I've just updated my DIY secure pseudo-DDNS setup using ssh article/HOWTO a bit, in order to make it simpler to set up (no more extra scripts required) and a bit more secure (by using command= and no-port-forwarding,no-X11-forwarding,no-agent-forwarding in the /home/user/.ssh/authorized_keys file, for instance). If you've considered employing such as solution please revisit the article for updated instructions.

As always, we’re doing lots of interesting and significant things and have more good ideas than we have people to do the work.  If you have an Eee PC or are planning to get one, or are otherwise interested in our work, some of which has uses beyond just the Eee, here are some highlights: Earliest Eee models supported in Lenny Lenny will release with the atl2 ethernet driver and the non-free madwifi-source now works with the earliest Eee models as well, so our patched version is no longer needed.  This means Lenny will work with all of the earliest models of the Eee PC: 701 (2G and 4G surf, 4G, 8G) and 900! All we need now for full support in Lenny is to replace the non-free wireless driver with the free ath5k driver when it is ready. Free drivers Nick Kossifidis has submitted patches on linux-wireless supporting the Eee models currently supported only by the non-free madwifi in ath5k.  This means we’ll soon realize our goal of a completely DFSG free system for the earliest models of the Eee.  By 2.6.27, or at the latest 2.6.28, these models will be supported.  Then we will see about making a patch to support whichever kernel makes it into Lenny. New models Model 901, 1000 and 1000H users are now able to install using the atl1e ethernet driver from eeepc.debian.net.  Support for wireless and other aspects of the new hardware will follow soon.  The debian-kernel team was prompt to add atl1e to 2.6.26 which has just been uploaded to sid.  We hope 2.6.26 makes it into Lenny. Wireless installer Glenn Saberton has been doing an upstanding job adding wireless support to our custom Debian-installer.  We have supported WEP authentication for several releases, now, and a beta version supports WPA.  Glenn is also making progress with these patches upstream so that non-Eee Debian users will benefit from our work. LXDE is in Lenny LXDE has entered Lenny, thanks to Andrew Lee.  It is a quite lightweight desktop environment that is made with the Eee PC in mind. Live images Two flavours of Debian-live USB images are available: a demo of the LXDE desktop and a minimal console-only image for rescue/backup.  The images are still in alpha stage of development.  If you’d like to help, give us a shout.

More interesting things are planned for the future that benefit Debian as a whole.  With a small amount of work patching live-helper, anyone will be able to make a live image that includes a customized Debian-installer. Mobile device initiative This month on debian-devel, there was some interesting discussion about Debian support for the Intel Atom processor and a possible mobile net device initiative.  That’s something we could get behind, if anything comes of it. Wiki translation Robert Epprecht has been keeping the German wiki translation in good shape, but we could always use some more help with any of the translations. New members welcome If you’d like to join us, check out our site at http://wiki.debian.org/DebianEeePC and drop us a note on our list or join our irc channel and talk to us about what you’d like to do.    

I am following closely this new DNS mess. In fact, there s nothing really new in that. DNS has been attacked lots of times over the years as a result of not being designed with security in mind from the ground up -, just this new one is a combination of known attacks against known security flaws. The quick fix is not a real fix, and just incorporate old ideas into the most used DNS software, strengthening it to face the attack. The details leaked, and there s already at least one public exploit (and who knows how many in the wild). The new buzzword is DNSSEC. I don t like DNSSEC. I never did. The first time I heard of it, around year 2001, it was a centralization of a decentralized database: A proposed company (called Network Solutions) would serve as a central authority, signing every root DNS entry. It was a joke! Come on! DNS is suppose to be decentralized! Having a central company anywhere is just a huge step back in decentralization (not to mention a huge step back in security). Time passed, and the DNSSEC specs evolved to a more decentralized way of thinking. The state it is now, and the implementations we saw so far are not good. No! I am not talking about security I am talking about the KISS principle: DNSSEC turns something really simple to deploy into a full-time job, with frequent key roll-overs and re-signing everytime you change the zone a huge mess! Yes, there are automated tools, but, come on! you still have to wait for TTL to expire before publishing this part or that part of the cryptographic machinery And, if we are talking about real security, are we going to build some automated tool fire-and-forget -style and not follow it? If we are not looking at it as it goes, and it fails, we could end up with a completely wrong set-up or (even worse) a non-validating zone. And I haven t yet mentioned the increase in payload I am not completely convinced that this alone would not lead to DoS attacks just by compromising the responsiveness of the servers (and DoS attacks are already available for quite some time maybe the DNSSEC-medicine is worse than the disease ). The root ( . ) servers are not even DNSSEC-aware, and there s a whole class of other stuff to work-around the fact that they may not be DNSSEC-aware for quite some time yet. There has to be a simpler way! I can imagine at least three ways to fix the problem until we can fix DNS in a KISS way And they re all KISS also:

• Change Transaction ID field. This is the first Achiles heel of this crisis. Let s increase the length of this field to 2048 bits, or even larger. Better yet, let s make it variable, so every system administrator can set his servers own size. Yes, I know this leads to replacing ALL the DNS infrastructure, but isn t that what we are doing right now, anyway?

• Deactivate in-bailiwick injection. Over the years, DNS have been expanded to allow a lot of things other than translation of names into numbers (or to ease this translation). The second Achiles heel is the ability to inject the IP address for WWW.VICTIM.COM while consulting for 10294DKGJSDL.VICTIM.COM since both name-addresses are in the same bailiwick (in-bailiwick). Let s take a step back, and deactivate all this Before 1995, the same thing could happen with any addresses, including those out of bailiwick , and it was fixed to only allow those in-bailiwick Let s fix it again to not allow it at all!

