As always, we’re doing lots of interesting and significant things and have more good ideas than we have people to do the work.  If you have an Eee PC or are planning to get one, or are otherwise interested in our work, some of which has uses beyond just the Eee, here are some highlights: Earliest Eee models supported in Lenny Lenny will release with the atl2 ethernet driver and the non-free madwifi-source now works with the earliest Eee models as well, so our patched version is no longer needed.  This means Lenny will work with all of the earliest models of the Eee PC: 701 (2G and 4G surf, 4G, 8G) and 900! All we need now for full support in Lenny is to replace the non-free wireless driver with the free ath5k driver when it is ready. Free drivers Nick Kossifidis has submitted patches on linux-wireless supporting the Eee models currently supported only by the non-free madwifi in ath5k.  This means we’ll soon realize our goal of a completely DFSG free system for the earliest models of the Eee.  By 2.6.27, or at the latest 2.6.28, these models will be supported.  Then we will see about making a patch to support whichever kernel makes it into Lenny. New models Model 901, 1000 and 1000H users are now able to install using the atl1e ethernet driver from eeepc.debian.net.  Support for wireless and other aspects of the new hardware will follow soon.  The debian-kernel team was prompt to add atl1e to 2.6.26 which has just been uploaded to sid.  We hope 2.6.26 makes it into Lenny. Wireless installer Glenn Saberton has been doing an upstanding job adding wireless support to our custom Debian-installer.  We have supported WEP authentication for several releases, now, and a beta version supports WPA.  Glenn is also making progress with these patches upstream so that non-Eee Debian users will benefit from our work. LXDE is in Lenny LXDE has entered Lenny, thanks to Andrew Lee.  It is a quite lightweight desktop environment that is made with the Eee PC in mind. Live images Two flavours of Debian-live USB images are available: a demo of the LXDE desktop and a minimal console-only image for rescue/backup.  The images are still in alpha stage of development.  If you’d like to help, give us a shout.

More interesting things are planned for the future that benefit Debian as a whole.  With a small amount of work patching live-helper, anyone will be able to make a live image that includes a customized Debian-installer. Mobile device initiative This month on debian-devel, there was some interesting discussion about Debian support for the Intel Atom processor and a possible mobile net device initiative.  That’s something we could get behind, if anything comes of it. Wiki translation Robert Epprecht has been keeping the German wiki translation in good shape, but we could always use some more help with any of the translations. New members welcome If you’d like to join us, check out our site at http://wiki.debian.org/DebianEeePC and drop us a note on our list or join our irc channel and talk to us about what you’d like to do.    

I recently bought a new MSI laptop and I am really pleased with my choice so far.

Since with the previous laptop I managed to kill two of my desired features, long battery life and pretty portable, I decided is time to look really well and see what the market has to offer.

I settled on a MSI PR200WX-058EU which has the following:

• built on a Centrino platform
• Intel(R) Core(TM)2 Duo CPU T8300 @ 2.40GHz
  
• Intel Corporation PRO/Wireless 4965 AG or AGN
• Intel mobile chipset
• 3GB of memory (yes, I would have enjoyed 4, but it seems the 32 bit barrier still decides hardware configurations)
• 320GB HDD
• DVD+/-RW
• Mobile GM965/GL960 Integrated Graphics Controller
• 12" wide screen (1280x800)
• 1 Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet
• 8 cell battery by default (long battery life)
  
• 1 USB 2.0 Camera - uses luvc driver
• bluetooth
• 1 card reader
• 3 USB port, 1 HDMI, 1 D-sub 15 connector, 1 PCI Express port, modem port
• fingerprint reader
• an advertised weight of 1.8kg (I weighted it at 2.1kg with the 8 cell battery)
  

In other words a small and mobile powerhouse for which I payed 3800 RON (approx. 1100 ). I'd say not too bad at all.

Thanks to Gon ri Le Bouder and some searches on the internet I concluded that
the brand is not bad at all, and now that I have it I really am sure.

Of course, I installed Debian Lenny on it (I also sent an installation report), and, in spite of the initial problems, I managed to make the laptop work pretty nice, but I am especially excited about the webcam, which works with the linux-uvc driver.


There were some issues, but I managed to fix some them while I have been ignoring some other. The LaptopTestingTeam page for MSI PR200 on the ubuntu wiki was very helpful.
What have I been ignoring?

• it seems that from time to time the battery charge status isincorrect, or acpi report that the AC is plugged in
• headphones don't automatically turn off the speakers
• fingerprint reader is not used yet, but I intent to experiment at some point with it (authentication via the fingerprint would be cool)
  
• the keyboard seems a little bit too hard (but I hope it will loose up with time)
• modem isn't probably working, but I don't think I'll ever try
• there are some issues in gnome-power-manager which cause strange behaviour and grief wrt screen brighness
• sleep doesn't work,but hibernation does
  

What would you do if I'd tell you that the battery lasts 4 hours or even more while the wlan is on and working (browsing and stuff like installing new packages, configs) with the brightness set to minimum?


I am really excited about this and I can say that I think I have found my next generation laptop, so if you're thinking of a cheap mobile powerhouse on which Linux must run, this laptop might be for you.

I find the following to be selling points (for a Linux buyer or others):

• comes with FreeDOS, so no extra money for an OS you don't use
  
• wifi works
• webcam works with luvc
• no big problems during install (the most severe are already fixed)
• long battery life, even when using wifi (4+ hours in browsing+some package installation mode, according to my tests)
• light enough to carry around easily (2.1kg, 2.4kg with charger)
• nice design - some people asked me if I bought a MacBook
• 4 state kill switch for all possible combinations for wifi/bluetooth
• hibernate works with 2.6.24 or newer (sleep doesn't, but I will try a few things later)
  
• there's no mechanical latch for the lid, there is a magnet, so there's no plastic to be broken, the laptop is more robust
• the 8 cell battery is thicker than the regular one, allowing better ventilation
• it seems it doesn't get too hot to put on my lap (still, I am a little afraid of blocking its ventilation due to the fabric of my clothes, so I'll probably try to carry around a hard paperboard or something like that)
• the big resolution 1280x800 (for this screen size) seems to partly compensate for the reduced physical size of the screen (12")
• bright screen

So, thanks again to Gon ri, Debian Installer team, LVM2 maintainers, Ubuntu Laptop Testing team, linux uvc developers, Lilo developers and maintainers, all the nice people who made and still make Debian possible.

