Search Results: "rul"

11 April 2006

Simon Richter: Absolutely Fabulous

The big problem with snowballs these days is that they melt if taken into a warm environment. I'd have brought a few with me on the way to Madrid, since snowballs are, like, the accessoire of the month. Or so I was told by the kids that were trying to show fashion sense and follow the "maximal three" rule (i.e. one in the hand, one in your neck, slowly melting, and the third one either in the backpocket or in your shoe). I mean, these kids were total fashion victims, even picking up new snowballs when they already had no idea what to do with the old ones their friends had presented them with.

Simon Richter: Absolutely Fabulous

The big problem with snowballs these days is that they melt if taken into a warm environment. I'd have brought a few with me on the way to Madrid, since snowballs are, like, the accessoire of the month. Or so I was told by the kids that were trying to show fashion sense and follow the "maximal three" rule (i.e. one in the hand, one in your neck, slowly melting, and the third one either in the backpocket or in your shoe). I mean, these kids were total fashion victims, even picking up new snowballs when they already had no idea what to do with the old ones their friends had presented them with.

8 April 2006

Neil McGovern: Choosing a CMS system

Well, I volunteered at the last SPI board meeting to re-do the SPI website, as it was old and outdated.

So, I posted a message over to spi-private and spi-www asking for ideas.

The main one that came up was using a CMS. Now, I've had a look at various CMSs in the past, and none of them have come up trumps. Also suggested were other options such as using Embperl and svn (which I use for the Debconf site), but this isn't user friendly enough for many people, and a wiki, but I'm not convinced a wiki is the best thing for a static site.

The main issue that I saw with using a CMS for the SPI site is the requirement for it to be truly multilinugual. Unfortunately, this does sort of knock out a SPI Project, Drupal. Another less important issue is the storage engine. Ideally, this should be postgres, as it's another associated project :) Thirdly, the software should be free (as in DFSG, not beer).

So, this leaves a few options. After many hours googling and lots of suggestions from the lists, I had a short list. This leaves one which I've found, Plone. It has issues, but it's the best I've found. Namely, it requires Zope. This means that every time you change it's skin, the entire Zope server requires a restart. Not even a reload, but a full restart. However, it's multilinugal facilities are very good, and it has a nice management interface. It does have lots of plugins that extend it's functionality, which is nice.

One of the problems I'm having at the moment is to get news items to have a 'Effective Date' of 1998, as the management interface only seems to go back to 1999, and I need to put old items on there. I also need to work out how to run it under Apache, and possibly use postgres as a storage engine.

So, all in all, Plone wins the day, due to it's ability to host multilinugal sites, and it having a management interface that doesn't suck.

For those that want a sneak preview, see the testbed, but don't expect it to work perfectly :)

Robert Collins: 8 Apr 2006

Yay for siproxd. Working multi-user sip is a beautiful thing. Key notes: You need to configure siproxd, allow siproxd to use some ports on the firewall, and configured your sip client. after installing the package, edit /etc/siproxd.conf and set if_inbound=INTERFACENAME if_outbound=INTERFACENAME hosts_allow_reg=your internal network/netmask do not set hosts_allow_sip - I found it interacted strangely and got 408 'timeouts' - which is how siproxd shows 'access denied' to the client. edit /etc/default/siproxd and set it to enabled. do a sudo invoke-rc.d siproxd start Now, in your iptables rules you need to allow the following ports for 'INBOUND' on your inside and outside interfaces: 5060 (sip) 7070-7079 (rtp - the voice and video data) Activate those rules, and you are done on the infrastructure, now its just each client that you need to configure. So fire up your sip client. It should have a sip proxy field - in there put 'sip:' + your gateway address/ip. if you have STUN configured - disable it. The sip proxy will forward registration and all traffic for you, STUN will at best confuse the issue. And bingo, you should have working sip.

7 April 2006

Gerfried Fuchs: untangle

/me wonders why people seem to prefer a webbased, flash game when we have the very same thing in our sgt-puzzles package called untangle. Wasn't Debian and sort of Planet Debian about mainly free software, back then, somehow?

