Luk had a nice idea today in the release channel: Is there anyone attending this years DebCamp willing to teach us (at least Luk and me) R?

OK, so after a lot of dithering I finally decided that I wanted to stand again for re-election in the DPL election this year. That's despite the fact that it's not good for my health and I don't have enough time to start with... Why am I doing it?

• I believe I've done a good job in the last year, and lots of other people seem to agree. However, I did not find the time for all the work I hoped to do and I think it's worth carrying on.
• I've been pestered to stand again by a lot of my friends in the project.
• I wasn't going to let Zack stand unopposed! *grin*

To make the job easier this year if elected, I'm standing with Luk Claes as an assistant. He and I are good friends, and we share ideas and values on a lot of points. My experience from the last year as DPL tells me that the job is a big one, and sharing the load with a willing victim^Wvolunteer should help with that.

/me for DPL Given that it is now widespread news, I guess it's time to blog about it: I'm running for DPL in this year elections, i.e.: zack for DPL!. Am I out of my mind?
Possibly It started as a joke at last DebConf, with my (naked or dressed ...) room mates spreading that rumor. Then the idea grows into me ... and now here I am. (IOW: I'm pretending I'm not entirely guilty of inflicting another platform to be read.) Apparently we are just two candidates: me and the "ticket" Steve-Luk. For the moment I've to spare a page where I will collect material about the election, and a couple of feelings:

• Sending the nomination mail is embarrassing: we are used to do only technical stuff in Debian, declaring our will of taking care for a while of our non-technical issues ain't easy.
• Preparing a platform is an intriguing experience. Whining about our problems is a thing. Trying to distill them in an organized list, and think about long term solutions is a totally different one. I suggest to try writing your own "platform" even if you are not candidate, and even when there are no DPL elections around (as Joey and HE did a while ago, IIRC, in the form of blog posts). It can be a rewarding exercise.

Version 1.0 of my platform has been submitted to the secretary, and is now available from my homepage. If you have questions, for me or the other candidates, just post them on -vote: campaigning has just started, I'm confident it will be fun! Update the platform is now available from the vote page

In a nice coincedence with the release of Lenny (cheers!!1), the low-quality versions of the videos from the Debian DevRoom at FOSDEM 2009 are available now!

Better quality versions will be encoded and uploaded by Ben over the next days. I'd also like to collect the slides from the talks there, so if you had a talk there, please send them to Wouter and/or me, and Wouter, please send me the slides you collected on the presetation computer ;-)

Basically I'm very happy with our results, excpet for two things: sadly the computer running dvswitch wasn't powerful enough to do picture in picture (and due to time constraints we weren't able to switch to a more powerful one), so we'll have to plan this better next year. And second, I have no real clue how useful our streaming efforts are, I believe the recordings are useful, but in both cases feedback from people who find them useful is appreciated! Covering FOSDEM is certainly a lot of fun, but it's also a lot of work and leaves not much room for seeing other parts of the conference. So a short reply (I'll post this to d-d-a with reply-to set to -project) will be very much appreciated! :)

Big thanks go to Womble2, edrz, xerrako, Q_, danielsan, DaCa, tokkee, luca, Yoe, Ganneff, franklin, huhn, luk, CarlFK, daven and some more volunteers I cannot remember right now! Also not to be forgotten the FOSDEM crew & volunteers for an awesome event and the people from CCC Hamburg who came by car and took a lot of audio/video/computer equipment for us (and left 90min later than planned! Thanks again!)! And also Debian (via the DPL) for some 120 Euros to rent equiqment and for buying batteries and the always needed duct-tape!

A few weeks ago, we finished a paper that surveys the current state of parallel computing with R. The paper was lead by Markus Schmidberger and written while he was visiting the Fred Hutchinson Cancer Research Center in Seattle. The co-authors are Martin Morgan, myself, Hao Yu, Luke Tierney and Ulrich Mansmann. The paper is now available as a technical report from LMU Munich via open access, and also from my papers page.

