Search Results: "nma"

Co-inciding with the first DebConf in Switzerland, one of the world's leading financial centers, the first official packaging of open messaging and market data distribution framework OpenMAMA for a Linux distribution has just been uploaded. The packages, along with the Avis low-latency event-router middleware/transport were uploaded to the Debian unstable catalog this week and will soon be available conveniently to install with apt-get.

OpenMAMA was developed by NYSE Technologies and includes code originally developed under their previous brand Wombat Financial Software. The project was recently placed under the strategic umbrella of the Linux Foundation. Packages for Fedora and EPEL The initial packaging effort has identified a number of build system bugs, patches have been contributed upstream. The resolution of these issues and the experience gained with the Debian package will make it relatively easy to package for RPM-based platforms in the near future. Not just for finance While it is clear that OpenMAMA's designers had financial services in mind (and the low-latency, high throughput transport of market price data in particular), the solution is generalised and likely to be useful in other domains where asynchronous messaging and inter-process communication is required. In fact, this distinction is made particularly clear by the division of OpenMAMA into two subprojects:

OpenMAMA itself is a general-purpose programming API for asynchronous messaging. It hides the details of various low-level transports, including the open source Avis event router and popular proprietary solutions like Tibco Rendezvous. Java programmers have had such a generalised API for many years (JMS), whereas OpenMAMA brings a similar paradigm to the C/C++ developer.
OpenMAMDA is a further layer on top of OpenMAMA designed to encapsulate market data. It competes directly with proprietary solutions such as those from Reuters and Bloomberg. OpenMAMDA comes with specific APIs for news, order books and options and could be extended for other markets.

Commercial background Reuters and Bloomberg are well known as two of the main vendors in the market data industry. Both of them (and other competitors) provide a range of data services and related software. Buying a data feed doesn't automatically give access to the software from the same franchise: the software and APIs are promoted as a valuable product in their own right. It is actually quite possible (and not unheard of) for an institution to run a Reuters Market Data System (RMDS) software stack fed by a data feed from Bloomberg or vice-versa. When an IT department or third-party vendor of trading systems wants to transport data between applications (or between multiple users of a single application) they will not typically do it themselves and one of these APIs is usually chosen. OpenMAMA appears to be a strong contender for such use cases. Bloomberg has recently made their API public, although OpenMAMA goes much further by making their source code public too. Development samples with the OpenMAMA API Programming the OpenMAMA API appears to be relatively consistent with the event-loop model that many developers are already comfortable with. For a very fast start, two compelling examples are the basic publisher and basic subscriber. Here is a sample of the code from the basic subscriber, demonstrating how to start the event loop and receive event notifications in a callback class:

static void createSubscriber (void)
 
    try
     
        gSubscription = new MamaBasicSubscription;
        gSubscription->createBasic (gTransport,
                                    gDefaultQueue,
                                    new SubscriptionCallback (),
                                    gTopic);
        gSubscription->setDebugLevel (gSubscLogLevel);
     
    catch (MamaStatus &status)
     
        cerr << "Error creating subscription: " 
             << status.toString () << endl;
        exit (1);

and here is some basic code that processes messages asynchronously:

class SubscriptionCallback : public MamaBasicSubscriptionCallback
 
public:
    virtual ~SubscriptionCallback ()  
    virtual void onCreate (MamaBasicSubscription*  subscription)
     
        if (gQuietLevel < 2)
         
            printf ("Created inbound subscription.\n");
         
     
    virtual void onError (MamaBasicSubscription*  subscription,
                          const MamaStatus&       status,
                          const char*             subject) 
     
        printf ("Error creating subscription: %s\n", 
                status.toString ());
        exit (1);
     
    virtual void onMsg (MamaBasicSubscription* subscription, 
                        MamaMsg&               msg)
     
        if (gQuietLevel < 2)
         
            printf ("Recieved msg.\n");
         
        DisplayIterator it;
        msg.iterateFields (it, NULL, NULL);
     
    //JG: need to add in onDestroy as this is abstract and must be implemented
    virtual void onDestroy (MamaBasicSubscription*  subscription, void * closure)
     
        if (gQuietLevel < 2)
         
            printf ("Destroyed subscription.\n");
         
     
 ;

Practical uses outside financial services Some people may feel that having a low-latency market-data system is overkill for anybody not running a trading desk. Not so. OpenMAMA may well prove useful and convenient as a one-stop-shop API for multi-currency accounting software (Postbooks, GnuCash, etc), for multi-currency web sites (e.g. UberCart) and many other applications.

https://chris-lamb.co.uk/wp-content/2013/cotswold_course.jpg

Since becoming interested in triathlon in October of last year, my goal in 2013 was not to just finish a "70.3" (or "Half-Ironman"), but to complete one in under 5 hours. At the time, each discipline was woefully inadequate; I had not swum in over a decade, my cycling was average and I had only begun running again after years away from exercise. The somewhat arbitrary target time would dictate my training. For example, the high proportion of time spent on the bike combined with the injury-sensitive nature of running meant that cycling would have a highest return on investment of the three disciplines. Despite that, I would need to take the run seriously but carefully - I decided to enter a series of monthly 10K races where I could steadily reduce my times over the year. Races themselves formed a crucial part of my preparation and a carefully balanced race calendar was surprisingly important, balancing upcoming milestones that would provide an achievable goal as well as uncovering weaknesses in enough time so they could be worked on. Whilst I did post about my first triathlon, I felt no compulsion with the interleaving five or six races as I was evaluating them in the context of the 70.3 rather than as races in their own right.

Swim

Distance: 1900m
Time: 37:42

Whilst this wasn't my worst open water swim, it was certainly not my best. The first 500m was straightforward, but I lost my form over the next 500m and I overcompensated with excessive kick. My calves responded by cramping badly two or three times after that, losing both momentum and time. Curiously, whenever I could identify my speed relative to my effort (for example, by some underwater reeds) I could use that as feedback and my rotation (etc.) would temporarily return. Pool swimming always has markers of this kind, whilst a murky lake does not. In conclusion, my lack of open water training outside of races held me back more than I expected.

Bike

Distance: 52 miles
Time: 2:22 (21.9 mph average)

I had thoroughly absorbed the advice that you should prepare for your primary race so that it feels like another day at the office. On this criterion, the bike leg was almost perfect. My nutrition strategy energy drink every 5 minutes, gel every 30 minutes worked fine until mile 35 where I felt like I had taken on too much fluid (and no time to take a bathroom break). I had a temporary hiccup with my rear derailleur but my "tame" 52/34 12x28 gearing was vindicated on the climbs, although in retrospect that might mostly be schadenfreude. Tens of hours acclimatising to a time trial bike was rewarded by being able to spend the entire leg in "aero" position (ignoring 90-degree turns or serious gradients), improving efficiency.

Run

https://chris-lamb.co.uk/wp-content/2013/cotswold_run.jpg

Distance: 13.1 miles (21km)
Time: 1:54:18 (5:25/km)

I had prepared a chart which provided the pace I required based on the race time at the start of the run. I would then only need to monitor my run pace instead of repeatedly extrapolating a finish time as even basic arithmetic can become impossible when fatigued. This strategy was chosen as I was too risk-adverse to aim for a faster time than strictly required; the downside of missing the target from aiming too high and "blowing up" outweighed going a few minutes faster overall. Despite that, I ran half-marathon personal best. Unfortunately, due to pressing the wrong watch button after the swim, the chart was worthless unless I could assume the race started exactly at 6:30AM. With no other option I decided to trust that with some padding, but the uncertainly it added was unsettling. Adding to that feeling, my left hip started to twinge at 7K, something it has never done before. My plan was to get to 16K, take a caffeine gel and then keep ratcheting up the pace until the finish. In my long run training I could speed up to a 4:10/km pace but after 5 hours of racing and being reasonably sure I was going to reach my goal, the best I could summon was 4:45/km. My form completely shot, I crossed the finish line and got into a fetal position in the shade behind a tent, scaring the race organisers for a few minutes.

Overall

Total time: 4:56:50

Writing this the day after the race, I am still a little unsure of how I feel. I am obviously extremely content that I reached my goal but given the volume and detail of preparation it was not a huge surprise to me on race day that I did so. This combined with the "real" work and progress being achieved throughout the training seems to have robbed the event of some element of triumph it could have had, but that in itself was somewhat expected. Where next? I had always dismissed the consensus view of needing to take a decent break after the season has ended but now I am looking forward to putting triathlon-specific training on hold for a while and explore other things. I highly doubt this will be my last triathlon though.

https://chris-lamb.co.uk/wp-content/2013/cotswold_result.jpg

(Full results)

A bug-fix release 3.900.7 of Armadillo was provided by Conrad a few days ago. It has been rolled into a new RcppArmadillo release 0.3.900.7 which, after a brief delay, is now on CRAN and in Debian. The main bug fix is a change in the in-place version of reshape(). This in turn caused the CRAN package Amelia to fail, but some diligent debugging by Conrad (which was much appreciated) revealed that the error was in fact in RcppArmadillo where we did not set the matrix flag properly in the constructor. The corresponding one-character fix had been made in this release. Another package exhibiting an issue is unmarked. It needs to make the target variable of reshape a matrix object in a handful of places. I sent the authors a small patch addressing this but have not yet heard back. The complete list of changes is below. In the meantime, I have also done some work on a new as() and wrap() converters for sparse matrices; a first implementation is in SVN.

Changes in RcppArmadillo version 0.3.900.7 (2013-08-02)

Upgraded to Armadillo release Version 3.900.7 (Bavarian Sunflower)

minor fix for inplace reshape()

minor corrections for compilation issues under GCC 4.8+ and MSVC

Corrected setting of vec_stats in intialization of row, vector and matrix objects

The inline package is no longer used in the examples and unit tests which have all been converted to using Rcpp attributes

Courtesy of CRANberries, there is also a diffstat report for the most recent release As always, more detailed information is on the RcppArmadillo page. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page.

This is time again for my annual report about the number of developers per country. This is now the fifth edition of this report, after the 2012, 2011, 2010 and 2009 editions. So, here we are with the July 2013 version, sorted by the ratio of *active* developers per million population for each country.

