Search Results: "spa"

20 September 2015

Michal Čihař: Weblate 2.4

Weblate 2.4 has been released today. It comes with extended support for various file formats, extended hook scripts, better keyboard shortcuts and dozen of bug fixes. Full list of changes for 2.4: If you are upgrading from older version, please follow our upgrading instructions. You can find more information about Weblate on http://weblate.org, the code is hosted on Github. If you are curious how it looks, you can try it out on demo server. You can login there with demo account using demo password or register your own user. Weblate is also being used https://hosted.weblate.org/ as official translating service for phpMyAdmin, Gammu, Weblate itself and other projects. If you are free software project which would like to use Weblate, I'm happy to help you with set up or even host Weblate for you. Further development of Weblate would not be possible without people providing donations, thanks to everybody who have helped so far! PS: The roadmap for next release is just being prepared, you can influence this by expressing support for individual issues either by comments or by providing bounty for them.

Filed under: English phpMyAdmin SUSE Weblate 0 comments

19 September 2015

Philipp Kern: Working with z/VM DIRMAINT as a mere user

Two helpful CMS commands to know if the users on the z/VM host you connect to are managed using DIRMAINT:

REVIEW is something I always expire from my mind after a few weeks of not using a mainframe. And then I do not usually find it quickly, even knowing where to look. (For some reason GET won't work unless you are a privileged user of the system.)

I guess by now most of the systems use DIRMAINT, but it's an IBM product that requires a separate license in addition to z/VM. Hence on some systems the user directory is still maintained by hand. In this case the password is written verbatim into the file and the administrator needs to change it manually for you.

Jakub Wilk: Executable URLs

or how to write shell scripts without using whitespace.

Jakub Wilk: Executable URLs

or how to write shell scripts without using whitespace.

Russ Allbery: Review: Magic's Pawn

Review: Magic's Pawn, by Mercedes Lackey
Series: Last Herald Mage #1
Publisher: DAW
Copyright: June 1989
ISBN: 0-88677-352-0
Format: Mass market
Pages: 349
Continuing my (very slow) re-read of Mercedes Lackey's Valdemar series. I've read all these books before (this series several times, in fact), but long before I started writing reviews. Vanyel is a legendary hero by the time of Talia (the hero of the first Valdemar series, starting with Arrows of the Queen). Talia was reading stories about him at the start of her story: the mage Herald who defended Valdemar against its enemies in the distant past. This is the first book of the trilogy that tells his story, starting (as Lackey's books often do) from rather inauspicious beginnings. Vanyel is the son of a border lord, and about as poorly suited for it as possible. He's small, pretty, entirely uninterested in the hammer-and-tongs sword fighting the arms master wants to teach him, and also gay, not that he has any idea that's even something that exists and has a name. His only ally was his sister, who is now off serving in Valdemar's military. Most of his life is spent hiding, feeling utterly lost and out of place, and wishing he could be a Bard. This is a Valdemar story, so if you're familiar with the series, you know what's coming next. What might come as a surprise is that "next" is quite some time into the story. Vanyel does not get rescued from his situation by a Companion. Instead, his father decides to exile him to the capital under the care of his aunt, who he's only met once and who didn't think highly of him. He expects to be even more miserable, and shuts emotionally down in anticipation. This is one of those books that I remembered as being better than it actually was, and one of the reasons why I enjoyed it less than I expected is that far too much of this book is devoted to describing Vanyel's mental state. This usually involves various elaborate emo analogies (which can be a failing of this series in general), and it's quite hard to maintain sympathy for Vanyel. Lackey gets us to feel for him at the start of the book, when he's really in a bad situation. But once he gets to the capital, he's his own worst enemy, and it's hard to avoid the desire to shake him. I also didn't remember just how much I disliked Tylendel. I'm sure it will come as a surprise to no one that Vanyel eventually meets someone who draws him out of his shell and gives him a reason to want to live. Unfortunately, that person, despite a positive surface impression, is self-obsessed, unstable, and not above manipulating Vanyel into actions that are so obviously catastrophic that it makes one want to yell at the book. I disliked this part of the book so much that even a Companion's choosing was overshadowed. The book does get a bit better after that truly awful middle, but it never hits the emotional stride that other Valdemar books hit. Lackey does introduce the Tayledras, which will be hugely important in later books in this series (and who are some of my favorite characters), but there too I prefer their later appearances. Vanyel's inability to see a good thing when it hits him in the face, punctuated by being occasionally cruel to the people who try to help him, makes it quite hard to enjoy his slow path to becoming a better person. I remember really liking this trilogy, so I think it gets better. But I also remembered liking Vanyel's claiming, and it didn't do much for me on a re-read. I can only recommend this one as a necessary preface to the later books in the trilogy, and expect to need a high tolerance for constant woe-is-me despair. Followed by Magic's Promise. Rating: 5 out of 10

18 September 2015

Dimitri John Ledkov: Clear Containers for Docker* Engine

Today at work, I announced something James Hunt, Ikey Doherty and myself have been working on. We integrated Clear Containers technology with Docker* Engine to create Clear Containers for Docker* Engine.

