As an aside to yesterday s Another Network Begins note, I should mention that one of the challenges of running any inter-business project is paying for it. It surprises some people that many great cooperative projects are running on very small budgets, whereas it looks like some Social Enterprise groups are awash with cash. How can this be, when it still looks like cooperatives are stronger financially than social enterprises? A written answer in Parliament on Monday suggests one possible reason: Co-operatives UK and The Plunkett Foundation together get 164k of Cabinet Office funding, while the Social Enterprise Coalition alone gets 488k and there are other SocEnt groups on the pay list. Once again, I m surprised by the way the Labour and Co-operative government is behaving, like I was on the way the real help initiatives exclude cooperative partnerships, while being open to both private sector employers and social enterprises. I m all in favour of intervening in markets, but this doesn t feel like it s making things fairer. Three strikes, funding social enterprise in preference to cooperatives would a Conservative or Liberal Democrat government really be worse?

It was great to meet the newest member of our co-op yesterday and discuss a new ethical business referral network, but I ve barely spent any time back at home and I m heading out again, partly to visit online09 and IMS, partly to collect some things from the co-op s founder and also to do whatever else I can do in London in the time available. I was unable to attend yesterday s #koha IRC general meeting because of the terrible state of mobile internet coverage in rural Gloucestershire and Worcestershire, where I was at the time. Apologies for not sending apologies beforehand, but I thought it would work. Mobile internet is so frustratingly patchy outside the big cities. It works, but not reliably when I m moving fast, which seems like part of the point of mobile . Once again, I m surprised that the U2Com free wifi network still has only one London hotspot. It makes finding wifi in Bristol and Somerset so much easier (as well as attracting me to Bath Ales) and there was even a node in Manchester yesterday. Is there another free wifi network in London that I don t know about? The Londonist Free Wifi map doesn t show if they re in networks.

The Association For Free Software (AFFS) seems to have been finally wound up last week. So long, AFFS was Richard Smedley s view of it. I actually left four years ago (when I wrote State of the AFFS site currently moving) but I was still a signatory for the bank, so I helped wind that up. So as one door closes, another opens. Today I m off to meet our co-op s newest member and also to see if we can reinvigorate the Principle Six business network. I ll post more about that in a few days, but if you ve any ideas about how Free and Open Source Software can help, I d love to read it in the blog comments.

savs seemed to agonise about posting it but I think his Top 10 crimes of Developer Engagement is spot on even if it might not be as amusing as Aral Balkan s similar message. I think it applies to my recent RFID development work too: the public information is fluffy and you have to hunt or reverse-engineer most of the technical info, the supplier websites are painful and there s almost no interaction. In the past, I d been factoring in something between 50 and 100% extra time when our co-op needed to coordinate with unknown non-co-ops. With RFID hardware work, it was well over 300% when I last calculated it and that s even though there was one pretty helpful RFID supplier. This sort of nonsense is painful, slows development massively, could kill useful technologies at birth and re-emphasises my commitment to use Open Standards as much as reasonable. Have other people got similar horror stories to share? Can we get savs s Top 10 Crimes under the noses of some high-profile people?

After all the U-turns by politicians, I got confused about how Three Strikes is developing. I think the current status is Mandelson trying to sneak it through as a Statutory Instrument and protect some of the most protectionist foreign interests ever seen. I ve written to my MP to express my disagreement. Andrew Heaney of TalkTalk has submitted a petition to abolish the proposed law that will see alleged illegal filesharers disconnected from their broadband connections, without a fair trial . It s not worded brilliantly, but it covers the vital point without a fair trial so I think it s still worth signing here. Thanks to Glyn Wintle for the updates on fsfe-uk. Meanwhile, unaccountable copyright collections agent PPL have picked the ideal moment to start harassing local community events. Please give generously: EMI only earned 298,000,000 last year. If you ve a bit more time, you could send a Message To Mandelson at ORG. I might not agree with ORG s structure, but they do make some cool protest sites. (Javascript required to view, as far as I can tell.) Even more flamboyantly, the Electronic Frontier Foundation is calling on people to phone up and Stop the Pirate-Finder General!

It s great to discover this experimental wikified version of W. A. Munford s Who was Who in British Librarianship 1800-1985 (1987). As a statistician who has strayed into serving libraries, I don t know many of the famous names and a lot of the online materials are from the US. This looks like a useful guide (and CC-BY-SA-3.0 which is OK, although the current site has an unfriendly Choice of Law and Forum) and I hope that any UK-based Librarians who read my site will take a look and see if they can help it.