6 April 2006

Mike Beattie: Planarity

Seriously, I'm not just responding to only you Erich.. Anyway, that's an evil thing to post on a Friday (for me). I can see I'll get no work done now. *sigh*. Oh, I found an example of your solution: Planarity Solution

Erich Schubert: SSH scanner rebuttal

Mike, please re-read my blog posting, especially the very first sentence:
I have a box still running woody, and can't run iptables recent match on it (see an earlier post in my blog on how to use this kernel filter to effectively block ssh scanners).
I've been using that method for well over a year I think. On those boxes that support it.

Mike Beattie: And now for something completely Clich d..

Check this out... (As I write this, it's about to tick over the 2,000,000 he's wanting.) I'm not entirely sure what to think.. Not a bet I'd take, I don't think. (Yes, I am a male, but I just couldn't do that...)

Mike Beattie: A solution for blocking ssh probers/scanners.

Erich, There's a much easier solution to blocking those ssh scanning bastards... some nice friendly iptables rules! (I forward ssh to an internal system, so this is in the FORWARD chain.. use the INPUT chain otherwise)
### Catch SSH probes
iptables -A FORWARD -p tcp --dport 22 -d <local net> -o eth0 -s 0/0 -i ppp0
         -m state --state NEW
         -m recent --rcheck --hitcount 3 --seconds 60 --name SSH_PROBERS
         -j LOG --log-prefix "Adaptive-FW SSH Prober: "
iptables -A FORWARD -p tcp --dport 22 -d <local net> -o eth0 -s 0/0 -i ppp0
         -m state --state NEW
         -m recent --update --hitcount 3 --seconds 60 --name SSH_PROBERS
         -j DROP
iptables -A FORWARD -p tcp --dport 22 -d <local net> -o eth0 -s 0/0 -i ppp0
         -m state --state NEW
         -m recent --set --name SSH_PROBERS
         -j ACCEPT
So, in the INPUT chain, you wouldn't use -o, and -d would be the IP on your external link.. in this example, ppp0. What it does, is uses the ipt_recent module, tracking connections from a given IP. 3 incoming connections in 60 seconds will cause the remote host to be blocked. Of course, this affects normal logins too, so for known hosts, it pays to insert a rule beforehand that does a -j ACCEPT. I'm enjoyng the very short log entries for a given ssh scanning host in my logcheck mail :).UPDATE 2006/04/07: Whoops...
Sorry Erich, didn't notice that :)

5 April 2006

Erich Schubert: Too many projects...

I'm doing too many projects. I need to step back from most of them ASAP. I just don't want them to dwindle, but prosper... I really need to find more contributors for Oh, and half of above projects need a fancy web design and an icon. Anyway, I should basically turn off my computer for the next two months and refrain from going online. :-( I know that I won't have the discipline to do so... And there are oh so many projects still only existant in my head that I'd really love to do sometime. One involving new search technologies with tags, bringing together directories like DMoz, tag based stuff like del.icio.us and "traditional" text search engines. Definitely the stuff the Web 2.0 is made out of (read: hype). But when I'm done with my diploma this new dotcom bubble is probably over, too... :-(

3 April 2006

Pierre Habouzit: @debian.org and Spam (#3) alioth

Following my recent posts about SPAM in our wonderful project, Rapha l Hertzog asked me to improve alioth mail configuration to use my suggestions. Thanks to him, the improvements I've suggested are now all in place, since roughly 12 hours. Alioth Exim's configuration had a couple of problems, and was in a not very satisfying shape. Here is the list of the improvements I've suggested, and that now are in place (hopefuly for our best comfort) : Moreover greylisting has been made more efficient: before, we only greylisted on the pair (sender_ip, sender_domain) which is suboptimal: spammers always forge sender addresses from the same domains (aol, hotmail, ). So in half an hour, aol.com, hotmail.com, were whitelisted, and spammers could just get through, unannoyed. Whereas occasionnal senders on not very widespread domains were always caught. Now, greylisting uses the full sender_address, which is the mildest way to do greylisting. The hard way would be to use the usual triplet (sender-ip, sender-address, recipient-address), but given the fact that alioth does not delivers to that many recipients, not taking it into consideration is a good compromise to avoid a too huge database, with almost the same results. I hope to be able to deliver some nice curves based on alioth's traffic in about 10 days, to see if that worked as expected. Thanks again to Rapha l that made it possible.