After following installation instructions, one can pull and run existing Docker* containers in the secure Clear Containers environment. This means that instead of namespaces, a fast virtual machine is started using the kvmtool hypervisor. This VM is running an optimised minimal Linux* kernel and the optimised Clear Linux* for Intel Architecture Project user-space, with the only goal to execute the Docker* workload and then shut down.

The net effect is almost indistinguishable from typical Docker* container usage:
$ docker run -ti ubuntu:vivid
root@d88a60502ed7:/# systemd-detect-virt
kvm
Apart from, as you see, it's running inside a kvm VM, and thus protected by Intel Virtualization Technology.

This is available on Clear Linux* as well as multiple other operating systems.

I hope this is exciting enough for people to try out, and if you have any feedback, feel free to leave comments or join our mailing list.

*Other names and brands may be claimed as the property of others

The postings on this site are my own and don't necessarily represent Intel s positions, strategies, or opinions.

17 September 2015

Lunar: A key signing party keyserver as a Tor hidden service

Key signing parties are a pain and hopefully, one day, we will have better ways to authentication keys than reading hexadecimal strings out loud. The Zimmermann Sassaman key-signing protocol makes them much more bearable already by having only one single hexadecimal string read out loud. That string is the cryptographic hash of a document given to every participant listing all participants and their fingerprints. If everyone has the same hash, then we assume that everyone has the same document. Then, participants in turn will confirm that they fully recognize the fingerprint listed in the document. Alexander Wirt wrote a small key server dedicated to receive keys from the participants. There is also a script that will generate the document from the submitted keys and a ready-to-use keyring. The latter can be run automatically using inoticoming when a new key arrives. Finally, it would be nice if participants could confirm that their key has been properly added to the document, e.g. by making the list available on a web server. Setting all this up seemed like a good opportunity to play with Tor hidden services and systemd-nspawn. Here's the setup log with some comments. This was done on a small armhf device with Debian Jessie. Create a new hidden service Edit /etc/tor/torrc on the host to setup the hidden service: 
HiddenServiceDir /var/lib/tor/ksp/
HiddenServicePort 80 10.0.0.2:80
HiddenServicePort 11371 10.0.0.2:11371
Run: 
host# systemctl reload tor.service
Then, to learn the name of the newly created hidden service name: 
host# cat /var/lib/tor/ksp/hostname
ksp123456789abcd.onion
Install the container debootstrap as always: 
host# debootstrap --variant=minbase jessie /var/lib/container/ksp
Preliminary container configuration We do the following step simply using chroot as we are going to use the host network configuration for this stage. The container itself will not have access to the Internet. 
host# chroot ksp
Let's set the hostname: 
ksp-chroot# echo 'ksp' > /etc/hostname
Set up APT: 
ksp-chroot# echo 'deb http://httpredir.debian.org/debian jessie main' > /etc/apt/sources.list
ksp-chroot# apt update
We need dbus to get systemd to work well: 
ksp-chroot# apt-get install dbus
Make sure that we can resolve our own hostname: 
ksp-chroot# apt-get install libnss-myhostname
ksp-chroot# sed -e '/^hosts:/s/files/myhostname \0/' -i /etc/nsswitch.conf
These are dependencies of the keyserver: 
ksp-chroot# apt-get install --no-install-recommends libhttp-daemon-perl \
                liblog-loglite-perl libproc-reliable-perl
These ones are needed for the script generating the list: 
ksp-chroot# apt-get install bzip2 inoticoming
And we will use the smallest HTTP server available: 
ksp-chroot# apt-get install netcat-traditional micro-httpd
Finally, let's unconfigure all DNS resolvers: 
ksp-chroot# echo > /etc/resolv.conf
And we are done with the chroot: 
ksp-chroot# exit
Let's retrieve the ksp-tools repository now: 
host# cd /var/lib/container/srv
host# git clone https://github.com/formorer/ksp-tools
Container setup We will now start the container with a shell to configure it: 
host# systemd-nspawn -D ksp --network-veth
Let's ask systemd to configure the network for us: 