Really, now is the day 3 I am just considering this day 2 for I had to do a lot of things again due to my dumbness. Let me explain: I had a desktop environment in place (with fluxbox), wired network, and most of my daily softwares (Iceweasel, X-Chat, Pidgin, GkRellM), then I decided to test the Suspend-to-Disk At first, it seemed to work well: I made a swap file for uswsusp, just as documented what is not documented is that this file must be outside the encrypted partition! So, when I turned it on again, an error telling me about some corruption in the opened luks partition. I though OK, something gone mad, just a matter of running an e2fsck . So I booted with the netinst pendrive, opened the luks partition and ran it with -y. Everything seemed to be corrupted!!! It spend almost 5 minutes fixing bogus inodes and stuff before I decided to interrupt the process this fixed filesystem would never work anyway. So I began from scratch All over again. When I got into a working base-system, some other thought stroke me: what if Brenda were to use rohan (have I mentioned the name is rohan? I name all my machines after places in Middle-earth)? So, a minimal user-friendly desktop is needed After some research, I decided to go for LXDE. This is a minimalist desktop with OpenBox as the window-manager. I ve been using FluxBox for a long time now, so running another BlackBox-based would not be such a problem. LXDE is quite good. So far, everything I expected is working fine . Then I decided it s time to move on to configure the Wi-Fi stuff. I installed the RT2860 modules from Debian/EEEPC Repository and added rt2860sta to /etc/modules. At first I was worried that some reports of it not working with WEP showed up in a Google Search But nothing could be smoother! I installed wicd and it detected our WEP AP like a charm (and a bunch of other APs nearby)... after entering our key it just connected fine and I ve been using it since no glitches so far. I would like to play a little more, but I called the day since I got a lot of work going on Next item planned is the webcam

A comment on Facebook yesterday got me thinking what American "traditional values" are all about. We hear it a lot, and I suspect it means something different to different people.

Here's what it means to me.

It starts with an ethic fundamentally informed by the central tenets of Christianity -- which are also excellent standards of decency by secular standards. We are called to have a relentless drive to care for the repressed, poor, downtrodden. As Jesus said, "whatever you do to the least of these, so you do to me." It means extending the hand of friendship and compassion to all, in our own neighborhood and around the world. It means taking good care of the resources we have, acting responsibly, and affirming and supporting others so they can do the same. It means that, as our founding fathers emphasized, remembering that all people are created equal, are equally deserving of a good life, and deserve liberty and freedom. Finally, it means a constant realization that we are creating a human institution, and will always have an imperfect answer to these ideals, but that we can -- and must -- recognize our faults and strive to make things better.

How do these apply to our time?

We must start with the poor, the repressed, and habitually think of their situation in everything we do. That means remembering that when we drop a bomb in Afghanistan to kill a terrorist, we also usually kill 50 innocent bystanders, and devastate their families. It means remembering that illegal immigrants from Mexico come here because all they want is refuge from drug wars, food on the table, and a roof over their head. It means showing compassion in deportation proceedings: when illegal immigrant parents have a child born in the United States, the child is an American citizen and can't be deported, but deporting the parents will create an orphan. It means actively helping the repressed people of the world, whether they be in Sudan, Georgia, or AIDS victims in Africa, Muslims in New York. It means reducing taxes on the poor, giving them the skills and tools they need to make their way in life. It means caring for those with alcohol drug addictions, helping them to summon the strength to get past those problems, rather than locking them up or throwing them out on the street. In days past, this might have meant sharing firewood with the family down the road that was at risk of freezing in winter. Today it might mean assistance with winter heating bills.

Remembering that all people are created equal means that we must provide good education for everyone, whether they live in suburban California, inner city Detroit, or rural Appalachia. We owe quality health care to everyone; those without means to pay for health care, or to pay for a car to get to a clinic, should be treated with dignity and respect, and have equal access to medicine.

Remembering that all people are created equal also means that we must provide equal justice under law, and give everyone a fair trail. We must abandon the death penalty, because we have a shocking number of people on death row -- hugely disproportionately black and poor -- that have been shown innocent of their crimes thanks to advances in DNA testing. We must maintain the integrity of checks and balances in government, and support judicial oversight over search and seizure. We must avoid warrantless wiretapping because it subverts judicial oversight and corrupts our justice system by making the exercise of power secret. We must denounce torture, and refuse to employ it, because no human, being created equal, deserves to be treated in such a way -- and we have been applying it to innocent humans.

