(tl;dr: if you have a few minutes, please add information here) Joss, the problem with the new package formats is that there is nothing that actually uses the additional information in a way that adds significant new functionality, so the net result of the change was that we throw away the information at a different layer in our software stack, and one of the interfaces got a lot more complicated in the process. One possible application would be a "poor man's patch tracking" inside the BTS, perhaps with a new state "fixed in patch". I can see two ways of implementing that:

1. by extending the interface of the "new" package formats that Debian,Ubuntu bug numbers are attached to the actual patch files and having the archive maintenance software extract and process that information (reject packages that add a patch for a bug without closing it in the changelog, notify the BTS), or
2. by leaving the package format untouched and simply adding a regex matching "Fixes: #nnnnnn" that is reported to the BTS as "we have added a patch", so the submitter is notified that the bug is gone for him/her; the bug is then closed in the changelog of the upload removing the patch.

The former approach also allows us to link to patches from BTS pages, which the latter doesn't, so there could be actual benefit here if we believe it is worth the additional complexity. (Update: Rapha l thinks it is. I like the idea of a package format with separate patches a lot more in this context than I did without it, but still my fear that it will actually be perceived as sanctioning large patchsets still remains.) About mandatory co-maintenance: the problem isn't "helping". We have plenty of people with commit access to packages they don't even remotely understand who are really helpful (not). The problem is that someone needs to actually read all the commit logs and understand what the changes do in this context. In most cases, that person or group would be upstream, not a DD. My first impression after reading the patch was "adding uninitialized data to the entropy pool is pointless/harmful as it is not random, so this patch makes sense", because the loop around it was not contained in the patch. Obviously I'm not an OpenSSL developer. There is nothing Debian could have done internally to verify the correctness of this patch that would properly scale to the entire archive, even if we put "more emphasis on security". The only solution I see is reporting every patch to upstream immediately and getting affirmation that it is correct. This, however means that we need to produce patches that upstream can accept. For obvious code bugs, that is simple, but for integration patches like paths it is not sufficient to replace one string with another, but rather make it configurable in some place that can be reached from debian/rules. In an ideal world, we end up with very few Debian specific patches, so essentially we are talking about adding functionality to dpkg that we don't want to use. I've started a page in the Debian Wiki, Getting Packaged with an outline of a possible document aimed at upstream developers that should list the typical problems we run into and how to avoid them.

There is an article on TechCrunch on Windows on the OLPC. This article started out as a comment below lots of comments that were missing the point, but eventually grew too large. The entire discussion circles around the question whether it would be beneficial to give the users the same view and behaviour that is on 90% of machines worldwide, so they can start out prospective jobs with a minimum of training. Learning your way around the UI is only a significant part of training if that actual work you will do is trivial — so this argument basically boils down to "I don't expect the African kids to do anything but grunt work during their lifetime anyway, so we better start training them early", which is the wrong approach not only to education. To make a bad car analogy, roads are usually made of several layers, from the foundation providing the stability up to the paint defining lanes. Operating systems are similarly layered, with a core that applications (cars) never touch directly, and several other layers on top of that that are not really required for basic functionality, but that add safety (process separation) or comfort (standard functions). The minimum standard of things is a "platform definition", which all car (or application) makers can expect — all roads have a minimum width and there are no dangerous spikes (if that is not true, you can get a steamroller or respectively format your harddisk). Railways use the same kind of foundation (operating system), but the platform (heh) is quite different. You cannot drive a car on a railway, or a train on a road, just as you cannot run a Windows application on a Linux system or vice versa (there are special wagons you can place your car on, and special trucks with rails on them if you feel like it, but these are heavier and need more energy to pull). Now in this discussion, people have been comparing Windows (the platform) to Linux (the operating system). That doesn't work. On Linux, there are several platforms available, the most prominent being GNOME and KDE for the desktop and POSIX utilities on the command line, but there are lots of others as well. Part of most platform definitions is an user interface, which abstracts what is really happening to something comprehensible to the user, using analogies (a tachometer displays our speed as an angle usually, but other representations are possible). The "desktop" idiom happened to be the first graphical UI some thirty years back, and was perpetuated into today's computers (just like the width of roads hasn't changed from the days of the Roman empire, where it was "two horses and then some"), however this doesn't mean it is the best choice available — it's just what we are used to. If you look at the screen contents on the day traders' computers (lots of that on the TV right now thanks to the market crisis), you will notice the vast majority does not use overlapping windows or standardized "rising-edge" buttons to click on, but rather, they have a tightly-packed grid layout with high-contrast information displays that also color-code certain messages. I think that is the most important point here: to achieve optimal results, the presentation idiom needs to be chosen in a task specific way. With children as the target audience, we lose one of the key requirements behind the adoption of the windowed view: the need for side-by-side presentation of data from multiple unrelated sources (which is also a problem given the lack of screen space). With the introduction of ad-hoc mesh networking and collaborative applications, the "desktop" analogy begins to break down. The project's mission also defines requirements on the platform. If we want to keep the requirement "users should be able to build and share their own stuff", then we want a framework where it is hard to make mistakes, especially those that can be spotted only after an interesting failure, and more importantly impossible to write code that makes unrelated components fail, because these components might be your way back out of the situation. Windows has an excellent event model with fairly good isolation of components (to the point where a problem in an event handler can be handled by the event loop rather than terminating the program, so for example Internet Explorer can shut down broken plugins rather than crashing), but the detail knowledge required to really work with the API (how to build a message loop that also runs queued I/O completion handlers correctly) leads to a fairly steep learning curve, and would teach implementation details rather than concepts. The normal "linuxy" approach of going low level whenever higher-level approaches fail is not the answer either as we want to truly empower people rather than just training them to be a cheap replacement for the tech support Indians (no offence), so it is vital that the "real" applications use the same framework that people implementing new things would use, and thus all the complexity that we want in our "official" applications needs to be taken care of by the platform, with all the safety features in place too. So no existing platform provides what we want. — hence Sugar. And that is the problem for Windows advocates: Sugar replaces those bits that make Windows a platform and not just a kernel, so porting Sugar to Windows doesn't make sense from a technical point of view, since we already replaced the bits that we didn't have free software for before. Other than that, the "Linux vs. Windows" kernel choice is secondary; in fact both kernels are very similar in design and function, the various advantages and disadvantages of either aren't that relevant really. The only technical reason in favour of Linux is the virtual memory management — the Windows VMM behaves erratically in the absence of a swap device, but I believe that is not something that cannot be fixed. The reason why I believe Linux is the better choice here is long-term support. Since these devices will be used in basic education (which hasn't changed that much in the past years as 1 plus 1 still equals 2), there is hardly any need for radical changes after the initial rollout — why add instability when you don't have to? With Microsoft as a for-profit company, there needs to be a business model sustaining that behind it, and I believe it will be very hard to find one. "Subscription" falls down in that it is a long-term recurring expense, which governments tend to be pretty wary of. The alternative is to upgrade several million computers' OS every few years. Lots of companies are skipping entire Windows releases because of the migration cost, and even with the "console bonus" (all hardware is the same) and bootloader support for software upgrades over a mesh network, this is still a massive endeavour. That each machine would have to reserve enough memory for the entire "upgrade pack" so it can transition "in one go" also makes this model unworkable. To summarize, using Windows on the OLPC does not make sense at all. If you use just the kernel, you don't gain anything over Linux, and if you use the entire platform (and by extension, the UI), you add unnecessary complexity that is not only not required for the actual task, but also distracting. If you add restrictions and extensions to make it work, you invent a new platform, which is precisely what Sugar did. The argument that it is important for pupils to use the same thing that the rest of the world is using to ease their entry into the workforce is bogus at best, and racist at worst.