ksp# systemctl enable systemd-networkd
Let's not forget to set a root password: 
ksp# passwd
We add a dedicated user to run the keyserver and the list generation script: 
ksp# adduser --system --group --disabled-password --disabled-login --home /var/lib/ksp ksp
Let's configure the keyserver: 
ksp# cp /srv/ksp-tools/keyserver.conf /var/lib/ksp/keyserver.conf
Let's edit /var/lib/ksp/keyserver.conf: 
homedir = /var/lib/ksp
Now create the GnuPG homedir for the keyserve: 
ksp# mkdir /var/lib/ksp/keys
ksp# install -d -o ksp -g ksp -m 0700 /var/lib/ksp/keys/gpg
Copy the template list generator: 
ksp# cp -r /srv/ksp-tools/example /var/lib/ksp/keys/ksp123456789abcd_onion
Create the key repository: 
ksp# install -d -o ksp -g ksp -m 0700 /var/lib/ksp/keys/ksp123456789abcd_onion/keys
Create a directory accessible to the web server where the participant list will be generated: 
ksp# mkdir -p /var/www
ksp# install -d -o ksp -g ksp -m 0755 /var/www/keys
Let's configure the list generation script by editing /var/lib/ksp/keys/ksp123456789abcd_onion/conf/vars: 
KS=ksp123456789abcd.onion
export GNUPGHOME=/tmp/ksp-gpg
KSPFILE="/var/www/keys/ksp-event.txt"
Don't forget to adjust the header in /var/lib/ksp/keys/ksp123456789abcd_onion/conf/list-header. Now we create a unit file for the keyserver in /etc/systemd/system/keyserver.service: 
[Unit]
Description=Key signing party keyserver
[Service]
Type=simple
Environment="KSP_HOMEDIR=/var/lib/ksp"
ExecStart=/srv/ksp-tools/bin/kspkeyserver.pl --nodaemonize
User=ksp
Group=ksp
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/var/lib/ksp
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target
Another unit for the list generator as /etc/systemd/system/ksp-list-generator.service: 
[Unit]
Description=Key signing party list generator
[Service]
Type=simple
EnvironmentFile=/var/lib/ksp/keys/ksp123456789abcd_onion/conf/vars
ExecStart=/usr/bin/inoticoming --foreground /var/lib/ksp/keys/ksp123456789abcd_onion/keys --chdir /var/lib/ksp/keys/ksp123456789abcd_onion bin/generate-list \;
User=ksp
Group=ksp
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=/var/www/keys
CapabilityBoundingSet=
[Install]
WantedBy=multi-user.target
For the web server, we first configure a socket listening on port 80 in /etc/systemd/system/micro-httpd.socket: 
[Unit]
Description=micro-httpd socket
[Socket]
ListenStream=80
Accept=yes
[Install]
WantedBy=sockets.target
And then the web server in /etc/systemd/system/micro-httpd@.service: 
[Unit]
Description=micro-httpd server
[Service]
ExecStart=-/usr/sbin/micro-httpd /var/www/ksp
StandardInput=socket
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
CapabilityBoundingSet=
Let's now ask systemd to start all of these at boot time: 
ksp# systemctl daemon-reload
ksp# systemctl enable keyserver.service
ksp# systemctl enable ksp-list-generator.service
ksp# systemctl enable micro-httpd.socket
One way to kill the container is to type Control+] three times. Boot the container Let's get this party started! 
host# systemd-nspawn -b -D /var/lib/container/ksp --network-veth
Hopefully, things should work now. Participants to the KSP should then be able to send their key with: 
$ torsocks gpg --keyserver ksp123456789abcd.onion --send-key $KEYID
(Sadly, this is broken with GnuPG 2.1 at the moment.) The participant list should be available at http://ksp123456789abcd.onion/ksp-event.txt. Final steps We need to tell systemd to start the container started at boot time: 
host# systemctl enable systemd-nspawn@ksp.service
But the default command-line will not use a dedicated network, so we need to override that part of the configuration. First create a directory: 
host# mkdir /etc/systemd/system/systemd-nspawn@ksp.service.d
And edit /etc/systemd/system/systemd-nspawn@ksp.service.d/use-network-veth.conf: 
[Service]
# The empty line because we want to override all previous ExecStart
# and not add an extra command
ExecStart=
ExecStart=/usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --directory=/var/lib/container/%i --network-veth
Let's reload systemd and verify that our snippet is there: 
host# systemctl daemon-reload
host# systemctl cat systemd-nspawn@ksp.service
All good? Let's start it: 
host# systemctl start systemd-nspawn@ksp.service
One should also add a firewall to disallow any outgoing connections from the ve-ksp interface as an extra protection.