We owe the opportunity to grow up in a loving family, in a safe community, to every child. We must make sure that gangs no longer have the run of our streets, that drugs aren't displacing hard work as the currency of the community, and that adoption is inexpensive and practical for more families, rather than costing thousands of dollars. Doing so will help every child grow up knowing that they are valued, are important, rather than being unwanted and therefore abused or neglected.

Extending the hand of friendship and compassion to all starts with being a good example -- that shining city on a hill that Reagan talked about. We have to run an open, just, and fair society ourselves. We must not fear those that are different than us, just because they're different. We have to recognize that citizens of Iran, Russia, North Korea, Palestine, and the United States fundamentally are humans, created equal, seeking the same thing: a safe and secure future for themselves and their families. Being able to coexist peacefully means starting from that point, and being willing to talk to them, and yes, even their leaders, regardless of how distasteful they may be.

Acting responsibly with our resources starts at home -- things like not driving up credit card debt, not living outside our means. The same applies to government: massive deficits each year are exceptionally irresponsible and place us at great risk both at the present and in the future. We also have a duty to care for the planet and the environment in which we live, which means actively working to curb the things we do to harm the planet and cause global warming.

What about recognizing our faults? Perhaps the most patriotic duty asked of Americans is dissent. It is never easy, but is essential to keeping our democracy functioning. This country has a long history of successes, and also a long history of failures. We failed so many by keeping slavery legal for so long, and discrimination and lynching legal for even longer. We failed that Native Americans by forcing them from their lands and treating them with brutality. We have, to some extent, risen above these failures thanks to the ability to recognize them and try, to the best of our ability, to fix them. This is what the civil rights movement was about, and why we have a holiday for Martin Luther King, Jr. He spoke out against a society that said some couldn't eat in a restaurant because of the color of their skin, or who were repressed because of their economic status. He recognized that problem in America, and by speaking out against it, helped to change this country for the better.

Today we have to recognize the things we are doing wrong, and try to change them. We are torturing potentially innocent people. We are discriminating against Muslims and homosexuals in our midst. We are giving extraordinary power to big media companies through changes in copyright law, to big communications companies through failure to enact network neutrality laws. And we are labeling people that disagree with war as unpatriotic.

Notice some things I didn't mention, such as abortion. It's not really relevant, and the lines we are fed by both sides present us with this false pro choice vs. pro life debate. In reality, it seems to me that both sides want the best for the children: for every child to grow up in a loving family, where he or she is wanted. We all know from research that laws banning abortion do not actually reduce it. So we ought all to come together and try to make it more rare by providing more support to single parents, by making it easier to adopt children, by trying to make the perceived need for an abortion to go away.

So, in this election, I look at the candidates and it seems pretty clear which one is promoting traditional values and which one isn't. Obama is actively trying to reach across the aisle and find common ground. Even in his convention speech, he suggested ways to work together on abortion like I just mentioned. In the debate, he listened carefully to his opponent and acknowledged when he thought McCain was right. This is a necessary first step in working together to move forward. McCain subsequently released an ad mocking Obama for this.

What about caring for the poor? Again, Obama's tax policies, education policies, and health care policies take care of them far better than McCain's. About responsibility? McCain supported these deficit-busting budgets of the last 6 years, supported the oil-centric energy policies, and has been only lukewarm towards dealing with global warming. McCain and Palin mock Obama for trying to help poor Chicago neighborhoods 20 years ago, for being willing to just talk to our supposed enemies, for actually reaching across the aisle.

So yes, I am a values voter, and that's why I can't possibly do anything but vote for Obama.

I just receive The Mail (tm) from weasel, and I can't be happier that this (mh, is my life too boring?): I just become a DD!!!!!!! Please join my happiness in this achievement!!