After recent not so funny thing with OpenSSL in Debian, I realized that I will have to regenerate most of keys and certificates, because last big changes I did in networking/vpn/ssh setup which involved generating keys are not older than broken OpenSSL appeared in archives. First obvious thing was SSH keys and cleanup of ~/.ssh/authorized_keys on all hosts. While doing that, I realized that I still have there several keys, which are more or less gone (not that I'd lost them, but I simply stopped to use them). So it was good opportunity to do cleanup here. While I was at these changes, cleaning up ~/.ssh/known_hosts was also good idea, because I still had there lot of hosts I collected during some of my previous jobs and I definitely won't (and can not) access these machines anymore. So good, big cleanup in SSH configuration was forced :-). Next and harder step was to found out where else I use certificates generated by vulnerable OpenSSL. Server certificates for sure were also generated by OpenSSL, so let's regenerate web and email certificates and hope I did not miss anything. All this happened yesterday, but today I realized that I missed other even more important thing - OpenVPN certificates. While regenerating certificates, I also found some machine keys which are not really used anymore, so I again could drop some of them. So that was task for this evening and now I'm hopefully really done with this issue and I really hope that this won't happen again in near future, I don't need to cleanup that often ;-).

Eric, I cann’t claim to 100% understand the situation but after glancing trough the logs of the discussions and of the patches the conclusion I came to was this - OpenSSL used supposed randomness of the uninitialized memory as an added source of entropy (interesting hack, but not an example of good coding as such). Valgring caught that problem and the Debian maintainer during a cleanup fixed it. Making such a fix can be considered a preventive step against possible attack vectors by poisoning the uninitialized memory. He took it up to upstream, they did not raise red flags, but did not quite merge the ‘clean up’ patch either. It fell through the cracks. The problem is that in the same file, in another function all other sources of entropy were being merged into the pool of randomness using exactly the same code line as the one code line flagged by Valgrind. The maintainer assumed that the second code line has a similar function to the first and commented that one as well. AFAIK that also did not show up in the emails to the upstream list. So we have:

• Upstream using clever hacks that rely on uninitialized memory having some randomness to it
• Upstream using same code and same variable names to describe different things
• Upstream having no comments in the code explaining the two things above
• Maintainer slightly over-generalizing a change
• A bug slipping trough the cracks in the review processes
• Another Debian Developer discovering the bug and recognizing its significance despite all of the above
• Debian project coming out and admitting all of the above and scrambling to get fixes out to its users ASAP

I am impressed by the swift action of the people involved in fixing this. And while I think everyone can find some lesson be learned here, I think this is another good example of free software in action. And I hope that in the aftermath of this we will find ways to prevent this from happening in the future without stifling our progress.

I've read some more about this and especially had a look at some of the source code, so I've completely revised this blog post.There is no doubt that the Debian Maintainer who added this patch screwed up, seriously. But he's not the only one to blame:

• OpenSSL isn't valgrind-clean. It should be made, since valgrind is a very important debugging tool; the bad patch was introduced to make OpenSSL better in this respect due to the request by the users.
• The OpenSSL source code could be better documented in these places.
• There are two instances of this line in OpenSSL which can both generate the 'using uninitialized data' warning. One is safe to remove (it's supposed to fill the buffer with random data, and just uses the existing contents as additional source of randomness), the other is not (it's used to feed randomness coming from e.g. /dev/random into the pool).
• The Debian maintainer received the reply "if it helps with debugging, I'm in favour of removing them" by one of the current OpenSSL devs on the openssl-dev mailing list. Probably just referring to the 'safe one' of the two locations where this occurs, though?
• Nobody noticed the severity of this change for more than 2 years. We're all to blame.