Raphaël Hertzog: Freexian s report about Debian Long Term Support, August 2015

A Debian LTS logoLike each month, here comes a report about the work of paid contributors to Debian LTS. Individual reports In August, 71.50 work hours have been dispatched among 7 paid contributors. Their reports are available: Evolution of the situation September is stable compared to August (71.50 hours per month) and has not caught up back to the level of July as I hoped. Again it s because 2 sponsors were not able to pay their renewal invoice on time (one of last month paid, but another bigger sponsor failed this month). Those sponsors will continue to support us and I would like to be able to say that things will be back to normal next month, but I can t say it since we have also been informed of the (hopefully temporary) defection of another bronze sponsor that will affect us next month. Fortunately there are also good news, we have 3 new sponsors in the pipe (2 silver, 1 platinum) who shall join the project soon. And Blablacar increased their support from Silver to Gold (from 4h/month to 8h/month). But we still need more support in particular since we would like to commit to support virtualization related packages in Wheezy: that s clearly an objective for us. I recently published the summary of the work session held during DebConf 15 in Heidelberg (video recording). It would be really nice if we could get closer to the goal of funding a full-time position. In terms of security updates waiting to be handled, the situation is close to last month: the dla-needed.txt file lists 18 packages awaiting an update (2 less than last month), the list of open vulnerabilities in Squeeze shows about 30 affected packages in total (8 more than last month). Thanks to our sponsors

No comment Liked this article? Click here. My blog is Flattr-enabled.

NOKUBI Takatsugu: PIXELS (film)

I watched PIXELS in a theater. It subjects about video games, mostly retro 80 s arcade games. I love video games from childhood, my first game played would be Taito s Space Invaders, I was the 4 or 5 yeas old time. It had bring me to the computer world. Fortunately I am working at Akihabara area, so I can play the video games in the movie like Pac-man, Glaga, Cemtipede, Donkey Kong and so on in two gamecenters, Natsuge Museum and Hey (Hirose Entertainment Yard . Natsuge Museum is under private management so it closes week days. They focused to old games between 70 th to 90 th. Hey is a franchised shop ownd by TAITO. They covered almost video games except medal games. You can play old games like Paper-boy, The Tower of Druaga, and newest games like Left4Dead arcade. They correct many titles of the games in the movie, and be playable. They are my recommended place in Akihaba, if you like video games.

15 September 2015

Norbert Preining: In Memoriam Adrian Frutiger

Just a few days ago another great font designer has passed away, Adrian Frutiger, 24 May 1928 10 September 2015. Famous in particular for his fonts Frutiger, Avenir, and the Univers family. His fonts are used throughout the worlds for visual communication like road signs. Much has been written about him: Linotype s excellent obituary, Adam Twardoch, David Airey, New York Times article. For an interview conducted with Frutiger in 1999, see this Eye Magazine article. An interesting article on Frutiger s typefaces by Charles Bigelow.
frutiger1 Here I want to recall a different quality of Adrian Frutiger his interest in the visual language of symbols, their development and interaction. His book Der Mensch und seine Zeichen (Signs and Symbols) is a profound study on the development, history, and use of all kind of symbols. In this book, translated into many languages, Frutiger explores the depth and breath of symbols, but the most important part for him, easily to be seen from the German title, is the human part ( Der Mensch ). Symbols are created, changed, and used by and for humans. His studies exhibit connections between various cultures when it comes to sign usage and design.
frutiger5 He also explores signets as modern sign language, and their importance for visual communcation and identity building.
frutiger4 The book also discusses the development of the Roman alphabet, and of course passes the Univers font family.
frutiger2 My favorite piece is this overlay of a s from different fonts, to show that there is a common pattern in these fonts.
frutiger3 He concludes this book with a very wise statement:
Zum Festhalten des Gedankens, zur Vermittlung der Aussage gen gen seit langem schon die Alphabet-Zeichen nicht mehr allein. Orientierung und Kommunikation sind heute unm glich ohne Schemata, Zeichen und Signale. Der geschriebene Ausdruck wird durch die Bildvermittlung notwendig erg nzt.
SInce long the alphabet letters alone do not suffice to take hold of thoughts and to transmit statements. Nowadays, orientation and communication are impossible without schemata, signs and signals. The written expression is necessarily enhanced through image transmission.
(my translation) After Hermann Zapf, this is now the second loss of the typographic world in this year. We will miss both of them.