Act: number of active developers
Dev: total number of developers
A/M: number of active devels per million pop.
D/M: number of devels per million pop.
2009: rank in 2009
2010: rank in 2010
2011: rank in 2011 (June)
2011: rank in 2012 (June)
2013: rank now

Code	Name	Population	Act Dev	Dev	Act/Million	Dev/Million	2009	2010	June 2011	June 2012	July 2013
fi	Finland	5259250	19	31	3,61	5,89	1	1	1	1	1
ie	Ireland	4670976	12	15	2,57	3,21	13	9	6	2	2
ch	Switzerland	7870134	20	27	2,54	3,43	2	2	2	3	3
mq	Martinique	396404	1	1	2,52	2,52			3	4	4
se	Sweden	9088728	22	37	2,42	4,07	3	6	7	5	5
no	Norway	4973029	12	15	2,41	3,02	5	4	4	6	6
nz	New Zealand	4331600	10	15	2,31	3,46	4	3	5	7	7
de	Germany	81471834	165	235	2,03	2,88	7	7	9	9	8	*
lu	Luxemburg	503302	1	1	1,99	1,99	8	5	8	8	9	*
at	Austria	8217280	16	26	1,95	3,16	6	8	10	10	10
fr	France	65350000	100	130	1,53	1,99	12	12	11	11	11
au	Australia	22607571	31	59	1,37	2,61	9	10	12	12	12
be	Belgium	11071483	14	17	1,26	1,54	10	11	13	13	13
uk	United-Kingdom	62698362	73	114	1,16	1,82	14	14	14	14	14
nl	Netherlands	16728091	19	40	1,14	2,39	11	13	15	15	15
ca	Canada	33476688	32	61	0,96	1,82	15	15	17	16	16
dk	Denmark	5529888	5	10	0,9	1,81	17	17	16	17	17
es	Spain	46754784	35	56	0,75	1,2	16	16	19	18	18
it	Italy	59464644	36	51	0,61	0,86	23	22	22	19	19
cz	Czech Rep	10190213	6	6	0,59	0,59	21	20	21	21	20	*
lt	Lithuania	3535547	2	2	0,57	0,57	28	19	20	22	21	*
us	USA	313232044	173	378	0,55	1,21	19	21	25	24	22	*
il	Israel	7740900	4	6	0,52	0,78	24	24	24	25	23	*
hu	Hungary	10076062	5	10	0,5	0,99	18	25	26	20	24	*
hr	Croatia	4290612	2	2	0,47	0,47	20	18	18	26	25	*
lv	Latvia	2204708	1	1	0,45	0,45	26	26	27	27	26	*
bg	Bulgaria	7364570	3	3	0,41	0,41	25	23	23	23	27	*
uy	Uruguay	3477778	1	2	0,29	0,58	22	27	28	28	28
jp	Japan	127078679	35	50	0,28	0,39	30	28	29	29	29
pl	Poland	38441588	10	14	0,26	0,36	29	29	30	30	30
cr	Costa Rica	4301712	1	1	0,23	0,23	31	30	31	31	31
by	Belarus	9577552	2	2	0,21	0,21	35	36	39	39	32	*
sg	Singapore	5183700	1	1	0,19	0,19				33	33
pt	Portugal	10561614	2	4	0,19	0,38	27	32	32	34	34
gr	Greece	10787690	2	3	0,19	0,28	33	38	34	35	35
sk	Slovakia	5477038	1	1	0,18	0,18	32	31	33	36	36
ar	Argentina	40677348	6	8	0,15	0,2	34	33	35	32	37	*
rs	Serbia	7186862	1	1	0,14	0,14					38	*
tw	Taiwan	23040040	3	3	0,13	0,13	37	34	37	37	39	*
br	Brazil	192376496	21	23	0,11	0,12	36	35	38	38	40	*
cu	Cuba	11241161	1	1	0,09	0,09		38	41	41	41
kr	South Korea	48754657	4	6	0,08	0,12	39	39	42	42	42
gt	Guatemala	13824463	1	1	0,07	0,07					43	*
ve	Venezuela	28047938	2	2	0,07	0,07	40	45	50	49	44	*
ec	Ecuador	15007343	1	1	0,07	0,07		40	43	43	45	*
co	Colombia	45566856	3	4	0,07	0,09	41	44	46	47	46	*
cl	Chile	16746491	1	2	0,06	0,12	42	41	44	44	47	*
za	South Africa	50590000	3	10	0,06	0,2	38	48	48	48	48
ru	Russia	143030106	7	8	0,05	0,06	43	42	47	45	49	*
mg	Madagascar	21281844	1	1	0,05	0,05	44	37	40	40	50	*
ro	Romania	21904551	1	2	0,05	0,09	45	43	45	46	51	*
my	Malaysia	28250000	1	1	0,04	0,04			49	50	52	*
pe	Peru	29907003	1	1	0,03	0,03	46	46	51	51	53	*
tr	Turkey	74724269	2	2	0,03	0,03	47	47	52	52	54	*
ua	Ukraine	45134707	1	1	0,02	0,02	48	53	58	59	55	*
th	Thailand	66720153	1	2	0,01	0,03	50	50	54	54	56	*
eg	Egypt	80081093	1	3	0,01	0,04	51	51	55	55	57	*
mx	Mexico	112336538	1	1	0,01	0,01	49	49	53	53	58	*
cn	China	1344413526	10	14	0,01	0,01	53	53	57	56	59	*
in	India	1210193422	9	9	0,01	0,01	52	52	56	57	60	*
sv	El Salvador	7066403	0	1	0	0,14			36	58	61	*


			957	1535	62,35%

A few interesting facts:

Rankings are very stable: the first 7 countries are the same
Germany takes Luxemburg over with 10 more active developers than last year
Finland is still ranked 1st but loses two active developers. Still, it would need to lose 6 developers to lose rank 1
By losing one active developer, Hungary drops from 20th to 24th
Similar loss for Bulgaria, dropping from 23rd to 27th
Belarus doubles its number of developers from 1 to 2 and therefore jumps from rank 39 to 32
Serbia gains its first developer (indeed, the person registered with the "yu" ISO code and I arbitrarily decided that would count for Serbia.....please correct me if I'm wrong) and shows up at rank 38
Argentina sadly loses two active developers and rops to rank 37
Venezuela doubles its number of developers from 1 to 2 and slightly climbs up
Even though both of them gained one developer, the two most populated countries in the world, China and India, remain very low. China would indeed need 2730 developers to reach the ratio of Germany and India would need 2470.
Again, one new country : Guatemala. Let's take this as an achievement of another DebConf in Central America, last year.
Ukraine shows up again and I'm partly responsible for that as I processed Boris Pek's application as DD!
This year, DebConf will be hosted in one of the top-ranked countries, namely Switzerland. Guys, 9 more developers and you can overtake Finland!
We have 37 more active Debian developers and 45 more developers overall.
The ratio of active developers increases from 61.74% to 62.35%

There is intense interest in communications privacy at the moment thanks to the Snowden scandal. Open source software has offered credible solutions for privacy and encryption for many years. Sadly, making these solutions work together is not always plug-and-play. In fact, secure networking, like VoIP, has been plagued by problems with interoperability and firewall/filtering issues although now the solutions are starting to become apparent. Here I will look at some of them, such as the use of firewall zones to simplify management or the use of ECDSA certificates to avoid UDP fragmentation problems. I've drawn together a lot of essential tips from different documents and mailing list discussions to demonstrate how to solve a real-world networking problem. A typical network scenario and requirements Here is a diagram of the network that will be used to help us examine the capabilities of these open source solutions.

Some comments about the diagram:

The names in square brackets are the zones for Shorewall, they are explained later.
The dotted lines are IPsec tunnels over the untrusted Internet.
The road-warrior users (mobiles and laptops) get virtual IP addresses from the VPN gateway. The branch offices/home routers do not use virtual IPs.
The mobile phones are largely untrusted: easily lost or stolen, many apps have malware, they can only tunnel to the central VPN and only access a very limited range of services.
The laptops are managed devices so they are trusted with access to more services. For efficiency they can connect directly to branch office/home VPNs as well as the central server.
Smart-phone user browsing habits are systematically monitored by mobile companies with insidious links into mass-media and advertising. Road-warriors sometimes plug-in at client sites or hotels where IT staff may monitor their browsing. Therefore, all these users want to tunnel all their browsing through the VPN.
The central VPN gateway/firewall is running strongSwan VPN and Shorewall firewall on Linux. It could be Debian, Fedora or Ubuntu. Other open source platforms such as OpenBSD are also very well respected for building firewall and VPN solutions, but Shorewall, which is one of the key ingredients in this recipe, only works on Linux at present.
The branch office/home network could be another strongSwan/Shorewall server or it could also be an OpenWRT router
The default configuration for most wifi routers creates a bridge joining wifi users with wired LAN users. Not here, it has been deliberately configured as an independent network. Road-warriors who attach to the wifi must use VPN tunnelling to access the local wired network. In OpenWRT, it is relatively easy to make the Wifi network an independent subnet. This is an essential security precaution because wifi passwords should not be considered secure: they are often transmitted to third parties, for example, by the cloud backup service in many newer smart phones.

Package mayhem The major components are packaged on all the major Linux distributions. Nonetheless, in every case, I found that it is necessary to re-compile fresh strongSwan packages from sources. It is not so hard to do but it is necessary and worth the effort. Here are related blog entries where I provide the details about how to re-build fresh versions of the official packages with all necessary features enabled:

For Debian users, compile strongSwan 5.0 for wheezy using official packaging artifacts from the Debian maintainers. Wheezy currently only contains v4.5.x, which doesn't have several compelling features.
For Fedora users, use rpmbuild to re-compile strongSwan 5.0 to get Elliptic Curve (ECDSA) support which works better than RSA for NAT users.
For OpenWRT, re-compile strongSwan 5.0 to get Elliptic Curve (ECDSA) support which works better than RSA for NAT users.