• Good, and old iptables. Couldn t we just use iptables LIMITS to stop this attack and blacklist the attacker? We ve been doing this for a lot of other things (SYN-floods, ICMP attacks, etc). Can t we just do the same. Again: this is not a new thing it relies on multiple attacks in a short period of time, just like other attacks we ve seen and successfully blocked with these techniques

Maybe some of those three solutions are flawed Maybe none are flawed and can be deployed together Maybe I am wrong and DNSSEC is the only way to go But let s not panic, let s cool our minds and begin thinking it through. I still don t think DNSSEC is the holy grail Now I already spent more time than intended on this let me go back signing some zones ;-)

After two weeks of well-deserved vacation and other delays, I'm back to doing regular updates of emacs-snapshot. Here's a quick summary of the notable changes in Emacs CVS since my last post:

• longlines-mode was replaced by a more complete and reliable implementation of the same concept, visual-line-mode. It's based on a new low-level change to the display engine to support line wrapping at word boundaries.
• Fonts can now be customized on a per-buffer basis. S-Mouse-1 shows a new menu which allows to change the font used in the buffer, increase/decrease its size, or reset it to the default font setting (Options > Set Default Font). A new minor mode variable-pitch-mode enables non-proportional fonts in the current buffer, which is useful in Gnus articles or Info buffers.
• There's a new NeXTSTEP port which provides support for GNUStep (on GNU/Linux) and Cocoa (on Mac OS X).
• M-s is a new global binding for all things related to search like Occur, Hi-Lock, etc.
• Serial port access: Emacs can now be used as a serial terminal (like minicom), see M-x serial-term.
• Project-local variables: like file variables but for directories.
• New SVG splash screen images for Emacs and Gnus.
• New packages: proced.el, zeroconf.el, xesam.el, linum.el, ...

Ryan kindly sent me a copy of the ACPI tables for his motherboard, so I've had the opportunity to look at them in a little more detail. There's nothing especially surprising. The first method of interest is OSFL, which I've annotated below:

   Method (OSFL, 0, NotSerialized)
     
        If (LNotEqual (OSVR, Ones))
         
            Return (OSVR)
         

This block simply skips the checks if they've already been evaluated and returns the cached value

        If (LEqual (PICM, Zero))
         
            Store (0xAC, DBG8)
         

If the programmable interrupt controller has been set up in PIC mode rather than APIC mode, 0xAC is written to i/o port 0x80. This would then show up on a plug-in card if one were attached. Simply debug code

        Store (One, OSVR)

Set OSVR to 1, which in this case clearly means "Unknown OS"

        If (CondRefOf (_OSI, Local1))

This checks whether the OS supports the _OSI method. If it does, the following block is executed. If not, the older _OS method is used to detect the OS

         
            If (_OSI ("Windows 2000"))
             
                Store (0x04, OSVR)
             

Newer versions of Windows will also claim to support the interfaces defined in older versions, so this set of checks is done in release order

            If (_OSI ("Windows 2001"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP2"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2006"))
             
                Store (Zero, OSVR)
             

If we've got this far, OSVR is now set to 0. Linux will claim to support all of these interfaces, and so OSVR should be 0 on Linux systems. Note that there is no _OSI check for Linux - the 2.6.24 change to remove Linux from the set of claimed interfaces is therefore irrelevant

         
        Else
         

Linux supports _OSI, so we should never be here. But if we somehow are...

            If (MCTH (_OS, "Microsoft Windows NT"))
             
                Store (0x04, OSVR)
             

Linux has responded to _OS with "Microsoft Windows NT" since 2.6.9. MCTH is simply a string matching routine defined elsewhere in the DSDT. So, worst case here is that OSVR is 4

            Else
             
                If (MCTH (_OS, "Microsoft WindowsME: Millennium Edition"))
                 
                    Store (0x02, OSVR)
                 
                If (MCTH (_OS, "Linux"))
                 
                    Store (0x03, OSVR)
                 

..because this could never be true unless you're running 2.6.8.1 or earlier. But even so, getting here would still indicate failure - we've supported _OSI since before then, and so should never come anywhere near this code block.

             
         
        Return (OSVR)
     

In summary, we end up with the following values:

Value	OS
0	Windows XP, 2003 or Vista. Linux (assuming absence of bugs)
1	Unknown OS
2	Windows ME
3	A version of Linux that doesn't implement _OSI and is from before 2.6.9
4	Windows NT 4 and 2000. A version of Linux that doesn't implement _OSI and is 2.6.9 or later (I don't believe any such version exists

Now, where is this used? The majority of the OSFL checks only check whether the return value is 1 or 2, which will only be true for an OS that (a) doesn't claim to be Windows or (b) is Windows ME. Linux doesn't fall into either of these categories, so we can ignore them. The first interesting hit we have is in the HPET code, where _STA will return 0xf (device present and working) if OSFL is 0 and 0xb (device present and working, but should not be shown in the UI) otherwise. This is just to keep the HPET from showing up in versions of Windows that don't know what it is. The only other interesting hit is the following code from the PCI bus initialisation pathway:

 
                               If (LEqual (OSFL (), Zero))
                                 
                                    Store (0x59, SMIC)
                                 