13 September 2015

Norbert Preining: Gaming: The Talos Principle

Over the last weekends I finally managed to finish The Talos Principle, all of its endings. Compared to the actual play time I needed for Portal 2, namely about 12 hours, The Talos Principle challenged me much longer, about 36 hours. An enjoyable ride through many different and stunningly created worlds filled with many many puzzles that need to be solved.
Combined with three different endings the games offers great fun for those who love riddle games. Comparing it to my favorite riddle game (series), Myst, the graphics have of course developed and provide stunning views. I haven t played games in a landscape since the Myst series (Portal is indoors), so I was taken by surprise about all the details and love that has been put into the graphics. Maybe its only me because it was the first game of this quality I have played. And above all, I could actually play it on my normal Intel GPU laptop (but surprisingly only on Linux, the Windows version refused to play on my under-powered laptop).
There are only two slightly negative points I have to mention: Due to the nature of very restricted tool set, the riddles feel a bit repetitive. Some of them stand out, but after having played through the A and B worlds, you feel like you have seen that before when entering a new riddle. Still challenging, and that is what I was looking for, but a bit more variation would be nice. Here is a riddle that stood out due to its funny nature.
The game also has a long list of Easter Eggs, some of which I could find, some of which I surely missed. Most funny of those I found was the Developer World where funny characters lounge. Another I found was this money throwing guy called Fork Parker, who happens to be the financial officer of the developers team. Did they really make sooo much money from the game?
Something a bit uncommon or new to me was the fact that there are three (3!) endings, depending on what you choose to do. The first and easiest one is the ending of the good student you collect enough sigils, and follow Elohims words and ascent to eternity rather boring. Reminds me of an old Viennese song how boring it is to be an angel in heaven.
Bit more challenging is the bad student ending: You ignore Elohim s warnings and ascent the tower, solve several more riddles, and via a few more twists manage to escape to the real world. Nice graphics, great ending.
The most challenging ending is the enlighted student ending. To manage to reach this ending, one needs to collect each and everything that is to be found in the game, including all hidden stars and grey sigils. Here I have to mention the second slightly negative point: Finding the stars is rather luck then problem solving ability. Often one needs to guess a location of a reflector, or stumble over a hidden staircase, or press some arbitrary buttons. For my feeling the riddles for the stars were to arbitrary. So I managed to collect several of the stars by myself, but for many I needed hints on how to solve the riddles. Anyway, in case you managed to listen to all recordings, collect all texts, get all stars and collect all sigils from the extra worlds, you might ascend to the last floor of the tower and become a messenger yourself. Not sure if I want to become a messenger there, though.
Just in time with me finishing the game, the developers shipped out an extension called Road to Gehenna . Stunning graphics, even better, waiting ahead now I only need the time!
All in all a great piece of game, lovingly crafted graphics, interesting game play, lots of small levels, which helps people like me who cannot play for hours overnight, but need to do riddles one by one in short gaming sessions. So if you are in for riddle games, watch out for the next offer on Steam. Enjoy.

Russ Allbery: Accumulated haul

I haven't posted one of these in a while, but now that I'm finally caught up with writing reviews (although not posting them yet), I've been feeling about reading again. And of course the backlog always grows. Let's see if I can figure out what I've picked up since the last post. Catherine Asaro The Phoenix Code (sff)
Annie Bellet Justice Calling (sff)
Annie Bellet Murder of Crows (sff)
Annie Bellet Pack of Lies (sff)
Zen Cho Sorcerer to the Crown (sff)
J.J. Gribble Steel Victory (sff)
Judith L. Herman Trauma and Recovery (non-fiction)
Janis Ian & Mike Resnick Stars: The Anthology (sff anthology)
Megg Jensen Hidden (sff)
T. Kingfisher Bryony and Roses (sff)
T. Kingfisher The Seventh Bride (sff)
Nancy Kress Crossfire (sff)
Edmond Lau The Effective Engineer (non-fiction)
Yoon Ha Lee The Fox's Tower and Other Tales (sff collection)
Lozzi Roma Rome and the Vatican (non-fiction)
Elizabeth Lynn The Dancers of Arun (sff)
Elizabeth Lynn The Northern Girl (sff)
Rhonda Mason Empress Game (sff)
Vonda N. McIntyre Starfarers (sff)
Linda Nagata Memory (sff)
Jody Lynn Nye Strong Arm Tactics (sff)
Cat Rambo Near + Far (sff)
Kristine Kathryn Rusch The Diving Bundle (sff collection)
Kristine Kathryn Rusch Recovering Apollo 8 (sff)
L. Shelby Serendipity's Tide (sff)
L. Shelby Treachery's Harbor (sff)
L. Shelby Fealty's Shore (sff)
K.B. Spangler Digital Divide (sff)
Judith Tarr Forgotten Suns (sff)
Greg van Eekhout California Bones (sff) Hm, that's quite a lot. Most of it is various ebooks I picked up from various places, including a Humble Bundle. I've been impulse-buying a lot of stuff based on James Nicoll's reviews. The travel guide was a gift from a friend from a vacation in Italy.

