# AICCU Configuration # Login information username USERNAME password PASSWORD # Protocol and server listed on your tunnel protocol tic server tic.sixxs.net # Interface names to use ipv6_interface sixxs # The tunnel_id to use # (only required when there are multiple tunnels in the list) #tunnel_id <your tunnel id> # Be verbose? verbose false # Daemonize? daemonize true # Require TLS? requiretls true # Set default route? defaultroute trueNow you can add a script to bring up the tunnel and interface to /jffs/config/sixxs.ipup (make sure you make it executable) where you replace your tunnel address in the ip commands.
# wait until time is synced
while [ date +%Y -eq 1970 ]; do
sleep 5
done
# check if aiccu is already running
if [ -n " ps grep etc/aiccu grep -v grep " ]; then
aiccu stop
sleep 1
killall aiccu
fi
# start aiccu
sleep 3
aiccu start /jffs/etc/aiccu.conf
sleep 3
ip -6 addr add 2001:....:....:....::/64 dev br0
ip -6 route add 2001:....:....:....::/64 dev br0
sleep 5
#### BEGIN FIREWALL RULES ####
WAN_IF=sixxs
LAN_IF=br0
#flush tables
ip6tables -F
#define policy
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT ACCEPT
# Input to the router
# Allow all loopback traffic
ip6tables -A INPUT -i lo -j ACCEPT
#Allow unrestricted access on internal network
ip6tables -A INPUT -i $LAN_IF -j ACCEPT
#Allow traffic related to outgoing connections
ip6tables -A INPUT -i $WAN_IF -m state --state RELATED,ESTABLISHED -j ACCEPT
# for multicast ping replies from link-local addresses (these don't have an
# associated connection and would otherwise be marked INVALID)
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-reply -s fe80::/10 -j ACCEPT
# Allow some useful ICMPv6 messages
ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
# Forwarding through from the internal network
# Allow unrestricted access out from the internal network
ip6tables -A FORWARD -i $LAN_IF -j ACCEPT
# Allow some useful ICMPv6 messages
ip6tables -A FORWARD -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type echo-request -j ACCEPT
ip6tables -A FORWARD -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
#Allow traffic related to outgoing connections
ip6tables -A FORWARD -i $WAN_IF -m state --state RELATED,ESTABLISHED -j ACCEPT
interface br0 AdvSendAdvert on; prefix 2001:....:....:....::/64 ; RDNSS 2001:4860:4860::8888 2001:4860:4860::8844 ; ;(again, replace the prefix with your own) That is pretty much it; at this point, you should have an IPv6 network and it's most likely that all your network devices will "just work" with it. I got full scores on the IPv6 test sites on a range of devices. Unfortunately, even a geographically close tunnel still really kills latency; compare these two traceroutes:
$ mtr -r -c 1 google.com Start: Fri Jan 15 14:51:18 2016 HOST: jj Loss% Snt Last Avg Best Wrst StDev 1. -- 2001:....:....:....:: 0.0% 1 1.4 1.4 1.4 1.4 0.0 2. -- gw-163.syd-01.au.sixxs.ne 0.0% 1 12.0 12.0 12.0 12.0 0.0 3. -- ausyd01.sixxs.net 0.0% 1 13.5 13.5 13.5 13.5 0.0 4. -- sixxs.sydn01.occaid.net 0.0% 1 13.7 13.7 13.7 13.7 0.0 5. -- 15169.syd.equinix.com 0.0% 1 11.5 11.5 11.5 11.5 0.0 6. -- 2001:4860::1:0:8613 0.0% 1 14.1 14.1 14.1 14.1 0.0 7. -- 2001:4860::8:0:79a0 0.0% 1 115.1 115.1 115.1 115.1 0.0 8. -- 2001:4860::8:0:8877 0.0% 1 183.6 183.6 183.6 183.6 0.0 9. -- 2001:4860::1:0:66d6 0.0% 1 196.6 196.6 196.6 196.6 0.0 10. -- 2001:4860:0:1::72d 0.0% 1 189.7 189.7 189.7 189.7 0.0 11. -- kul01s07-in-x09.1e100.net 0.0% 1 194.9 194.9 194.9 194.9 0.0 $ mtr -4 -r -c 1 google.com Start: Fri Jan 15 14:51:46 2016 HOST: jj Loss% Snt Last Avg Best Wrst StDev 1. -- gateway 0.0% 1 1.3 1.3 1.3 1.3 0.0 2. -- 10.50.0.1 0.0% 1 11.0 11.0 11.0 11.0 0.0 3. -- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 4. -- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 5. -- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 6. -- riv4-ge4-1.gw.optusnet.co 0.0% 1 12.1 12.1 12.1 12.1 0.0 7. -- 198.142.187.20 0.0% 1 10.4 10.4 10.4 10.4 0.0When you watch what is actually using ipv6 (the ipvfoo plugin for Chrome is pretty cool, it shows you what requests are going where), it's mostly all just traffic to really big sites (Google/Google Analytics, Facebook, Youtube, etc) who have figured out IPv6. Since these are exactly the type of places that have made efforts to get caching as close as possible to you (Google's mirror servers are within Optus' network, for example) and so you're really shooting yourself in the foot going around it using an external tunnel. The other thing is that I'm often hitting IPv6 mirrors and downloading larger things for work stuff (distro updates, git clones, image downloads, etc) which is slower and wasting someone else's bandwith for really no benefit. So while it's pretty cool to have an IPv6 address (and a fun experiment) I think I'm going to turn it off. One positive was that after running with it for about a month, nothing has broken -- which suggests that most consumer level gear in a typical house (phones, laptops, TVs, smart-watches, etc) is either ready or ignores it gracefully. Bring on native IPv6!
What happened in the reproducible
builds effort between January 3rd and January 9th 2016:
--fix-autoload-date option (on by default) to take autoload dates from changelog.
Lunar updated and sent the patch adding the generation of .buildinfo to dpkg.
SOURCE_DATE_EPOCH in the build system.SOURCE_DATE_EPOCH in the build system.armhf build nodes provided by Vagrant Cascadian. This added 7 more armhf builder jobs. We now run around 900 tests of armhf packages each day. (h01ger)
The footer of each page now indicates by which Jenkins jobs build it. (h01ger)
When I was thinking about using Ghost, I did read the installations guide and then I just closed the browser window. docker to work with service docker restart
# docker pull ghost
# mkdir -p /srv/docker/ghost/
# cat > /etc/systemd/system/ghost.service << EOF
[Unit]
Description=GHost Service
After=docker.service
Requires=docker.service
[Service]
ExecStartPre=-/usr/bin/docker kill ghost
ExecStartPre=-/usr/bin/docker rm ghost
ExecStartPre=-/usr/bin/docker pull ghost
ExecStart=/usr/bin/docker run --name ghost --publish 2368:2368 --env 'NODE_ENV=production' --volume /srv/docker/ghost/:/var/lib/ghost ghost
ExecStop=/usr/bin/docker stop ghost
[Install]
WantedBy=multi-user.target
EOF
# systemctl enable ghost && systemctl daemon-reload && systemctl start ghost
This will start your container on start and even is looking for a new Docker image and is fetching it, if needed. If you don't like this behavior, just comment out the line in the config and reread it with systemctl daemon-reload.