I'm really sick of hearing comments like "Still, whoever took out the entire initialization should not be trusted with security intensive code." (guest comment on LWN). Yes, he screwed up there. But you bet he's going to be a lot more careful with any change in the future: he has learned his lesson. Better than having someone else screw up in a similar way again. And actually he didn't do this change half as easy-hearted as many people suggest, if you look at the discussions on the bug report and mailing lists. He was trying to fix the valgrind bug, and he talked to several people on how to do it properly.The best way the bug could have been avoided was if the OpenSSL upstream developers had cared more about the valgrind issue themselves. (E.g. by teaching valgrind to ignore the issue, documenting in the source code why this is intentional and not an issue, ...)P.S. in the previous version of this blog post I had asked why OpenSSL apparently relies on uninitialized data for security. It doesn't; the same lines exist in two places, and it's the other change that caused the problems. One place will 'usually' generate the warning, and it's not important (that's the place where you could just remove the line). The other place will generate the same warning when someone passes uninitialized data into the RNG. As long as the RNG is sufficiently seeded with other random data that isn't much of a problem. So if you take a buffer of 1024 bytes and fill it with 1000 bytes of good random data (e.g. from a hardware randomness source) and feed the whole buffer to the RNG, it will be seeded quite well, but the warning will be generated. The 24 uninitizialized bytes won't take the entropy away.(This blog does intentionally not have a comment function. Sorry.)

A little off-topic exercise conducted in the "eye of the storm", when Ilenia and Helen were still in the hospital: A post on Seth Robert's blog brings up the idea that many Chinese restaurants were opened as a way to go into business without competing with native male workers. The post made the rounds of several other online journals. That was the push I needed to get up and go collect a few statistics of my own, regarding an idea I've been kicking around for a while. My theory is that the number of restaurants of a given type, divided by the number of immigrants from that country might be an interesting way of guaging the popularity of the cuisine in question. In order to simplify things just a bit, I actually used data from Italy, for the following reasons:

• Most immigration to Italy is pretty recent, so it's not necessary to account for the length of time different immigrant groups have been present, and the effects that may have had on the diffusion of a given cuisine.
• Immigration statistics were readily available: http://demo.istat.it/str2006/index.html
• Italian the language almost completely corresponds to Italy the country (outside of a chunk of Switzerland, San Marino, and the Vatican), something that makes things that much easier.
• I speak Italian, so it was easy to find out all the information I needed

Unfortunately, finding out the number of restaurants of various types is far from an exact measurement, and since this is a quick fun project, I just went for Yahoo search (they deserve credit for keeping their search API open when Google's was closed) results on terms like "Ristorante Turco" (Turkish), "Ristorante Messicano" (Mexican), and so on. This was the most expedient means of gathering information quickly, but this approach does present a number of obvious problems, listed here in the hope that someone without diapers to change and a business to run might come up with some good answers:

• Some hits likely come from people talking about a restaurant that happens to be in a country, like "ristorante americano". "Nel tipico ristorante americano, ...." or in other words, "In a typical American restaurant", rather than an American-style restaurant in Italy, which is what we were looking for in the first place. This is probably also true of countries close to Italy, where people go on vacation and thus have occasion to write about their experiences in a "ristorante tedesco" (German), rather than going to eat in a German restaurant in Italy. Perhaps the search query could be improved in an attempt to eliminate this sort of false positive.
• Some restaurants probably are not known as, nor brand themselves with a country name, but instead utilize titles like "Middle Eastern", "Arab", "South American", "African", or others that do not correspond with any one country in particular. It would be possible to group countries together with other adjectives, and get statistics for these clusters as well.
• Measuring hits is measuring what people are talking about, rather than simply restaurants that exist, so if restaurants from a certain country are more talked about than others, that would muddy the statistics a bit. However, it seems reasonable that people would mostly talk about restaurants in proportion to their popularity, and I don't see a particular reason why there would be more talk of Vietnamese restaurants, say, than Thai restaurants, compared to the actual numbers.

That said, for a quick project, this approach seemed to work out ok, and the results appear credible. Obviously, the results also reflect people discussing certain cuisines, rather than an actual number of restaurants, but since it does reflect interest, we'll use the number in any case. Since the number of restaurants/interest in a type of restaurant was clearly not correlated directly with the number of immigrants, other factors must come into play. For instance, "ristorante giapponese" turns up 125,000 hits, but the stats say only 6873 Japanese nationals live in Italy. As above, hits don't mean actual restaurants, but clearly Japanese cuisine is not being popularized through immigration. Here's my guess: these statistics show, to some degree, what people in the host country actually like to eat. Food that tastes good means more restaurants. Things that aren't that popular mean few restaurants, even if there are many immigrants. To pick on one country, there are many Philippino immigrants in Italy, but very few search hits - and anecdotally, I've never seen a Philippino restaurant in Italy either, whereas even smaller towns like Padova have Chinese, Mexican (well, it's called that, even if it's a shadow of the real thing), Japanese, various Arab and middle eastern restaurants, and even a few less common things like Eritrean. And I know that many native and foreign restaurants employ Philippino cooks. Below is the chart I whipped up showing the number of Yahoo hits per immigrant. The Italian names shouldn't be too hard to figure out. A few tricky ones: Giordano-Jordanian, Giamaicano-Jamaican, Spagnolo-Spanish. If you're interested in numbers or source code, contact me.

Imagine, for a moment, that you are a young man in your 20s, trying to make your way in the world. You are married and have a young daughter, just old enough to start to talk. You live in a run-down neighborhood, long passed-over by any economic advances. What schools you had access to barely taught anyone much. The few jobs you can reach have fierce competition, even though the pay is low. You worry about your health, but even more about that of your wife and child. Finding food is a constant concern. Although you are still healthy now, and you are willing and able to be a hard worker, there is simply nobody hiring people in your area. Not to mention the gunfights that erupt between gangs or drug dealers. Oh, and did I mention that your wife is 4 months pregnant?