Gregor Herrmann: RC bugs 2015/31-37

during the last weeks, I spent time mostly with RC bug prevention but I at least managed to also fix a couple of actual RC bugs:

Russ Allbery: Review: The Sea Thy Mistress

Review: The Sea Thy Mistress, by Elizabeth Bear
Series: Edda of Burdens #3
Publisher: Tor
Copyright: February 2011
ISBN: 0-7653-1884-9
Format: Hardcover
Pages: 334
The Sea Thy Mistress is the third book in the Edda of Burdens series, but the second book (By the Mountain Bound) was a prequel to the first, telling the story of an earlier world and the betrayal that ended it. This one is a direct sequel to All the Windwracked Stars, a complex and idea-rich book that I read more than six years ago. A challenging property of Bear's fiction is that it's short on explanation and doesn't hold your hand. This makes it lean, sharp, and effective if you're fully invested in it and can keep the context in your head. It becomes very hard to understand if you've mostly forgotten the plot of an earlier book. (Once again, I bemoan the death of the previous book synopsis in series fiction.) The Sea Thy Mistress is all about aftermath, loss, despair, unhealed wounds, old grudges, and complicated personal histories, and it relies very heavily on the reader being invested enough in the characters to care about all of those things. I wish I'd read this entire series closer together so that I could retain more of the state. The start of this story was therefore somewhat frustrating, as I scrambled to rebuild my memory of the first book and piece together the large cast. Thankfully, most of the characters are easy to care about. Aethelred reliably brought a smile to my face, and the opening scene of him finding a baby on the sea shore is a great piece of writing. Selene is back; she was one of my favorite characters in the first book. And Bear pulls off something I didn't think she could: the Grey Wolf is also back, for the third book, and he actually won me over. I think he grew up a bit; there's at least less whining and angst, and more effective action. It probably also helped that less of the story was told from his perspective. The Sea Thy Mistress is primarily the story of Cathoair and his son, Cathmar, and their encounter with a truly nasty threat: a goddess who has way more knowledge of how their world works than they do, and is out to destroy it. This review will necessarily be sketchy on details; most of them would partly spoil All the Windwracked Stars. (I suppose I'm spoiling it a bit anyway just by listing characters who are still around.) Cathmar is... not too irritating. He's young and stupid, and the first half of the book is a bit painful as he plays into the hands of the plot with much less information than the reader has available. But I was okay with him by the end of the book. Cathoair is a more complicated matter. I suspect whether you like this book will depend mostly on whether you can find some sympathy for his personal angst and self-destructive behavior, or at least tolerate him long enough to get to the ending. Quite a lot of this book consists of people behaving stupidly and horribly while those who love them stand by helplessly, unable to figure out how to break the cycle. If that sounds frustrating, you have the right impression. I really struggled with the first two-thirds of the book and started regretting reading it. But there is a payoff: one that's uncomfortable, raw, perilous, and sad, but also beautiful and honest and effective. Muire's role in this book may be minor, but it's very memorable. Despite the difficulties of the early book, I was very glad to have read it for the payoff. I'm not sure whether to recommend this or not, but I think it's worth reading if you enjoyed All the Windwracked Stars. If you do read it, though, try to read the whole series in close proximity. You'll want to remember the details between books. I'm now somewhat tempted to go back and re-read the whole series to experience it in context. Rating: 6 out of 10

12 September 2015

Ritesh Raj Sarraf: Google Take Action - Encryption

So I got an email yesterday from Google's Jess Hemerly, talking about how they care about encryption To quote a small snippet of the email: 
We use locks to keep our homes and our possessions safe offline. But how can we protect our digital things, like photos on a smartphone or email traveling across the web? The answer is encryption.
To change, it has to start from home. That means, add encryption support to Gmail. Add encryption to Google Photos. To every service you provide. So that, if tomorrow, your service is compromised, you don't public our data. What all the service providers need to realize, is that it is not the tool that needs encryption, but the data. You could claim that newer Androids are safer because encryption is enabled by default. But the data that you are backing up on your cloud, is not encrypted. It only makes sense to have an end-to-end encryption, or rather, encryption at source. Had you just stacked the interface to have write() transparently call encrypt() for any and all data, there'd be no worry about privacy. But wait, then how'd you munch.