Now you should have listening something on port 2368:
# netstat -tapn grep 2368
tcp6 0 0 :::2368 :::* LISTEN 7061/docker-proxy
Update: Jo l Dinel did send me a mail, that starting your Docker container with --restart always will take care that it is brought up again if Docker or (even) the whole system will get restarted. For real I used that before and might be a lightweight solution, but I liked the systemd unit file solution a lot more.
/srv/docker/ghost/. So your blog will still have content, even if the ghost Docker images is updated:
# ls /srv/docker/ghost/
apps config.js data images themes
While the details about how to join the set of paid contributors have always been public (here) we did not advertise this fact very much outside of the people already interested in LTS (and thus subscribed to debian-lts@lists.debian.org). But right now we would like to have a few more paid contributors on board and I m thus posting this call for volunteers.
Who can apply?
You need to meet those requirements:
One comment Liked this article? Click here. My blog is Flattr-enabled.
Since moving to Japan, I got more and more interested in history, especially the recent history of the 20th century. The book I just finished, Ian Buruma (Wiki, home page) Wages of Guilt Memories of War in Germany and Japan (Independent, NYRB), has been a revelation for me. As an Austrian living in Japan, I am experiencing the discrepancy between these two countries with respect to their treatment of war legacy practically daily, and many of my blog entries revolve around the topic of Japanese non-reconciliation.
Willy Brandt went down on his knees in the Warsaw ghetto, after a functioning democracy had been established in the Federal Republic of Germany, not before. But Japan, shielded from the evil world, has grown into an Oskar Matzerath: opportunistic, stunted, and haunted by demons, which it tries to ignore by burying them in the sand, like Oskar s drum.
Ian Buruma, Wages of Guilt, Clearing Up the Ruins
The comparison of Germany and Japan with respect to their recent history as laid out in Buruma s book throws a spotlight on various aspects of the psychology of German and Japanese population, while at the same time not falling into the easy trap of explaining everything with difference in the guilt culture. A book of great depth and broad insights everyone having even the slightest interest in these topics should read.
This difference between (West) German and Japanese textbooks is not just a matter of detail; it shows a gap in perception.Only thinking about giving a halfway full account of this book is something impossible for me. The sheer amount of information, both on the German and Japanese side, is impressive. His incredible background (studies of Chinese literature and Japanese movie!) and long years as journalist, editor, etc, enriches the book with facets normally not available: In particular his knowledge of both the German and Japanese movie history, and the reflection of history in movies, were complete new aspects for me (see my recent post (in Japanese)). The book is comprised of four parts: The first with the chapters War Against the West and Romance of the Ruins; the second with the chapters Auschwitz, Hiroshima, and Nanking; the third with History on Trial, Textbook Resistance, and Memorials, Museums, and Monuments; and the last part with A Normal Country, Two Normal Towns, and Clearing Up the Ruins. Let us look at the chapters in turn:
Ian Buruma, Wages of Guilt, Romance of the Ruins
What is so convenient in the cases of Germany and Japan is that pacifism happens to be a high-minded way to dull the pain of historical guilt. Or, conversely, if one wallows in it, pacifism turns national guilt into a virtue, almost a mark of superiority, when compared to the complacency of other nations.
Hitler s doom and the emperor s speech, the end of one symbol and the odd continuity of another. Whatever their symbolic differences, both would be associated forever with ruins ruined cities, ruined people, ruined ideals.
Here the past had fossilized into something monumental or, as Adorno would have put it, museal.
The problem with this quasi-religious view of history is that it makes it hard to discuss past events in anything but nonsecular terms. Visions of absolute evil are unique, and they are beyond human explanation or even comprehension. To explain is hubristic and amoral. If this is true of Auschwitz, it is even more true of Hiroshima. The irony is that while there can be no justification for Auschwitz unless one believes in Hitler s murderous ideology, the case for Hiroshima is at least open to debate. The A-bomb might have saved lives; it might have shortened the war. But such arguments are incompatible with the Hiroshima spirit.
Yet the question remains whether the raping and killing of thousands of women, and the massacre of thousands, perhaps hundreds of thousands, of other unarmed people, in the course of six weeks, can still be called extreme conduct in the heat of battle. The question is pertinent, particularly when such extreme violence is justified by an ideology which teaches the aggressors that killing an inferior race is in accordance with the will of their divine emperor.
The Nuremberg trials were to be a history lesson, then, as well as a symbolic punishment of the German people a moral history lesson cloaked in all the ceremonial trappings of due legal process. They were the closest that man, or at least the men belonging to the victorious powers, could come to dispensing divine justice.Also, the differences in war trials in East and West Germany is compared. The East Germany Waldheimer trials, as well as the thorough purge of Nazis from East German jurisdiction and politics, which was in stark contrast to both West German s very restricted trials, as well as Japan s absolute non-purge of criminals.
As long as the emperor lived, Japanese would have trouble being honest about the past. For he had been formally responsible for everything, and by holding him responsible for nothing, everybody was absolved, except, of course, for a number of military and civilian scapegoats, Officers and Outlaws, who fell victim to victors justice.
The judges and some of the counsel for the ministry sat back with their eyes closed, in deep concentration, or fast asleep. Perhaps they were bored, because they had heard it all before. Perhaps they thought it was a pointless exercise, since they knew already how the case would end. But it was not a pointless exercise. For Ienaga Saburo had kept alive a vital debate for twenty-seven years. One cussed schoolteacher and several hundred supporters at the courthouse might not seem much, but it was enough to show that, this time, someone was fighting back.
The tragedy is not just that the suicide pilots died young. Soldiers (and civilians) do that in wars everywhere. What is so awful about the memory of their deaths is the cloying sentimentality that was meant to justify their self-immolation. There is no reason to suppose they didn t believe in the patriotic gush about cherry blossoms and sacrifice, no matter how conventional it was at the time. Which was exactly the point: they were made to rejoice in their own death. It was the exploitation of their youthful idealism that made it such a wicked enterprise. And this point is still completely missed at the Peace Museum today.
It was not an ignoble enterprise, but he should have recognized that Historisierung, even forty-three years after the war, was still a highly risky business. For a normal society, a society not haunted by ghosts, cannot be achieved by normalizing history, or by waving cross and garlic. More the other way around: when society has become sufficiently open and free to look back, from the point of view neither of the victim nor of the criminal, but of the critic, only then will the ghosts be laid to rest.On the Japanese side the case of Motoshima Hitoshi , who dared to question Hirohito:
Forty-three years have passed since the end of the war, and I think we have had enough chance to reflect on the nature of that war. From reading various accounts from abroad and having been a soldier myself, involved in military education, I do believe that the emperor bore responsibility for the war.which led to hitherto unseen of demonstration of extreme-right-wing groups issuing death treats that lead to a failed assassination of Motoshima, all under the completely complacent Japanese police and politics letting the right-wingers play their game.