for those who are interested, the exim4.conf snipplet to do conditionnal greylisting is :
    # acl that tell if we will greylist or not
    acl_greylist:
        # Check if EHLO greeting is resolvable
        deny
            !verify = helo
        # Deny if the host is blacklisted
        deny
            log_message = match $dnslist_domain
            dnslists = cbl.abuseat.org : dul.dnsbl.sorbs.net : dynablock.njabl.org
        # Deny if the sender address can't be verified
        deny
            !verify = sender/callout=30s,connect=5s,defer_ok
        accept
        accept
            acl = acl_greylist
Notes [1] I really think we sould also check that the helo line is either an IP or a FQDN, but that can come later

Mike Beattie: A small side trip..

So, today, I've just arrived back from Sydney with a few of my fellow LCA 2006 organisers where we'd been attending the annual LCA Ghosts meeting. Next year, as you all know, LCA will be held at UNSW in Sydney, Australia. The venue looks great, and a lot of the ideas the Seven team have in the pipeline sound fantastic. If they pull a couple of them off, then this is going to be a fairly significant turning point in LCA growth. All things considered, this will make LCA 2007 even better than LCA 2006.. if that's even possible :). Raewyn also came along on this little trip, so that she could have a little holiday, and go shopping - also to add some stamps to her passport, she'd never been outside of New Zealand before.. One of her memorable comments was something like "That's really the Sydney Opera House, not just a postcard". She spent some of her time with the wife of one of the other 2006 organisers, who was there just for the shopping. This may not have been a good thing. We didn't get to do a whole lot together, since I was tied up for most of the weekend at Jeff and Pia's place. We did however manage to slip in a visit to see a good friend (bod, for those that know him), a BridgeClimb, a diamond ring, and a wander around the city on Sunday evening. I'd highly recommend the bridge climb, if you can manage to go around dusk, it's fantastic to watch the sunset in the west over the Blue Mountains. We also had a lovely dinner after the climb on Saturday with everyone else at James Squire Brewery down on the King St Wharf. I had the kangaroo - there's something pleasing about eating a national icon :) Yeah, for those of you that read that last paragraph and went "diamond ring?!? Wha?!".. I finally gave in, and proposed to Raewyn on the top of the Sydney harbour bridge. I'm still coming to terms with having a fianc , rather than just a girlfriend :). For those that are wondering, how do you take the ring up on the bridge, when you can't carry loose items? Well, it turns out it's not uncommon for guys to propose on the bridge.. So the BridgeClimb folk have this thing called an ERD - an Engagement Ring Device. Basically an elastic armband with a ribbon attached. The ring is placed over one side of the ribbon, and the two ends are placed through a small plastic toggle - like the one you have on your sleeping bag cover. When you are up on the bridge, you loosen the toggle, and place the ring on the appropriate finger, hold hands together, and slide the elastic from you to your (now) fianc . It's a bit hard to describe, but it works quite well. Anyway, This happened underneath what the Aussies call 'Blinky Bill' - the flashing red light on the top of the bridge used as a bit of a warning/navigation aid to aircraft. Our climb group were on the western arch of the bridge awaiting the descent, and the group behind were on the eastern arch after just arriving. Both erupted into applause, and cheering when I went down on one knee... quite an experience! The amusing anecdote of the whole thing was about 3-4 minutes later, as we were descending, Raewyn said "Oh my god, I'm engaged" - it had just sunk in.. At that dinner afterwards? We walked up to join the others, and they erupted into more applause and cheering, in front of the all the other diners.. Bastards. Right, now back to the real topic... The Seven crew really do have this LCA job all sorted out, and Sydney in January 2007 is the place to be.. Hell, even I'm tempted to put in a paper submission this time around - normally I'd try and avoid it! (I need to get back into this blogging thing again, it's so easy to just fall out of the habit when you get busy with other things.. I promise to try harder from now on!)