Categories:

Keywords:

Like:

11 September 2015

Matthias Klumpp: Deploying Limba packages: Ideas & current status

LimbaHubThe Limba project does not only have the goal to allow developers to deploy their applications directly on multiple Linux distributions while reducing duplication of shared resources, it should also make it easy for developers to build software for Limba. Limba is worth nothing without good tooling to make it fun to use. That s why I am working on that too, and I want to share some ideas of how things could work in future and which services I would like to have running. I will also show what is working today already (and that s quite something!). This time I look at things from a developer s perspective (since the last posts on Limba were more end-user centric). If you read on, you will also find a nice video of the developer workflow 1. Creating metadata and building the software To make building Limba packages as simple as possible, Limba reuses already existing metadata, like AppStream metadata to find information about the software you want to create your package for. To ensure upstreams can build their software in a clean environment, Limba makes using one as simple as possible: The limba-build CLI tool creates a clean chroot environment quickly by using an environment created by debootstrap (or a comparable tool suitable for the Linux distribution), and then using OverlayFS to have all changes to the environment done during the build process land in a separate directory. To define build instructions, limba-build uses the same YAML format TravisCI uses as well for continuous integration. So there is a chance this data is already present as well (if not, it s trivial to write). In case upstream projects don t want to use these tools, e.g. because they have well-working CI already, then all commands needed to build a Limba package can be called individually as well (ideally, building a Limba package is just one call to lipkgen). I am currently planning DeveloperIPK packages containing resources needed to develop against another Limba package. With that in place and integrated with the automatic build-environment creation, upstream developers can be sure the application they just built is built against the right libraries as present in the package they depend on. The build tool could even fetch the build-dependencies automatically from a central repository. 2. Uploading the software to a repository While everyone can set up their own Limba repository, and the limba-build repo command will help with that, there are lots of benefits in having a central place where upstream developers can upload their software to. I am currently developing a service like that, called LimbaHub . LimbaHub will contain different repositories distributors can make available to their users by default, e.g. there will be one with only free software, and one for proprietary software. It will also later allow upstreams to create private repositories, e.g. for beta-releases. 3. Security in LimbaHub Every Limba package is signed with they key of its creator anyway, so in order to get a package into LimbaHub, one needs to get their OpenPGP key accepted by the service first. Additionally, the Hub service works with a per-package permission system. This means I can e.g. allow the Mozilla release team members to upload a package with the component-ID org.mozilla.firefox.desktop or even allow those user(s) to own the whole org.mozilla.* namespace. This should prevent people hijacking other people s uploads accidentally or on purpose. 4. QA with LimbaHub LimbaHub should also act as guardian over ABI stability and general quality of the software. We could for example warn upstreams that they broke ABI without declaring that in the package information, or even reject the package then. We could validate .desktop files and AppStream metadata, or even check if a package was built using hardening flags. This should help both developers to improve their software as well as users who benefit from that effort. In case something really bad gets submitted to LimbaHub, we always have the ability to remove the package from the repositories as a last resort (which might trigger Limba to issue a warning for the user that he won t receive updates anymore). What works Limba, LimbaHub and the tools around it are developing nicely, so far no big issues have been encountered yet. That s why I made a video showing how Limba and LimbaHub work together at time: Still, there is a lot of room for improvement Limba has not yet received enough testing, and LimbaHub is merely a proof-of-concept at time. Also, lots of high-priority features are not yet implemented. LimbaHub and Limba need help! At time I am developing LimbaHub and Limba alone with only occasional contributions from others (which are amazing and highly welcomed!). So, if you like Python and Flask, and want to help developing LimbaHub, please contact me the LimbaHub software could benefit from a more experienced Python web developer than I am (and maybe having a designer look over the frontend later makes sense as well). If you are not afraid of C and GLib, and like to chase bugs or play with building Limba packages, consider helping Limba development :-)