Various people have asked me why there'd ever be a justification for ACPI tables to base various types of behaviour on the operating system they're running on, and why Linux claims to be Windows. There's pretty straightforward explanations that don't involve conspiracies, but they're not necessarily obvious. Let's start from the beginning.

ACPI provides two mechanisms for determining the OS, _OS and _OSI. _OS is an ACPI object containing a string. This string is supposed to represent the operating system. Windows 98 contained "Microsoft Windows", NT4 "Microsoft Windows NT" and ME "Microsoft WindowsME: Millennium Edition". All later versions of Windows contain "Microsoft Windows NT". Linux was "Linux" up until 2.6.9, and has been "Microsoft Windows NT" since then.

The obvious drawback to _OS is that it's a single string. _OSI was introduced with later versions of ACPI, providing an interface for ACPI tables to request which interfaces an OS supported. Interfaces may be something like "3.0 Thermal Model", indicating support for a specific aspect of ACPI, but may also be used to indicate the interfaces supported by the OS. The _OSI method is passed a string and returns either true or false depending on whether the OS claims to support that interface. The OS can therefore claim to support many different interfaces. Linux implements pretty much every aspect of ACPI that Windows does, and so claims to support all the interfaces that Windows implements. As a result, Linux will return true when asked if it implements support for any of the Windows interfaces (up to and including Vista).

That's all straightforward enough, but leaves two questions. The first is why Linux now claims "Microsoft Windows NT" for _OS. That's actually pretty simple - some DSDTs only check for various _OSI strings if _OS is "Microsoft Windows NT". This is stupid of them, but not a violation of the ACPI spec. The second is why Linux returns false for _OSI("Linux"). This is a little more subtle, but it basically boils down to "There is no Linux interface". The behaviour of Linux changes over time. We make no guarantees that its behaviour will be consistent over time as we find and fix bugs. Microsoft take a different approach. Their ACPI behaviour has few changes over time. Something claiming to be Windows 2000 will always behave the same way. We can't even bump the interface string per release - doing so would require us to maintain every broken behaviour we've ever implemented and switch between them depending on what the BIOS asked us for. Linux does not provide a stable ACPI API to platform firmware, and we make no guarantees that it ever will. The only behaviour you can depend on is that Linux will conform to either the ACPI spec or (where it differs) the behaviour of Windows. If you find behaviour that does not fall into either of those categories, then it's likely that the behaviour will change when we notice. The reason we removed Linux from the supported interfaces list in 2.6.24 was that we were beginning to see BIOSes that changed behaviour when they detected that they were running on Linux, and changes we wanted to make could have potentially broken these BIOSes.

Anyway. That's why we claim to be Windows. Now, why would a DSDT want to do anything with that information? It should be noted that making decisions based on this is not a contravention of the ACPI spec - section 5.7.2 even describes a case of this. There are a few situations under which this can be helpful. The first is due to varying interpretations of the spec. Early versions of Windows require that hotswap bays signal their removal by sending a bus check notification to the parent IDE bus. Later versions want a device check notification on the device itself. Both are valid, but you ideally want to use the right one on the corresponding OS. Checking the OS version lets you do so.


Red Stripe makes a lousy spec-compliant ACPI implementation. That is because it is not a spec-compliant ACPI implementation, it is beer! Hooray beer!

Another is user experience. Not all hardware is supported by all operating systems. For instance, older versions of Windows don't support high-precision event timers (HPET). The HPET is defined as an ACPI device, and so will show up as an unknown device in the Windows device manager unless the firmware disables it. This is acheived by altering a flag in the _STA response depending on the Windows version - earlier versions are told that the device should be invisible, and later versions are told that it should be exposed. Finally, there's bug workarounds. An example of this is Windows 98 crashing if a thermal zone reports a temperature of less than 15.8 degrees celsius. Working around that seems like a perfectly reasonable thing for a piece of hardware to do, since Microsoft don't make it easy for vendors to provide hotpatched versions of Windows.

The final part of this mystery is why various BIOSes attempt to check whether they're running on Linux. Almost all the BIOSes I've examined do nothing with this information, which is consistent with someone writing an OS lookup table many years ago and adding Linux just in case someone found it useful. People don't generally write ACPI tables from scratch (doing so would be very dull), so they'll base it on the one from a previous version. Code won't be removed unless it's breaking things, so you'll end up with various odd evolutionary dead ends that have persisted anyway. If your ACPI firmware checks for Linux, this is not inherently a bug in your BIOS. It's more likely that nobody cared enough to remove two lines of code that might turn out to be useful one day.

This is a pretty technical note, which I’m posting here for review and hopefully to help other people. The reinstall I mentioned last week was a MacOS X 10.5 server, so this time I installed Koha more simply and took more notes. I don’t want to put this in the distribution as INSTALL.osx, for reasons mentioned below. Also, I’d be very happy if people replaced all osx servers with debian ones, or at least some sort of tidy GNU/Linux. The sysadmin installed XCode and fink for me and I ran

fink install apache2 apache2-dev mysql mysql15-dev

without any great event. I also re-used an old, imperfect, local finkinfo/idzebra.info to

fink install idzebra idzebra-shlibs

Next, I used the extremely horrible command

fink list $(sed -n -e “/PREREQ_PM =/,/ / ;s/^[ ']*//;s/::/-/g;s/’.*\$/-pm588/;/-.*-pm588/p; ” Makefile.PL tr A-Z a-z)

inside an unpacked koha-3.00.00.094 folder to find out which modules fink had packaged already. Something similar can be done for debian and ubuntu, using apt-search or dpkg instead of fink and a libperl- prefix instead of a -pm588 suffix. (I think all systems should do something like that. Then we could merge the INSTALL.*s into the main INSTALL because they lag behind.) Three of those, I copied to /sw/fink/10.5/local/main/finkinfo and edited slightly (usually to increase the version: dbd-mysql-pm, html-template-pm, xml-libxml-common-pm, xml-libxml-pm.info and xml-simple-pm.info… also in my fink-10.5 folder) and then ran