I'd like to thank all the people helped me in my way to Debian, both for a long and fruitful collaboration or for just a mail exchange, both for kind people and rude ones (ah, we all have our own character, so never mind :) ) and in doing this I'm sure I'll forget someone (so please excuse me for this, you're in my mind tough): so thank you Tony, Bernd, Piotr, Thomas, Vincent, Adeodato, Lucas, Luk, Sune, Joerg (yeah, I'm brave :) ), Paul, and many others!

Of course, congrats go also to my other colleagues that "laureate" with me in Mid September DD Class :D

A few years ago, Terah and I got to visit the beautifully-restored Kansas City Union Station. What a sight. A train station designed to hold 200,000 people, and saw over 200 trains pass through in its heyday. So many people had stories of traveling through Union Station, of arranging to meet someone under the station's iconic giant clock. Maybe they were meeting a husband or wife back from a long trip or fighting in a war, or maybe they were meeting a relative they hadn't seen for years. Walking through Union Station one quiet evening, you can almost hear all the activity still there. Taking the train there, walking in through Amtrak's small boarding area, then stepping out into the dazzling expanse of the station is quite the experience too. It wasn't just a static relic; it was a true piece of history that we can feel.

Decades ago, one of the busiest airports in the country was in Wichita, Kansas. At its peak, the Wichita Municipal Airport saw a flight land or take off every 90 seconds. Its beautiful art deco terminal saw off many an excited traveler. From the Wichita Municipal Airport, you could see buildings owned by Boeing, could drive a minute or two and see Cessna, and other major aircraft manufacturers were also in Wichita. The airport saw many cutting-edge flights, perhaps thanks in part to this. Movie stars were known to fly through Wichita frequently. And Wichita was part of one of the first cross-country air travel routes, New York to Los Angeles, which then took "only" 48 hours. Due to lack of radios and lighted runways, people would fly during the day and ride onboard a train at night to minimize travel time.

Due to an incredible fluke of history, the Wichita Municipal Airport terminal building and control tower still stand. I've never been in an airport that still feels like the 1940s. Other great airports of the era have continued to expand, grow, and generally be replaced as demands for jet service rendered them obsolete and unusable for air service.

You can walk into the building and stand on the main floor lobby (see photos) where people once waited to catch their flight. You can walk down the single departure gate to the tarmac. Obviously we were witnessing a different era -- one in which planes carried only a few passengers each, not the hundreds that they carry today. Three to five planes would line up, and you would simply walk to yours and walk on up and into it. The control tower, a new addition in 1941, still has the high-powered red and green lights that were used to signal airplanes in the days before radio contact was common. The outside of the building has been beautifully restored, but the interior needs a lot of help (and funding) yet. You can still see some areas where the original decorative paintings and tile work survive, but all too many areas have been stripped to the concrete. Outdoors, you can find everything from one of the few surviving B-29s, to some of the earliest small airplanes, to a FedEx jet transport and other quite large planes.

Up in the control tower, they have a radio tuned to air traffic control frequencies. You can hear aircraft being routed to various Wichita airports. On the counter sit several photo albums. As you look down on the ground where historic airplanes sit, you see photos of airplanes lined up, ready to receive passengers. In this building, too, you can really feel the history.

Volunteers were all over. They were all eager to share about the building, the planes, everything they knew. One of the people working on the restoration of the B-29 saw us approaching, and excitedly asked, "Would you like a tour?" Of course!

Though you don't really see 1940s airports anymore, this situation was unique. In 1951, the United States Air Force announced plans to seize the airport and use it to establish an air force base in Wichita. They intended to do so within three weeks. Due to much legal wrangling, including a landmark court case in which the Air Force was forced to honor a contract it had signed with the City of Wichita, the Air Force couldn't quite kick everyone out until 1954, when a new airport in Wichita was completed.

Between 1954 and 1984, the building was an office used by the Air Force. It was abandoned between 1984 and 1991, when the City of Wichita purchased it for use as a museum.

Despite years of neglect, it still stands as a grand old airport. Standing in the airport today, you can see the sign for the Boeing Co. off in the distance, the runways in the other direction, and excited people scurrying about. In a way, it's the same scene that you would have seen 60 years ago -- though nobody was wearing a suit.