                                Else
                                 
                                    If (LEqual (OSFL (), 0x04))
                                     
                                        Store (0x5A, SMIC)
                                     
                                    Else
                                     
                                        Store (0x58, SMIC)
                                     
                                 

This writes different values to SMIC (which turns out to be i/o port 0xb2) depending on the OS. 0xb2 is the standard(ish) way to trigger a system management interrupt, which causes the CPU to execute some code from a memory region that can't be accessed by the OS. This isn't that unusual, but it's a little weird. In any case, note that there's no check for whether OSFL is 3 here (which would be true if the _OS call returned Linux), and so Linux is being treated identically to Windows ME and any unknown OS. In reality, Linux will be treated identically to either Vista or 2000. This block provides no evidence of conspiracy. Finally, the OS version flag is written to a region of memory before suspend and read back afterwards. Nothing appears to be done with this information - it's conceivable that the low-level resume code in the BIOS has conditionals based on this, but I suspect that it's just boilerplate code that's ignored.

To summarise:

• There is no code in this DSDT that could determine that the system is running any Linux kernel of 2.6.9 or later. This may even be true of earlier versions - I'm not sure when _OSI support was added
• Even if the code did manage to determine that the system was running Linux, there are no codepaths that are Linux specific. Every piece of code is run on at least one version of Windows

What's the problem, then? I've no idea. The only "significant" issue is that the OEMB table provided by the BIOS has an incorrect checksum. Given that the OEMB table is never used by Linux (it's a vendor extension of some kind, with the best hint I've been able to find being that it can be used to pass information from the BIOS to the OS - kind of like the rest of ACPI, then...), this is pretty unimportant. And given that the OEMB table isn't part of the ACPI spec, it's certainly entirely irrelevant when it comes to determining whether the system is ACPI compliant or not.

Are there ACPI issues with Ryan's system? It sounds like it. The "Error attaching device data" complaints indicate some kind of failure on the part of the kernel to work out how the devices correspond to the ACPI namespace, but I strongly suspect that this is a Linux bug. Failure to reboot after suspend? Could be anything (I'd need direct access to the hardware to figure it out properly), but again it's almost certainly a Linux bug. The standard way Linux reboots systems is to bang the keyboard controller, and it's conceivable that something we're doing on resume is leaving the keyboard controller in a slightly confused state. We're clearly doing something wrong there, given that my Dell comes up without a keyboard about one resume in twenty - I just haven't had time to look into it yet.

The only remaining thing is the mutex handwaving. I've got no clue what's going on there. Ryan's suggested change (from Acquire (MUTE, 0x03E8) to Acquire (MUTE, 0xFFFF)) simply means that the OS will wait forever until it acquires the mutex - in the past it would only wait a second. The reason the compiler generates a warning here is that the firmware never checks whether it acquired the mutex or not! Bumping the timeout to infinity obviously fixes this warning (there's no need to check the return code if you're happy to wait forever rather than failing), but the original code is merely stupid as opposed to a spec violation.

Take home messages? There's no evidence whatsoever that the BIOS is deliberately targeting Linux. There's also no obvious spec violations, but some further investigation would be required to determine for sure whether the runtime errors are due to a Linux bug or a firmware bug. Ryan's modifications should result in precisely no reasonable functional change to the firmware (if it's ever hitting the mutex timeout, something has already gone horribly wrong), and if they do then it's because Linux isn't working as it's intended to. I can't find any way in which the code Foxconn are shipping is worse than any other typical vendor. This entire controversy is entirely unjustified.

I'm really enjoying OSCon this year. I've been here two days and just Tuesday afternoon actually went to what I had planned to go to. There's an XMPP summit here (wasn't on the schedule), and I dropped in there a few times. Got one of the XMPP developers to look at my system and figure out why Empathy isn't doing video chat with the N810 right.

Had an OSCon moment yesterday. I was sitting at a table with my laptop, trying to meet up with someone I had only met online before. We were chatting over Jabber. And I realized that person was about 20 feet away. This pattern has repeated itself several times now.

We went to McCormick and Schmick's for dinner. Great seafood and everybody there seemed to really enjoy Jacob too.

The People for Geeks talk was fun. They talked about how geeks tend to apply the tact filter in input, and everybody else on the output, which causes frustration for everyone. Though somebody in the audience asked why that applies to computer geeks but not theater geeks -- an interesting question, and one I wish they had probed a bit more.

I keep running in to interesting people here. One day I was talking to someone about alternatives to cfengine (he suggested parrot). This morning I was talking to someone that works for IBM, who is involved with their project to convert desktop machines to Linux and was interested in how we fared. I've met several people that spot my Haskell ribbon and are interested. One of them told me at breakfast that he heard there is this new Haskell book coming out that's about using Haskell in the real world. Another OSCON momemt when I told him I'm one of the authors of that book. The surprise was fun.

Damian Conway had a great talk Monday night on "how to give a great OSCON talk." I haven't found his slides anywhere.