By breaking a Japanese taboo, Motoshima struck a blow for a more open, more normal political society, and very nearly lost his life. Jenninger, I like to think, wanted to strike a blow for the same, but failed, and lost his job. Perhaps he wasn t up to the task. Or perhaps even West Germany was not yet normal enough to hear his message.
I asked him again about the local camp and the small hidden memorial. Dominik showed signs of distress. It was difficult, he admitted, very difficult. I know what you mean. But let me give you my personal opinion. When you have a crippled arm, you don t really want to show it around. It was a low point in our history, back then. But it was only twelve years in thousands of years of history. And so people tend to hide it, just as a person with a crippled arm is not likely to wear a short-sleeved shirt.A similar incident is recounted on the Japanese side, the Hanaoka incident (detailed article) and its unveiling by Nozoe Kenji, where 800 Chinese slave workers, after escaping from a forced-work camp for the Kajima Corporation, where rabbit-hunted down and slaughtered. He, too, got death threats, and was virtually expelled from his home area because he dared to publish his findings.
I think it is this basic distrust, this refusal to be told what to think by authorities, this cussed insistence on asking questions, on hearing the truth, that binds together Nozoe, Rosmus, and others like them. There are not many such people in Japan, or anywhere else for that matter. And I suspect they are not much liked wherever they live.
The state was run by virtually the same bureaucracy that ran the Japanese empire, and the electoral system was rigged to help the same corrupt conservative party to stay in power for almost forty years. This arrangement suited the United States, as well as Japanese bureaucrats, LDP politicians, and the large industrial combines, for it ensured that Japan remained a rich and stable ally against Communism. But it also helped to stifle public debate and stopped the Japanese from growing up politically.His description of current Japanese society, written in 1995, is still hauntingly true in 2016:
There is something intensely irritating about the infantilism of postwar Japanese culture: the ubiquitous chirping voices of women pretending to be girls; the Disneylandish architecture of Japanese main streets, where everything is reduced to a sugary cuteness; the screeching television talents rolling about and carrying on like kindergarten clowns; the armies of blue-suited salarymen straphanging on the subway trains, reading boys comics, the maudlin love for old school songs and cuddly mama-sans.
The Nanking Massacre, for leftists and many liberals too, is the main symbol of Japanese militarism, supported by the imperial (and imperialist) cult. Which is why it is a keystone of postwar pacifism. Article Nine of the constitution is necessary to avoid another Nanking Massacre. The nationalist right takes the opposite view. To restore the true identity of Japan, the emperor must be reinstated as a religious head of state, and Article Nine must be revised to make Japan a legitimate military power again. For this reason, the Nanking Massacre, or any other example of extreme Japanese aggression, has to be ignored, softened, or denied.While there are signs of resistance in the streets of Japan (Okinawa and the Hanako bay, the demonstrations against secrecy law and reversion of the constitution), we are still to see a change influenced by the people in a country ruled and distributed by oligarchs. I don t think there will be another Nanking Massacre in the near future, but Buruma s books shows that we are heading back to a nationalistic regime similar to pre-war times, just covered with a democratic veil to distract critics.
Ian Buruma, Wages of Guilt, Nanking
[ ] mainstream conservatives made a deliberate attempt to distract people s attention from war and politics by concentrating on economic growth.
The curious thing was that much of what attracted Japanese to Germany before the war Prussian authoritarianism, romantic nationalism, pseudo-scientific racialism had lingered in Japan while becoming distinctly unfashionable in Germany.In Romance of the Ruins:
The point of all this is that Ikeda s promise of riches was the final stage of what came to be known as the reverse course, the turn away from a leftist, pacifist, neutral Japan a Japan that would never again be involved in any wars, that would resist any form of imperialism, that had, in short, turned its back for good on its bloody past. The Double Your Incomes policy was a deliberate ploy to draw public attention away from constitutional issues.In Hiroshima:
The citizens of Hiroshima were indeed victims, primarily of their own military rulers. But when a local group of peace activists petitioned the city of Hiroshima in 1987 to incorporate the history of Japanese aggression into the Peace Memorial Museum, the request was turned down. The petition for an Aggressors Corner was prompted by junior high school students from Osaka, who had embarrassed Peace Museum officials by asking for an explanation about Japanese responsibility for the war.
The history of the war, or indeed any history, is indeed not what the Hiroshima spirit is about. This is why Auschwitz is the only comparison that is officially condoned. Anything else is too controversial, too much part of the flow of history .In Nanking, by the governmental pseudo-historian Tanaka:
Unlike in Europe or China, writes Tanaka, you won t find one instance of planned, systematic murder in the entire history of Japan. This is because the Japanese have a different sense of values from the Chinese or the Westerners.In History on Trial:
In 1950, Becker wrote that few things have done more to hinder true historical self-knowledge in Germany than the war crimes trials. He stuck to this belief. Becker must be taken seriously, for he is not a right-wing apologist for the Nazi past, but an eminent liberal.
There never were any Japanese war crimes trials, nor is there a Japanese Ludwigsburg. This is partly because there was no exact equivalent of the Holocaust. Even though the behavior of Japanese troops was often barbarous, and the psychological consequences of State Shinto and emperor worship were frequently as hysterical as Nazism, Japanese atrocities were part of a military campaign, not a planned genocide of a people that included the country s own citizens. And besides, those aspects of the war that were most revolting and furthest removed from actual combat, such as the medical experiments on human guinea pigs (known as logs ) carried out by Unit 731 in Manchuria, were passed over during the Tokyo trial. The knowledge compiled by the doctors of Unit 731 of freezing experiments, injection of deadly diseases, vivisections, among other things was considered so valuable by the Americans in 1945 that the doctors responsible were allowed to go free in exchange for their data.
Some Japanese have suggested that they should have conducted their own war crimes trials. The historian Hata Ikuhiko thought the Japanese leaders should have been tried according to existing Japanese laws, either in military or in civil courts. The Japanese judges, he believed, might well have been more severe than the Allied tribunal in Tokyo. And the consequences would have been healthier. If found guilty, the spirits of the defendants would not have ended up being enshrined at Yasukuni. The Tokyo trial, he said, purified the crimes of the accused and turned them into martyrs. If they had been tried in domestic courts, there is a good chance the real criminals would have been flushed out.
After it was over, the Nippon Times pointed out the flaws of the trial, but added that the Japanese people must ponder over why it is that there has been such a discrepancy between what they thought and what the rest of the world accepted almost as common knowledge. This is at the root of the tragedy which Japan brought upon herself.