Using X.509 certificates as a standard feature of the VPN For convenience, many people building a point-to-point VPN start with passwords (sometimes referred to as pre-shared keys (PSK)) as a security mechanism. As the VPN grows, passwords become unmanageable. In this solution, we only look at how to build a VPN secured by X.509 certificates. The certificate concept is not hard. In this scenario, there are a few things that make it particularly easy to work with certificates:

strongSwan comes with a convenient command line tool, ipsec pki. Many of it's functions are equivalent to things you can do with OpenSSL or GnuTLS. However, the ipsec pki syntax is much more lightweight and simply provides a convenient way to do the things you need to do when maintaining a VPN.
Many of the routine activities involved in certificate maintainence can be scripted. My recent blog about using Android clients with strongSwan gives a sample script demonstrating how ipsec pki commands can be used to prepare a PKCS#12 (.p12) file that can be easily loaded into an Android device using the SD-card.
For building a VPN, there is no need to use a public certificate authority such as Verisign. Consequently, there is no need to fill in all their forms or make any payments for each device/certificate. Some larger organisations do choose to outsource their certificate management to such firms. For smaller organisations, an effective and sometimes better solution can be achieved by maintaining the process in-house with a private root CA.

UDP fragmentation during IPsec IKEv2 key exchange and ECDSA A common problem for IPsec VPNs using X.509 certificates is the fragmentation of key exchange datagrams during session setup. Sometimes it works, sometimes it doesn't. Various workarounds exist, such as keeping copies of all certificates from potential peers on every host. As the network grows, this becomes inconvenient to maintain and to some extent it eliminates the benefits of using PKI. Fortunately, there is a solution: Elliptic Curve Cryptography (ECC). Many people currently use RSA key-pairs. Best practice suggests using RSA keys of at least 2048 bits and often 4096 bits. Using ECC with a smaller 384-bit key is considered to be equivalent to a 7680 bit RSA key pair. Consequently, ECDSA certificates are much smaller than RSA certificates. Furthermore, at these key sizes, the key exchange packets are almost always smaller than the typical 1500 byte MTU. A further demand for ECDSA is arising due to the use of ECC within smart cards. Many smartcards don't support any RSA key larger than 2048 bits. The highly secure 384-bit ECC key is implemented in quite a few common smart cards. Smart card vendors have shown a preference for the ECC keys due to the US Government's preference for ECC and the lower computational overheads make them more suitable for constrained execution environments. Anyone who wants to use smart cards as part of their VPN or general IT security now, or in the future, needs to consider ECC/ECDSA. Making the network simple with Shorewall zones For this example, we are not just taking some easy point-to-point example. We have a real-world, multi-site, multi-device network with road warriors. Simplifying this architecture is important to help us understand and secure it. The solution? Each of these is abstracted to a "zone" in Shorewall. In the diagram above, the zone names are in square brackets. The purpose of each zone is described below:

Zone name	Description
loc	This is the private LAN and contains servers like databases, private source code respositories and NFS file servers
dmz	This is the DMZ and contains web servers that are accessible from the public internet. Some of these servers talk to databases or message queues in the LAN network loc
vpn_a	These are road warriors that are not very trustworthy, such as mobile devices. They are occasionally stolen and usually full of spyware (referred to by users as "apps"). They have limited access to ports on some DMZ servers, e.g. for sending and receiving mail using SMTP and IMAP (those ports are not exposed to the public Internet at large). They use the VPN tunnel for general internet access/browsing, to avoid surveillance by their mobile carrier.
vpn_b	These are managed laptops that have a low probability of malware infection. They may well be using smart cards for access control. Consequently, they are more trusted than the vpn_a users and have access to some extra intranet pages and file servers. Like the smart-phone users, they use the VPN tunnel for general internet access/browsing, to avoid surveillance by third-party wifi hotspot operators.
vpn_c	This firewall zone represents remote sites with managed hardware, such as branch offices or home networks with IPsec routers running OpenWRT.
cust	These are servers hosted for third-parties or collaborative testing/development purposes. They have their own firewall arrangements if necessary.
net	This zone represents traffic from the public Internet.

A practical Shorewall configuration Shorewall is chosen to manage the iptables and ip6tables firewall rules. Shorewall provides a level of abstraction that makes netfilter much more manageable than manual iptables scripting. The Shorewall concept of zones is very similar to the zones implemented in OpenWRT and this is an extremely useful paradigm for firewall management. Practical configuration of Shorewall is very well explained in the Shorewall quick start. The one thing that is not immediately obvious is a strategy for planning the contents of the /etc/shorewall/policy and /etc/shorewall/rules files. The exact details for making it work effectively with a modern IPsec VPN are not explained in a single document, so I've gathered those details below as well. An effective way to plan the Shorewall zone configuration is with a table like this:

		loc	dmz	vpn_a	vpn_b	vpn_c	cust	net
		Destination zone
Source zone	loc	\
	dmz	?	\	X	X	X
	vpn_a	?	?	\	X	X
	vpn_b	?	?	X	\	X
	vpn_c	X				\
	cust	X	?	X	X	X	\
	net	X	?	X	X	X		\

The symbols in the table are defined:

Symbol	Meaning
	ACCEPT in policy file
X	REJECT or DROP in policy file
?	REJECT or DROP in policy file, but ACCEPT some specific ports in the rules file

Naturally, this modelling technique is valid for both IPv4 and IPv6 firewalling (with Shorewall6) Looking at the diagram in two dimensions, it is easy to spot patterns. Each pattern can be condensed into a single entry in the rules file. For example, it is clear from the first row that the loc zone can access all other zones. That can be expressed very concisely with a single line in the policy file:

loc all ACCEPT

Specific Shorewall tips for use with IPsec VPNs and strongSwan Shorewall has several web pages dedicated to VPNs, including the IPsec specific documentation.. Personally, I found that I had to gather a few details from several of these pages to make an optimal solution. Here are those tips:

Ignore everything about the /etc/shorewall/tunnels file. It is not needed and not used any more
Name the VPN zones (we call them vpn_a, vpn_b and vpn_c) in the zones file but there is no need to put them in the /etc/shorewall/interfaces file.
The /etc/shorewall/hosts file is not just for hosts and can be used to specify network ranges, such as those associated with the VPN virtual IP addresses. The ranges you put in this file should match the rightsourceip pool assignments in strongSwan's /etc/ipsec.conf
One of the examples suggests using mss=1400 in the /etc/shorewall/zones file. I found that is too big and leads to packets being dropped in some situations. To start with, try a small value such as 1024 and then try larger values later after you prove everything works. Setting mss for IPsec appears to be essential.
Do not use the routefilter feature in the /etc/shorewall/interfaces file as it is not compatible with IPsec

Otherwise, just follow the typical examples from the Shorewall quick start guide and configure it to work the way you want. Here is an example /etc/shorewall/zones file:

fw firewall
net ipv4
dmz ipv4
loc ipv4
cust ipv4
vpn_a ipsec mode=tunnel mss=1024
vpn_b ipsec mode=tunnel mss=1024
vpn_c ipsec mode=tunnel mss=1024

Here is an example /etc/shorewall/hosts file describing the VPN ranges from the diagram:

vpn_a eth0:10.1.100.0/24 ipsec
vpn_b eth0:10.1.200.0/24 ipsec
vpn_c eth0:192.168.1.0/24 ipsec

Here is an example /etc/shorewall/policy file based on the table above:

loc all ACCEPT
vpn_c all ACCEPT
cust net ACCEPT
net cust ACCEPT
all all REJECT

Here is an example /etc/shorewall/rules file based on the network:

SECTION ALL
# allow connections to the firewall itself to start VPNs:
# Rule  source    dest    protocol/port details
ACCEPT   all       fw                ah
ACCEPT   all       fw                esp
ACCEPT   all       fw                udp 500
ACCEPT   all       fw                udp 4500
# allow access to HTTP servers in DMZ:
ACCEPT   all       dmz               tcp 80
# allow connections from HTTP servers to MySQL database in private LAN:
ACCEPT   dmz       loc:10.2.0.43     tcp 3306
# allow connections from all VPN users to IMAPS server in private LAN:
ACCEPT vpn_a,vpn_b,vpn_c loc:10.2.0.58 tcp 993
# allow VPN users (but not the smartphones in vpn_a) to the
# PostgresQL database for PostBooks accounting system:
ACCEPT vpn_b,vpn_c loc:10.2.0.48      tcp 5432
SECTION ESTABLISHED
ACCEPT   all       all
SECTION RELATED
ACCEPT   all       all

Once the files are created, Shorewall can be easily activated with:

# shorewall compile && shorewall restart

strongSwan IPsec VPN setup Like Shorewall, strongSwan is also very well documented and I'm just going to focus on those specific areas that are relevant to this type of VPN project.

Allow the road-warriors to send all browsing traffic over the VPN means including leftsubnet=0.0.0.0/0 in the VPN server's /etc/ipsec.conf file. Be wary though: sometimes the road-warriors start sending the DHCP renewal over the tunnel instead of to their local DHCP server.
As we are using Shorewall zones for firewalling, you must set the options leftfirewall=no and lefthostaccess=no in ipsec.conf. Shorewall already knows about the remote networks as they are defined in the /etc/shorewall/hosts file and so firewall rules don't need to be manipulated each time a tunnel goes up or down.
As discussed above, X.509 certificates are used for peer authentication. In the certificate Distinguished Name (DN), store the zone name in the Organizational Unit (OU) component, for example, OU=vpn_c, CN=gw.branch1.example.org
In the ipsec.conf file, match the users to connections using wildcard specifications such as rightid="OU=vpn_a, CN=*"
Put a subjectAltName with hostname in every certificate. The --san option to the ipsec pki commands adds the subjectAltName.
Keep the certificate distinguished names (DN) short, this makes the certificate smaller and reduces the risk of fragmented authentication packets. Many examples show a long and verbose DN such as C=GB, O=Acme World Wide Widget Corporation, OU=Engineering, CN=laptop1.eng.acme.example.org. On a private VPN, it is rarely necessary to have all that in the DN, just include OU for the zone name and CN for the host name.
As discussed above, use the ECDSA scheme for keypairs (not RSA) to ensure that the key exchange datagrams don't suffer from fragmentation problems. For example, generate a keypair with the command ipsec pki --gen --type ecdsa --size 384 > user1Key.der
Road warriors should have leftid=%fromcert in their ipsec.conf file. This forces them to use the Distinguished Name and not the subjectAltName (SAN) to identify themselves.
For road warriors who require virtual tunnel IPs, configure them to request both IPv4 and IPv6 addresses (dual stack) with leftsourceip=%config4,%config6 and on the VPN gateway, configure the ranges as arguments to rightsourceip
To ensure that roadwarriors query the LAN DNS, add the DNS settings to strongswan.conf and make sure road warriors are using a more recent strongSwan version that can dynamically update /etc/resolv.conf. Protecting DNS traffic is important for privacy reasons. It also makes sure that the road-warriors can discover servers that are not advertised in public DNS records.