Your top priority is to do your best to keep your family safe. You're afraid that your whole family will starve, or be killed by an errant bullet. You've tried for a long time -- it seems like forever -- to do everything you can think of, with no success. Finally, you decide that the only way you can have the hope for a better life is to move somewhere where the economy is better, and the drug dealers are fewer.

But moving hundreds or thousands of miles away is no easy task when you have no money to move. Somehow, with some luck, ingenuity, and tenacity, you have finally managed to find a way. You have no job offer in your new town, but conditions are so bleak at home that you just can't risk staying there. So the three of you move 1500 miles away.

You arrive with no money, no apartment, and don't know anybody. But you're a hard worker, and have talked yourself into a job. It pays what passes for minimum wage in your new home, but it's a fortune compared to what you made before. It's backbreaking work, and you work long hours. But soon you can afford a cramped apartment, and keep your refrigerator stocked with food. What a luxury!

Pretty soon your new baby son is born. You can afford to feed him, your daughter, your wife, and yourself, every day. When you're really lucky, you even have some money left over to send to your brother back home, who is still struggling to make ends meet there. You seem to have climbed the first rung on the American Dream ladder.

Years pass. Your old home becomes a memory; your daily life revolves around new struggles now. Your oldest child is in school, your wife finds part-time work sometimes too, cleaning houses for rich people. You've been laid off several times, your income isn't guaranteed, and the others in your new home don't take kindly to strangers -- and they still think you're one. But it's better than flying bullets and never knowing where your next meal will come from.

Then one day, while you are at work, federal agents show up. You are arrested and taken to jail. Agents show up at home, too, arresting your wife. It turns out that they realized you entered the country illegally from Ecuador those years ago. Meanwhile, your wife wonders what will happen to your son that was playing in a neighbor's yard while she was arrested, or to your daugther that was at school.

After months in jail, with little contact with each other, and poor medical care, the government decides to deport you to Mexico. Why Mexico? Well, it's cheaper, and there's no documentation showing where you came from. Apparently you "look" Mexican, and they don't believe your story.

After months in jail with no income, you are once again bankrupt. A government bus takes you to Mexico and drops you down someplace there, with your wife and your oldest child. Your younger child was born in the United States, and so is an American citizen and can't be deported. But the government isn't going to give him a free ride on a prison bus (and Mexico wouldn't take him anyway, since everyone knows he's American). You have no idea where he is. You have no idea how you're going to find food in Mexico, no idea how to find your son, no idea where to find refuge from the ever more prevalent drug dealers. Meanwhile, the Americans think you're scum because you wanted to protect your family, and it's going to be much more difficult to get back in to try to reunite your family.

This story is based on true events.

It's truly easy to demonize illegal immigrants, isn't it? Easy to round them up by the thousands, easy to build a bigger fence, easy to lock them away.

Sometimes it seems like this nation built on freedom, supposedly on Christian values, has lost sight of compassion for the lowly. In this country, we would throw in jail parents that didn't do everything humanly possible to find food for their children. We also throw in jail parents that grew up in other countries that are just doing the same.

How sad that we have people going on TV, suggesting we round up millions of Americans that happened to come here illegally, breaking up millions of families, creating an immense foster child problem, a human tragedy on a mass scale. How incredible that some of these people on TV wear the title "senator" or "candidate for president". How stupid do they think we are, suggesting that a poor South American family would somehow be able to navigate the arcane American immigration system and wait the 15 years to get here legally, if they manage to come up with all the necessary money somehow?

Politicians have been pushing our buttons for too long. We aren't a nation of selfish hoarders; we came together through tough times, survived the Depression, put in place the Berlin Airlift that saved countless lives in West Berlin. But the thought of someone with darkish skin coming to this country and building highways is enough to send some people looking for a rifle.

I hope that we will someday do better.

1st of May is in most civilized countries a bank holiday (term that means “if you work for a bank, you dont have to go to work” and is closely similar to a standard holiday). Ireland prides itself for moving the holidays to the morning after, so you can enjoy a long weekend, and did we: rented a car, took off and visited the country side. Well, right after we exchanged seats, since apparently one cannot drive here on the left side of the car. The country is in much better state than the 10 years old Lonely Planet describes: good condition signaled roads and a B&B on every other corner. From Dublin we jumped to Kilkenny were we had a beer (guess which one) and enjoyed a concert on a pub, since they had some festival going on. It also meant we had to stay a bit far from the center. Moving south from Kilkenny we visited Waterford and from there we moved all the way to Cork, for a small visit. Lara lives there, and we had a great chocolate and some food after paying a visit to the cathedral. After deciding not to spend the night in the city we headed towards Old Head. That was a great plan. The view from the cliffs in there is impresive. Pity they have a golf course which will not allow you to reach the tip. One night over in Timoleague, after a beer in the local pub and we headed back to Dublin. A nice relaxing weekend away from the city. The best: sunny countryside, getting away for a while, B&Bs (mostly the second B). The weird: driving on the left, requires loads of concentration not to make mistakes and shifting gears with the left hand is not great. The worst: having to jump from B&B to another one looking for a bed. Also it made it interesting, since we never knew where we were going to end.

Surveillance, massive patent litigation, and toxic trails are just a few of the atrocities that are part and parcel of the global giant Monsanto. They do not just produce a lot of the worlds GE crops but some MAJOR FUD with real muscle as this disturbing in-depth article demonstrates . Whether it is their shadowy, relentless fight against American farmers to “protect” their patents or their fight to scare dairy farmers from labeling their milk BST free, they deploy an astonishing range of legal and extra-legal tactics to make sure they stay on top. Below is a smattering of some of their creepiest tactics, which kinda make the RIAA look angelic in comparison.