fink install dbd-mysql-pm588 text-iconv-pm588 xml-simple-pm588 data-dumper-pm588 digest-md5-pm588 file-temp-pm588 getopt-long-pm588 html-scrubber-pm588 list-util-pm588 list-moreutils-pm588 mime-base64-pm588 net-ldap-pm588 test-harness-pm588 text-wrap-pm588 time-hires-pm588 unicode-normalize-pm588 xml-dumper-pm588 xml-libxslt-pm588 xml-rss-pm588 yaml-syck-pm588

to install those modules. For the remaining modules from CPAN, I set PERL5LIB to my new Koha folder (export PERL5LIB=/Library/WebServer/Koha/lib:/Library/WebServer/Koha/System/Library/Perl/5.8.8/:/Library/WebServer/Koha/lib/perl5/site_perl/:$PERL5LIB) and ran perl -MCPAN -e shell, telling the configuration screens to use PREFIX=/Library/WebServer/Koha (so install into the Koha folder instead of splattering across /System/Library). Then the command

install Bundle::KohaSupport

just worked, thanks to excellent work by Mike Mylonas and others. Finally, all that was left was to run the normal installation in the koha-3.00.00.094 folder, picking the “single” configuration and ignoring “make test” failure (because it’s a work in progress and this is RC1), edit the /Library/WebServer/Koha/etc/zebra/*cfg to point at /sw instead of /usr, symlink koha-httpd.conf into /sw/etc/apache2/sites-available and run the a2ensite commands, copy the service plist files into /Library/LaunchDaemons and load them into launchctl, browse koha and start testing it. Simple(!) It only took me a full day of work to figure that out and do the reinstall… compared to under 2 hours from scratch on debian at the moment. Maybe it’s faster if you know the OS better and/or aren’t trying so hard not to splatter stuff across the base system. Did I do anything wrong above?

over 96% successful
243 packages built successfully.
8 packages failed to cross build.

Failing packages

1. cups
   

   http-addr.c: In function 'httpGetHostByName':
   
   http-addr.c:464: error: invalid 'asm': invalid operand for code 'w'
   
   http-addr.c:464: error: invalid 'asm': invalid operand for code 'w'

   
   history
   


2. gtk+2.0 - cairo-directfb problems.
   history
   The cross-build keeps finding /usr/arm-linux-gnu/lib/libcairo.so first so it misses the extra symbols provided in /usr/arm-linux-gnu/lib/libcairo-directfb/lib/libcairo.so. Hopefully, this can be resolved by judicious hackery of LDFLAGS and LD_LIBRARY_PATH.


3. ncurses
   
/trunk/n/ncurses/trunk/ncurses-5.6+20080713/ncurses/curses.priv.h:1417: warning: parameter names (without types) in function declaration
/trunk/n/ncurses/trunk/ncurses-5.6+20080713/ncurses/curses.priv.h:1418: error: expected '=', ',', ';', 'asm' or '__attribute__' before '_nc_to_widechar'

   history
   


4. ntp - same assembly error as cups
   

   authkeys.c: In function 'authencrypt':
   
   authkeys.c:445: error: invalid 'asm': invalid operand for code 'w'
   
   authkeys.c:445: error: invalid 'asm': invalid operand for code 'w'

   
   history
   


5. slang2 - confusing build behaviour - outside a chroot, files are put into a directory called elfobjs. Inside a chroot, files are put into a directory called elfamd64objs (and presumably that would change according to the BUILD architecture with is plain insane.
   history
   

The assembly errors look spooky and the cairo and slang2 errors could be made much simpler if the upstream builds were sane. (Honestly, why can't we just have /usr/lib/libcairo-directfb.so ?)

Some other packages fail to build, e.g. gcc-4.2, but we don't need those anymore so I'm ignoring those.

Last summer we tried to organise a Cinema d'estiu movie projections in Benimaclet's Church Square, in an attempt to promote social activities in the street done by the neighbours, for the neighbours. The response was very positive, and the first two projections attracted many people, who would bring a chair and their dinner to the old town's square to watch a movie. Unfortunately, the authorities, who were completely out of the loop, weren't happy and on the 3^rd week the Local police appeared and said that that kind of activities needed official permits, and disallowed the projection. For this year's summer, we decided we'd try to do the projections once again, and learned that only a legally-established organisation can do the paperwork to get an authorisation. In parallel, some neighbours of Benimaclet, who had liked last year's idea, were working on their own to repeat the experience, and somehow Clara was contacted by them, and we ended up collaborating. As these people are members of the Associaci de ve ns of Benimaclet, there were legally able to do the paperwork, and soon we agreed on the four movies for this year, to be played every Sunday of July at 22:00h. Our pick for Sunday 6^th was Giuseppe Tornatore's Cinema Paradiso, followed on the 13^th by Elling, a Norwegian comical drama by Petter N ss which I hadn't seen and I can totally recommend. Last week we saw Poniente, a Spanish film by Chus Guti rrez that focus on immigration issues in the South East of Spain, based on the racist happenings of El Ejido of 2000. Finally, next Sunday is the turn for some political action with V for Vendetta. A note for Benimaclet neighbours: if you don't come to see the movie, be aware that we plan to pump up the volume a lot for this one. You're definitely going to hear it from home. ;) We're very happy about the response of the neighbours this year. Not having done any effort to announce this around the city, except for a few posters around Benimaclet during the last week of June, people clearly remembered last year's experience and the pla a de Beni was full of chairs for all three weekends. It really helps to turn around during a projection and see so many people behind you participating in something you've invested some of your own time and money. It's probably too late now, but there's some talk of extending this to the Sundays in August, so we'll see. Also, we plan to do a picaeta for attendees as a small closing party for this year's cycle. See you on Sunday, and enjoy V!