Several weeks ago, the people in charge of maintaining the Windows machines in my institute were desperate because of a series of virus outbreaks - Specially, as expected, in the public lab - but the whole network smell virulent. After seeing their desperation, I asked Rolman to help me come up with a solution. He suggested me to try replacing the Windows workstations by substituting local installations by a server having several virtual machines, all regenerated from a clean image every day, and exporting rdesktop sessions. He suggested using Xen for this, as it is the virtualization/paravirtualization solution until now best offered and supported by most Linux distributions (including, of course, RedHat, towards which he is biased, and Debian, towards I am... more than biased, even bent). So far, no hassle, right?
Of course, I could just stay clear of this mess, as everything related to Windows is off my hands... But in October, we will be renewing ~150 antivirus licences. I want to save that money by giving a better solution, even if part of that money gets translated to a big server.
Get the hardware
But problems soon arose. The first issue was hardware. Xen can act in its paravirtualization mode on basically any x86 machine - but it requires a patched guest kernel. That means, I can paravitualize many several different free OSs on just any computer I lay my hands on here, but Windows requires full- or hardware-assisted- virtualization. And, of course, only one of the over 300 computers we have (around 100 of which are recent enough for me to expect to be usable as a proof-of-concept for this) has a CPU with VT extensions - And I'm not going to de-comission my firewall to become a test server! ;-)
When software gets confused for hardware
So, I requested a Intel Core 2 Quad Q9300 CPU, which I could just drop in any box with a fitting motherboard. But, of course, I'm not the only person requiring computer-related stuff. So, after pestering the people in charge for buying stuff on a daily basis for three weeks, the head of acquisitions came smiling to my office with a little box in his hands.
But no, it was not my Core 2 Quad CPU.
It was a box containing... Microsoft Visio. Yes, they spent their effort looking for the wrong computer-related thingy :-/ And meanwhile, Debconf 8 is getting nearer and nearer. Why does that matter? Because I have a deadline: By October, I want the institute to decide not to buy 150 antivirus licenses! Debconf will take some time off that target from me.
Anyway... The university vacations started on July 5. The first week of vacations I went to sweat my ass off at Monterrey, by Monday 14 I came back to my office, and that same day I finally got the box, together with two 2GB DIMMs.
Experiences with a nice looking potential disaster
Anyway, by Tuesday I got the CPU running, and a regular Debian install in place. A very nice workhorse: 5GB RAM, quad core CPU at 2.5GHz, 6MB cache (which seems to be split in two 3MB banks, each for two cores - but that's pure speculation from me). I installed Lenny (Debian testing), which is very soon going to freeze and by the time this becomes a production server will be very close to being a stable release, and I wanted to take advantage of the newest Xen administration tools. Of course, the installation was for AMD64 - Because 64 bitness is a terrible thing to waste.
But I started playing with Xen - And all kind of disasters stroke. First, although there is a Xen-enabled 2.6.25 Linux kernel, it is -686 only (i.e. no 64 bit support). Ok, install a second system on a second partition. Oh, but this kernel is only domU-able (this is, it will correctly run in a Xen paravirtualized host), but not dom0-able (it cannot act as a root domain). Grmbl.
So, get Etch's 2.6.18 AMD64 Xen-enabled kernel, and hope for the best. After all, up to this point, I was basically aware of many of the facts I mentioned (i.e. up to this point I did reinstall once, but not three times)... And I hoped the kernel team would have good news regarding a forward-port of the Xen dom0 patches to 2.6.25 - because losing dom0 support was IMO a big regression.
But quite on time, this revealing thread came up on the debian-devel mailing list. In short: Xen is a disaster. The Xen developers have done their work quite far away from the kernel developers, and the last decent synchronization that was made was in 2.6.18, over two years ago. Not surprisingly, enterprise-editions of other Linux distributions also ship that kernel version. There are some forward-patches, but current support in Xen is... Lacking, to say the least. From my POV, Xen's future in the Linux kernel looks bleakish.
Now, on the lightweight side...
Xen is also a bit too complicated - Of course, its role is also complicated as well, and it has a great deal of tunability. But I decided to keep a clean Lenny AMD64 install, and give KVM, the Kernel Virtual Machine a go. My first gripe? What a bad choice of name. Not only Google searches for KVM gives completely unrelated answers (to a name that's already well known, even in the same context, even in the same community).
KVM takes a much, much simpler approach to virtualization (both para- and full-): We don't need no stinkin' hypervisors. The kernel can just do that task. And then, kvm becomes just another almost-regular process. How nice!
In fact, KVM borrows so very much from qemu that it even refers to qemu's manpage for everything but two command-line switches.
Qemu is a completely different project, which gets to a very similar place but from the other extreme - Qemu started off as Bochs, a very slow but very useful multi-architecture emulator. Qemu started adding all kinds of optimizations, and it is nearly useful (i.e. I use it in my desktop whenever I need a W2K machine).
Instead of a heavyweight framework... KVM is just a modprobe away - Just ask Linux to modprobe kvm, and kvm -hda /path/to/your/hd/image gets you a working machine.
Anyway - I was immediatly happy with KVM. It took me a week to get a whole "lab" of 15 virtual computers (256MB RAM works surprisingly well for a regular XP install!) configured to start at boot time off a single master image over qcow images.
KVM's shortcomings
Xen has already been a long time in the enterprise, and has a nice suite of administrative tools. While Xen depends on having a configuration file for each host, KVM expects them to be passed at the command line. To get a bird-eye view of the system, xen has a load of utilities - KVM does not. And although RedHat's virt-manager is said to support KVM and qemu virtualization (besides its native Xen, of course), it falls short of what I need (i.e. it relies on a configuration file... which lacks expresivity to specify a snapshot-based HD image).
To my surprise, KVM has attained much of Xen's most amazing capabilities, such as the live migration. And although it's easier to just use fully virtualized devices (i.e. to use an emulation of the RTL8139 network card), as they require no drivers extraneous to the operating system, performance can be greatly enhanced by using the VirtIO devices. KVM is quickly evolving, and I predict it will largely overtake Xen's (and of course, vmware and others) places.
Where I am now
So... Well, those of us that adopt KVM and want to get it into production now will have some work of building the tools to gracefully manage and report it, it seems. I won't be touching much my setup until after Debconf, but so far I've done some work over Freddie Cash's kvmctl script. I'm submitting him some patches to make his script (IMHO) more reliable and automatizable (if you are interested, you can get my current version of the script as well). And... Starting September, I expect to start working on a control interface able to cover my other needs (such as distributing configuration to the terminals-to-be, or centrally managing the configurations).