1 April 2006

David Nusinow: I Can't Believe I'm A "Manager"

Via reddit (which kicks the crap out of slashdot and digg): What I've Learned From Failure.

The link above is a long, but fascinating piece. I've had to become a lot more interested in how to manage software projects since taking on Xorg maintainance, and the same lessons seem to scale up well to how Debian as a whole manages itself. This article talks about some of the major problems that I've seen myself deal with, and the experiences of this guy echo my own over the past year very strongly. Here's a few examples:

"Getting away from weak teams, another source of failure is the omnipresent threat of "chickens." A chicken is not necessarily a weak individual, but a sign of a weak management structure. A chicken is an individual who has significant authority over your project, but does not make a personal commitment to the success of the project. Significant authority includes the authority to impose constraints on the team."

I like this and I've noticed it in the XSF and in Debian as a whole. People are free to work on what they want how they want, and this tends to work out well for us. But we also have no structure in which people must actually commit to what they do. As such, there's no accountability. This frees Debian developers from the preassure of having to work on something they don't enjoy, but it also creates abandoned packages, ignored bugs, and frustrated release schedules. In the past I've described a need for a stick in addition to a carrot for Debian developers, and the sentiment here echoes that idea. I've spoken with Manoj about his conception of personal responsibility in Debian, and I think it may truly be the bedrock on which Debian needs to rest. I still don't have a good mechanism for this yet though.

"Another sign of a weak team is poor development hygiene. There are dozens of development practices that seem trivial to the inexperienced outsider or to the manager focusing on "big wins." Examples of development hygiene include source code versioning, maintenance of an accurate bug or issue database, significant use of automated testing, continuous integration, and specifications that are kept current (whether incredibly detailed or high-level overviews)."

This is a something I myself have had a problem with over the past year. Branden was extremely good about keeping the XSF svn repo and the BTS up to date and well managed. I've done just about the opposite over the past year, and it's bitten me a few times. This however, was a conscious decision on my part, knowing that I was so far behind upstream that it was going to be hard to effectively manage the BTS without a recent codebase deployed to our users. So I focused on packaging instead, and luckily that road is nearly finished. Also fortunately, everyone else in the XSF managed the BTS for me, most notably (in alphabetical order by last name) Julien Cristau, Michel D nzer, Eugene Konev, and David Martinez Moreno, and they've managed to keep it relatively tidy. I'm going to spend some serious effort over the coming months to clean out the BTS so it's more manageable both for users and developers again. Luckly our SVN repo is in good shape still, so for the most part we're doing pretty well here. Debian as a whole also seems to be doing better at this, with lots of public svn repos springing up on alioth.

"It's mandatory to fail early. You need to know you're in trouble right away. That's essential when taking over an existing project or starting something new. You have to find out how you're doing within weeks. Not quarters, not months. The longer you wait, the more inertia the failure will have."

We're getting better at this, and I've sort of made it my mantra for this release cycle. Get things in to experimental as fast as possible, and then when I've fixed the majority of the bugs that show up there, put it in unstable as fast as possible. It worked out well for all the releases I've done so far and I'm going to keep doing it. Michel is really pushing me to keep CVS (or git as of Real Soon Now) snapshots from upstream in experimental, and I really like this idea and plan to follow through with it for this reason. This also echoes some of aj's ideas about speeding up development pace. Hopefully he'll implement them whether or not he becomes DPL, because I think they're going to be important for Debian as a whole.

"Dates are sacred."

We learned this during the sarge release cycle.

"The net result is that I've tried to find the happy medium where I generate weekly management reports on projects. A management report is something that is used to actually make a decision. Everything else is garbage. I've learned that when I haven't had management reports for a project, failure has resulted."