The one problem I have with my server at home now seems to have a fix.

The server has a standard encrypted root, as configured by debian-installer. The issue with this is that after booting I need to go to the console and enter the LUKS password. As I do almost everything remotely this is a pain.

However C'T published a nice article a while ago on how to solve this. The short story is that you install a custom initrd plugin that starts dropbear and waits for the password on the console or via ssh.

Now to install and test this...

Another point release for Etch has been done; now it's the time for the CD team to roll out new images after the next mirror pulse. The official announcements (prepared by Alexander Reichle-Schmehl, thanks!) will follow shortly afterwards. FTP master of the day was Joerg Jaspert, who did his first point release since Woody, as he told us on IRC. We appreciate your work and you spending your time that shortly before going to Argentina. This point release includes the etchnhalf update introducing a new kernel image (based on 2.6.24) and some driver updates. Additionally the infamous openssl hole will be fixed for good, even for new installs. Again I want to present you a list of people who contributed to this release. It cannot be complete as I got the information out of the Changed-by fields of the uploads.

• akira yamada
• Alexander Sack
• Alexander Schmehl
• A Mennucc1
• Andrea De Iacovo
• Andres Salomon
• Aurelien Jarno
• Charles Plessy
• Christian Perrier
• Christian Welzel
• Colin Watson
• dann frazier (indefatigable kernel worker, most sourceful uploads)
• Darren Salt
• Devin Carraway (3rd place of sourceful uploads, due to security work)
• Emmanuel Lacour
• Eric Dorland
• Fabio Tranchitella
• Faidon Liambotis
• Fathi Boudra
• Florian Weimer
• Francesco Paolo Lovergine
• Francois Marier
• Frank Lichtenheld
• Frans Pop (thanks for your d-i work!)
• Frederic Peters
• Gregory Colpart
• Holger Levsen
• Jan Wagner
• Jay Berkenbilt
• J r my Bobbio
• Joey Hess
• Joey Schulze
• Josselin Mouette
• Julien Cristau
• Kai Hendry
• Kurt Roeckx
• LaMont Jones
• Laszlo Boszormenyi
• Martin Pitt
• maximilian attems
• Michael Biebl
• Michael Koch
• Mike Hommey
• Moritz Muehlenhoff
• Noah Meyerhans
• Ola Lundqvist
• Otavio Salvador
• Patrick Matth i
• Petter Reinholdtsen
• Philipp Kern
• Pierre Habouzit
• Raphael Hertzog
• Rene Engelhard
• Robert Millan
• Roberto Lumbreras
• Roland Mas
• Romain Beauxis
• Russ Allbery
• Sean Finney
• Stefan Fritsch
• Steffen Joeris
• Stephen Gran
• Steve Kemp
• Sune Vuorela
• Thijs Kinkhorst (2nd place of sourceful uploads, due to security work)
• Thomas Viehmann
• Toni Mueller
• Tzafrir Cohen

From the Release Team we had dann frazier (who drove the important kernel part of etchnhalf), Luk Claes, Neil McGovern, Andreas Barth, Martin Zobel-Helas and me working on it. ;-)

Congratulations, Luk, on your new position as the Debian project's maintainer! Now you can fix the bugs in all of our packages! It's a huge job, which presumably is why Slashdot has given you an extra E to help out. Or maybe that's just for plausible deniability....

Even though the Debian installer can set up encrypted partitions, it is optimised for systems with a single data partition, unless you want to enter multiple passphrases when the system boots. The installer configures a LUKS volume using cryptsetup, but it provides no mechanism for the use of key files, only interactive passphrases. I like partitioning my disks and use different filesystems for /tmp, /home, /var, and /usr/local for a number of reasons. I don t like entering more passphrases than necessary. If you can identify with that, the following is for you.