Here I am writing today to tell something that might not be known outside Brazil at least, I haven t read much in English about it the attempt to turn the Internet into a government surveillance device. This story goes back to 2006 (and even back), when we first successfully blocked the approval of a bill that would, in effect, turn the Brazilian Internet into a giant Big Brother. This bill was introduced by Senator Eduardo Azeredo as a replacement to a series of other similar bills that were attempted before and was followed by a strong resistance by civil organizations, one of those being ASL, of which I am proud of being one of the founders. By that time we ended having it postponed for more debate. It happened that the bill made a come back last weeks, and was pushed into approval by a subcommittee of the Senate (one that was suppose to deal with the constitutionality of bills) and now is heading to the Chamber of Deputies for appreciation. Apart from the first debates back in 2006, nothing happened between then and the approval. The bill have changed a little bit, but not much as to change its effects. In Brazil, we have two legislative houses, Federal Senate and Chamber of Deputies. If a Law Project is proposed by one, is revised by the other. So we have already lost 50% of the fight. Ronaldo Lemos, professor of Funda o Get lio Vargas (think about a Brazilian version of Harvard Law School ) have already stated how dangerous such a Law can be, once approved. In his own words: The wording of the law is too broad, and can be applied in several cases. The interpretation of what is a crime or not will be done by a criminal judge, who is used to deal with homicides and not with technology . Since its approval in Senate, several people have been putting together a resistance. Central to it is a Petition, hosted at Petition Online, that already holds 64-thousand signatures. One of the writers of that petition, Andr Lemos, a university professor and researcher, have said that the regular user will have the feeling of being watched, and not knowing if what he s doing in legal or not: For instance, if I disseminate a virus without knowing, will I be arrested? Can I exchange my files in P2P networks (my pictures, my musics, my text files) without asking for permission? How will the ISPs interpretate these exchanges? Can I copy a part of a text from a blog and paste it into mine? This law creates a feeling of insecurity and generalized fear . FGV s Center for Society and Technology have published an analysis of the Law Project, and have spotted a lot of problems in it. For instance:

• Unlock a cellphone to be used in another carrier or unlock a DVD player, so it reads disks from different regions, can be a crime punished with 1 to 3 years of imprisonment and a fine, as deals article 285-A;
• Copy something from a blog that doesn t state access restrictions is turned into a crime since a blog is covered by copyright and, if not stated otherwise, those restrictions should apply, and someone that copies can be punished with the same 1 to 3 years of inprisonment and a fine, as deals article 285-B;
• Unlock the iPhone using softwares like jailbreak is turned into a crime punished with 2 to 4 years of imprisonment and a fine, as deals article 163-A. Even put a link somewhere in your site pointing to the software jailbreak is considered a crime;
• The ISP is turned into a surveillance apparatus, and is mandate to inform the authorities about any of the crimes the Law deals with, as states article 22.

Thinking of how I can help, after sending an email to every Deputy whose email address I was able to get, I decided to translate the law into English (I also uploaded a version with indentation, since it s pretty hard to understand the whole law without it, if you re not used to), so the World can be made aware of what s going on in Brazil. I also just sent an email with it to EFF, asking for their help. Not that I think they can do much, but they surely will know one or two strings to pull in order to put more pressure on the Brazilian government. I also hope that, once this post reaches Planet Debian, even more people become aware of the issue. In a sense, this is an appeal for all the Freedom Culture lovers out there to take any actions they can to help us prevent this Law Project to become a Law. (In time, I d like to thank Alexandre Oliva, who revised the translation). Update (2008-07-23 11:50): Steve Langasek also revised the translation of the Law Project and I ve made a cherry-pick merge , which resulted in the version currently linked in the text above. Older version of the plain and the indented documents are still available. Thanks Steve!

Last news I gave for D-I and related stuff l10n completion was on June 15th. We're now one month later, so let's see what happened since then. D-I "level 1" (ie the core D-I) had several templates changes which bringed the translation ratio from 100% to 99% and below several times, for all languages. Several teams have still been able to cope with that. Other levels had no changes and I therefore spent some time nagging them to complete the missing bits here and there. The current status is:

• Level 1 (core D-I): 20 complete languages (be cs de eu fi fr gl gu ja ko nl pt pt_BR ro ru sk sv th tr vi) just like we had on June 15th
• Level 1 + Level 2 (packages with strings used in default installs): 20 complete languages as well (the same ones of course). Big improvement here as we had only 11 of them in June.
• Level 1-3 (pkgs prompting during default desktop installs or important for desktop installs): 16 complete languages. We "lose" Belarusian, Gujarati, Brazilian Portuguese, Romanian.
• Level 1-4 (adding pkgs prompting during other tasks): 16 (the same ones)
• Level 1-5 (adding important stuff such as apt, dpkg, aptitude): 9 complete languages. Those languages reaching the Grand Slam are: German, French, Galician, Japanese, Portuguese, Russian, Slovak, Swedish, Vietnamese