Emperor Hirohito was not Hitler; Hitler was no mere Shrine. But the lethal consequences of the emperor-worshipping system of irresponsibilities did emerge during the Tokyo trial. The savagery of Japanese troops was legitimized, if not driven, by an ideology that did not include a Final Solution but was as racialist as Hider s National Socialism. The Japanese were the Asian Herrenvolk, descended from the gods.
Emperor Hirohito, the shadowy figure who changed after the war from navy uniforms to gray suits, was not personally comparable to Hitler, but his psychological role was remarkably similar.
In fact, MacArthur behaved like a traditional Japanese strongman (and was admired for doing so by many Japanese), using the imperial symbol to enhance his own power. As a result, he hurt the chances of a working Japanese democracy and seriously distorted history. For to keep the emperor in place (he could at least have been made to resign), Hirohito s past had to be freed from any blemish; the symbol had to be, so to speak, cleansed from what had been done in its name.In Memorials, Museums, and Monuments:
If one disregards, for a moment, the differences in style between Shinto and Christianity, the Yasukuni Shrine, with its relics, its sacred ground, its bronze paeans to noble sacrifice, is not so very different from many European memorials after World War I. By and large, World War II memorials in Europe and the United States (though not the Soviet Union) no longer glorify the sacrifice of the fallen soldier. The sacrificial cult and the romantic elevation of war to a higher spiritual plane no longer seemed appropriate after Auschwitz. The Christian knight, bearing the cross of king and country, was not resurrected. But in Japan, where the war was still truly a war (not a Holocaust), and the symbolism still redolent of religious exultation, such shrines as Yasukuni still carry the torch of nineteenth-century nationalism. Hence the image of the nation owing its restoration to the sacrifice of fallen soldiers.In A Normal Country:
The mayor received a letter from a Shinto priest in which the priest pointed out that it was un-Japanese to demand any more moral responsibility from the emperor than he had already taken. Had the emperor not demonstrated his deep sorrow every year, on the anniversary of Japan s surrender? Besides, he wrote, it was wrong to have spoken about the emperor in such a manner, even as the entire nation was deeply worried about his health. Then he came to the main point: It is a common error among Christians and people with Western inclinations, including so-called intellectuals, to fail to grasp that Western societies and Japanese society are based on fundamentally different religious concepts . . . Forgetting this premise, they attempt to place a Western structure on a Japanese foundation. I think this kind of mistake explains the demand for the emperor to bear full responsibility.In Two Normal Towns:
The bust of the man caught my attention, but not because it was in any way unusual; such busts of prominent local figures can be seen everywhere in Japan. This one, however, was particularly grandiose. Smiling across the yard, with a look of deep satisfaction over his many achievements, was Hatazawa Kyoichi. His various functions and titles were inscribed below his bust. He had been an important provincial bureaucrat, a pillar of the sumo wrestling establishment, a member of various Olympic committees, and the recipient of some of the highest honors in Japan. The song engraved on the smooth stone was composed in praise of his rich life. There was just one small gap in Hatazawa s life story as related on his monument: the years from 1941 to 1945 were missing. Yet he had not been idle then, for he was the man in charge of labor at the Hanaoka mines.In Clearing Up the Ruins:
But the question in American minds was understandable: could one trust a nation whose official spokesmen still refused to admit that their country had been responsible for starting a war? In these Japanese evasions there was something of the petulant child, stamping its foot, shouting that it had done nothing wrong, because everybody did it.
Japan seems at times not so much a nation of twelve-year-olds, to repeat General MacArthur s phrase, as a nation of people longing to be twelve-year-olds, or even younger, to be at that golden age when everything was secure and responsibility and conformity were not yet required.
For General MacArthur was right: in 1945, the Japanese people were political children. Until then, they had been forced into a position of complete submission to a state run by authoritarian bureaucrats and military men, and to a religious cult whose high priest was also formally chief of the armed forces and supreme monarch of the empire.
I saw Jew S ss that same year, at a screening for students of the film academy in Berlin. This showing, too, was followed by a discussion. The students, mostly from western Germany, but some from the east, were in their early twenties. They were dressed in the international uniform of jeans, anoraks, and work shirts. The professor was a man in his forties, a 68er named Karsten Witte. He began the discussion by saying that he wanted the students to concentrate on the aesthetics of the film more than the story. To describe the propaganda, he said, would simply be banal: We all know the what, so let s talk about the how. I thought of my fellow students at the film school in Tokyo more than fifteen years before. How many of them knew the what of the Japanese war in Asia.
WAV files before the
rise of the MP3 format, of which I ended up building a significant
collection (just fair use copies from friends and owned CDs, of
course) and eventually video files.)
The downloadable internet is what still allows me to type this article
in a text editor, without internet access, while reading H0d3r's blog
post on my e-reader, because I downloaded his article off an RSS
feed. It is what makes it possible for anyone to download a full copy
of this blog post and connected web pages as a git repository and
this way get the full history of modifications on all the pages, but
also be able to edit it offline and push modifications back in.
Wikipedia is downloadable (there are even offline apps for your
phone). Open standards like RSS feeds and HTML are
downloadable. Heck, even the Internet Archive is downloadable (and
I mean, all of it, not just the parts you want), surprisingly enough.
The above sign was at the Melbourne Docks in December 2014 when I was returning from a cruise. I have no idea why there are 3 men and 1 woman on the sign (and a dock worker was also surprised when I explained why I was photographing it). I wonder whether a sign that had 3 women and 1 man would ever have been installed or not noticed if it was installed.
At the start of the first day of LCA 2015 the above was displayed at the keynote as a flow-chart for whether someone should ask a question at a lecture. Given that the first real item in the list is that a question should fit in a tweet I think it was inspired by my blog post about the length of conference questions [1].
At the introduction to the Astronomy Miniconf the above slide was displayed. In addition to referencing the flow-chart for asking questions it recommends dimming laptop screens (among other things).
The above sign was at a restaurant in Auckland in January 2015. I thought that sort of sexist joke went out of fashion a few decades ago.
The above photo is from a Melbourne department store in February 2015. Why gender a nerf gun? That just doesn t make sense. Also it appeared that the only nerf crossbow was the purple/pink one, is a crossbow considered feminine nowadays?
The above picture is a screen-shot of one of the Talking Angela series of Android games from March. Appropriating the traditional clothing of marginalised groups is a bad thing. People of Native American heritage who want to wear their traditional clothing face discrimination when they do so, when white people play dress-up in clothing that is a parody of Native American style it s really offensive. The site Racialicious.com has a tag for articles about appropriation [2].
The above was in a library advertising an Ebook reader. In this case they didn t even have pointlessly gendered products they just had pointlessly gendered adverts for the same product. They also perpetuate the myth that only girls read vampire books and only boys read about space. Also why is the girl lying down to read while the boy is sitting up?
Above is an Advent calendar on sale in a petrol station. Having end of year holiday presents that have nothing to do with religious festivals makes sense. But Advent is a religious observance. I think this would be a better candidate for war on Christmas paranoia than a coffee cup of the wrong colour.