77020 packets transmitted, 18029 received, 76% packet loss, time 77049435ms
rtt min/avg/max/mdev = 20.026/130.848/2245.752/287.550 ms, pipe 3 Above are the ping results from pinging my server (hosted on a business DSL connection). Telstra stuffed up and appear to have entirely disconnected DSL for a few suburbs (based on reports from a client who has several clients in that region that all went offline simultaneously). It’s affected at least two ISPs (every DSL service uses Telstra’s backbone). The above ping results show almost 17 hours of outage, but it was really more like 18 (I didn’t start pinging until I realised it was down). Telstra’s response to the problem reports (which my client raised via two ISPs) was that it would take until the end of the next business day. The problem was reported at 10AM, so Telstra was apparently happy with two entire business days of outage. I think that the root cause of such problems is the terrible performance of Sol Trujillo [1] (or “Telstra’s Sole True Hero” as suggested in Crikey [2]). Under Sol’s leadership Telstra stock has not performed well (it’s a monopoly - it’s supposed to reap money), it’s lost market share in every area where competition is permitted and it hasn’t made it’s customers happy. Sol is taking an approach to business that works well for some big companies in the US (and for the mining and automative industries in Australia). He has been trying to force the government to extend the Telstra monopoly with the Fibre To The Node (FTTN) plan [3]. His idea was to have small Telstra boxes (nodes) spread around the suburbs with short copper runs to each home, each node would have absolutely no spare space for other ISP equipment and therefore the other ISPs would not be able to provide a service. The claim was that FTTN was needed for decent performance but ADSL2+ has been shown to work well in the areas where FTTN was proposed. Telstra even sent out brochures to stock-holders encouraging them to lobby members of Parliament on behalf of Telstra’s rent seeking [4]. However Australia is not like the US and this didn’t work, they couldn’t even get Telstra stock holders to support such plans. Speaking for myself, my interests as a Telstra stock-holder (and I own more Telstra shares than the median stock holder) are vastly outweighed by my interests as a consumer of telecommunications services. I would like to see the government nationalise the local loop and the exchange buildings and then provide fair and equal access to all telephone companies and ISPs (including Telstra). Then we can have true competition in this market and the companies that provide the best services will win. Currently Telstra resembles one of those inefficient Soviet monopolies. We need some capitalism in the telco industry!

• [1] http://en.wikipedia.org/wiki/Sol_Trujillo


• [2] http://www.crikey.com.au/


• [3] http://www.zdnet.com.au/news/communications/soa/Optus-threatens-war-over-Telstra-s-fibre-plans/0,130061791,139225166,00.htm


• [4] http://en.wikipedia.org/wiki/Rent_seeking

Share This

Last week, Stanford University hosted Cartel, a gathering of several schools that share similarities of infrastructure and IT problems. I was one of the coordinators, handled most of the content for the web site, helped prepare the agenda, and presented for three of the segments. It's considerably more work hosting and coordinating one of these than just attending one, even with the travel. Jeff Altman and Derrick Brashear, the other two OpenAFS gatekeepers, were also in town for half of Cartel and stayed through Friday, so we went out to dinner several times, played a great deal of Fluxx, talked about the state of the world, and caught up. This was all great and very informative, but I'm also an introvert, which means that no matter how much I'm enjoying social interaction, it's also extremely tiring. I'm still fairly wiped; I'm getting more done (and got more done last weekend) than I really expected, but I expect I'll be paying the price all the way through this week. (And then I have more company from out of town that I've been looking forward to for months, but which will then take its own toll, which means it's likely I'm going to be exhausted until well into August.) So, I'm currently looking at all the things I want to do and trying to tell myself that not only is it okay that they're not all going to get done right away, but I need to make a concerted effort to take time to relax, try to work less than 40 hours this week (after working 56 last week), and spend more time reading. Of course, writing reviews is one of the other things that I'm currently a bit behind on.... Debian is freezing for lenny next weekend. If I have a few moments, I may do final uploads of OpenAFS (to clarify that hppa isn't a supported platform) and kstart (a long-awaited new upstream release that adds a flag saying not to get forwardable tickets, needed if one has a krb5.conf configuration saying to get them and a site policy that says you can't). gnubg could stand another upload, but I probably won't get to that. The Shibboleth packages are all in good shape except that they don't all have complete copyright files for all the Autotools helper stuff, which is very not important. Thankfully, the freeze is basically meaningless for Lintian, which will continue apace (and Adam D. Barratt continues to take much of the load off by doing a ton of commit work), and means that Debian Policy work should actually slow. My intention is to make the next normative release of Policy shortly after the lenny release, which gives us plenty of time to work on more changes for the next version. I plan on somewhat ignoring both for a bit while I catch up on other things, since I released Lintian 1.24.2 on the 13th (which I see I never announced here — whoops). In other news, I finally started the process of moving services from systems I own and have to fix to systems where someone else owns the hardware and has to fix it when it breaks by buying a VM from Panix. I still need to sort out my DNS situation and get more direct control over my zone file now that I have somewhere I can run my own DNS server so that I can start moving services there, but so far, so good. I'm extremely impressed by their service and capabilities and already have all of my Git repositories on the system and gitweb set up once I get DNS updated.

Emma Jane Hogbin gave a presentation on the gender gap in free software at Lugradio Live this weekend. One of the central messages was that a great deal of how to avoid putting women off computing can be distilled down to "Don't be a dick". This ties in well with Mako's restatement of the Ubuntu code of conduct as "Be excellent to each other" (a wonderful phrasing which demonstrates that Bill and Ted's Excellent Adventure is the most philosophically worthwhile film that Keanu Reeves has ever appeared in, and certainly not The fucking Matrix) and led to my 5 minute rant on why I hate the Linux community slightly later in the day, but does leave a certain problem. What standards are used to define whether given behaviour is dickish or not? The comments here show that there's disagreement even within a single sub-community of the larger free software world. Ben suggests that the reaction to perceived inappropriate behaviour is perhaps even more discouraging than the original behaviour, suggesting that bitching about things that offend you is dickish behaviour in and of itself. How do we decide whether someone is being a dick or helping the community? Is lack of tolerance a form of exclusionary behaviour?