Central firewall/VPN gateway configuration Although they are not present in the diagram, IPv6 networks are also configured in these strongSwan examples. It is very easy to combine IPv4 and IPv6 into a single /etc/ipsec.conf file. As long as the road-warriors have leftsourceip=%config4,%config6 in their own configurations, they will operate dual-stack IPv4/IPv6 whenver they connect to the VPN. Here is an example /etc/ipsec.conf for the central VPN gateway:

config setup
        charonstart=yes
        charondebug=all
        plutostart=no
conn %default
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
conn branch1
        left=198.51.100.1
        leftsubnet=203.0.113.0/24,10.0.0.0/8,2001:DB8:12:80:/64
        leftcert=fw1Cert.der
        leftid=@fw1.example.org
        leftfirewall=no
        lefthostaccess=no
        right=%any
        rightid=@branch1-fw.example.org
        rightsubnet=192.168.1.0/24
        auto=add
conn rw_vpn_a
        left=198.51.100.1
        leftsubnet=0.0.0.0/0,::0/0
        leftcert=fw1Cert.der
        leftid=@fw1.example.org
        leftfirewall=no
        lefthostaccess=no
        right=%any
        rightid="OU=vpn_a, CN=*"
        rightsourceip=10.1.100.0/24,2001:DB8:1000:100::/64
        auto=add
conn rw_vpn_b
        left=198.51.100.1
        leftsubnet=0.0.0.0/0,::0/0
        leftcert=fw1Cert.der
        leftid=@fw1.example.org
        leftfirewall=no
        lefthostaccess=no
        right=%any
        rightid="OU=vpn_b, CN=*"
        rightsourceip=10.1.200.0/24,2001:DB8:1000:200::/64
        auto=add

Sample branch office or home router VPN configuration Here is an example /etc/ipsec.conf for the Linux server or OpenWRT VPN at the branch office or home:

conn head_office
        left=%defaultroute
        leftid=@branch1-fw.example.org
        leftcert=branch1-fwCert.der
        leftsubnet=192.168.1.0/24,2001:DB8:12:80:/64
        leftfirewall=no
        lefthostaccess=no
        right=fw1.example.org
        rightid=@fw1.example.org
        rightsubnet=203.0.113.0/24,10.0.0.0/8,2001:DB8:1000::/52
        auto=start
# notice we only allow vpn_b users, not vpn_a
# these users are given virtual IPs from our own
# 192.168.1.0 subnet
conn rw_vpn_b
        left=branch1-fw.example.org
        leftsubnet=192.168.1.0/24,2001:DB8:12:80:/64
        leftcert=branch1-fwCert.der
        leftid=@branch1-fw.example.org
        leftfirewall=no
        lefthostaccess=no
        right=%any
        rightid="OU=vpn_b, CN=*"
        rightsourceip=192.168.1.160/27,2001:DB8:12:80::8000/116
        auto=add

Further topics Shorewall and Shorewall6 don't currently support a unified configuration. This can make it slightly tedious to duplicate rules between the two IP variations. However, the syntax for IPv4 and IPv6 configuration is virtually identical. Shorewall only currently supports Linux netfilter rules. In theory it could be extended to support other types of firewall API, such as pf used by OpenBSD and the related BSD family of systems. A more advanced architecture would split the single firewall into multiple firewall hosts, like the inner and outer walls of a large castle. The VPN gateway would also become a standalone host in the DMZ. This would require more complex routing table entries. Smart cards with PIN numbers provide an effective form of two-factor authentication that can protect certificates for remote users. Smart cards are documented well by strongSwan already so I haven't repeated any of that material in this article. Managing a private X.509 certificate authority in practice may require slightly more effort than I've described, especially when an organisation grows. Small networks and home users don't need to worry about these details too much, but for most deployments it is necessary to consider things like certificate revocation lists and special schemes to protect the root certificate's private key. EJBCA is one open source project that might help. Some users may want to consider ways to prevent the road-warriors from accidentally browsing the Internet when the IPsec tunnel is not active. Such policies could be implemented with some basic iptables firewalls rules in the road-warrior devices. Summary Using these strategies and configuration tips, planning and building a VPN will hopefully be much simpler. Please feel free to ask questions on the mailing lists for any of the projects discussed in this blog.

Someone recently asked me about the Debian Xfce 4.10 status, as apparently I forgot to update this post series. So, as you might have noticed, the full Xfce 4.10 desktop environment is currently in Debian Jessie (current name for testing). All in all, the transition went well and smooth. One of the most regular question I get about Xfce 4.10 is the panel behavior when it comes to the task bar expansion. In xfce4-panel 4.8, when people wanted to have a full side panel with a task bar plugin inside, they added a Windows buttons plugin and configured the panel to 100% length. Then the Windows buttons would expand to occupy all the free space on the panel. It was a special case plugins, as usually other plugins only used a fixed space. Now, in 4.10, this is not the case anymore. Windows button uses a fixed size. And the plugins are left-aligned, which means usually people end up with some space at the far right of the panel. To restore the previous behavior back (which is actually the pre-4.8 behavior, 4.8 was an exception by itself), one needs to add a Separator plugin, then configure it to expand (and optionnally select a transparent handle). Then move it next right to the Windows buttons plugin. Another thing which might be a bit surprising for upgrading users is the change in the Action buttons plugin, which people usually use to logout. In 4.8, by default, it's set to run the logout dialog. In 4.10, by default, it's set to logout directly (but with a confirmation dialog). If you prefer the previous behavior, you can just configure the Action buttons plugin and select the Log out item instead of the Log out one (I know, it's a bit confusing). If you have any question, don't hesitate to reach us by mail or on irc (#debian-xfce on Freenode). Other than that remember that Xfce really needs you help, both in Debian and upstream (and at that point, I'd say *especially* upstream). There's a lot of unmaintained project under the Xfce umbrella, some of them part of the core (like xfce4-power-manager), so if you have some spare time and some C/GTK+ knowledge, feel free to contact the Xfce team on the mailing list.

I found the following news item; if you can read Spanish, you will most probably prefer the original version in the Proceso magazine's site. The subject? The federal police (PGR) and army arrest 17 artisans for making money out of Spiderman. The following translation is mine. Done past midnight, and being quite tired, and translated so this news item can reach a broader audience. All errors are mine (except those carried out by the security forces, that is).

June 13, 2013 Cuernavaca, Morelos. Policement from the General Republic Attorney (Procuradur a General de la Rep blica, PGR) and the Army entered and searched the "3 de mayo" neighbourhood, in the municipality of Emiliano Zapata, detaining 17 ceramist artisans that sold candies, dolls and pi atas shaped like Spiderman. This search was done on the evening of last Wednesday, around 16:00. Federal ministerial policement and army soldiers closed a street with several informal stores and detained workers taht were selling this Marvel Comics character, following said company's denounce. As a result for this operation, 17 artisants were detained, although the same day five of them were freed. The policemen also seized 12 bags of candies, pi atas, ceramics and wooden figures of the superhero. PGR closed down 11 stores where ceramics with this same figure was being sold, accusing the detainees of plagiarizing Spiderman's image, protected under the copyright law. The 12 that remained under detention were put at the Federal Justice's disposal, which prompted that this Thursday, around 10AM, hundreds of sellers of "3 de mayo" went out to PGR's building to demand their friends' freedom, who are facing a bail of up to 200,000 pesos (~USD$18,000). Outraged because they said they were treated as if they were part of a drug ring, hundreds of artisans closed intermitently Avenida Cuauhn huac, where the PGR representation in Morelos state is located. The artisans' pressure helped for the amount of the bail to be lowered from MX$200,000 to MX$16,000, and so they were set free. Francisco Fern ndez Flores, president of the Ceramists Association, criticized the operation because, he said, it was as strong as if they were "drug dealers". The artisans explained that they don't even make the Spiderman figures, they are made by the interns of the Centro Estatal de Reinserci n Social de Atlacholoaya (prision), located in the Xochitepec municipality, who offered them to the ceramists so they could be sold. "The Atlacholoaya inmates do them, we buy them to support them, and turns out we are the delinquents now", said Miriam Monroy, sister of one of the detainees. This information was contradicted by Jes s Valencia Valencia, responsible for Morelos' state prision system, who assured that in said prision no ceramics are done. Fern ndez Flores insisted though that from within the prision they are being offered pi atas, candies and "piggy banks" with Spiderman's shape. Jos Luis Pozo, vicepresident of the Ceramists Union, said that to avoid more such federal operations for copyright breaches, they have committed not to produce or commercialize Marvel superhero figures, and any other characters the authority demands. "We do commit to, from now on, those products singled out to us will not be commercialized", he said. Pozo said that the PGR operation caused losses not just to the detained producers and salesmen, but to over 200 ceramists that had to close their stores in solidarity with their friends. Acording to the artisans, the products were a success until the PGR came, seized the products and detained the salesmen.

And yes, the copyright insanity does not stop. Spiderman is by today a clear part of popular culture. Marvel brilliantly succeeded in creating such a popular icon that everybody recognizes, that everybody identifies with And that everybody should be able to recreate. We are not talking about brand protection. Marvel does not, and will never, commercialize pi atas, ceramics or wooden toys. And even if they were plastic-cast While Spiderman is still under the protection of copyright, as the Berne Convention defines it (and of course, as the much stricter Mexican laws agree), that does not mean that any and every product resembling a Spiderman should be protected. Many ceramists and pi ata makers will create unique pieces of art Ok, handicraft. But reading the copyright law more strictly, Spiderman is more treated as a trademark than as a copyright. And it is a trademark that should be declared as having passed on to the public domain.