“To gather leads, the company maintains an 800 number and encourages farmers to inform on other farmers they think may be engaging in seed piracy. Once Pilot Grove had been targeted, Monsanto sent private investigators into the area. Over a period of months, Monsanto s investigators surreptitiously followed the co-op s employees and customers and videotaped them in fields and going about other activities. At least 17 such surveillance videos were made, according to court records

“Studies by health authorities consistently found elevated levels of PCBs in houses, yards, streams, fields, fish, and other wildlife and in people. In 2003, Monsanto and Solutia entered into a consent decree with the E.P.A. to clean up Anniston. Scores of houses and small businesses were to be razed, tons of contaminated soil dug up and carted off, and streambeds scooped of toxic residue. The cleanup is under way, and it will take years, but some doubt it will ever be completed the job is massive. To settle residents claims, Monsanto has also paid $550 million to 21,000 Anniston residents exposed to PCBs, but many of them continue to live with PCBs in their bodies. Once PCB is absorbed into human tissue, there it forever remains.”

The company contends that advertising by Kleinpeter and other dairies touting their no rBGH milk reflects adversely on Monsanto s product. In a letter to the Federal Trade Commission in February 2007, Monsanto said that, notwithstanding the overwhelming evidence that there is no difference in the milk from cows treated with its product, milk processors persist in claiming on their labels and in advertisements that the use of rBST is somehow harmful, either to cows or to the people who consume milk from rBST-supplemented cows. Monsanto called on the commission to investigate what it called the deceptive advertising and labeling practices of milk processors such as Kleinpeter, accusing them of misleading consumers by falsely claiming that there are health and safety risks associated with milk from rBST-supplemented cows.

Apparently it is a political suicide in USA to make people think. Obama’s ex-preacher Jeremiah Wright is the most sane US preacher that I’ve ever heard. If you read or listen to his sermons in full length and go beyond the Fox News presented soundbites, he is 99% right. The US has long been doing extreme violence to countries around the world, so it is no wonder that such violence came back to US. Russia had the same problem with Afghanistan and Chechnya. If you try to put yourself up as ‘world police’, some people will disagree. Then he damned America’s _government_ for letting Americans down by not caring enough about the people. The only thing that I would smile and shake my head at was the statement that American government invented HIV. I doubt even they have such resources. Read this transcript for example, the sermon is just a great sermon that urges the people think for themselves. And what people put this sermon down for? Using a word ‘Negro’? Having an issue with some specific politicians? He is a pastor, pastors are meant to have a strong opinion a vision and to project that for the congregation to see. “I’m not going to stop thinking just because I love Jesus” is the summary of that sermon if you ask me. And that is the most positive religious message I’ve heard from that side of the pond for a long time. You can agree or disagree with rev. Wright, but you can still go to his sermons and enjoy it because he makes you think. I would talk to most racist bastard, serial killer or even Hitler himself if he could tell me something that would provoke my mind to think and thus improve myself. You don’t have to agree with people to benefit from speaking to them or from listening to what they have to say. Even if someone is 100% wrong and misguided, if his speeches can make you think of some good idea, it is worth it. And rev. Jeremiah Wright is not 100% wrong, from what I’ve heard he is on the money most of the time and only some of his statements I would disagree with. And he is a great speaker. If I would have not been an Obama supporter, I would become one because of Wright. Or because of the very accurate observation by Obama that in hard times people in rural USA cling to trusted values such as guns and religion. There is nothing wrong with that. I am amazed how such true statements can be so turned by US press and can actually reduce Obamas rating. I was starting to believe that not all is lost in the US, but if Obama does not get elected, well … it is all lost in the US. PS. How this related to Debian? Or software is the best choice for the society in the long term. However, that is only true if we assume that people behave rationally and use it, improve it and contribute back improvements for the public good. If the general population is made weary of rational thinking and starts thinking in soundbites and slogans, then there is a ceiling to free software expansion and the whole free software movement can eventually be crushed in the interests of homeland security with strong corporate commercial software backing. (Only government approved software is allowed to run with mandatory government approved back-doors and hardware verification to prevent cyber-terrorism or something, thus also forbidding any compilers and interpreters outside government controls.)

Ubuntu’s audio team has patched my code using a “new approach” to make audacious use Pulse by default! Great right Well, not really, because the way they do it is wrong and won’t work and is prone to breakage with future releases. Here’s the patch:

@DPATCH@
diff -urNad audacious-1.5.0~/src/audacious/main.c audacious-1.5.0/src/audacious/main.c
--- audacious-1.5.0~/src/audacious/main.c       2008-03-13 17:19:27.000000000 -0500
+++ audacious-1.5.0/src/audacious/main.c        2008-03-14 12:38:13.000000000 -0500
@@ -174,7 +174,7 @@
 0.0, 0.0, 0.0, 0.0, 0.0,             /* equalizer bands */
0.0, 0.0, 0.0, 0.0, 0.0 ,
1.2,                        /* GUI scale factor, hardcoded for testing purposes --majeru */
"/usr/share/audacious/Skins/Classic1.3",                       /* skin */
-    NULL,                       /* output plugin */
+    "/usr/lib/audacious/Output/pulse_audio.so (#0)",                       /* output plugin */
NULL,                       /* file selector path */
NULL,                       /* playlist path */

As you can see, this patch is wrong. Why? Because:

• It uses an absolute path, and an absolute plugin UUID.
• The value will probably be ignored on first run for most people anyway, resulting in it using ALSA.
• Obviously we can’t support this change upstream, where all of the Ubuntu users come to ask everything anyway.