This topic is actually one of the issues discussed in the Geek Social Fallacies, but here's a nice easy example. Would tolerating planet posts encouraging the eradication of the Jewish population be inclusive or exclusive? I suspect that most people would agree that it wouldn't be acceptable behaviour, which leads us to the next question. Why? There's two obvious arguments here. The first is that at a community level we have some form of rough moral consensus that advocating genocide is Just Wrong, and so criticising Nazis is obviously the right thing to do. The second argument is more pragmatic than philosophical - alienating millions of people in order to avoid alienating hate groups could be considered to reduce our potential contributor base in an unfortunate way.

I'm a fan of the second argument. The example I gave is emotive and relatively recent history has resulted in people tending to be pretty uniform in considering genocide to be a bad thing, but many other cases aren't clear cut. What I consider to be objectification of women is seen by others as appreciation of natural beauty. What I think of as sexist jokes are perceived by others as acceptable humour. When I advocate intolerance of certain behaviour, people are going to see me not having enough tolerance. So we end up in a situation where people make the "We should all just get along and be tolerant of each other" argument, which sounds fine but is fundamentally flawed in one significant way.

Advocating tolerance excludes the intolerant.

The reason people fail to see this is that it doesn't sound like a flaw. If you ask people whether we need to support intolerance, the immediate answer is probably no. But by advocating exclusion of intolerance, you're excluding all those who have good reasons to be intolerant. You're excluding the women who don't want to feel that the community sees them as a pair of breasts attached to some legs. You're excluding the ethnic groups who would prefer to avoid racist slurs or ethnic stereotyping. Telling anti-fascism protestors that they're being intolerant isn't likely to endear you to them. Advocating tolerance is telling the intolerant that they're wrong and should just deal with whatever it is that makes them unhappy.

So, ironically, tolerating certain types of intolerance is probably required in order to avoid alienating many potential contributors. That means some way of deciding what kinds of behaviour are acceptable and which are unacceptable. In the absence of either pre-existing community consensus or some philosophical breakthrough that allows unambiguous determination of the "rightness" of a given action, I'm going to suggest that we look at it from a pragmatic viewpoint. How many potential contributors do we discourage by criticising a certain type of behaviour? How many do we discourage by tolerating it?

The fallacy of the completely inclusive community is the idea that it includes everyone. The reality is that a certain level of social exclusion is required in order to include a wider range of people. So don't criticise people purely for criticising someone else's behaviour - make an argument for why that behaviour benefits the community. And when you see behaviour that you think discourages others, call people on it. Even if nobody's behaviour changes as a result, you're sending a signal that not everyone in the community agrees. Sometimes all people want is to know that there'll be some people on their side.

But, above all, try not to be a dick.

After many years with ion, I've switched to using the Awesome window manager. This took three tries; the latest try seems to have stuck. I wish I had a good analogy to explain to my nontechnical readers what changing to a new window manager is about. One way to think about it is that it's like driving a car down the road, and suddenly swapping the steering wheel and brakes out for a tiller and gear shifter. And having to downshift for braking until you learn that the brakes moved to the turn indicator lever. By trial and error. But that's really only part of it. Another way to look at it is adopting a new philosophy. Or, in some cases a cult. (In some cases, with crazy cult leaders.) Whether they use Windows or a Mac, or Linux, most computer users are members of a big established religion, with some implicit assumptions, like "thy windows shall be overlapping, like papers on the desktop, and thou shalt move them with thy mouse". So, changing to a new window manager is a process of being dumped into a different environment, where nothing works like you've come to expect, and trying to construct a mental model that you can use to make sense of it. But it's also a process of modifying that environment to behave the way you like. And when done whole-heartedly, this doesn't just mean trying to make it like the environment you were used to before. It means trying to absorb the underlying philosopy of the window manager, and think up new ways of doing things, inspired by that philosopy, and modify the environment to allow doing those things. So ideally, "I switched to a new window manager" doesh't mean "my screen has some different widgets on it now". It means "I'm looking at the screen with new eyes."

Since the launch of Identi.ca a few weeks ago, I've had a very busy time. Not much sleep, but lots of fulfilling and exciting work. It's invigorating to work on something that is popular and that you believe in. And I'm glad that the Franklin Street Statement so succinctly encapsulates those beliefs. As some people may have read in my previous blog post about the motivations behind creating Identi.ca (see Journal/14 Messidor CCXVI), I was part of a group convened at the FSF to discuss the impact of the growth of software as a service on user autonomy. It was a very loose organization of hackers, activists, and scholars who come from different backgrounds but all share an interest in user rights online. As computing moves into "the cloud" (see cloud computing), what power does the user retain to control their own computing experience? As much of our social lives -- romance, family, work, friends -- becomes Web-enhanced, what can we do to assert our right to manage that data and its use? How can software developers and service providers gauge their own proper ethical behaviour, and how can users of services judge what is and is not acceptable to use? We didn't come up with any easy answers, but we've summarized our thinking in a new document: the Franklin Street Statement on Freedom and Network Services. In essence, we've tried to point a direction towards what software developers, service providers, and software users should think hard about when thinking about network services. Our group will continue to explore these issues on our new group blog, http://autonomo.us/ . We're going to concentrate on the effects of software services on user autonomy -- people's ability to make their own informed choices about their data and creative works and the software that processes them. It is a realm that as a society -- a cluster of societies -- we're only beginning to understand, and I think that there is still a lot of exploration to do. Autonomo.us includes a wiki where we'll be exploring some of these ideas, and the blog will feature guest submissions about the subject. We're a loose and unofficial group with some smiling benevolence but no sanction from the FSF or any related organization, so we're really going to dig into some of the gray areas of this issue without worrying about making official statements for any one organization. I'm looking forward to the coming months and I hope this issue captures the imagination of the Web's Open Source and Open Content communities. P.S. You can see the FSF press release about the statement and the launch of autonomo.us. tags: autonomy franklinstreet softwareasaservice