The Guardian is reporting that Britain's GCHQ first started getting produtive with PRISM early 2012. It was about the same time that their buddies down under, ASIO revised their earlier assessment of a refugee, Ranjini, and scooped her up in Australia's domestic rendition program. This may be more than a notable co-incidince, because it adds further support to the hypothesis that Ranjini is a victim of Big Data and PRISM. If ASIO first gained access to PRISM at the same time as GCHQ, then they may have used some tenuous PRISM data to form their revised assessment of her suitability for a visa. Making such inferences, and using them as the basis for a cruel program of indefinite detention is a gross violation of human rights and goes far beyond the claim that PRISM is about catching real terrorists. I've previously mentioned the systematic persecution of coloured people in my own country. Like many honest people, I'm utterly ashamed of it. The Government also has similar programs for indigineous people (they cooked one aboriginal elder alive on our national holiday) and they've also toyed with outlawing homosexuality. Having seen first hand some of the prejudiced, Government-sanctioned evil that exists in Australia, it's not hard to imagine small-minded members of the public service using PRISM data to target these classes of people for an unhealthy dose of bastardisation. Ranjini was ripped away from her husband by the rendition program and dumped in Sydney's Villawood death camp. Twenty-four hours after the gestapo got their hands on her, it was discovered she was pregnant - her child, an Australian citizen, was recently born and confined to the same concentration camp. Ranjini has racked up more than 12 months in captivity now, most of it while pregnant, and the Government has still not made any official charges against this woman. They say they can't comment on her case for fear of revealing their sources: once again, they don't want to talk about programs like PRISM that they share with the US. Maybe she just had one of the wrong people in her facebook friends list? That is not the sort of evidence that can be used to convict somebody in court, especially if the Government wants to avoid public questioning about their access to a close ally's secret database. Various rapists and murderers have made multiple court appearances in the last 12 months, tried and convicted in accordance with the procedures of justice. Ranjini has not been brought into a court room even once because the spooks don't want to reveal their sinister sources like PRISM.

Australia's close ties with the US Australia has had particularly close ties with the US for many years and just as the British GCHQ has been linked to PRISM, it seems Australia's ASIO is also in on the act. For those not familiar with the depth of this alliance, it is worth checking up on Pine Gap, the ECHELON program and the recent exposure (by Wikileaks) of one of our senators with unauthorised US spy connections - he quietly resigned for family reasons'.

Pine Gap, Australia This is not to say that the US is universally bad or that the strategic alliance is undesirable: rather, it is simply to demonstrate the strength of these links and the real risk that data-sharing is used for inappropriate purposes. While many of us in a technical field treat large volumes of data from a very theoretical perspective, it is worth remembering that in the wrong hands, data can be very dangerous and there are real human victims.

I was asked by some people to write a status report about the whole PK/AS/LI stuff sorry guys that it took so much time to write it

. PackageKit (PackageKit is an abstraction layer for package-management systems, allowing applications to access the package-manager using simple DBus calls)

PackageKit is an incredibly successful project. With the 0.8.x series, it received many performance improvements, and has now the same speed on my computer than the distribution s native tools. PackageKit is used in almost all major Linux distributions, except for Ubuntu[1]. But even Ubuntu has written some compatibility layer, so most calls to PackageKit will work. The only major distro where PackageKit is currently not available, seems to be Gentoo (and I am not sure about the shape of the Gentoo PackageKit backend too). Debian Wheezy includes PackageKit by default, and in Jessy we are going to replace some distribution-specific tools with PackageKit frontends (mostly the old and unmaintained update-notifier and Software-Updater no worries, we are not going for a Synaptic replacement

(currently this won t be possible with PK anyway)) Unfortunately, some PackageKit backends are still not adjusted for the 0.8.x API and are only running on 0.7.x. This is bad, since 0.8.x is a huge step forward for PackageKit. But the situation is slowly improving, with the latest OpenSUSE release, the Zypper backend is now available on 0.8.x too. Being able to run a PackageKit from the 0.8.x series is a requirement for both AppStream and Listaller. AppStream (AppStream is a cross-distro effort for building Software-Center-like applications. It contains stuff like a screenshot-service, ratings&reviews etc. The most important component is a Xapian database, storing information about all available applications in the distribution s repositories. The Xapian DB is distro-agnostik, but distributors need to provide data to fill it. AppStream offers an application-centric way to look at a package database) The AppStream side doesn t look incredibly great, but the situation is improving. As far as I know, OpenSUSE is shipping AppStream XML to generate the database. Ubuntu ships the desktop-files, and I am working on AppStream support in Debian s Archive Kit. On the Fedora side, negotiations with the infrastructure-team are still going on. I haven t heard anything from Mageia and other AppStream participants yet. Unfortunately, at least for OpenSUSE, the AppStream efforts seem to be stalled, due to people having moved to different tasks. But efforts to add the remaining missing things exist. On the software side, Apper (KDE PackageKit frontend) has full support for AppStream. Apper just needs to be compiled with some extra flags to make it use the AppStream database. On the GNOME-side, GNOME-Software is being developed. The tool will make use of the AppStream database, on distributions where it is available. Also, a Software-Center for Elementary and other GTK+-based desktops is being developed, which is based on AppStream (already quite usable!). Using the Ubuntu Software Center on not-Ubuntu-based distributions ist still not much fun, but with the AppStream database available and a working PackageKit 0.8.x with a backend which supports parallel transactions, it is possible to use it. On the infrastructure side: I recently landed some patches in AppStream-Core, which will improve the search function a lot. AppStream-Core contains all tools necessary to generate the AppStream database. It also contains libappstream, a GObject-based library which can be used to access the AppStream database. Also, we discuss dropping PackageKit s internal desktop-file-cache in favour of using the AppStream database. If we do that, we will also add software descriptions to the AppStream db, to improve search results and to speed up search for applications. Because we have to deprecate API for that, I expect this change to happen with PackageKit 0.9.x. As soon as the Freedesktop-Wiki is alive again and my account is re-enabled, I will create compatibility-list, showing which distribution implements what of the PK/AS/LI stuff, especially focusing on components needed for AppStream. Only a few distributions package AppStream-Core so far. Although it is beta-software, creating packages for it and shipping the required data to generate the AppStream database would be a very huge step forward. Listaller (Listaller is a cross-distro 3rd-party software installer, which integrates into PackageKit and AppStream. It allows installing 3rd-party applications, which are not part of the distributor s repositories, using standard tools used also for native-package handling. Everything which uses PackageKit can make use of Listaller packages too. Listaller also allows sandboxing of new applications, and uses an AppDir-like approach for installing software.) Listaller is currently undergoing it s last transition before a release with stable API and specifications can be made. Dependency solving will be improved a lot during the current release-cycle, making it less powerful, but working on all distributions instead. (Fedora always had an advantage in dependency-solving, due to RPM providing more package metadata for Listaller to use) This change was delayed due to discussing a possible use of ZeroInstall-feeds to provide missing dependencies with the ZeroInstall team. We did not come to a conclusion about extending the XML, so Listaller will contain an own format to define a dependency, which can reference a ZeroInstall feed. That should be a good solution for everyone. All these changes will result in IPK1.2, a new version of the IPK spec with small changes in the pkoptions file syntax and huge changes in dependency-handling. The new code is slowly stabilizing in a separate branch, and will soon be merged into master. The next Listaller release will be the last one of the 0.5.x series, we will start 0.6.x then. KDE currently has support for Listaller through Apper, which is enabled on a few distributions. In GNOME, optional Listaller support is being developed and will be available in one of the upcoming releases. Currently, to my knowledge, only a few distributions package Listaller. This should improve, so it is easier for application developers to deploy IPK packages. The upcoming changes in KDE and GNOME to build stable developer platforms will help Listaller a lot in finding matching dependencies, and for stuff which only depends on one software frameworks, installations should be a matter of seconds. As you can see, lots of things are happening, and there is improvement in all components related to installing and presenting software on Linux machines. However, all these projects have a severe lack of manpower, especially AppStream and Listaller have the lowest number of developers working on the tools (at time, only two active developers). This is the main reason for the slow development. But I am confident that we will have something shipped in the next distribution releases. At least AppStream should be ready then. [1]: I don t blame Ubuntu for that during the time they wrote an own solution, PackageKit did not have all the required features. (This situation has changed now, fortunately.) NOTE: I might extend this post with feedback from the different distributions, as soon as I get it.

In January, I announced a new IRC channel #debian-lego, for those of us in the Debian and Linux community interested in LEGO, the marvellous construction system from Denmark. We also created a wiki page to have a place to take notes and write down our plans and hopes. And several people showed up to help. I was very happy to see the effect of my call. Since the small start, we have a debtags tag hardware::hobby:lego tag for LEGO related packages, and now count 10 packages related to LEGO and Mindstorms:

brickos	alternative OS for LEGO Mindstorms RCX. Supports development in C/C++
leocad	virtual brick CAD software
libnxt	utility library for talking to the LEGO Mindstorms NX
lnpd	daemon for LNP communication with BrickOS
nbc	compiler for LEGO Mindstorms NXT bricks
nqc	Not Quite C compiler for LEGO Mindstorms RCX
python-nxt	python driver/interface/wrapper for the Lego Mindstorms NXT robot
python-nxt-filer	simple GUI to manage files on a LEGO Mindstorms NXT
scratch	easy to use programming environment for ages 8 and up
t2n	simple command-line tool for Lego NXT

Some of these are available in Wheezy, and all but one are currently available in Jessie/testing. leocad is so far only available in experimental. If you care about LEGO in Debian, please join us on IRC and help adding the rest of the great free software tools available on Linux for LEGO designers.

Today I'm writing this blog with saddened heart. My mentor and a best friend Dr.Ashokkumar is no more. He died yesterday after fighing with Lymph Node cancer. Ashokkumar or Ashok sir that is how we all students used to address him, was a Professor in Information Science Engineering in NMAM Institue of Technology and recently transferred to Computer Science Engineering Departement. My last meeting him with him was last year December during which he was looking every bit okay other than he had knee pain because of which he couldn't walk freely. But I never imagined that it will be my last meeting with him. Ashok sir was also behind the FLOSS event that took place in NMAM Institute of Technology including MiniDebconf 2011 which saw 2 of the foreign DD's Christian Perrier and Jonas Smedegaard. It was because of his first organized FLOSS event which I volunteered called Linux Habba I entered into the FLOSS world. This means its because of him that I started my FLOSS world journey and reached to my current level. Also it was because of his motivation I started writing this blog which I continue till this day.