Changes are still planned for level 1: D-I developers are really active these days, particularly with the great "come back" of J r my Bobbio and the constant QA work by Frans Pop. I also tried to merge in some work done in Ubuntu's Rosetta and then interest those people who translate there to collaborate to D-I "upstream". This lead me to merge updates for Icelandic, Kazakh, Afrikaans, Malay, Welsh and Serbian. Contacts were made with the relevant translators:

• For Icelandic, the translation updates in Rosetta come from a woman whose login is "eeinarsdottir" but I couldn't succeed in getting an e-mail address to get in touch with her. She apparently lives in Finland if I believe Google and is also using "zorglubb" as nickname. Any hint to get in touch with her would be appreciated.
• For Kazakh, I tried to get in touch with the person who translated in Rosetta but got no answer as of now. In the same time, I tried to re-wake up Talgat, who's registered as the D-I translator but wasn't very successful.
• For Afrikaans, Friedel Wolff, the main maintainer of Pootle, is very interested in working on the translation, through Pootle of course. He was however very reluctant wrt our current policy to activate languages only when people complete "sublevels" 1 and 2....which would require about 6000 words to be updated. Scary for him, as it seems. I tried to get in touch with the translator in Rosetta....but got no answer.
• For Malay, the current translator (NB Liang) was very happy to get more strings translated because of the merge with Rosetta translations. He proposed the Rosetta translator to collaborate: no answer.
• For Welsh, I got a positive contact with Jonathan Price who did some work in Rosetta, completing the old work by Daffyd Harries (Welsh used to be complete in D-I in the past). We'll see if that goes further than "I'll have a look at it".
• By far the most positive contact was for Serbian. In about one week, I managed to get in touch with Veselin Mijuskovic and Marko Uskokovic, who work for the cp6linux project, funded by the Ministry of Telecommunications and Information Society of the Republic of Serbia. This project is aimed at creating a fully localized Linux-based distribution for use in Serbia, with support for Serbian (both cyrillic and latin), as well as regional languages of Serbia. Their distribution is currently based on Ubuntu. They did a lot of l10n work which, unfortunately, did not end up upstream as of now. They gave me access to their Pootle server and I'll try to get some of their work back in Debian.

My conclusion about all this is mitigated: I'm somewhat sorry to see some work happening in Rosetta, still without any connection with "upstream" work, with people apparently working without even some internal coordination and quite anonymously. I wonder if these people know that their work has few chances to end up anywhere, except in Ubuntu (for D-I translation, I even doubt it ends up somewhere: this is just unused work....until I grab it for D-I "suptream").

There has been a lot of fuss recently about the release of the iPhone [1] in Australia. But I have not been impressed. I read an interesting post Why I don’t want an iPhone [2] which summarises some of the issues of it not being an open platform (and not having SSH client support). Given all the fuss about iPhones (which have just arrived in Australia) I had been thinking of writing my own post about this, but TK covered most of the issues that matter to me. One other thing I have to mention is the fact that I want a more fully powered PC with me. So even if I had a Green Phone (which doesn’t seem to be on general sale) [3] or OpenMoko [4] I would still want at least a PDA running Familiar and preferrably a laptop - I often carry both. A Nokia N8×0 series Internet Tablet [4] would satisfy my PDA needs (and also remove the need to carry an MP3/MP4 player and audio recorder). When doing serious travelling I carry a laptop, a PDA, and a MP3 player all areas of my digital needs are covered better than an iPhone could reasonably manage. Finally mobile phones tend to not work or not work well ($1 per minute calls is part of my definition of “not well”) in other countries. While I haven’t been doing a lot of traveling recently I still try to avoid buying things that won’t work in other countries. I had planned to just mention TK’s post in a links post. But then a client offered to buy me an iPhone. He wants me to be able to carry a ssh client with me most places that I go so that whenever his systems break I can login. Now apart from the lack of ssh client support an iPhone seems ideal. :-# The cheapest Optus iPhone plan seems to be $19 per month for calls and data (which includes 100M of data) and $21 per month over 24 months for the iPhone thus giving a cost of $40 per month for 100M of data transfer (and a nice phone). There is a plan ofr a $19 per month iPhone, but that has a $19 per month un-capped phone plan and doesn’t sound like a good way of saving $2 per month. The “Three” phone company offers USB 3G modems for $5 per month (on a 24 month contract) and their cheapest plan is $15 per month which gives you 1GB of data per month and $0.10/M for additional data transfer. So it’s $20 per month for 1G (which requires a laptop) vs $40 per month for 100M. Three also has a range of phone plans that allow 3G data access over bluetooth to a PC, it seems that a Nokia N8×0 tablet can be used with that which gives a result of two devices the size of mobile phones. But that costs $20 per month (on top of a regular Three bill) for a plan that offers 500M of data and still requires two devices while not giving the full PC benefits. In the past I’ve done a lot of support work with a Nokia Communicator, so I’ve found that anything less than a regular keyboard really slows things down. While a EeePC keyboard is not nearly as good as a full sized keyboard it is significantly better than a touch-screen keyboard on a PDA (IE the Nokia N8×0 or the OpenMoko). At the moment I’m looking at the option of carrying an EeePC with a USB Internet access device. That will cost $20 per month for net access. The cost of the EeePC is around $300 for a low-end model or about $650 for a 901 series that can run Xen (as noted in my previous post I’m considering the possibilities for having a mobile Xen simulation of a production network [5]). The savings of $20 per month over 24 months will entirely cover the cost of a low-end EeePC (ssh terminal, web browsing, and local storage of documentation) and cover most of the cost of a high-end EeePC. Another possibility to consider is using an old Toshiba Satellite I have hanging around (which I used to use as a mobile SE Linux demonstration machine) for a few months while the price on the EeePC 901 drops (as soon as the 70x series is entirely sold out and the 1000 series is available I expect that the 901 will get a lot cheaper).