Open Service Definition On a related note, one of the first organizations to approach the issue of Open Services has been the Open Knowledge Foundation. Today they've launched the 1.0 version of the Open Software Service Definition (OSSD). I think the OSSD 1.0 is a great step. It's a bar against which we can start measuring Open Software Services. For example, I think that Identi.ca meets the requirements of the OSSD. Other sites, like Wikipedia, are also clearly compliant. Some services that I really like, such as OpenStreetMap and geonames.org, seem to be compliant. But are they? It's good to start this investigation. I think other kinds of services are on their way there. The announcement by Reddit that their code will now be Open Source is a great step for user autonomy in the social news arena. Now, Reddit needs to consider what an Open Content/Open Data policy would mean for their service... or see others implement it on other sites. I look forward to a rich ecology of open software services growing, now that we have a name for it and a clear community of people interested in the topic. tags: autonomy ossd openknowledge

Lucy left for England yesterday (OK, now it’s two days ago — last Friday). That means that I have unusual amount of free time at my hands, and yet even more things that could be done with it. But I suppose it’s time to update this little blog. It’s probably pointless to enumerate what happened, or what changed. Everything is fine and smooth over here — the wrinkles get worked out over time (with Lucy, without Lucy). Hobbies still take time and I still haven’t given up. My latest determination is to get myself a bassoon for next Christmas. (Now, that will be a year since we got Lucy a Marigaux 901, used, in great condition for a great price, lo and behold, on Austrian ebay. World is so weird sometimes…) And in the land of [LVM], I have finally started the process to merge code to improve LVM’s behaviour in presence of failed storage hardware (physical volumes gone missing). In the land of Adept, well… first things first. FOSSCamp I have visited Prague for the latest Ubuntu- (well, Canonical-) organised event, the FOSSCamp. I have met Johnatan (KUbuntu), Seli (KWin), Lidya (Amarok), Robert (Konsole), Jos (Strigi) and Inge (KOffice). See also Johnatan’s Blog (including a real blurry picture). So back to Adept — I had some hacking time over there in Prague, and I have almost brought Installer and Updater back to life for Adept 3. I unfortunately didn’t have as much time for it since then — but my current free time situation does open up some possibilities. First and foremost, I should really make a text interface to the underlying libraries for myself, maybe with fancy colourful UI, hopefully one that is comfortably close enough to apt-get and still offers advantages. Hmmmm… Intermezzo 1 Now zoom out and zoom in somewhere else, enough of coding matters. Our research group at the University had a (tool) paper accepted for ATVA 2008, meaning that I am not unlikely to visit Seoul, South Korea in October. Another piece of distant world to visit. FOSDEM Now, that reminds me… Since the last time, I have also been in Belgium — to visit FOSDEM — meeting Alasdair (of LVM) and Bart and Pino of Krita and Okular, respectively… although unfortunately, I didn’t spend nearly enough time with Pino… At least we have spend a day walking around Ghent with Bart (and Lucy, who visited Belgium with me, also having friends of her own there). Moreover, I have spent a lot of mostly productive time with Alasdair, discussing LVM2. And Belgium is nice and pretty, although I didn’t really get around to taste any beer. Maybe next time. And Antwerps were nice, too. Photos? Someday. LinuxTag And after that, I have visited Berlin again, for LinuxTag as usual — plus the accompanying LVM discussions, with Milan, Kabi and Mikul (Blek) of the Czech part of the team, and Heinz, John and of course Alasdair for the rest of the world… Also as usual, we walked around, had dinners, discussed non-work stuff, etc… a good event all in all. At LinuxTag, I have briefly seen Lidya again, as well as Ossi (whom I nearly didn’t recognise…) and Aaron who (for a change) didn’t recognise me (but to be fair, I didn’t quite stop by to chat and he’s been busy…) and Sebas, cordial as ever (and always a pleasure to meet)… reminds me of Paris two years ago, too. Intermezzo 2 Less than a month ago, I have finished my first semester of master’s study — two or three more to go (I have completed bachelor’s the semester before). Yes, I am a bachelor of computer science, or something like that, anyway, now. Or so I hope. I did not attend the whatever ceremony and I don’t really have the diploma (or maybe I do, but gods know where it is…). A short note on Debian with best intentions I am now sponsoring Trent Buck’s ?darcs packages, contributing a little on the go (making me wish that alpha buildd would make a little more progress…). With Enrico, we have uploaded new versions of wibble and libept, both of which I think make both of us fairly happy. (Although we again managed to hit a way strange compiler issue (only manifested on arm… what have I done that the gods punish me so?), as documented in Debian bug 487406…) I have packaged dzen2 and taken over haskell-mode (I am losing track of my own packages again — I really need to set up reliable watch files so I don’t miss out too many releases… apparently neither has new upstream versions, so I can sleep peacefully for a little longer). Intermezzo 3 I am not going to DebConf nor Akademy this year. That makes me a little sad, but it’s all my own fault (and laziness). Next time folks, next time. I haven’t seen K vin in aeons and he probably removed me from his memory by now… No matter, I’ll try a little harder next year, promise (oh, how many have I made to date?). Finale Nothing grandiose, just best wishes to everyone, I have to land in bed now it seems, as I am ever so sleepy. (Just So Stories, anyone?) There I go.

Since Kristian’s excellent GTK State of the Union talk was today his slot is now available for a Patchsquad BOF. So that’s tomorrow at 11am. Thanks Behdad for allowing us to grab this. A little background on the idea of a Patchsquad: Primarily the idea is to reduce the workload of maintainers by commenting, not reviewing, patches that are waiting in Bugzilla. This may include testing, checking for obvious issues and gentle pestering of maintainers. Lucas held a BOF last year to introduce the idea that was well attended and a lot said but interest seems to have twindled. Myself and Diego want to try reinvigorate the idea! Update: Whoops! Looks like we haven’t got that slot afterall. If you’re interested in the Patchsquad pleas some along and speak to either Diego or myself.