I whole heartedly thank Ashok sir for teaching me guiding me and motivating me during my difficult times. You will always be remembered through out my life. May your soul Rest In Peace.

Here are the 2 pics of Ashok sir taken during Minidebconf (Credits: Christian Perrier and Kartik Mistry) Ashokkumar with Jonas and Me

Ashokkumar during inaugaration of MiniDebconf with Christian and Kartik on stage

Good bye Sir :-(

For the Danish company Fleten.net [1] (with my X2Go [2] developer hat on) I have recently developed X2Go integration into the Unity Greeter [3] theme of LightDM [4] in Ubuntu. Fleten.net--as a Canonical Partner--is providing FOSS based IT-services to schools and municipalities in Denmark and Norway, based on Ubuntu and X2Go. read more

We have asked Lucas Nussbaum, one of the three candidates for DPL elections 2013, to tell our readers about himself and his ideas for the Debian Project. You can also read the interviews to the other two candidates: Gergely Nagy and Moray Allan.

Please tell us a little about yourself. Hi! I'm a 31 years old french computer geek. In my day job, I'm an assistant professor (Ma tre de Conf rences) of Computer Science at Universit de Lorraine. What do you do in Debian and how did you started contributing? Like many, I started contributing to Debian by creating and maintaining packages for my own software, in the Ruby team. Then, I discovered that, even if it's not so obvious from the outside, there are a lot of areas in Debian that could use more contributors. So I just started to contribute to more and more things. There's a list of things I did in Debian in my platform. What I have been doing recently is:

rebuild all packages in Debian on a regular basis in order to identify packages that can no longer be built, and file bugs accordingly. In order to do that efficiently, I use cluster and cloud resources (more info)
develop and maintain Ultimate Debian Database, a data aggregator that collects data in most Debian services so that it is possible to expose it in interesting ways (e.g. find release-critical bugs affecting popular packages).
write and maintain a Debian Packaging tutorial, (packaging-tutorial package), to provide an easy-to-read introduction to packaging in Debian.

Why did you decide to run as DPL? Two main reasons:

Most of my Debian contributions aim at addressing problems at the distribution scale (cross-distro collaboration, Quality Assurance, data-mining). Being DPL is a great way to contribute to Debian at this level.
the DPL campaign is a great time in Debian where we discuss the project's problems, politics and visions. Being a candidate is in itself a way to contribute to Debian (though it would be better if we had those discussions outside DPL campaigns too).

Three keywords to summarise your platform. (re-)make Debian the center of the Free Software ecosystem; foster innovation inside Debian; reduce barriers to contributions What are the biggest challenges that you envision for Debian in the future? I often have the impression that the project is losing momentum, positive energy, and slowing down. It feels like we are living on the benefits of the past. A lot of very cool things happen in the Debian ecosystem, but very often outside the Debian project (in derivative distributions). Debian should aim at reinforcing its position in the center of the Free Software ecosystem: it should be the main active intermediary between upstream projects and final users. To achieve that, we need to reinforce the visibility and the impact of Debian. This is extremely important because the values we fight for as a project are often neglected by our derivatives. What are, in your opinion, the areas of the project more in need of technical and/or social improvements? Fostering innovation inside Debian: we should be more welcoming towards innovation and experiments inside the project. Often, we merely tolerate them, and bureaucracy makes them hard and slow to conduct. As a result, people tends to innovate outside the Debian project. Making it easier to contribute to Debian: we compete with more and more projects to attract contributors. While we are already quite good at welcoming new contributors with good documentation and mentoring (much better than people usually think), there's still a lot of room for improvement. Why should people vote for you? A great thing in Debian's voting system is that you don't vote "for" or "against" a specific candidate. Instead, due to our use of the Condorcet method, you rank candidates (and also indicate those who you consider suitable for the role by ranking a virtual "None of the above" candidate). Why am I a good candidate? My previous contributions to Debian show that I have a pretty good understanding of the inner workings of the project, and that I have a track record of managing projects successfully inside Debian. I think that those are two required qualities for a DPL. Name three tools you couldn't stay without. vim, mutt, ssh. What keep you motivated to work in Debian? Debian is a fantastic project from a technical point of view (focus on technical excellence, lots of interesting challenges), but also from a social point of view: the Debian community is a great community where I have lots of good friends. Also, what's great when you contribute to Debian is that your work has a real impact, and that you see people using stuff you worked on everywhere. Are there any other fields where you call yourself a geek, besides computers? I'm not sure this really qualifies as "besides computers", but I've gotten very interested in the OpenStreetMap project lately. I very much enjoy exploring unmapped areas on a mountain bike. It feels like being Christopher Columbus or Marco Polo, but 20 minutes from home. ;) The OpenStreetMap and Debian projects also share many values, such as a great attention to quality and details.

These Open Source Days were kind of a mixed experience. The social part Things started off quite nicely; the speaker dinner was very pleasant and the people at my table interesting to talk with. The way back to the hotel and breakfast on Saturday were even more interesting; talking with Amelia Andersdotter, a member of the European Parliament for the Swedish Pirate Party, about anti-trust measures, privacy protection, lobbyists, and creating the right incentives for companies to actually protect user data was fun and engaging. My own claim to fame is that I told her that while Microsoft is willing to sign UEFI payloads for x86, they refuse to do so for ARM which she didn't know. From my understanding, their interpretation is that any anti-trust rulings apply to PCs only, and not general computing devices like tablets. It will be interesting to see how that plays out in the long run, especially once ARM processors start appearing in laptops and desktops as main CPUs where Microsoft clearly still has a near monopoly. It was fascinating to discuss all those issues with someone who's actively involved with legislation, mainly because her style of talking was markedly different from what I am used to. One point which she stressed repeatedly is that the most important skill within the context of political work in the EU is to be able to track down, read, and then reference all the content that's being produced in Brussels and Strasbourg. Maybe that tidbit is useful to people who want to try themselves at political activism. She nicely, and maybe unknowingly, emphasized that point by always referring to specific papers, directives, and studies after making any point. Statement of opinion, reference to supporting document. Statement of opinion, reference to supporting document. Statement of opinion, reference to supporting document. Rinse, repeat. It's no secret that I'm continuously disappointed by the political process in general and politicians in particular. Yet, I have to say that this encounter had a lasting and positive impression on me. Amelia has an incredible amount of energy and genuinely cares about the issues which too many other politicians ignore completely. It's good to know someone like this is on our side. If you're Swedish, please inform yourself about her and consider voting in her favour. Other than that, I met several other people, new and old. This year's OSD felt a lot more relaxed and there were more informal and spontaneous conversations going on in hallways and at tables. Even though I failed to have any intense discussion of Mercurial vs git this year, all those conversation were still really interesting. The "workshop" I already knew that the room assignment for my workshop on Saturday afternoon would be a last-minute thing. What I didn't expect was that the final confirmation by Copenhagen Business School would be given on Friday evening. Mixed with a very cumbersome process to update the slides of the CBS-owned and -operated information beamer in the lobby, this resulted in the official schedule showing my room as "Workshop" instead of "SP 214". The official schedule repeatedly stated that people had to pre-register for the workshop which was a left-over from last year where they actually had to plan the amount of hardware kits needed; the registration itself was was very well hidden behind a rather generic link you saw exactly once after purchasing your ticket. Add to this that my room was literally in the farthest corner of the building and on the top floor and things start to turn sour real quick. All other rooms were either close to the main entrance or on the ground floor. Helpers at the front desk had a lot of people asking where my room was and gave out directions, yet... ...the grand total of six people who arrived were all telling me how they couldn't find the room and almost gave up on finding it. As more people asked for directions than turned up at the workshop, this means that even with directions, the room was really hard to find. Myself, it took me two attempts to find the room after which I was led there by one of the helpers who wasn't completely sure we were going in the right direction, himself. Still, I managed to get everyone who had a laptop and access to a UNIX-based system set up with working mr and vcsh repositories they can work from as well as a demo git-annex repository to play with. Sadly, not everyone had a laptop, or access to UNIX, or the tools installed, or even an idea where to install them from, even though I had noted these "requirements" in the description. Next time I do this workshop, I will need to make sure to include information on what distributions have the relevant packages and how to find and install the software on Max OS X in the workshop description. Feedback from the very few people who actually managed to find me was very good and one of the attendants asked if I would be willing to hold the workshop again at another conference in Denmark. I am still awaiting details on this, but I would obviously enjoy having the chance to reach more people. At least I fared better than the guys who did the workshop on "Binary exploitation 101" in yet another room. Two guys held a workshop with a total attendance of... one... I know the organizers of OSD were really unhappy with how this turned out and I believe them when they say that something like this will never happen again. It's the second year that this team is running the conference, running conferences is an incredible amount of work, and things were smoother this year than last year. Iterate and improve, etc. The talk Saturday evening, Alex offered me the chance to hold a reparation talk on Sunday morning to compensate for the botched workshop. Said talk was scheduled for the first slot and not really announced (but the schedule on both www and the beamer was changed over night). Additionally, this was merely an updated and extended version of the talk which I already held at OSD 2012 so at least part of the visitors knew most of what I had to say, already. To be honest I didn't expect too much, but more than twenty people turned up which is a very decent turnout, all things considered. Same as with the workshop, feedback was extremely positive and I was told afterwards by Bryan that several people mentioned my talk as one of the highlights, or even the highlight, of OSD when he was talking to them. To make things even better this talk has, finally, been videotaped; I will update this blog with a link as soon as the video is online.