I like that, as usual, upstream was not consulted or asked in any way about how to go about making it do what they want. While my first try was wrong, it’s actually wrong due to a bug in audacious; that is the way they should patch it, and they should switch back to my patch in 1.5.1, as the weighted plugin detection is fixed there*. *On my branch only. Which i will be pushing to proposed/audacious-1.5 soon enough. Update: apparently some people took this the wrong way and assumed I was flaming Ubuntu here. Why would I? No, I was ranting about the fact that this guy changed a bug and within minutes uploaded this hideous patch. There wasn’t even realistically time to reply to the bug, nor was the patch posted for any sort of public review before hand. Anyone familiar with audacious’s internals would have immediately recognized that the patch is bogus.

Every now and then, I want to understand a bit better English. Today, when Joeyh mentioned nettle soup, I had to ask Wikipedia what a nettle is. And Joey, no wonder it itches... It refers to around 45 species of genus Urtica in the family Urticaceae - In Spanish, of course, urtica is known as ortiga, or as blind person's herb, as even a blind person will quickly recognize it to touch - Touching it will cause the apt-named urticaria, which Joey seems to have discovered and learnt to fear. At least in Spanish, urticaria is generalized and used to call all kinds of skin diseases.
It happens to be a very common plant in the area I live and dwell in (the ecological reserve REPSA spans a good portion of the University, and limits my neighbourhood), a large extension of Southern Mexico City where the lava of the small Xitle volcano covered everything, rendering a good portion of the Mexico City valley unfertile, known as malpa s (badland, literally).
Anyway... I don't think I'll rush to cut some ortigas and make them into soup, as both Joeyh and Wikipedia (Spanish and English versions) suggest. But it is always an option, having so many fine specimens around.
This posting serves no other purpose than to show my appreciation to the Mexico City Area

I did some 'playing' with Hecl the other day, to see what it might look like if implemented in a slightly different way, and I thought I'd share what I was thinking about. Keep in mind that

1. I haven't thought this through completely:-)
2. It's not something I'm going to just rush out and do in the near future. It's definitely a Hecl 2.0 sort of idea.

My notion was to make use of the ClassCommand feature to have at least simple types be hooked directly to the relevant Java types, and dealt with through methods, rather than commands. For instance:

$i + 10

instead of

+ $i 10

Where $i is, in the first case, a Java Integer, rather than a Hecl type. What it would be doing internally is something like this:

1. $i is recognized as the object to act on.
2. It's an Integer, so the corresponding ClassCommand is looked up and executed with + and 10 as arguments.
3. The classcommand for Integer has a + method that accepts an argument, in this case, 10, which is added to the value of $i, and returned as a new Integer.

Without a "real" (where real also means bloated, memory and space hungry) parser, Hecl is never going to have a C-like syntax - you still wouldn't be able to do foo = 1 + 2 + 3 - but this just might make a significant amount of people more comfortable with Hecl, which would be a good thing. You could do something like this:

set i 1
while   $i < 1000000    
    set i [$i + 1]
 

instead of

set i 1
while   < $i 1000000    
    set i [+ $i 1]
 

I actually built a really simple HeclInteger class that implements < and + as methods to Integer ObjectThings, in order to test out this idea, and it seems to run about as fast as the regular Hecl version. I welcome any thoughts or comments on the idea.

Sune, I have begun to think that it might actually be useful if many people replied to this kind of backscatter and make sure, that the mailsystem works as intended. Mail gets delivered. (Or not, as it's recognized as spam. Something which is possible in 2008.)

So I wrote an entry on my tumblelog about what s going on with my life currently. Since Tumblr s feed doesn t get pushed immediately, I showed the post to my co-worker and friend Chris, before it hit the planets: - So, yeah I have my blog since it s syndicated on Planet Debian and other small feed aggregators -I said. - But do they really care about your bike, your chess games or you attending that conference? -he asked-, I mean, I do care, but people? - Well -I replied after a quick thought-, I think that s how personal blogs work. After a deeper thought I just realized that indeed no one cares and deleted the entry before it was pushed to the feed, updating it on FeedBurner, etc. It was a nice awakening.

---

But on a bit more interesting (for people) things, The Perl Foundation is currently requesting comments on the projects they received for grant requests. My proposal is there, Solidifying and Extending the Blog Normalize project . I do think there are some other more deeper projects, of course, but I think B::N is also an interesting one and the amount requested is not as big for other projects, so it d be nice to give it a try. I believe B::N is a good idea that could be enhanced nicely. I proposed the idea to the TextMotion developers yesterday on IRC (since that s one of the CMS there would be a connector for -as of the grant proposal-). After deeper discussion, CMSs will not make translators for a lot of projects into theirs, but B::N would, so maybe we could make some sort of webservice that CMSs could call on their installation phases. That, or the user at the end could actually do the conversion himself locally. Having the proper information, one could be able to get from TextMotion to Wordpress, to Blogger, to Joomla, to Tumblr, to MovableType and to TextMotion again, making a transparent circular transformation. Some of this is currently possible with the few code I ve written for it, currently in CPAN (and a bit deeper proof of concept); if you are interested, please leave your comments on the Perl Foundation blog entry. And review others too. At the end, I might end up doing the project myself, but if some money is granted to do so, why not apply to it, that d just speed it up.

These last two weeks most of my time has been sucked into getting Python 2.5 as default into testing. That’s done now. I made use of the block uploads thingie ftpmaster implemented for the release team to use. Basically, if your package could disrupt an “almost there” transition, the upload will be rejected. The blocks were in place for 5 days, which I think it’s acceptable. As long as we don’t end blocking stuff for very long, I think we should be fine. See the end of this post for more about this. Though it was quite a bit of work, I’m very glad I took care it myself, since now I really feel I’m 100% back to Debian, after the time I spent off for health reasons. Update: Oh, and I forgot to say: having control over britney has really really helped. Thanks a lot Joerg for that.