For everyone at GUADEC, there’s a boat party sponsored by Collabora this evening. Our sponsorship was confirmed after the program was printed so it’s listed anonymously, but it’s mostly sponsored by Collabora, of course with huge thanks to Baris and his team for the organisation, and local sponsors for food and discounted beer. The boat leaves from Kabatas at 9pm today (Thursday). It’s actually pretty close to the 3rd anniversary of Collabora’s incorporation, so I think we could call this our birthday party. :D I gave my presentation earlier today about using Telepathy to make collaborative applications. My slides are available, as well as the apps I demoed, which are the python VNC demo based on telepathy-python’s examples, Elliot’s Tic Tac Tube game, and Guillaume and Alban’s quick hack to Empathy and Vinagre to share your desktop over a stream tube. I was followed up by Senko’s presentation (slides also available) which had an overview of the libraries and APIs currently available to embed Telepathy functionality in applications on the desktop. The talks were all recorded so hopefully some videos will turn up on-line too. Speaking about collaborative stuff with Telepathy, we’re really keen to hear from the authors of applications like Abiword, Inkscape, Vinagre, Jokosher, Tomboy, Gobby, etc, to find out how we can help you integrate with Telepathy, what features you need before you can get started, or just try and convince you that it’s a good idea. :) If you’re at GUADEC, come and grab one of the Collaborans or drop by on #telepathy on FreeNode and tell us what you’d like to do and how we can help. Yesterday after the talks on Soylent and the People project, Travis and I met up with the guys behind the People project (Ali Sabil and Johann Prieur) and some of the Online Desktop team (Owen Taylor and Marina Zhurakhinskaya). We sketched out a way of plugging together Telepathy, People, Soylent and the Online Desktop to deal a lot better with meta-contacts on the desktop, providing “first-class” people objects. It all looks pretty promising and hopefully we’ll all find some time to make moves towards our vision. This afternoon at 3:30pm, Olivier is also presenting our work on Farsight 2, which is really cool stuff and should include some exciting demos of the multi-person video conferencing stuff we’ve been doing. More generally, GUADEC is awesome. I’m having a great time in Istanbul (despite it being pretty hot for a pale-faced Brit like me), and enjoying the sights and sounds of such an interesting city and culture. I’ve caught up with many of the usual suspects (like Lennart, who never turns down the chance to turn up at a conference and sample the local bars and clubs), and had some great discussions.

Like many people, I participated in the Google Android contest this spring, and like most of them, I didn't win, but I did enjoy working with the platform, and am very excited about the idea of an open source mobile platform that's relatively powerful. From the outset, due to the lack of actual source code for a lot of the system, there have been "doubters" about what Google is really up to. I'm not one of them, and am largely ok with their reasons for holding back: I buy their reasoning that the long term benefits of a strong, properly QA'ed launch probably outweigh the possibility of failure that might come from the press and the public at large that doesn't care much about software freedom seeing phones come out with half-baked, early implementations. I think most of us working with Android were ok with that strategy, and the ones who weren't self-selected out of the platform, most likely. However, lately Google has made something of a mess of their communications regarding Android. The problem stems from the fact that they gave an updated version of the SDK only to the winners of the competition, which for a lot of people felt like a bit of a slap in the face: they helped popularize the platform by participating in the contest and writing applications for it, and in return got excluded from the upgrade path. Personally, it's not really any skin off my nose, as I'm sanguine about the Hecl port proceeding apace when the new SDK is public, but I can see that if you were, say, a company porting your app to the platform and now are left behind the competition winners, you might be a bit irritated. The biggest mistake they've made though, is a big lack of communication regarding this business. As I said, I don't really have that much skin in the game, and if they explained in a convincing way why they needed to do things that way, they would go a long ways to allaying the frustrations felt by many. I'm not much of a believer in conspiracy theories and plots, especially where companies are concerned. Inept bumbling is a far more likely explanation in most cases, including this one. What is odd, though, is that Google has a lot of people who "get it". I met Dan Morrill at the Munich Android event, and he definitely gets it. He writes about his frustrations as a developer advocate and all the crazy things people say. Well, one way to reduce the number of batty internet theories (eliminating them is clearly impossible due to the alien mind control rays) is to consistently communicate quality information about what's really going on, something that has been lacking with regards to the SDK question. Here's another Google employee who understands this need to communicate, and apparently does so despite being worried about being "slapped for talking publicy about all this": http://groups.google.com/group/android-developers/msg/244edfad99870c63

But the root of the problem is certainly not licensing but that there hasn't been a new public SDK release since M5, while at the same time a small group of people received updated versions privately. I really don't know precisely why this happened; but I'm sure it has more to do with logistics and reducing the burden of support while we shift priorities (to shipping real devices) rather than politics or any will of our part to "hurt the community" (come one guys, we are not that stupid... !) While others in the team may disagree, I think it was very very unfortunate; some of us are trying to prepare a new SDK release, but it's a lot harder than I can comment on here, so don't hold your breath because it might not happen that soon.

This explains things in part, but still leaves us in the dark, and leaves me with the feeling that someone in power, somewhere at Google, despite his or her clued in colleagues, really doesn't get it with regards to open source. I'm still unconcerned about the Android source code: I think we'll see it, but to be a true open source project, Android will need an open community as well, not one where decisions are taken exclusively at Google, and not even communicated to the development community at large. All in all, this mistake is more molehill than mountain, but however you look at it, in terms of open source, it is a step backwards.

Does a GPG pass-phrase provide a real benefit to the majority of users? It seems that there will be the following categories of attack which result in stealing the secret-key data:

1. User-space compromise of account (EG exploiting a bug in a web browser or IRC client).
   
2. System compromise (EG compromising a local account and exploiting a kernel vulnerability to get root access).
   
3. Theft of the computer system while powered down when the system was configured to not use swap or to encrypt the swap space with a random key at boot time.


