restore for setting the new rules in one transaction. Check the web page for other benefits; should just work on any Linux distribution with iptables and python (read: every). [Update: Martin, I was referring to the instructions you gave, to adding an at job and then running atrm to accept the changes. Yeah, what you script does is basically the same what mine does for rollback.]