The above photo is of boys and girls pipette suckers. Pointlessly gendered recreational products like Nerf guns is one thing, but I think that doing it to scientific equipment is a bigger problem. Are scientists going to stop work if they can t find a pipette sucker of the desired gender? Is worrying about this going to distract them from their research (really bad if working with infectious or carcinogenic solutions). The Integra advertising claims to be doing this to promote breast cancer research which is also bogus. Here is a Sociological Images article about the problems of using pink to market breast cancer research [3] and the Sociological Images post about pinkwashing (boobies against breast cancer) is also worth reading [4].
As an aside I made a mistake in putting a pipette sucker over the woman s chest in that picture. The way that Integra portreyed her chest is relevant to analysis of this advert. But unfortunately I didn t photograph that.
Here is a link to my sociological images post from 2014 [5].
if [ grep foobar somefile wc -l -gt 0 ]; then ...
Yes it's obvious that silencing grep and working with the return code is
way more elegant and the backticks are also deprecated, or at least discouraged,
nowadays. For this special case "grep -c" is not the right replacement. Just in case.
So I wanted to know how widespread the "grep wc -l" chaining
actually is. codesearch.d.n to the rescue!
At least in some codebases it seems to be rather widespread, so maybe
"grep -c" is not POSIX compliant?
Nope. Traveling back a few years and looking at a somewhat older
manpage
also lists a "-c" option. At least for now I doubt that this is some kind
of backwards compatiblity thing. Even
busybox
supports it.
As you can obviously deduce from the matching lines, and my rather fuzzy search pattern,
there are valid cases among the result set where "grep" is just the first command
and some "awk/sed/tr" (you name it) is in between the final "wc -l". But quite some
" wc -l" could be replaced by a "-c" added to the "grep" invocation.
| Calculate q(yi | yi-1, yi-2) = trigram counts[trigram])/float(bigram counts[bigram]. Note: yi-2 = , yi-1 = for the first round |
As the Buddha said 2500 years ago... we're all out of our fucking minds. (Albert Ellis)There have been a few occasions over the last year where people suffering mental illnesses have been the subject of much discussion. In March 2015 there was the tragic loss of Germanwings flight 9525. It was discovered that the co-pilot, Andreas Lubitz, had been receiving treatment for mental illness. Under strict privacy laws, nobody at his employer, the airline, had received any information about the diagnosis or treatment.
During the summer, the private mailing list for a large online community discussed the mental illness of a contributor to a project. Various people expressed opinions that appeared to be generalizations about all those with mental illness. Some people hinted the illness was a lie to avoid work while others speculated about options for treatment. Nobody involved mentioned having any medical expertise.
It is ironic that on the one hand, we have the dramatic example of an aircraft crashing at the hands of somebody who is declared unfit to work but working anyway and on the other hand when somebody else couldn't do something, the diagnosis is being disputed by people who find it inconvenient or don't understand it.
More recently, there has been openly public discussion about whether another developer may have had mental illness. Once again, there doesn't appear to be any evidence from people with any medical expertise or documentation whatsoever. Some of the comments appear to be in the context of a grudge or justifying some other opinion.
What's worse, some comments appear to suggest that mental illness can be blamed for anything else that goes wrong in somebody's life. If somebody is shot and bleeds to death, do you say low blood pressure killed him or do you just say he was shot? Likewise, if somebody is subject to some kind of bullying and abused, does this have no interaction with mental illness? In fact, Google reveals an enormous number of papers from experts in this field suggesting that mental illness can arise or be exacerbated by bad experiences. Although it may not have been clear at that point in time, when we look back at Alan Turing's death today, suicide was not a valid verdict and persecution was a factor.
Statistics tell us that 1 in 4 people experience a mental health problem in the UK each year. In the USA it is 26% of the adult population, each year. These may be long term conditions or they may be short term conditions. They may arise spontaneously or they may be arising from some kind of trauma, abuse or harassment in the home, workplace or some other context.
For large online communities, these statistics imply it is inevitable that some participants will be suffering from mental illness and others will have spouses, parents or children suffering from such conditions. These people will be acutely aware of the comments being made publicly about other people in the community. Social interaction also relates to the experience of mental illness, people who are supported by their community and society are more likely to recover while those who feel they are not understood or discriminated against may feel more isolated, compounding their condition.
As a developer, I wouldn't really like the idea of doctors meddling with my code, so why is it that some people in the IT and business community are so happy to meddle around in the domain of doctors, giving such strong opinions about something they have no expertise in?
Despite the tragic loss of life in Germanwings 9525, observing some of these other discussions that have taken place reminds me why Germany and some other countries do have such strict privacy laws for people who seek medical treatment.
(You can Follow or Tweet about this blog on Twitter)
This is not a new world, this is simply an extension of the old one. I'm not going to write here about sweeping changes that are happening now, but changes that have been taking place in plain sight for many decades. No one has flipped a switch, only tweaked and tuned variables here and there to lead us down this path. I'd like to reflect on where we are now but there is no way I could describe how it is we got here, the journey was far too complex and filled with ommissions, half-truths and outright lies. It's likely we will never know what has brought us here.
I live in Scotland, a country that is a part of the United Kingdom and a member of the European Union. We have a Scottish Government, although certain matters are still handled by the UK Government. The European Government also handles some matters and these can take effect across the entire European Union. I do not feel that I can hold trust in any of these bodies anymore.
The European Convention on Human Rights was, for me at least, a beacon of hope. A series of fundamental rights guaranteed to be upheld for every person within the European Union. A series of fundamental rights that has been ignored by governments repeatedly:
"nearly all passengers, if they fully understand the procedures, would be unlikely to opt for [the alternative of a private search]"Even with this display of confidence that they believe the public are happy with the invasion of privacy brought by the security scanners, they have still chosen to not fully inform the public in the way in which the scanner operates. It is the lies that anger me the most. We claim to live in a democracy and you cannot have a democracy without transparency. It is not too late for the Government to earn back my trust, but for now, they haven't given me good reason to believe anything they produce. If you have read this article and you would like to support efforts for change in the United Kingdom, please consider joining the Open Rights Group and perhaps getting involved in their work.
Since quite some time I was wondering why my blog suddenly does not display a title in the browser bar. Hmm, Of course I thought I broke something, but it turned out that this is a feature of a recent WordPress update. Mentioned in a blog entry on the development or should I say, hidden there so that nobody knows about it the changes stirred quite some reactions, not the least because a lot, if not all older themes, are suddenly broken. Congratulations WordPress developer to this great move.
So what has happened? Many themes use the wp_title function to ship out title tags. After a short period of deprecation WordPress developers instantiated the function, but in a way that it doesn t work with older themes. Perfect.