Partially because of Markdown being Github s markup format of choice, I enjoy writing documents in simple markup formats more and more. There s though one common annoyance with these formats compared to writing plain HTML The Annoyance They need to be rendered (i.e. more or less compiled) before you can view your outpourings rendered, e.g. in the web browser. So the workflow usually is:

Saving the current file in your favourite editor
Switch to terminal with commandline
Cursor up, Enter
Switch to your favourite web browser
Hit the reload button

Using a Specialized Editor with Live Preview One choice would be to use a specific editor with live rendering. The one I know in Debian (from Wheezy on) is ReText (Debian package retext). It supports Markdown and reStructuredText. But as with most simple GUI editors, I miss there many of the advanced editing commands possible with Emacs. Using Emacs Markdown Mode Then there is the Markdown Mode for Emacs (part of Debian s emacs-goodies-el package), where you can get a preview by pressing C-c C-c p. But for some reason this takes several seconds, opens a new buffer and window with the rendered HTML code and then starts (hardcoded) Firefox (which is not my preferred web browser). And if you do that a second time without closing Firefox first, it won t just reload the file but will open a new tab. You might think that just hitting reload should suffice. But no, the new tab has a different file name, so reload doesn t help. Additionally it may not use my preferred Markdown implementation. Meh. Well, I probably could fix all those issues with Markdown Mode, it s only Emacs Lisp. Heck, the called command is even configurable. But fixing at least four issues to fix one workflow annoyance? Maybe some other time, but not as long there are other nice choices Using inotifywait to Render on Write So everytime you save the currently edited file, you immediately want to rerender the same HTML file from it. This can be easily automated by using Linux inotify kernel subsystem which notices changes to the filesystem, and reports those to applications which ask for it. One such tool is inotifywait which can either output all or just specific events, or just exit if the first requested event occurs. With the latter it s easy to write a while loop on the commandline which regenerates a file after every write access. I use either Pandoc or Asciidoc for that since both generate full HTML pages including header and footer, but you can use that also with Markdown to render just the HTML body. Most browsers render it correctly anyway:

while inotifywait -q -e modify index.md; do pandoc -s -f markdown -t html -o index.html index.md; done
while inotifywait -q -e modify index.txt; do asciidoc index.txt; done
while inotifywait -q -e modify index.md; do markdown index.md > index.html; done

This solution is even editor- and build-system-agnostic (But not operating-system-agnostic.) inotifywait is part of inotify-tools, a useful set of commandline tools to interface with inotify. They re packaged in Debian as inotify-tools, too. Using mdpress for Markdown plus Impress.js based Slides The ruby-written mdpress is a special case of the previous case. It s a commandline tool to convert Markdown into Impress.js based slide shows and it has an option named --automatic which causes it to keep running and automatically update the presentation as soon as changes are made to the Markdown file. mdpress is not yet in Debian, but there s an ITP for it and Impress.js itself recently entered Debian as libjs-impress. Nevertheless, two dependencies (highlight.js, ITP ed, ruby-launchy, ITP ed) are still missing in Debian.

The first time I met my Debian team mates (from the Publicity and WWW teams) was during DebConf11 in Banja Luka, in 2011. I was very excited, and being the craft geek I am, I decided to bring them little handmade gifts. After some thought, I opted for a Debian swirl plush charm/keychain. And here is how I made it, in six easy steps. It's a really simple project, you just need a bit of patience for the sewing part: the swirl is sewn by hand and it's very important to make regular stitches. The finished swirl measures approximately 7.5x12 cm. What you'll need

red felt: a square of at least 15x24 cm
poly-fil stuffing (or other filling)
~ 4 cm of ribbon
a keychain ring
red thread
pins and needle
fabric shears
pen (or chalk pencil)

Step 1

Make a sketch of your swirl on paper or, if you don't feel too confident about your drawing skills, print this pattern I made. Trace it on the felt and cut it on felt twice (you'll need two swirl-shaped pieces for the plushie). You can also fold the felt double and cut just one time (as I did). Step 2

Pin the two swirl-shaped pieces together, with the wrong sides inside. With the red thread, using back stitch, sew them together, starting from the lower end as indicated in the image above. Step 3

When you reach the point marked in the image above, start stuffing the filling into the curved part of the swirl (use a pen to stuff it more easily in the narrow part of the curve). Step 4

Continue stuffing the swirl and sewing it until you reach the point marked in the picture above. Step 5

Now it's time to add the ribbon and the ring: cut 4 cm of ribbon and fold it lenghtwise. Slide on it the ring and fold it again, then put the two ends between the folds of the swirl, as shown in the picture above. Step 6

Continue sewing til the end. Congratulations, you now have a Debian plushie. I really loved creating these, and I'm really happy to know that the swirls I made are now scattered around the world: one in Austria, one in Australia, one in Denmark, four in Germany, three in Italy and one in Martinique. And the one I made for this tutorial will end in Italy as well (Mark, it's yours). If you have any doubts about the pattern, you can contact me. And if you make one, please send me a pic. This pattern is released under CC-BY-SA 3.0 license: this means that you can share, distribute, modify and even use it commercially but you'll need to mention the original author (OH HAI! it's me!) and maintain the same license.

...my hats are amazing, give them a lick, they taste just like raisins... I gained two new hats, recently: Debian On 2013-01-24, I became a Debian Maintainer. This should allow me to annoy bremner less often with sponsor requests (thanks for all that work). FOSDEM After carrying lots of stuff around in the past and volunteering for the token sale at last year's beer event while also holding two lightning talks, I became a proper staff member early this year. Doing what I do at my dayjob, I am focussing on RIPE interfacing and backbone/networking in the broader sense. Well, and OCDing on the booklet for the last few hours ;) So yes, "I am going to FOSDEM"; see you when I sell tokens for what, other than the cactus beer, basically amounts to sweet lemonade.

The War on Time Whoosh! I ve been incredibly quiet on my blog for the last 2-3 months. It s been a crazy time but I ll catch up and explain everything over the next few entries. Firstly, I d like to get out a few details about the last Ubuntu Developer Summit that took place in Copenhagen, Denmark in October. I m usually really good at getting my blog post out by the end of UDS or a day or two after, but this time it just flew by so incredibly fast for me that I couldn t keep up. It was a bit shorter than usual at 4 days, as apposed to the usual 5. The reason I heard for that was that people commented in previous post-UDS surveys that 5 days were too long, which is especially understandable for Canonical staff who are often in sprints (away from home) for the week before the UDS as well. I think the shorter period works well, it might need a bit more fine-tuning, I think the summary session at the end wasn t that useful because, like me, there wasn t enough time for people to process the vast amount of data generated during UDS and give nice summaries on it. Overall, it was a great get-together of people who care about Ubuntu and also many areas of interest outside of Ubuntu. Copenhagen, Denmark I didn t take many photos this UDS, my camera is broken and only takes blurry pics (not my fault I swear!). So I just ended up taking a few pictures with my phone. Go tag yourself on Google+ if you were there. One of the first interesting things I saw when arriving in Copenhagen was the hotel we stayed in. The origami-like design reminded me of the design of the Quantal Quetzel logo that is used for the current stable Ubuntu release.

The Road ahead for Edubuntu to 14.04 and beyond St phane previously posted about the vision we share for Edubuntu 14.04 and beyond, this was what was mostly discussed during UDS and how we ll approach those goals for the 13.04 release. This release will mostly focus on the Edubuntu Server aspect. If everything works out, you will be able to use the standard Edubuntu DVD to also install an Edubuntu Server system that will act as a Linux container host as well as an Active Directory compatible directory server using Samba 4. The catch with Samba 4 is that it doesn t have many administration tools for Linux yet. St phane has started work on a web interface for Edubuntu server that looks quite nice already. I m supposed to do some CSS work on it, but I have to say it looks really nice already, it s based on the MAAS service theme and St phane did some colour changes and fixes on it already.

From the Edubuntu installer, you ll be able to choose whether this machine should act as a domain server, or whether you would like to join an existing domain. Since Edubuntu Server is highly compatible with Microsoft Active Directory, the installer will connect to it regardless of whether it s a Windows Domain or Edubuntu Domain. This should make it really easy for administrators in schools with mixed environments and where complete infrastructure migrations are planned.

You will be able to connect to the same domain whether you re using Edubuntu on thin clients, desktops or tablets and everything is controllable using the Epoptes administration tool. Many people are asking whether this is planned for Ubuntu / Ubuntu Server as well, since this could be incredibly useful in other organisations who have a domain infrastructure. It s currently meant to be easily rebrandable and the aim is to have it available as a general solution for Ubuntu once all the pieces work together. Empowering Ubuntu Flavours This cycle, Ubuntu is making some changes to the release schedule. One of the biggest changes made this cycle is that the alpha and beta releases are being dropped for the main Ubunut product. This session was about establishing how much divergence and changes the Ubuntu Flavours (Ubuntu Studio, Mythbuntu, Kubuntu, Lubuntu and Edubuntu) could have from the main release cycle. Edubuntu and Kubuntu decided to be a bit more conservative and maintain the snapshot releases. For Edubuntu it has certainly helped so far in identifying and finding some early bugs and I m already glad that we did that. Mythbuntu is also a notable exception since it will now only do LTS releases. We re tempted to change Edubuntu s official policy that the LTS releases are the main releases and treat the releases in between more like technology previews for the next LTS. It s already not such a far stretch from the truth, but we ll need to properly review and communicate that at some point. Valve at UDS and Steam for Linux