---

Dudesconf Tomorrow I’m leaving to Coru a for Dudesconf, which is a kind of Debconf-ES. I’m giving an introductory talk to Git, a semi-lighting talk about grep-dctrl (30 min.), and (gasp) a talk about Debian packaging with a VCS. We may have a Debian Quiz as well. I’m so looking forward to it, since many people who’ll attend are amongst my most loved ones, and I already missed last year’s since I wasn’t fully recovered yet. See you there!

---

Minirok and Sevilla One of the reasons I wasn’t fully back to release management during the past 5 months or so is because I spent as much time as I had doing development for Minirok. I don’t think I mentioned here before, but I was participating in a Free Software Contest for college students organized by the University of Sevilla, Spain. Such effort finally paid off, since Minirok was elected as one of the finalists. This means next week I’ll go to Sevilla, to make a presentation of the project, and who knows what more. ;-) I’m very excited.

---

Finally, more on blocking uploads This Python 2.5 transition was the first time the block uploads feature was used, and there were a couple bumps along the way. In particular, a couple packages were blocked, when they shouldn’t have been (libqt4-ruby and evolution-sharp), and one needed package was not blocked, though Rene Engelhard thankfully spotted it very quickly (mono). The problem is it’s not completely straightforward to generate a list of all the stuff that could possibly affect the transition. What I did was to make a run of britney on an arch that had all the needed bits in place, and block all the packages that migrated together as a result of the hint. This fails in two ways:

• it can include stuff that is not needed for the transition, namely unrelated packages that happen to become candidates for testing by one of the their dependencies having migrated as part of the hint. This is what happened with libqt4-ruby and evolution-sharp.
• it can miss stuff that is needed, like packages that can migrate by themselves, so the main run prior to the hint migrates them, and hence do not show up as part of the hint, but that some package of the transition depend on. This is what happened with mono.

The second problem, though, can be fixed by parsing the excuses list and blocking stuff that some bits of the transition depends on. Easy enough. Yet, there are more cases when things can go wrong, for example a shlibs-bumping upload of a package (say, sqlite3) linked against by some package still needing a couple of builds (say, qt4-x11). For that, blocking uploads is not an option, since that’d be an insane amounts of packages that, furthermore, can be uploaded if they don’t bump shlibs, so I guess we’ll have to ask in the next release update that shlibs-bumping uploads are coordinated in -release too, at least when close to finishing a transition.

A few weeks ago, NYU hosted an interesting event about the future of the Internet, appropriately tittled The Futures of the Internet, the video of which is now available here. One of the panelists was Jonathan Zittrain (who recently wrote an important new book bearing the same name as the event) and during the talk he provided a few ideas about how geeks and developers can help secure the Future of the Internet. While I agree with a lot in fact most of his assessments about the state and fate of the Internet as he lays out in his book and his talks, his characterization of geek/hacker/developer politics is not one of them. Basically, one of Zittrain’s claims is that developers are not doing enough to save the Future of the Internet and it is their rampant, Atlas-like libertarianism, which is, in part, to blame (first made 37:20 minutes into the video for those who want to listen to the actual comments). They have little-to-no political consciousness, are too cool to care about the fine print and they don’t care about the broader politics of the the Internet because they assume that they can just hack around any sort of barrier and impediment. While we can, without a doubt, identify a strain of libertarianism among hackers, it is by no means representative of all of geekdom and in fact, is becoming more and more a worn out 1990s stereotype/clich as time passes than an accurate representation of what is a far more variegated set of ethics and practices among hackers (and I will soon publish an article on this topic). It also completely fails to capture the ethical spirit as well as sociological, and political workings of one of the most important strains of hacking free and open source software which not only powers most of our (open) Internet but which in fact has provided a pretty hefty ethical backbone by which to conceptualize one of the ways we should think about the fight for the future of the Internet. Ok, time for a rant now Geeks not only designed the Internet, an indisputably revolutionary medium, but also implemented, and continue to maintain it, and then in their copious spare time, also engage in fighting back the political, legal and corporate encroachment which threatens to limit the very revolutionary nature of the Internet (as Chris Kelty’s new book on Free Software argues). If these acts by geeks are not enough political action, then maybe the development of not just one, but multiple entirely open and free alternatives to the only two proprietary operating systems that exist today might be a political act that would satisfy? Many would agree that even simply using a free operating system is a political act. It would be better to claim that individuals, lawyers and other political actors are not doing enough to save the Future of the Internet, rather than imploring the already overtaxed geeks to set aside everything that they are already doing to do something even more. (end rant) It also seems that when it comes to political questions related to the Internet, net neutrality being the hot topic now, or fighting restrictive and problematic laws like the DMCA, one of the only groups of people (outside of lawyers and librarians) to actually understand and dissect the fine print (and geeks actually are pretty attuned to and like to dissect the fine legal print), to protest these unsavory laws, and to support the organizations who are doing something about it (like the EFF), are geeks and hackers. While many geeks are not necessarily keen on conceptualizing their labor in traditional political terms, or aligning their technical projects with a political affiliation, and yes would rather just be writing good code, they do fight for their productive freedom and this productive freedom just happens to relate to most questions and concerns related to an open, accessible, and tweakable Internet, built by the geeks, lest we forget What was perhaps most surprising was that he also seemed to think that geeks and developers have not turned to “apprenticeship,” nor policies and procedure to coordinate their development projects, unlike Wikipedia, which he considers a shining example that geeks should look towards as a beacon of policy that geeks should consider emulating in their projects (comments made answering my question). He clearly has not been hanging out with any Debian developers in the last 10 years nor has he gone through their New Maintainer Process In other words, he seems to think they are allergic to regulation due to their accentuated libertarianism, or are against structure because of their anarchism, neither which is remotely true. I think I found this characterization most ironic and problematic for before Wikipedia was even an entry on a Wiki, projects like Debian (and most other F/OSS projects) were transforming and changing to integrate normative procedures and policies that allowed a group of people to work together, scale, grow and deal with crises’. No, they don’t have the Wikipedia badge system, but that system is emblematic of Wikipedia’s own transformation into integrating its own normative procedures and policies for working together, not an example of an idealized policy system that other projects are too primitive to have evolved into yet. About one hour into the talk when questions opened up, I objected to his characterization, but given his answer back to me, I did not make much of a dent in his thinking. Another lawyer Tim Wu (who also wrote a wonderful book on the Internet) chimed in to give me some props and also made a good point that even if geeks are the only groups of people who would storm AT&T and know intimately about the importance of net neutrality, there is a lot of room for thinking about how to strengthen and improve the tactics and politics among geeks and developers so that we can ensure the type of open and generative Internet and set of technologies we value. As part of thinking and rethinking new strategies, it is as key to acknowledge and honor the past. In this regard, free software development has been pivotal both in terms of providing software (and making it is an important political act as is choosing to use free software over propriety software) and a set of important set of ideas that a lot of lawyers like Yochai Benkler and Lawrence Lessig have run with to make some important political claims of their own. So despite my rant above, which was a rant and thus exaggerates things to some degree, I do think there is much more that geeks and non-geeks can do, such as help translate these uber-geeky issues into less geeky terms (and actually this is already being done by some geeks as the work of Jelena Karanovic has shown, or translate the technical issues into new domains as the uber-geek Karl Fogel is doing with question copyright but first lets give credit where credit it due and recognize that labor is political