Installing the system The first step to setting up an encrypted Debian system is to perform a normal Debian system installation. When you are asked to partition your harddrive and create filesystems, set up all partitions as encrypted volumes (I suggest to go with the installer defaults and use dm-crypt and AES with the default settings, simply because I have no reason to doubt the installer dveeloper team s choices). Make sure to erase the disks in the process the installer has an option for that. Set up the swap partition as an encrypted volume too, but don t worry too much about the settings at this point; we will recreate the swap partition later. Unless you want to boot off an external medium, such as a USB stick, you will need to create an unencrypted partition for /boot. I will return to this topic, which has security implications, further down. The installer will ask you for passphrases for each of the volumes you create. I suggest you pick a secure passphrase for the root volume (/), but simple passphrases for all the other ones (such as a ), since we will reconfigure them to use key files instead.

Using key files A key file is like a passphrase stored in a file on disk; as opposed to what you know , it s a what you have security asset. Thus, you need to store the file somewhere. When I boot up my system, I unlock the root partition with a passphrase entered interactively, which makes the root filesystem available. I store key files for all other volumes in /etc/keys. Obviously, I need to tell cryptsetup to use those. The first step is to create a key file for each partition and to add it as a decryption key to the LUKS volume. You can do all of the following without unmounting the filesystems. See the following example for hda6, which will prompt for the simple passphrase we entered above to unlock the key ring when adding the key file:

umask 077
mkdir /etc/keys
dd if=/dev/urandom of=/etc/keys/hda6.luks bs=4k count=1
cryptsetup luksAddKey /dev/hda6 /etc/keys/hda6.luks
cryptsetup luksKillSlot /dev/hda6 0 --key-file /etc/keys/hda6.luks

The last command wipes the simple passphrase from the key ring and thus makes it unusable. Now we need to tell cryptsetup to use the key file by editing /etc/crypttab and ensuring a line such as the following exists:

hda6_crypt /dev/hda6 /etc/keys/hda6.luks luks

This tells cryptsetup to create the cryptographic volume hda6_crypt from the base device /dev/hda6, using the key file we created above, and letting it know that it s dealing with a LUKS volume. Repeat this for every partition except your root and swap partitions.

Encrypting the swap partition If you are using an encrypted Debian system, you likely have some security requirements to meet. If that s the case, you must also use an encrypted swap partition. The swap partition can be encrypted in two ways:

• it can be recreated on every boot, using a random passphrase, or
• it can be created like the other encrypted volumes with a persistent passphrase

If you want to use suspend-to-disk, you cannot use the first approach as it would overwrite your memory footprint stored in the swap partition. Furthermore, you cannot use a key file like the other partitions, since the root filesystem is not (and must not) be mounted by the time the resume process starts and needs to read the decrypted swap partition. The way I solved this is by telling cryptsetup to compute the passphrase of the swap partition from the decryption key of the volume holding the root filesystem; the cryptsetup package implements this with /lib/cryptsetup/scripts/decrypt_derived. Thus, to set up the swap partition, I do the following, assuming hda2 is the partition holding the encrypted swap and the root filesystem is in hda5_crypt:

swapoff /dev/mapper/hda2_crypt
cryptsetup luksClose hda2_crypt
dd if=/dev/urandom of=/dev/hda2
/lib/cryptsetup/scripts/decrypt_derived hda5_crypt \
    cryptsetup luksFormat /dev/hda2 --key-file -
/lib/cryptsetup/scripts/decrypt_derived hda5_crypt \
    cryptsetup luksOpen /dev/hda2 hda2_crypt --key-file -
mkswap /dev/mapper/hda2_crypt

To tell the system about this swap partition, we need to add it to /etc/crypttab and /etc/fstab; make sure, those files contain lines like the following:

/etc/crypttab:
  hda2_crypt /dev/hda2 hda5_crypt luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
/etc/fstab:
  /dev/mapper/hda2_crypt swap swap sw 0 0

With this in place, as soon as you configure the system for suspend-to-disk, the swap partition will be automatically set up alongside the root filesystem very early during the boot sequence. To figure out which swap partition to make available at that point, cryptsetup checks the following:

• a line like RESUME=/dev/mapper/hda2_crypt in /etc/initramfs-tools/conf.d/resume
• a resume device setting in /etc/uswsusp.conf (see uswsusp.conf(5))
• an entry in /etc/suspend.conf
• a resume=/dev/mapper/hda2_crypt in the kernel command line

You can inspect /usr/share/initramfs-tools/hooks/cryptroot if you want to know more about this.