This is an interesting idea. It sort of echoes how I try and provide status updates on my blog, as well as the "Bits from" emails, but perhaps something more like this would be useful. I may try and play with this idea in the near future.

There's a lot more in there, but this entry already got way too long. Hopefully there's some food for thought in there for everyone who's interested in how Debian is run. The Debian development model has carried us very far, but I can't shake the feeling that we need to make some critical changes for it to continue. This will require a certain degree of boldness, but in order to fix the problems with the project I think we just need to clench our teeth and go for it. With that, I'll leave you with one last line from the above: "And if you decide to make changes, have the courage to go 100% with your gut. I've failed more than once when I watered down my convictions in order to appease dissenters. The only thing worse than evangelizing change and failing is looking back and realized you might have succeeded if you'd held firm on your convictions."

29 March 2006

MJ Ray: Software Patents: They're back: SPLT

As predicted, the protectionism interests are pressing for software patents again. The European Commission is consulting until the end of March. Please tell them what you think. Here is some background material:

Erich Schubert: SELinux optionals in base

Up to now, if you had a working modular reference policy, you actually had had luck. There were some bugs in the toolchain that prevented this from working as intended. Thanks to all who helped tracking this down. Looks like modular reference policy is now actually working as intended for me. ;-)

28 March 2006

Steve Kemp: We re gonna get together one day

A free mod_security replacement? Once upon a time I was interested in writing something to filter, sanitize, and otherwise protect incoming Apache requests. Then I learnt that it already existed, and was called mod_security. (Initially I was suprised it was written as an Apache module, rather than a proxy, but I think it makes sense to code it that way now). Now I learn the license makes it non-Debian-friendly. So I we? need a free replacement. Writing the engine is almost trivial. The value comes from the rules (which should ideally be seperate a la snort - but freely redistributable), and to a lesser extent the simplicity of the rule-writing process / flexibility of the rule-engine. My time is tight, but it is a genuinely interesting area to me. Wanna play?

Uwe Hermann: People should not be afraid of their governments. Governments should be afraid of their people.


Voil ! In                                                       view, a humble
 vaudevillian                                                  veteran, cast 
  vicariously as both                                         victim and
   villain by the                                            vicissitudes of Fate. This 
    visage, no mere                                         veneer of
     vanity, is a                                          vestige of the
      vox populi, now                                     vacant,
       vanished, as the once                             vital
        voice of the                                    verisimilitude now
         venerates what they once                      vilified. However, this 
          valorous                                    visitation of a bygone
           vexation stands                           vivified, and has
            vowed to                                vanquish these 
             venal and                             virulent                   Remember, remember the 5th of November
              vermin                              vanguarding
               vice and                          vouchsafing the
                violently                       vicious and
                 voracious                     violation of
                  volition. The only          verdict is 
                   vengeance; a              vendetta held as a 
                    votive, not in          vain, for the
                     value and             veracity of such shall one day
                      vindicate the       vigilant and the
                       virtuous.         Verily, this 
                        vichyssoise of  verbiage 
                         veers most    verbose
                          vis- -vis an introduction,
                           and so it is my
                            very good honor
                             to meet you
                              and you may
                               call me
                                  V.
Yes, I've seen V for Vendetta today. Very impressing movie, highly recommended! Makes you start to think...

26 March 2006

Wouter Verhelst: Dear lazyweb,

I'm looking for a calendaring application with the following features:
  1. Must have a (limited) command line interface. I want to be able to view my appointments of the day in plain text format, so that I can put that in my .profile; it'd be nice if it allows me to view my appointments on any random date, but that isn't required. Moreover, when someone sends me a meeting invitation, I want to be able to pipe the ical file into something which puts it in my calendar, with optionally also sending an email to the person who sent me the invitation that I'm accepting it (optionally, as in, it must have the feature, and it should allow me to decide whether to send the mail on a case-by-case basis, not as in it would be nice if the feature existed.)
    More command line features are nice, but not necessary.
  2. Must have the ability to export ical files to a text file on my local hard disk; must not require me to set up a server with some weird login scheme and ditto protocol so that I can please put my webcalendar somewhere—and no, I won't sign up for one of those "free" webcalendar services. I'll put it online myself, thank you very much.
    This requirement rules out evolution, unless I missed some plugin somewhere (I don't think so).
  3. Must have basic calendaring functionality. I.e., I should somehow be able to get an overview of my appointments of any given day, to get a weekly, monthly or yearly overview, to print out things, etc.
  4. Must not require ages to start up. This, definately, rules out evolution. When I have a phone call, I want to be able to see within a few seconds whether I'm available at any given time.
  5. The ability to synchronize my calendar with my cellphone somehow would be nice, but isn't absolutely required. I'm willing to jump through a number of hoops here. Note that gnokii supports my cellphone.
Suggestions are welcome.