To quote from the kind of annoucement:
This latest change makes the new API (almost) feature complete and theme authors are discouraged from using wp_title() in the future. If it was decided to add a UI to let users choose the make up of their document title, or another improvement to how title generation works, we now have a forward compatible way to handle these things. To upgrade themes from using wp_title() to declaring theme support for core s title-tag without breaking backwards compatibility with WordPress 4.0 and older, theme authors can check if the callback function exists and add a shiv in case it does not:Well, thanks for putting this well hidden in a development blog. Furthermore, one needs to read the following code quite carefully, otherwise one overlooks that it is necessary to delete the calls to
wp_title.
Fortunately, on blog of the Theme Review Team the this post was found, which explains what has to be done:
add_action( 'after_setup_theme', 'theme_slug_setup' ); function theme_slug_setup() add_theme_support( 'title-tag' ); |
header.php template: <title><?php wp_title( ' ', true, 'right' ); ?></title>
The elections for the new OpenStack board are coming closer
and this time the Open Source community has a great
opportunity of representation: Giuseppe Patern is standing as a candidate for the board.
Although Giuseppe is considered by HP and Forrester Research
among the top talented consultants in the world,
Gippa (as he s largely known in the industry) is still one of us ,
a nerd that grew up with a keyboard on his hands.
As he s one of the candidates of the OpenStack board,
Fabio Marzocca wishing to know more has interviewed him.
[FM] The hard question. You re a techie. Why the hell are you running for the board?
[GP] This is indeed a good question It all started as a challenge from some clients and friends that are working in the OpenStack project. The truth is that the board and most of the management of the foundation are from vendors. I m not questioning here if they do a good job or not, it is very likely that they tend to protect their own interests. In my opinion it lacks some community spirit that have fostered Linux development such as Debian and Ubuntu. That s why I m running for it, to bring the community where it should be.
[FM] Back to Debian and Ubuntu, could you tell us your story with Linux?
[GP] I discovered Linux in 1994, but only in 1996 things were serious. By the time I just finished high school and I applied for a job in a local Internet Service Provider. At 15 years I was well known in the local community as I was installing and maintaining several BBSes, so it wasn t hard to get the job. I can say it was love at first sight. I started with Slackware (was the first distro), but I moved into redhat first and then debian. When I was working for the IBM Linux Technology Center, I was in charge of helping porting Linux to PowerPC and backporting LVM to make it similar to AIX. Sun was also a good playground as they acquired Cobalt, a hardware appliance based on debian. Then I shifted more towards Enterprise Linux adoption with 6 years in RedHat and then I went to Canonical. I was happy to go back to Debian and Ubuntu community, because I still believe that Ubuntu Developer Summits (UDS) were the real spirit of a Linux community.
[FM] Another hard question. We know you re somehow involved in the rebellion of Devuan.org. What is your opinion about systemd?
[GP] Let me tell you that it s not totally black/white and let s see the two sides here. Something like systemd was indeed needed. Each distro has its own way of init ing the system and for a package maintainer or commercial software maker, maintaining different init behaviour is insane. And as an init replacement it totally makes sense. However, IMHO systemd went too far away, incorporating into its code something that should not happen. A DHCP client into an init system, seriously? I doubt it was in the spirit of the Unix and Linux system
However, in the real world of pets vs cattle , where application matters more than systems, having a systemd as it is, doesn t change that much.
[FM] OpenStack was incubated in Ubuntu and the roots are quite clear. Is there something else that you would like to see from Debian and Ubuntu in OpenStack?
[GP] Stability, if I can name just one. Currently OpenStack is released every 6 months, which was probably the best choice to speed up the development. However, this is now becoming a weakness, as enterprise customers can t upgrade their critical infrastructures every 6 months. Traditionally Debian is maniacally focused on given a bullet-proof distribution, this is something that in my opinion is missing from OpenStack.
[FM] Gippa, tell us just 2 or 3 topics you will bring to action in case of election
[GP] I d like to introduce an OpenStack LTS process, following the Ubuntu approach: while releasing every 6 months is fair enough for development and testing environments, having a stable release every 2-3 years can give enterprise customers the peace of mind they need while running production environments.
I d also love to see a consolidation of the core (Nova/Neutron/Cinder/Swift): vendors and developers are introducing new features and projects while I d love to see for example- a more stable and scalable Neutron and a more stable connection to Oslo (in particular rabbitmq).
In general, I would encourage more attention to who is actually deploying, integrating and using OpenStack every day. I would also try to foster the ecosystem of ISVs in order to release and certify their software for OpenStack. And last but not least- to see interoperation between regional datacenters: I dream of a world where companies in a given territory can work together , and this is only possible through standards. I hope that OpenStack can represent this standard.
[FM] When are the elections and how can we vote?
[GP] Individual Member Director elections for the 2016 Board will be held online from Monday January 11, 2016 to Friday January 15, 2016. More informations on the website.
Making it easier to use C++ in R has been a really nice and rewarding side effect of the work on Rcpp. One really good idea came from something Jay Emerson, Michael Kane and had I kicked about for way too long: shipping Boost headers for easier use by R and CRAN packages (such as their family of packages around bigmemory). The key idea here is headers: Experienced C++ authors such as library writers can organise C++ code in such a way that one can (almost always) get by without any linking. Which makes deployment so much easier in most use cases, and surely also with R which knows how to set an include path.
So after years of "yes we really should", Jay deserves the credit for actually sitting down almost three years ago and creating the first version. So at the end of January 2013, we released BH version 1.51.0-0. By now the package is used fifty-four other CRAN packages --- clearly a much stronger uptake then we ever expected. I took over maintenance at some point, and we are currently in-line with the most recent Boost release 1.60.0.
But some people were always lusting after (some) parts of Boost which also require linking. For some libraries (such as Boost.Date_Time in my RcppBDT package) you can set a #define to not require linking (and forego some string formatting or parsing we get from R anyway). Some others are trickier; Boost Regex is one example. I do not think you can use it without linking (but then C++11 helps and finally brings regular expression in the default library).
Another library which the systems / network programmers at work would frequently rely upon is Boost.Asio, a cross-platform C++ library for network and low-level I/O programming. It was already used on CRAN by the iptools package by Bob Rudis and Oliver Keyes which shied away from building on Windoze (while 'doze and Boost do get along, but the CRAN system makes it a little more involved).
A couple of days ago, I somehow learned that the Asio library actually comes in two flavours: the well-known Boost.Asio (requiring linking), and also as a header-only standalone library! Well, well, well -- so I ran that by Bob and Oliver asking if that would be useful. And the response was a resounding and pretty much immediate Hell, Yes!.
So I wrapped it in a package, told Bob about it, who tested it and gave the thumbs up. And after a slightly longer-than-usual on-boarding, the package is now on CRAN. As network (and systems) programming is not entirely uncommon even at CRAN, I hope that this package may find a few more use cases. A new version of iptools should be forthcoming "shortly", including for the first time a Windows build thanks to this package. The indefatigable Martin Morgan already spotted our GitHub repo and scored the first fork.
Comments and suggestions about AsioHeaders are welcome via the issue tracker at the GitHub GitHub repo.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.