• [1] http://en.wikipedia.org/wiki/Iphone


• [2] http://arctanx.id.au/blog/?p=49


• [3] http://trolltech.com/products/qtopia


• [4] http://wiki.openmoko.org/wiki/Freerunner


• [5] http://etbe.coker.com.au/2008/07/16/xen-and-eeepc/

Share This

Lenny general freeze is approaching, so I'm walking thru my packages bugs and I found this one reported against fdupes.

I got 4Gb of memory, so how to reproduce an OoM? Let's start with a rather large file base, but I need a script to generate it. With 4 cores and a fast Raptor hd, I want something to stess them while learning something: Python + ParallelPython was the answer!

I wrote a small script that takes 3 parameters: the destination directory, the number of dirs to create and the number of files (with random contents) to created inside each of the created dirs. I ran it with 1000 dirs and 1000 files, so it generated 1M files set to work on.

But even with so many files, fdupes ran fine... At that point I realized that ulimit could be my friend, and the "-v" option would have saved me some time, but without the fun to write the script :)

If you don't know pp, here is a little explanation of the main part of the script (I forgot to comment the script well enough):

• job_server = pp.Server() is the pp job server: with no parameter, it allocates execution slots for the number of cores/CPUs on your system (you can force more/less)
  
• jobs.append(job_server.submit(gen_dir_set, (dirname+'/'+str(i),fileno), (), ('random',))) appends to jobs list the function returned by job_server.submit: this command takes the function to execute, the parameters tuple, the functions called by the first one (here empty) and the tuple of needed modules for the called function (here random).
• for job in jobs: job() execute each item in jobs: they are functions that return the results for every jobs (here they are discarded, but you could aggregate them to obtain the final result)
• job_server.print_stats() prints some stats about jobs executions (I love stats :D )

ParallelPython is more powerful than this: for examples, it allows to send your jobs to job nodes, machine dedicated to execute tasks (while you keep your own machine as the administration one), and more! Give it a try ;)

Since the launch of Identi.ca a few weeks ago, I've had a very busy time. Not much sleep, but lots of fulfilling and exciting work. It's invigorating to work on something that is popular and that you believe in. And I'm glad that the Franklin Street Statement so succinctly encapsulates those beliefs. As some people may have read in my previous blog post about the motivations behind creating Identi.ca (see Journal/14 Messidor CCXVI), I was part of a group convened at the FSF to discuss the impact of the growth of software as a service on user autonomy. It was a very loose organization of hackers, activists, and scholars who come from different backgrounds but all share an interest in user rights online. As computing moves into "the cloud" (see cloud computing), what power does the user retain to control their own computing experience? As much of our social lives -- romance, family, work, friends -- becomes Web-enhanced, what can we do to assert our right to manage that data and its use? How can software developers and service providers gauge their own proper ethical behaviour, and how can users of services judge what is and is not acceptable to use? We didn't come up with any easy answers, but we've summarized our thinking in a new document: the Franklin Street Statement on Freedom and Network Services. In essence, we've tried to point a direction towards what software developers, service providers, and software users should think hard about when thinking about network services. Our group will continue to explore these issues on our new group blog, http://autonomo.us/ . We're going to concentrate on the effects of software services on user autonomy -- people's ability to make their own informed choices about their data and creative works and the software that processes them. It is a realm that as a society -- a cluster of societies -- we're only beginning to understand, and I think that there is still a lot of exploration to do. Autonomo.us includes a wiki where we'll be exploring some of these ideas, and the blog will feature guest submissions about the subject. We're a loose and unofficial group with some smiling benevolence but no sanction from the FSF or any related organization, so we're really going to dig into some of the gray areas of this issue without worrying about making official statements for any one organization. I'm looking forward to the coming months and I hope this issue captures the imagination of the Web's Open Source and Open Content communities. P.S. You can see the FSF press release about the statement and the launch of autonomo.us. tags: autonomy franklinstreet softwareasaservice

Open Service Definition On a related note, one of the first organizations to approach the issue of Open Services has been the Open Knowledge Foundation. Today they've launched the 1.0 version of the Open Software Service Definition (OSSD). I think the OSSD 1.0 is a great step. It's a bar against which we can start measuring Open Software Services. For example, I think that Identi.ca meets the requirements of the OSSD. Other sites, like Wikipedia, are also clearly compliant. Some services that I really like, such as OpenStreetMap and geonames.org, seem to be compliant. But are they? It's good to start this investigation. I think other kinds of services are on their way there. The announcement by Reddit that their code will now be Open Source is a great step for user autonomy in the social news arena. Now, Reddit needs to consider what an Open Content/Open Data policy would mean for their service... or see others implement it on other sites. I look forward to a rich ecology of open software services growing, now that we have a name for it and a clear community of people interested in the topic. tags: autonomy ossd openknowledge