Using UUIDs Even though the above is all you have to do, you might want to consider replacing the device paths in /etc/crypttab with persistent ones. One motivation might be the ability to boot off your drive via a USB adapter, which might cause it to appear as /dev/sda instead of /dev/hda. udev is installed by default on Debian systems and it makes persistent links to partitions available under /dev/disk/by-uuid, using the UUID of the content structure (e.g. the LUKS header). It uses /lib/udev/vol_id to determine those link names. If you replace the entries in /etc/crypttab, make sure to update the initramfs (update-initramfs -u -k all) and consider to use the same approach for the /boot filesystem in /etc/fstab; you ll note that all other filesystems use persistent device paths thanks to the dm-crypt layer. If you ever end up booting off the disk through a USB adapter, you might face the problem where the usb_storage subsystem takes too long to activate, so that the cryptsetup script does not find the devices in time. You can either solve this by adding the rootdelay=x parameter or break=mount to the kernel command line. The first will cause the scripts to wait x seconds before trying to configure and mount the root filesystem; the second would give you a shell that you can exit as soon as the kernel spouted its device initialisation messages at you. If you got this far, you might even want to take it further and replace hda5_crypt with cr_root or the like to abstract those silly partition numbers away even further. This is easier than it sounds, but does require several steps. Do not do this if you re not comfortable reviving your system in case it fails to come back up!

1. replace the old names with the new names in /etc/crypttab for all volumes except the root volume. If you are using a derived passphrase for the swap partition, make sure to put the new name for the root volume into the third column of the swap partition s configuration line.
2. modify /etc/fstab accordingly, leave the root filesystem s device path alone.
3. call update-initramfs -u
4. modify your bootloader to ask the kernel to boot off the new root volume.
5. replace the root volume s old name with the new one in /etc/fstab.
6. reboot, and add break=mount to the kernel command line.
7. at the busybox prompt, edit (vi) /conf/conf.d/cryptroot and change the first field of the root volume s line to the new name.
8. exit the shell and watch the boot process complete.
9. finally, replace the root volume s old name with the new one in /etc/crypttab.

If the system fails to boot up again, you can use the backup initial ramdisk, which update-initramfs left in /boot.

Security implications Apart from the usual security implications related to cryptosystems, passphrases, mathematics, user stupidity, and so on, the approach I outlined will leave you with a pretty well-secured system. Obviously, you should make sure to lock your screen whenever you leave the system unattended or the entire encryption is basically useless. There are two attack vectors on your system, both involving physical access to the machine:

• theft of the machine or its RAM chip, freezing the latter, and scanning the working memory for the passphrase
• manipulation of the kernel or initramfs stored on the (unencrypted) /boot filesystem, in such a way as to obtain the passphrase. To do this, you would have to have access to my machine and return it to me without me noticing; once I restart and enter the passphrase, you d have to steal it again

Other than that, you should be careful when travelling to totalitarian countries, like the Excited States of America, China, and probably the UK. First off, encryption arouses suspicion, and second, border agents might ask you to decrypt the partitions for them to copy or scan, and refusal to do so might get your turned away at the border. When travelling to those countries, make sure to hide your data properly.

Speed implications Obviously, having your entire system encrypted (including swap) will slow it down. I don t have any quantitative information on that, but after several years of using full-disk encryption on my laptop (an X40, which isn t very powerful), I can say that it remains usable, if you don t rely on disk-intensive operations, such as compiling kernels and the like.

Alternative approaches Several alternative approaches exist, all involving an additional device:

• if you don t like to type in the passphrase for the root filesystem, you could store it on a USB key (or the like); cryptsetup provides /lib/cryptsetup/scripts/passdev, which can be used to deal with such a situation. You can find more information in cryptsetup s README.Debian file.
• if you don t like the unencrypted /boot partition, you could boot the system off a USB key, which you can keep separate from the system except for when booting and upgrading the kernel. All you need to do for that is install the bootloader and kernel onto the device and configure it to use the proper encryption volume on the harddisk as root filesystem.
• cryptsetup also comes with support for PKCS#15 smartcards (opensc and openct).