Which gadgets does Bond bring to Switzerland?
On Her Majesty's Secret Service is one of the more memorable Bond movies for its spectacular setting in the Swiss Alps, the location now transformed into a mountain-top revolving restaurant visited by thousands of tourists every day with a comfortable cable car service and hiking trails with breathtaking views that never become boring.
Can you imagine Bond leaving behind his gun and his skis and visiting Switzerland with a smartphone instead? Eating a pizza with one hand while using the fingertips of the other to operate an app for making drone strikes on villains, swiping through Tinder for a new girl to replace the one who died (from boredom) in his previous "adventure" and letting his gelati melt while engrossed in a downhill ski or motorcycle game in all the glory of a 5.7" 24-bit colour display?
Of course its absurd. Would you want to live like that yourself? We see more and more of it in people who are supposedly in Switzerland on the trip of a lifetime. Would you tolerate it in a movie? The mobile phone industry has paid big money to have their technology appear on the silver screen but audience feedback shows people are frustrated with movies that plaster the contents of text messages across the screen every few minutes; hopefully Bond movies will continue to plaster bullets and blood across the screen instead.
Time for freedom
How would you live for a day or a weekend or an entire holiday without your mobile phone? There are many small frustrations you may experience but the biggest one and the indirect cause of many other problems you will experience may be the inability to tell the time.
Many people today have stopped wearing a watch, relying instead upon their mobile phone to tell the time.
Without either a phone or a watch, frustration is not far away.
If you feel apprehension just at the thought of leaving your phone at home, the lack of a watch may be a subconcious factor behind your hesitation.
Trying is better than reading
Many articles and blogs give opinions about how to buy a watch, how much to spend and what you can wear it with. Don't spend a lot of time reading any of it, if you don't know where to start, simply go down to the local high street or mall and try them. Start with the most glamorous and expensive models from Swiss manufacturers, as these are what everything else is compared to and then perhaps proceed to look more widely. While Swiss brands tend to sell through the stores, vendors on Amazon and eBay now distribute a range of watches from manufacturers in Japan, China and other locations, such as Orient and Invicta, at a fraction of the price of those in the stores. You still need to try a few first to identify your preferred style and case size though. Google can also turn up many options for different budgets.

I just published the first version of git find on gh/mirabilos/git-find
for easy collaboration. The repository deliberately only contains the
script and the manual page so it can easily be merged into git.git with
complete history later, should they accept it. git find is MirOS licenced. It does require
a recent mksh (Update: I did start it
in POSIX sh first, but it eventually turned out to require arrays, and
I don t know perl(1) and am not going to rewrite it in C) and some common
utility extensions to deal with NUL-separated lines (sort -z,
grep -z, git ls-tree -z); also, support for '\0'
in tr(1) and a comm(1) that does not choke on embedded NULs in lines.
To install or uninstall it, run
$ git clone git@github.com:mirabilos/git-find.git $ cd git-find $ sudo ln -sf $PWD/git-find /usr/lib/git-core/ $ sudo cp git-find.1 /usr/local/share/man/man1/ hack $ sudo rm /usr/lib/git-core/git-find \ /usr/local/share/man/man1/git-find.1
then you can call it as git find and look at the documentation with git help find , as is customary. The idea behind this utility is to have a tool like git grep that acts on the list of files known to git (and not e.g. ignored files) to quickly search for, say, all PNG files in the repository (but not the generated ones). git find acts on the index for the HEAD, i.e. whatever commit is currently checked-out (unlike git grep which also knows about git add ed files; fix welcome) and then offers a filter syntax similar to find(1) to follow up: parenthes s, ! for negation, -a and -o for boolean are supported, as well as -name, -regex and -wholename and their case-insensitive variants, although regex uses grep(1) without (or, if the global option -E is given, with) -E, and the pattern matches use mksh(1) s, which ignores the locale and doesn t do [[:alpha:]] character classes yet. On the plus side, the output is guaranteed to be sorted; on the minus side, it is rather wastefully using temporary files (under $TMPDIR of course, so use of tmpfs is recommended). -print0 is the only output option (-print being the default). Another mode forwards the file list to the system find; since it doesn t support DOS-style response files, this only works if the amount of files is smaller than the operating system s limit; this mode supports the full range (except -maxdepth) of the system find(1) filters, e.g. -mmin -1 and -ls, but it occurs filesystem access penalty for the entire tree and doesn t sort the output, but can do -ls or even -exec. The idea here is that it can collaboratively be improved, reviewed, fixed, etc. and then, should they agree, with the entire history, subtree-merged into git.git and shipped to the world. Part of the development was sponsored by tarent solutions GmbH, the rest and the entire manual page were done in my vacation.
With the world passing 10% IPv6 penetration over the weekend,
we see the same old debates coming up again; people claiming IPv6 will
never happen (despite several years now of exponential growth!),
and that if they had only designed it differently, it would have been
all over by now.
In particular, people like to point to a 2002 3 article by D. J. Bernstein,
complete with rants about how Google would never set up useless IPv6
addresses (and then they did that in 2007 I was involved). It's difficult
to understand exactly what the article proposes since it's heavy on
calling people idiots and light on actual implementation details (as opposed
to when DJB's gotten involved in other fields; e.g. thanks to him we now have
elliptical curve crypto that doesn't suck, even if the
reference implementation was sort of a pain to build), but I will try to
go through it nevertheless and show how I cannot find any way it would work
well in practice.
One thing first, though: Sorry, guys, the ship has sailed. Whatever genius
solution DJB may have thought up that I'm missing, and whatever IPv6's
shortcomings (they're certainly there), IPv6 is what we have. By now, you can not
expect anything else to arise and take over the momentum; we will either live
with IPv6 or die with IPv4.
So, let's see what DJB says. As far as I can see, his primary call is for
a version of IPv6 where the address space is an extension of the IPv4
space. For sake of discussion, let's call that IPv4+ , although it would
share a number of properties with IPv6. In particular, his proposal requires
changing the OS and other software on every single end host out there,
just as IPv6; he readily admits that and outlines how it's done in rough
terms (change all structs, change all configuration files, change all
databases, change all OS APIs, etc.). From what I can see, he also readily
admits that IPv4 and IPv4+ hosts cannot talk to each other, or more clearly,
we cannot start using the extended address space before almost everybody
has IPv4+ capable software. (E.g., quote: Once these software upgrades have been
done on practically every Internet computer, we'll have reached the magic
moment: people can start relying on public IPv6 addresses as replacements for
public IPv4 addresses. )
So, exactly how does the IPv4 address space fit into the IPv4+ address space?
The article doesn't really say anything about this, but I can imagine only
two strategies: Build the IPv4+ space around the IPv4 space (ie., the IPv4
space occupies a little corner of the IPv4+ space, similar to how v4-mapped
addresses are used within software but not on the wire today, to let
applications do unified treatment of IPv4 addresses as a sort of special IPv6
address), or build it as a hierarchical extension.