10 September 2015

Chris Lamb: Joining strings in POSIX shell

A common programming task is to glue (or "join") items together to create a single string. For example: 
>>> ', '.join(['foo', 'bar', 'baz'])
"foo, bar, baz"
Notice that we have three items but only two commas this can be important if the tool we passing doesn't support trailing delimiters or we simply want the result to be human-readable. Unfortunately, this can be inconvenient in POSIX shell where we construct strings via explicit concatenation. A na ve solution of: 
RESULT=""
for X in foo bar baz
do
    RESULT="$ RESULT , $ X "
done
... incorrectly returns ", foo, bar, baz". We can solve this with a (cumbersome) counter or flag to only attach the delimiter when we need it: 
COUNT=0
RESULT=""
for X in foo bar baz
do
    if [ "$ COUNT " = 0 ]
    then
        RESULT="$ X "
    else
        RESULT="$ RESULT , $ X "
    fi
    COUNT=$((COUNT + 1))
done
One alternative is to use the little-known ":+" expansion modifier. Many people are familiar with ":-" for returning default values: 
$ echo $ VAR:-fallback
By contrast, the ":+" modifier inverts this logic, returning the fallback if the specified variable is actually set. This results in the elegant: 
RESULT=""
for X in foo bar baz
do
    RESULT="$ RESULT:+$ RESULT ,  $ X "
done

Norbert Preining: Getting CafeOBJ via MacPorts

I have finally finished the Portfile for CafeOBJ, which allows users to install CafeOBJ via the usual port command of MacPorts. For one needs to add our local source (which only ships CafeOBJ port), but I hope to get the port into the standard distribution soon. cafeobj-logo Necessary steps:
  • Add the following line to your MacPorts sources.conf, which usually resides in /opt/local/etc/macports/sources.conf: 
    http://cafeobj.org/macport/ports.tar.gz
  • After that, call the following two commands (as root or with sudo), the first syncronizing the ports, the second one installing CafeOBJ: 
    port sync
port install cafeobj
This should give you a working installation of CafeOBJ 1.5.3. The port will be updated as soon as 1.5.4 is released (which should be rather soon). Enjoy, and please leave comments and suggestions how to improve the port file here, per email, or at our bug tracker.

9 September 2015

Carl Chenet: Retweet 0.3: retweet given tweet popularity

Follow me on Identi.ca or Twitter or Diaspora*diaspora-banner Don t know Retweet? My last post about it introduced this small Twitter bot whichs aims to retweet every tweets from a Twitter account to another one. Retweet The new features of this release:
  • retweet a tweet only if it was already retweeted a number of times you can specify
  • define the duration to wait before processing the next tweet to possibly retweet (useful if you want to control the delay between two tweets).
Retweet was created in order to improve the Journal du hacker Twitter account. The Journal du hacker is a Hacker News-like French-speaking website. logo-journal-du-hacker Especially useful to broadcast news through a network of Twitter accounts, Retweet was also improved to improve pep8 compliance and code readability (wip). The project is also well documented and should be quite simple to install, configure and use. Twitter_logo_blue What about you? If you try it, please tell me what you think about it, opening a bug request or ask for new features. Or just write your comment here ;)

8 September 2015

Daniel Silverstone: Orchestration, a cry for help

Over the past few years, a plethora of orchestration frameworks have been exploding onto the scene. Many have been around for quite a while but not all have the same sort of community behind them. For example there's a very interesting option in Joey Hess' Propellor but that is hurt by needing to be able to build Propellor on all the hosts you manage. On the other hand, Ansible is able to operate without installing extra software on your target hosts, but instead it ends up very latency-bound which can cause problems when your managed hosts are "far away". I have considered CFEngine, Chef, Puppet and Salt in addition to the above mentioned options, but none of them feel quite right to me. I am looking for a way to manage a small number of hosts, at least one of which is not always online (my laptop) and all of which are essentially snowflakes whose sparkleybits I want some reasonable control over. I have a few basic requirements which I worry would be hard to meet -- I want to be able to make changes to my hosts by editing a file and committing/pushing it to a git server. I want to be able to manage a host entirely over SSH from one or more systems, ideally without having to install the orchestration software on the target host, but where if the software is present it will get used to accelerate matters. I don't want to have to install Ruby or PHP on any system in order to have orchestration, and some of the systems I wish to manage simply can't compile Haskell stuff sanely. I'm not desperately interested in learning yet more DSLs, but I appreciate that it will be necessary, but I really don't want to have to learn more than one DSL simply to run one frameworks. I don't want to have to learn strange and confusing combinations of file formats. For example, Ansible quite sensibly uses YAML for its structured data except for its host/group lists. It uses Jinja2 for its templating and looping, except for some things which it generates its own looping constructs inside its YAML. I also personally find Ansible's sportsball oriented terminology to be confusing, but that might just be me. So what I'm hoping is that someone will be able to point me at a project which combines all the wonderful features of the above, with a need to learn only one DSL and which doesn't require to be installed on the managed host but which can benefit from being so installed, is driven from git, and won't hurt my already overly burdened brain. Dear Lazyweb, pls. kthxbye.

Next.

Previous.