4. Theft of a computer system while running or that did not have encrypted swap.


5. Theft of unencrypted backup media.

Category 1 will permit an attacker to monitor user processes and intercept one that asks for a GPG pass-phrase as well as to copy the secret key. Category 2 will do the same but for all users on the system. Category 3 will give the potential for stealing the private key (if it’s not encrypted) but no direct potential for getting the pass-phrase. Category 4 has the potential for copying a pass-phrase from memory or swap. I am inclined to trust Werner Koch (and anyone else who submitted code to the GPG project) to have written code to correctly lock memory and scrub pass-phrase data and decrypted private key data from memory after use. But I really doubt the ability of most people who write code to interface with GPG to do the same. So every time that a GUI program prompts for a GPG pass-phrase I think that there is the potential for it to be stored in swap or to remain indefinitely in RAM. Therefore stealing a machine that does not have it’s swap-space encrypted with a random key (which is the most practical way of encrypting swap) or stealing a running machine (as mentioned in a previous post [1]) can potentially grant a hostile party access to the pass-phrase. So it seems to me that out of all the possible ways of getting access to a GPG private key, the only ones where a pass-phrase ones is going to really do some good are categories 3 and 5. While it’s good to protect against those situations, it seems to me that the greatest risk to a GPG key is from category 1, with category 2 following close behind. I previously wrote about the slow progress towards using SE Linux and GPG code changes to make it more difficult to steal the secret key [2] - something that I’ve been occasionally working on over the last 6 years. Now it seems to me that the same benefits can and should be made available to people who don’t use SE Linux. If a system directory such as /var/spool/gpg was mode 1770 then gpg could be setgid to group “gpg” so that it could create and access secret keys for users under /var/spool/gpg while the users in question could not directly access them. Then the sys-admin would be responsible for backing up GPG keys. Of course it would probably be ideal to have an option as to whether a new secret key would be created in the system spool or in the user home directory, and migrating the key from the user home directory to the system spool would be supported (but not migrating it back). This would mean that an attacker who compromised a local user account (maybe through a vulnerability in a web browser or MUA) would not be able to get the GPG secret key. They could probably get the pass-phrase by ptracing the MUA (or some other GUI process that calls GPG) but without the secret key itself that would not do as much good - of course once they had the pass-phrase and local access they could use the machine so sign and decrypt data which would still be a bad thing. But it would not have the same scope as stealing the secret key and the pass-phrase. I look forward to reading comments on this post.

• [1] http://etbe.coker.com.au/2008/02/17/hot-plug-and-how-to-defeat-it/


• [2] http://etbe.coker.com.au/2008/06/06/se-linux-support-gpg/

Share This

Dear Lazyweb, A few weeks ago rng started to show some segfaulty behavior. I’ve absolutely no idea what’s going on, since Python code usually doesn’t segfault. I guess the problem lies in the qt3-bindings rng uses — does someone know how to verify this? There is a backtrace which seems to show that the problem lies somewhere in /usr/lib/python2.5/site-packages/qt.so but I’m not entirely sure how to interpret that.

This year's Underhanded C Contest has been announced. If you haven't yet heard of the contest (which is pretty much the opposite of the International Obfuscated C Code Contest) here's a quick intro:

The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior. In this contest you must write C code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should do something subtly evil.

This year's topic is Leaky Redaction:

Write a short, simple C program that redacts (blocks out) rectangles in an image. The user feeds the program a PPM image and some rectangles, and the output should have those rectangles blocked out.
[...]
Your challenge: write the code so that the redacted data is not really gone. Ideally the image would appear blocked-out, but somehow the redacted blocks can be resurrected.

The deadline for submissions is September 30th, 2008. Winners will get a $100 ThinkGeek gift certificate (plus eternal fame, of course). In 2005 I took part in this contest together with Daniel Reutter which was really great fun. See underhanded2005.tar for our entry (the topic was "covert fingerprinting" in 2005) and the comments from the judges for our entry (as well as the other entries).

We currently have fifteen cats in the house. Only three of them are ours. When Sarah was contracting at Google, she started an informal, but company-endorsed trap/neuter/release program, because the basement of buildings 40-43 had a bit of a stray/feral cat infestation. Since she left Google, she's continued doing trappings on an on and off basis. She got a call a couple of days ago about a litter of kittens behind one of the other buildings, so she headed off last night with one of her crazy cat lady friends, and they proceeded to catch one of the kittens. She brought that home, and I went back with her, and the mother, which seems fairly feral, had been caught in a trap. The rest of the kittens seemed to have managed to secrete themselves away inside a generator behind the building. This morning, with some help from various facilities types, she managed to extract the other four kittens from the generator. So that put the mother plus five kittens in the spare room (in a large cage). At more or less the same time, Sarah got news of a litter of six kittens that need rescuing from down Gilroy way (some woman in a trailer park didn't seem to realise that boy cat + girl cat = kittens), so after grabbing the other four kittens this morning, she headed off to Gilroy to grab them. So the current plan is to get the mother cat of what we'll call the Google litter desexed on Tuesday and then release her back where she came from. Her five kittens are young enough (~8 weeks) that they can be socialised and won't be feral. The six Gilroy kittens are from non-feral parents, and are about 11 weeks old. All of the kittens are old enough to be desexed as well, but Sarah can't get them into Palo Alto Animal Services for desexing for a couple of weeks, so I suspect we're stuck with them in the interim, unless Sarah can find foster homes for them. To cap it off, we're going to Sacramento for the weekend, so we have to get one of our friends in the complex to take care of them all. The sad thing is the Gilroy Six seem to be in worse condition than the Google Five. They've got pretty poor coats, and seem to have some diarrhoea. Hopefully with a better diet they'll pick up. They're all very cute. The first one of the Google Five that Sarah caught last night is particularly cute. I expect Sarah will get some photos of them all up soon. If anyone is in the Bay Area is interested in a kitten, we've got them by the near-dozen.

After I arrived at home after work today I noticed that the machines at my parents home network were all down and just recovering from the outage. Two of my m68k autobuilders are located there. Nothing serious, I thought, because the machines are located behind DSL and maybe there was a short DSL outage.
Some minutes later I received two mails from my UPS that there was a power outage. Well, this explains the DSL outage as well, because the DSL is not attached to the USV (located in a different room).

Thu Jul 03 17:56:19 CEST 2008 Power is back. UPS running on mains.
Thu Jul 03 17:56:19 CEST 2008 Mains returned. No longer on UPS batteries.
Thu Jul 03 17:46:49 CEST 2008 Running on UPS batteries.
Thu Jul 03 17:46:43 CEST 2008 Power failure.

Ten minutes of power outage without machines being shutdown. It's a APC UPS BR800I with 3 machines (2x m68ks, 1x PIII@550), a SCSI hardware RAID with 7 disks and a 8 port switch hooked up to it. I'm really glad that I bought the UPS earlier this year - exactly for this purpose and to prevent filesystem errors on the buildds when there is a power outage. :-)