I have chosen neither of these approaches, because the extra security does not make up for the inconvenience, and the danger of an unbootable system in case of loss of forgetting of the additional device.

How to resize a luks partition After things-not-to-do.mdwn I want to be careful when resizing a luks partition: here's a note with the right procedure. As explained in this bug report, the way to resize a luks partition is:

# lvresize -L+100M /dev/vg00/test 
  Extending logical volume test to 400.00 MB
  Logical volume test successfully resized
# cryptsetup resize test1 
# resize2fs /dev/mapper/test1

OCaml 3.10.2 meets Lenny As per title: OCaml 3.10.2 (... and friends of course) today has entered testing, as such it will be released with Debian Lenny. Yay. This transition was the second binNMU-based and went flawlessly (while the first one was hit by a bug in the script generating binNMU/dep-wait requests automatically). This way transitions are way easier to handle, and would probably be real PITAs now that we have about 120 OCaml-related source packages to care about. Kudos to all who helped, Luk -release side, and the other fellow Debian camlers.

Catching up: some OCaml in Debian news Hei, it looks like I stopped giving updates about OCaml news in Debian, time to catch up. 2 hot news basically:

1. OCaml 3.10.2 transition is ongoing. Release managers did not forget about our old request of transitioning OCaml to 3.10.2 in time for Lenny, and as soon as the last Perl transition was other they pinged us about the transition. Together with Luk we are now working on it. After some initial issues on arm which was unable to run docbook2html on our poor little policy document without segfaulting(!), it now looks like is not going too bad ... get ready for OCaml 3.10.2 in Debian Lenny!
2. the "core" OCaml library by Jane St Capital (which I consider a really good replacement for the legacy standard library FWIW) has entered testing a few days ago. It will be released with Debian Lenny, no matter if with 3.10.1 or 3.10.2

Stay tuned!

Laptops are easily lost or stolen and in order to protect your emails, web passwords, encryption keys, etc., you should really think about encrypting (at least) your home directory.

If you happen to have /home on a separate partition already (/dev/hda5 in this example), then it's a really easy process:

1. Copy your home directory to a temporary directory on a different partition:
   

   mkdir /homebackup
   cp -a /home/* /homebackup

2. Encrypt your home partition:
   

   umount /home
   cryptsetup -h sha256 -c aes-cbc-essiv:sha256 -s 256 luksFormat /dev/hda5
   cryptsetup luksOpen /dev/hda5 chome
   mkfs.ext3 -m 0 /dev/mapper/chome

3. Add this line to /etc/crypttab:
   

   chome    /dev/hda5    none    luks,timeout=30

4. Set the home partition to this in /etc/fstab:
   

   /dev/mapper/chome /home ext3 nodev,nosuid,relatime 0 2

5. Copy your home data back into the encrypted partition:
   

   mount /home
   cp -a /homebackup/* /home
   rm -rf /homebackup

That's it. Now to fully secure your laptop against theft, you should think about an encrypted backup strategy for your data...

I usually don't like me too comments... But this is something that really disappoints me of my otherwise-favorite development framework. I must echo Matt Palmer's comment on Luke Kanies' entry:
Ruby. Has. A. Distribution. Problem.
Nice, good read. Sadly, many Rails pushers see distributability as something very minor, something that should not worry Rails developers right now, as there is too much other serious work to be done - Better UTF8, a clearer language, better performance... And besides, any programmer can live well with gems. (yes, that's all taken from a rant I had with a very convinced person)
My gripe is that... Rails is no longer a small, fringe project. Rails is an enterprise-grade development framework, with thousands of deployed production systems. And if they don't start to act responsably, if the Rails developers keep pushing said problems as low-priority, the Rails developers' (that is, their users) culture will become rigid - and will constitute a serious harm to Rails' future.
Distributability and packageability is not only for OS distributors. Not only we Debian zealots care about software being easily packageable. By using Ruby Gems, you dramatically increase entropy and harm your systems' security.
Read Luke's text for more details. It is quite worth the time.