In times where screen resolutions of 1600x… and above are becoming more and more common, I wonder if the maximize window button which enlarges a window to take all the available space on the desktop is still as useful as it used to be. I noticed that some (if not all, I’m not a Mac user) applications on Mac only maximize their windows depending on the content of the window. For example if you maximize the window of your word processor, the window becomes only as wide as necessary to make the whole page visible. This doesn’t just look better on very large monitors, it is also more usable than a simple maximize since it doesn’t unnecessarily hide other windows. Is there a window manager for Linux which does something similar, or better: is something like this possible with KDE? I know that QT widgets have a “preferred size” — shouldn’t it be possible to have a maximize to preferred size button? It’s surely not useful for every application, but may applications only need a quite small main window and look very ugly when maximized.

I'd like to announce a modest contest on the Squeezed Books web site: the person who contributes the most to existing or new summaries wins a free business book + shipping, from Amazon, courtesy of Squeezed Books. Yeah, I know that it doesn't really compare with the millions that big companies can give away, but I thought it would be a nice way to reward people who work on the site. If it works out well, we'll repeat it every month. So, if you're the kind of person who already takes notes when you read a book, or you've read a lot of business books and can distill their key points, this might be a good opportunity to take a chance at a free book, and share your knowledge with others (summaries, unless otherwise noted, are under a Creative Commons license). Questions and comments welcome: it's an experiment, so ideas on how to improve it are welcome too.

• Personal stuff coming up; if you are not that kind of person, please skip :-)
  
• I forgot to say on my previous post about YAPC::NA 2008 that while I was in Chicago, I had the really nice chance to meet Carlo Segre and Dirk Eddelbuettel and enjoy a couple of nice beers with them. Great guys!
  
• I'm probably not attending DebConf this year. It's just too expensive right now and since sponsorship appears to be not enough, chances for me are quite low now. The cheapest I can get from NYC is around $1050/1100, which might be cheap for some folks in Europe which paid the same amount in Euros, but not for me now.
• I'm not attending OSCON neither. I wanted to, I really did, but it'll have to be next year now, because...
  
• On that days, I'll be in Mexico City with Raquel renewing our visas. Almost one year already since we got here, time flies.
• Last Friday (Fourth of July), we were invited by Mike and Rachel O'Connor to a barbeque at their place in Brooklyn. Even though they are veggies, they had some meat sausages and burgers which were great (also the grilled corn!). We watched the fireworks from their roof, which I have to say, weren't as spectacular as I expected, but it was probably because we weren't very, very close to Manhattan or because a big building was blocking our view in front of us, or because of the rain. A bunch of their friends were also there. I enjoyed spending time with them and Mr. Micah Anderson and Sr. Abraham Estrada. By the way...
• There will be a Debian NYC BSP very soon now! Stay tuned! Represent! :P
  
• I've been playing more chess that it should be legal, as some of you may have already realized.
• I gave myself a present and bought a PSP. I now do alley-oops, slam dunks and all kind of dribbles on NBA Live 2008 on my morning commute ;-)
  
• And last; for my personal workstation, I'm trying now Ubuntu Hardy and I'm doing a personal project with Rails. I have to say that even though I had some encountered feelings about both of them, I've been having quite a nice surprise and experience with both.
  

As summarized by Ace Suares, to validate my first rough upgrading instructions:

1. Upgrade the packages in the LTSP chroot First become root: sudo chroot /opt/ltsp/i386 Then add the repository, update and upgrade: echo "deb http://ppa.launchpad.net/q-funk/ubuntu hardy main" >> /etc/apt/sources.list apt-get update && apt-get upgrade && apt-get clean APT will inform you that some packages cannot be authenticated. This is normal, since the PPA is not digitally signed. Simply answer Yes.
2. Purge the transitional AMD driver apt-get --purge remove xserver-xorg-video-amd Then, exit the chroot:

   exit

3. Update the LTSP boot image

   sudo ltsp-update-image

   On a 64-bit server, the correct command is:

   sudo ltsp-update-image --arch=i386

4. Profit?

Happy Midsummer, everyone!

When I just started to read planet.debian.org today, I realized that Russel Coker was speaking of an unknown tool to print the UUID, but that Debian version doesn't seem to do that.

It's called fle apparently.
Sadly, an apt-cache showed that there's no package named fle. Then I realized that he was actually speaking of the good old tool called file - with an I between F and L!
Really, I wish the font rendering will improve in Lenny as this was on Etch... sigh

Mark is in town visiting after spending this last year at CMU. While here, he graciously organized a hiking trip to Sequoia National Park. We did around 20 miles over two days, 12 of which with full packs, and over 4000ft of climbing with full packs. The consequence of this work was that my old trusty camping backpack finally broke. The duct tape came loose, my sweat helped, and the left shoulder strap broke. This pack has lasted around 15 years, so it has done its job. Now is probably time for a new one.

My other bit of exercise was riding home from the tenderloin without a seat on my bike. Someone managed to get the seat, and post, off of my bike while it was locked up . Normally riding without a seat should be challenging, but not too bad. Unfortunatly, my bike is a fixie and I had clipless pedals and shoes with me today. I learned after the first block that I shouldn't clip in since it is very hard to clip out while pedalling and standing up. I also had a down hill section that was very scary. It turns out if you have your butt too far back on the bike that it becomes wobbly.