Bernhard R. Link: compiler arguments

Please do not hide the arguments given to the compiler from me.

It's hard to realize something is going wrong if you do not see what is happening. If the argument list is too long, do something against that instead of hiding it.

Make sure you follow policy when packaging software

Debian packages should be compiled with -Wall -g, but more and more do not. Please check you do, but check at the correct place. Do not look into the debian/rules file, but in the build log. If the Makefile sets a default with a single equal sign ("="), running 'CFLAGS="-Wall -g -O2" make' will not suffice. Try 'make CFLAGS="-Wall -g -O2"' instead. (Actually, there is no good reason to put them before the command. Always try to put things as arguments first, both with make or with ./configure)

It really makes everyone's live easier if those options are set.

Keep the argument list tidy.

Many argument lists are longer than necessary. If there is some -I/ in the argument list on a Debian system, there is something fishy. (It's not the universial collection of different stuff all going whereever it wants, after all). Common cases are:

- buggy scripts to add -I/usr/include

Better fix those scripts. Also make sure they do not cause other problems, like linking your program against libraries your program does not use directly. (Possibly causing funny segfaults when those libs link against other versions of those libraries)

- -I/usr/X11R6/include

For upstream packages this might perhaps be useful to support older operating systems and people unable to give it to CFLAGS themselves. But for FHS systems, this is not needed at all, as it mandates this handy /usr/include/X11 -> /usr/X11R6/include/X11 symlink. And newer X directly puts the headers in the correct place.

- packages working around upstreams breaking compatibility

Life would be too easy if upstream would not break APIs. But if they make a new incompatible version, and even change the library name for that, would it have been that difficult to also change what programs written/ported for that new incompatible API have to place in their #include line?

- plainly broken upstreams

putting stuff in $ PREFIX /include/subdir/ and #include'ing other files from that subdirectory without the subdir deserves application of some large LART.

- oversight

often it is just not necessary, and everything gets much more readable and easier if left away.

Other things makeing things unreadable are large armounts of -Ds generated by ./configure. AM_CONFIG_HEADER can help here a lot with non-path stuff. Stuff containing paths is suprisingly often not used at all.

25 March 2006

Martin Michlmayr: Compiling the whole Debian archive on MIPS with GCC 4.1

Over the last 2.5 weeks I have built the complete Debian archive on a quad-core MIPS machine donated by Broadcom using the recently released version 4.1 of GCC. In parallel, I have done the same on an EM64T box donated to Debian by Intel. The purpose of this exercise was three-fold: Executive summary GCC 4.1 itself appears to be very stable, both on MIPS and AMD64. There are, however, a large number of packages using code (especially C++) which GCC 4.1 treats as errors. Fortunately, most of them are trivial to fix. By compiling about 6200 packages, over 500 new bugs have been discovered and submitted, 280 of which are specific to the increased strictness of GCC 4.1. Patches for 2/3 of those GCC 4.1 specific bugs have been submitted. Based on my findings, Ben Hutchings has prepared a summary of the most common C++ syntax errors (that weren't treated as errors before G++ 4.1). Most common programming errors Basically, it all boils down to broken C++ code. There were a few bugs in C code, but the majority was in C++. The most common errors I found are: I've posted a detailed report to debian-devel. Acknowledgements (abridged)

Next.

Previous.