I gave Brenda a Palm TX, so she can better organize her life. As a plus, it is wi-fi aware, so all sorts of interesting things can be done. Sadly, though, it doesn t ship with a microphone (I still wonder why it s large enough to hold an embedded mic, just as Palm smartphones have). Lately, Brenda was talking about recording some sessions or holding her thoughts in one of those tiny memo-recorders, and this promptly stroke me as another gadget to stuff her purse ... then I remembered having read that Palm TX have all that is required to hold a microphone, but the microphone I retrieved the Palm Multi-Connector pinout from Wikipedia and realized that all I had to do was attach an electret microphone to 16 and 17 pins and there we go. I ordered a charging cable just for the connector and here are the pictures I took of the building process: The tools and pieces I used: It s easy to disassemble the connector. Take a close look at the attaching plastic hooks there are four of them: two outside, near the pins, and two inside near the cable. Last two are harder to detach, but once you ve detached the first ones, just hold the two pieces of the connector and easily shear them: one side will detach first. The microphone have two terminals that already hold enough soldering tin. Beware to solder the blue cable (the one that goes with pin 16 AGND) to the marked terminal of the microphone, and the red one (the one that goes with pin 17 MIC_IN) to the unmarked one. (In the picture, my cables are all black, but the wires inside are red or blue . I could not get a good picture of the terminal markings). I have dissolded the charging cables from pins 1, 3, 5, and 8, but that is up to you (you can just cut the main cable and leave the pins untouched). Also, while soldering the microphone cables to the connector, beware of using as little tin as possible. It ll be even easier if you remove the pin from the connector it s easy to do if you have small pliers and careful fingers. Try first with one of the other pins that will not be used. Solder the red one to pin 17 and the blue one to pin 16. I cut a piece of an old earphone cushion to close the charging cable hole (and to protect the microphone). Here is the final result: Now, for the recording software, there s a nice free software that does that perfectly for PalmOS: Better Recorder. Now Brenda can record her mind!

When I heard that there will be a miniseries based on “The Andromeda Strain” book, I was very exited. That was one of my favorite sci-fi books in my childhood. After watching the miniseries I must conclude that this is another book perverted and trivialized by Hollywood. SPOILERS AHEAD! They created some crazy pseido-sci-fi idea that humans from the future sent Andromeda back from the future via a wormhole in a container that contained a message which was then picked up by a satellite that was sent up to investigate the wormhole. No wormhole was there in the book. The book had a much more modest idea - a Scoop satellite was to skim the outer layers of the atmosphere for mutations of common Earth bacteria for military purposes when it was impacted my a micrometeorite carrying the Andromeda. Much more probable, no need to involve wormholes, time travel, ASCII messages, eco-terrorists and a sub-plot on conservation of marine species. Due to extreme modernization of the script, the whole subplot of the teletype mechanical failure was omitted. Andromeda was made sentient instead and communicated via ’some kind of inductive field’ to shoot down a fighter jet and activate a nuke. The survivors and their pH levels got barely a glance. Also the amount of destruction was obviously too low for the movie, so the Andromeda was made to mutate more, spread out of containment easily and even make a flock of birds attack a squad of solders ‘Hitchcock style’. Disgustingly cheap scriptwriting. Huge chunks of plot were ripped out (searching for the micro-meteorite impact crater with different lenses, central core security) and the two hours were filled with Rembo style journalism vs. black ops, selfless president and scenes of animals eating each other and dieing. At the end they ran out of budget and just made it look like presence of Andromeda made air and water bright red so that people would have something to run away from in fear. Oh and the scientists are allowed to freely talk about the event after it’s done. Yeah, right. In my book this movie rates very close to the infamous “The Core” with the only difference that they managed to fuck up a really good book. Do not watch it and read the book instead.