Let's look at the former first; one IPv4 address gives you one IPv4+ addresses.
Somehow this seems to give you all the disadvantages of IPv4 and all the
disadvantages of IPv6. The ISP is not supposed to give you any more IPv4+
addresses (or at least DJB doesn't want to contact his ISP about more also
saying that the fact that automatic address distribution does not change his
argument), so if you have one, you're stuck with one. So you still need NAT.
(DJB talks about proxies , but I guess that the way things evolved, this
either actually means NAT, or it talks about the practice of
application-level proxies such as Squid or SOCKS proxies to reach the
Internet, which really isn't commonplace anymore, so I'll assume for the sake
of discussion it means NAT.)
However, we already do NAT. The IPv4 crunch happened despite ubiquitous
NAT everywhere; we're actually pretty empty. So we will need to hand out
IPv4+ addresses at the very least to new deployments, and also probably
reconfigure every site that wants to expand and is out of IPv4 addresses.
( Site here could mean any organizational unit, such as if your neighborhood
gets too many new subscribers for your ISP's local addressing scheme to have
enough addresses for you.)
A much more difficult problem is that we now need to route these addresses on
the wire. Ironically, the least clear part of DJB's plan is step 1, saying
we will extend the format of IP packets to allow 16-byte addresses ; how
exactly will this happen? For this scheme, I can only assume some sort of
IPv4 option that says the stuff in the dstaddr field is just the start and
doesn't make sense as an IPv4 address on its own; here are the remaining 12 bytes
to complete the IPv4+ address . But now your routers need to understand that
format, so you cannot do with only upgrading the end hosts; you also need to
upgrade every single router out there, not just the end hosts. (Note that
many of these do routing in hardware, so you can't just upgrade the software
and call it a day.) And until that's done, you're exactly in the same
situation as with IPv4/IPv6 today; it's incompatible.
I do believe this option is what DJB talks about. However, I fail to see
exactly how it is much better than the IPv6 we got ourselves into; you still
need to upgrade all software on the planet and all routers on the planet.
The benefit is supposedly that a company or user that doesn't care can just
keep doing nothing, but they do need to care, since they need to upgrade
100% of their stuff to understand IPv4+ before we can start even deploying it
alongside IPv4 (in contrast with IPv6, where we now have lots of experience
in running production networks). The single benefit is that they won't have
to renumber until they need to grow, at which point they need to anyway.
However, let me also discuss the other possible interpretation, namely that
of the IPv4+ address space being an extension of IPv4, ie. if you have
1.2.3.4 in IPv4, you have 1.2.3.4.x.x.x.x or similar in IPv4+. (DJB's article
mentions 128-bit addresses and not 64-bit, though; we'll get to that in a
moment.) People keep bringing this up, too; it's occasionally been called
BangIP (probably jokingly, as in this April Fool's joke) due to
the similarity with how explicit mail routing would work before SMTP became
commonplace. I'll use that name, even though others have been proposed.
The main advantage of BangIP is that you can keep your Internet core routing
infrastructure. One way or the other, they will keep seeing IPv4 addresses
and IPv4 packets; you need no new peering arrangements etc.. The exact
details are unclear, though; I've seen people suggest GRE tunneling, ignoring
problems they have through NAT, and I've seen suggestions of IPv4 options
for source/destination addresses, also ignoring that someting as innocious
as setting the ECN bits has been known to break middleboxes left and right.
But let's assume you can pull that off, because your middlebox will almost
certainly need to be the point that decapsulates BangIP anyway and converts
it to IPv4 on the inside, presumably with a 10.0.0.0/8 address space so that
your internal routing can keep using IPv4 without an IPv4+ forklift upgrade.
(Note that you now lose the supposed security benefit of NAT, by the way,
although you could probably encrypt the address.) Of course, your hosts
will need to support IPv4+ still, and you will need some way of communicating
that you are on the inside of the BangIP boundary. And you will need to know
what the inside is, so that when you communicate on this side, you'll send
IPv4 and not IPv4+. (For a home network with no routing, you could probably
even just do IPv4+ on the inside, although I can imagine complications.)
But like I wrote above, experience has shown us that 32 extra bits isn't
enough. One layer of NAT isn't doing it, we need two. You could imagine
the inter-block routability of BangIP helping a fair bit here (e.g.,
a company with too many machines for 10.0.0.0/8 could probably easily
get more addresses for more external IPv4 addresses, yielding 10.0.0.0/8
blocks), but ultimately, it is a problem that you chop the Internet off
in two distinct halves that work very differently. My ISP will probably
want to use BangIP for itself, meaning I'm on the outside of the core; how
many of those extra bits will they allocate for me? Any at all?
Having multiple levels of bang sounds like pain; effectively we're creating
a variable-length address. Does anyone ever want that? From experience, when
we're creating protocols with variable-length addresses, people just tend to
use the maximum level anyway, so why not design it with 128-bit to begin
with? (The original IP protocol proposals actually had variable-length
addresses, by the way.) So we can create our 32/96 BangIP , where the first
32 bits are for the existing public Internet, and then every IPv4 address
gives you a 2^96 addresses to play with. (In a sense, it reminds me of 6to4,
which never worked very well and is now thankfully dead.)
However, this makes the inside/outside-core problem even worse. I now need
two very different wire protocols coexisting on the Internet; IPv4+ (which
looks like regular IPv4 to the core) for the core, and a sort of
IPv4+-for-the-outside (similar to IPv6) outside it.
If I build a company network, I need to
make sure all of my routers are IPv4+-for-the-outside and talk that, while if I build the
Internet core, I need to make sure all of my connections are IPv4 since
I have no guarantee that I will be routable on the Internet otherwise.
Furthermore, I have a fixed prefix that I cannot really get out of, defined
by my IPv4 address(es). This is called hierarchical routing , and the IPv6
world gave it up relatively early despite it sounding like a great idea at
first, because it makes multihoming a complete pain: If I have an address
1.2.3.4 from ISP A and 5.6.7.8 from ISP B, which one do I use as the first
32 bits of my IPv4+ network if I want it routable on the public Internet?
You could argue that the solution for me is to get an IPv4 PI netblock
(supposedly a /24, since we're not changing the Internet core), but we're
already out of those, which is why we started this thing to begin with.
Furthermore, if the IPv4/IPv4+ boundary is above my immediate connection
to the Internet (say, ISP A doesn't have an IPv4 address, just IPv4+),
I'm pretty hosed; I cannot announce an IPv4 netblock in BGP. The fact that
the Internet runs on largely the same protocol everywhere is a very nice
thing; in contrast, what is described here really would be a mess!
So, well. I honestly don't think it's as easy to just do extension instead of
alternative when it comes to the address spaces. We'll just need to deal
with the pain and realize that upgrading the equipment and software is the
larger part of the job anyway, and we'll need to do that no matter what
solution we go with.
Congrats on reaching 10%! Now get to work with the remaining 90%.
Next.