One of the first plenaries was from Valve where Drew Bliss talked about Steam on Linux. Steam is one of the most popular publishing and distribution systems for games and up until recently it has only been available on Windows and Mac. Valve (the company behind Steam and many popular games such as Half Life and Portal) are actively working on porting games to run natively on Linux as well. Some people have asked me what I think about it, since the system is essentially using a free software platform to promote a lot of non-free software. My views on this is pretty simple, I think it s an overwhelmingly good thing for Linux desktop adoption and it s been proven to be a good thing for people who don t even play games. Since the announcement from Valve, Nvidia has already doubled perfomance in many cases for its Linux drivers. AMD, who have been slacking on Linux support the last few years have beefed up their support drastically with the announcement of new drivers that were released earlier this month. This new collection of AMD drivers also adds support for a range of cards where the drivers were completely discontinued, giving new life to many older laptops and machines which would be destined for the dumpster otherwise. This benefits not only gamers, but everyone from an average office worker who wants snappy office suite performance and fast web browsing to designers who work with graphics, videos and computer aided design. Also, it means that many home users who prefer Linux-based systems would no longer need to dual-boot to Windows or OS X for their games. While Steam will actively be promoting non-free software, it more than makes up for that by the enablement it does for the free software eco-system. I think anyone who disagrees with that is somewhat of a purist and should be more willing to make compromises in order to make progress. Ubuntu Release Changes Last week, there was a lot of media noise stating that Ubuntu will no longer do releases and will become a rolling release except for the LTS releases. This is certainly not the case, at least not any time soon. One meme that I ve noticed increasingly over the last UDSs was that there s an increasing desire to improve the LTS releases and using the usual Ubuntu releases more and more for experimentation purposes. I think there s more and more consensus that the current 6 month cycle isn t really optimal and that there must be a better way to get Ubuntu to the masses, it s just the details of what the better way is that leaves a lot to be figured out. There s a desire between developers to provide better support (better SRUs and backports) for the LTS releases to make it easier for people to stick with it and still have access to new features and hardware support. Having less versions between LTS releases will certainly make that easier. In my opinion it will probably take at least another 2 cycles worth of looking at all the factors from different angles and getting feedback from all the stakeholders before a good plan will have formed for the future of Ubuntu releases. I m glad to see that there is so much enthusiastic discussion around this and I m eager to see how Ubuntu s releases will continue to evolve. Lightning Talks Lightning talks are a lot like punk-rock songs. When it s good, it s really, really amazingly good and fun. When it s bad, at least it will be over soon :) Unfortunately, since it s been a few months since the UDS, I can t remember all the details of the lightning talks, but one thing that I find worth mentioning is that they re not just awesome for the topic they aim to produce (for example, the one lightning talks session I attended was on the topic of Tests in your software ), but since they are more demo-like than presentation-like, you get to learn a lot of neat tricks and cool things that you didn t know before. Every few minutes someone would do something and I d hear someone say something like Awesome! I didn t know you could do that with apt-daemon! . It s fun and educational and I hope lightning talks will continue to be a tradition at future UDSs. Social Stefano Rivera (fellow MOTU, Debianista, Capetonian, Clugger) wins the prize for person I ve seen in the most countries in one year. In 2012, I saw him in Cape Town for Scaleconf, Managua during Debconf, Oakland for a previous UDS and Copenhagen for this UDS. Sometimes when I look at silly little statistics like that I realise what a great adventure the year was! Between the meet n greet, an evening of lightning talks and the closing party (which was viking themed and pretty awesome) there was just one free evening left. I used it to gather with the Debian folk who were at UDS. It was great to see how many Debian people were attending, I think we had around a dozen or so people at the dinner and there were even more who couldn t make it since they work for Canonical or Linaro and had to attend team dinners the same evening. It was as usual, great to put some more faces to names and get to know some people better. It was also great to have a UDS with many strong technical community folk present who is willing to engage in discussion. There were still a few people who felt missing but it was less than at some previous UDSs. I also discovered my face on a few puzzles! They were a *great* idea, I saw a few people come and go to work on them during the week, they seem to have acted as good menial activities for people to fix their brains when they got fried during sessions :)

Overall, this was a good and punchy UDS. I ll probably not make the next one in Oakland due to many changes in my life currently taking place (although I will remotely participate), but will probably make the one later this year, especially if it s in Europe. I ll also make a point of live-blogging a bit more, it s just so hard remembering all the details a few months after the fact. Thanks to everyone who contributed their piece in making it a great week!

With the arrival earlier today of the stochvol package onto the CRAN network for R, our Rcpp project reached a new milestone: 100 packages have either a Depends:, Imports: or LinkingTo: statement on it. The full list will always be at the bottom of the CRAN page for Rcpp; I also manually edit a list on my Rcpp page. But for the record as of today, here is the current list as produced by a little helper script I keep:

 acer                apcluster           auteur             
 bcp                 bfa                 bfp                
 bifactorial         blockcluster        ccaPP              
 cda                 classify            clusteval          
 ConConPiWiFun       EpiContactTrace     fastGHQuad         
 fdaMixed            forecast            fugeR              
 GeneticTools        gMWT                gof                
 gRbase              gRim                growcurves         
 GUTS                jaatha              KernSmoothIRT      
 LaF                 maxent              mets               
 minqa               mirt                mRMRe              
 multmod             mvabund             MVB                
 NetworkAnalysis     ngspatial           oem                
 openair             orQA                parser             
 pbdBASE             pbdDMAT             phom               
 phylobase           planar              psgp               
 quadrupen           Rchemcpp            Rclusterpp         
 RcppArmadillo       RcppBDT             rcppbugs           
 RcppClassic         RcppClassicExamples RcppCNPy           
 RcppDE              RcppEigen           RcppExamples       
 RcppGSL             RcppOctave          RcppRoll           
 RcppSMC             RcppXts             rforensicbatwing   
 rgam                RInside             Rmalschains        
 Rmixmod             robustgam           robustHD           
 rococo              RProtoBuf           RQuantLib          
 RSNNS               RSofia              rugarch            
 RVowpalWabbit       SBSA                sdcMicro           
 sdcTable            simFrame            spacodiR           
 sparseHessianFD     sparseLTSEigen      SpatialTools       
 stochvol            surveillance        survSNP            
 termstrc            tmg                 transmission       
 trustOptim          unmarked            VIM                
 waffect             WideLM              wordcloud          
 zic

And not to be forgotten is BioConductor which has another 10:

 ddgraph            GeneNetworkBuilder GOSemSim          
 GRENITS            mosaics            mzR               
 pcaMethods         Rdisop             Risa              
 rTANDEM

As developers of Rcpp, we are both proud and also a little humbled. The packages using Rcpp span everything from bringing new libraries to R, to implementing faster ways of doing things we have before to doing completely new things. It is an exciting time to be using R, and to be connecting R to C++, especially with so many exciting things happening in C++ right now. Follow the Rcpp links for more, and come join us on the Rcpp-devel mailing list to discuss and learn.

Recently I recieved a MyAudio Tablet Series9 as a gift. From the factory it runs some version of Android, but I already got enough Android devices. Instead I wanted to play a bit with a basic Linux install. This tablet is based on the AllWinner A10 System on a Chip. Some of these instructions might work for other systems based on the same chip set: Step 1: Install the rescue system from http://forum.doozan.com/read.php?6,9396 on a SD-card. You can configure network settings in rescue/interfaces and rescue/wpa_supplicant.conf. Step 2: Boot the rescue system. The MyAudio table will boot from the SD-card if it contains a bootable system, so this is quite easy. The first time you boot the rescue system tries to locate a system.bin file from the tablet. this file contains the hardware configuration and is needed for initializing all the hardware. This means that the screen can t be initialized the first time you boot and will just appear off. Unless the system automatically boots again you need to locate the system.bin yourself from the tablet. It is usually located on /dev/nanda and have names like system.bin, script.bin, or evb.bin. To find the file you can use the log the rescue system places in log/deviceinfo.log on the SD-card during boot. You should now have console access to the tablet and using a USB keyboard you should be able to work in the console. Step 3: Setting up the network Having configured rescue/interfaces and rescue/wpa_supplicant.conf the network ought to work. I am experiencing some problems getting it to connect to my Access Point (using WPA2). Patience works, but you might need to monitor the status with wpa_cli(8) and then run udhcp -i wlan0 when it succeeds. Step 4: Install Debian using the installer at http://forum.doozan.com/read.php?6,8906 This just worked fine Step 5: Getting the touch screen to work. The system.bin file can be decoded with the fexc utility either available on the rescue system (compiled for arm) of from https://github.com/linux-sunxi/sunxi-tools. Finding the ctp_para section we can see that this tablet uses a ft5x touch screen. Adding ft5x_ts to /etc/modules on our installed system will make sure that the correct kernel module gets loaded on boot time. But for some reason the kernel driver and the X11 evdev driver will not talk together. So we need to compile our own kernel patched as described on https://www.miniand.com/forums/forums/development/topics/how-do-i-get-the-lcd-display-and-touch-screen-working-on-an-a10-tablet#post-1225. I have made kernel packages for Debian available at http://hacking.dk/files/linux-image-3.0.57-sun4i+_1.0+nomultitouch_armhf.deb or http://hacking.dk/files/linux-image-3.4.24-sun4i+_1.0+nomultitouch_armhf.deb. Install the kernel package you want and run this as root:

# KERNEL_VERSION=3.4.24-sun4i+
# /usr/bin/mkimage -A arm -O linux -T kernel  -C none -a 0x40008000 -e 0x40008000 -n Linux-$KERNEL_VERSION -d /boot/vmlinuz-$KERNEL_VERSION /boot/uImage
# /usr/bin/mkimage -A arm -O linux -T ramdisk -C gzip -a 0x00000000 -e 0x00000000 -n initramfs-$KERNEL_VERSION -d /boot/initrd.img-$KERNEL_VERSION /boot/uInitrd

After a reboot X11 will respond to the touch screen, but Step 6: Configure the touch screen the pointer does not point where I touch the screen. The transformation between the points are wrong. This is fixed by adding this to your xorg.conf:

Section "InputClass"
    Identifier     "touchscreen"
    MatchProduct   "ft5x_ts"
    Option    "TransformationMatrix" "0 1 0 1 0 0 0 0 1"
    Option    "Calibration" "0 768 0 1024"
EndSection

or more dynamically by running:

$ xinput set-prop ft5x_ts "Coordinate Transformation Matrix" 0 1 0 1 0 0 0 0 1
$ xinput set-prop ft5x_ts "Evdev Axis Calibration" 0 768 0 1024

For more information about the Transformation Matrix, see the X.Org Wiki Step 7: Install a on-screen keyboard. I have not found the perfect keyboard application yet. Currently I am using matchbox-keyboard

Search Results: "nma"

15 August 2013

12 August 2013

4 August 2013

27 July 2013

12 July 2013

6 July 2013

17 June 2013

8 June 2013

12 May 2013

11 May 2013

28 April 2013

27 April 2013

27 March 2013

12 March 2013

10 March 2013

11 February 2013

9 February 2013

29 January 2013

24 January 2013

22 January 2013