Most librarians probably already know this, but maybe the programmers don t yet. A SirsiDynix Corp lobby paper against Open Source technologies escaped onto the internet. SirsiDynix is a competitor of our co-op with products that compete with Koha. They re also interesting because Sirsi bought another competitor (Dynix), essentially stopped its product line (something near impossible with Free and Open Source Software like Koha) to replace it with its own and has ended up a messy lawsuit with Queens Borough Public Library as a consequence of that all as I understand it. Late last month, someone leaked SirsiDynix s criticism of Free and Open Source Software which is missing references for key evidence and described on WikiLeaks as containing possible libel per se against certain competitors . The comments and links at thesecretmirror and code4lib wiki seem interesting dissections. I feel that this document is taking advantage of an opportunity presented by the biggest promoters of FOSS library management systems not speaking about freedom. As you can see from some comments on thesecretmirror, it s all about freedom. reflections Missing the point: It s time to talk about software freedom develops that point a bit more and gives a few links back to other statements of freedom which I d not seen before. Anyway, one of the points in the leaked document was that the US Department of Defense (DoD) restricts use of FOSS. Unluckily for SirsiDynix, on 16 October, a memo was published by the DoD CIO saying Defense: Open source software is more secure than commercial code. There s some analysis by David Wheeler discussed on LWN. Anyway, who would you believe about FOSS? An under-fire legacy private software competitor, or the Department of Defense? I don t like either that much, but there s not really a contest. DoD are willing to bet lives on it.

Revisiting two old ssh points:-

1. Smart Tricks with ssh mentioned ServerAliveInterval 3600 and the page I referenced for it mentions ClientAliveInterval on the server-side. Is there any reason not to use that?
2. ssh security mentioned sslh to put ssh on port 443, but it seems Top J2ME MIDP Application MidpSSH can t connect to ssh on other ports. The instructions in the manual about port numbers don t work for me if I put in 443. I get java.lang.SecurityException. Anyone know why?

SME Web Internet advertisers: New cookie laws approved: reports that:

internet users will have to provide consent to cookies being stored on their computers. This could result in them being bombarded with pop-ups seeking their permission to accept the cookies.

However, the site doesn t link to a text supporting that interpretation. The only reference is to a directive which doesn t seem explicit. Further, the article states

The current EU telecom law allows the use of cookies if web users are notified of them and are able to opt-out.

but there are tons of sites which don t comply with that and are simply broken if they can t store their cookies. That includes several gov.uk ones very annoying, but surely there wouldn t be so many if it was illegal, would there? Is that article accurate and does anyone have plain English that I can send to gov.uk webmasters to persuade them to fix their sites?

I knew that / (slash) activated the Quick Find in Firefox and its close relations, but I didn t know that ' (apostrophe) activated a Quick Find (in links). That s quite helpful when jumping through web admin interfaces where I know which links I want, I m using the two-handed keyboard (not the one-hander) and prefer not to jump between keyboard and mouse. I don t see that on the menus anywhere, so how was I meant to find it without digging through the manuals? What other speed-up shortcuts are lurking in common applications? Is there something like Emacs s where-is function (c-h w) for Firefox that will tell you where to find something?

I know it has been a long time since my last post. I am sorry about that, but life has it s complications every now and then (as you know)... Well, on to the article. Recently I had to reimplement in C a prefork server I wrote in Ruby for an internal project at Propus. Not that the Ruby version wasn t enough (after all, although being in Ruby, I was using Unix plumbing, much in the fashion Ryan tell us about in the now famous I like Unicorn because it s Unix article)... The problem is that, in one of our clients, the only version available for Ruby was 1.8.1. Yeah I know But we were not allowed to upgrade and, although it didn t seem at first, the same server presented a nasty memory leak in 1.8.1 that was not present in 1.8.7 and 1.9.1. I still don t know where the problem is I suspect some of the C-to-Ruby glues around TCP sockets might be blamed, but after a couple of days trying to figure it out, I decided it was easier just to reimplement it using C. It actually took less than a day to get the C version going nothing fancy and, apart from memory footprint, just the same functionality and about the same speed of the Ruby version. But it was enough to remind me I really don t like all the scaffolding one has to raise in order to make something useful in C. It s not just a matter of SLOC (of course, C version was more than 3 times longer than Ruby one)... I am talking about all the manual memory management, pointer operations and the disgusting experience of dealing with strings in C. I know some people are addicted to that sort of thing like heroin, but to me it just slows development. This experience made me think about learning a second compiled programming language. I do some Perl, a lot of Python and (of course) most of my work in Ruby, but those are all interpreted languages. For compiled languages I always resorted to C So I am officially looking for a language to learn. So far, the best candidates are OCaml (I got a little excited about JoCaml a few months ago, now I might get serious about it), Haskell, Lisp, Objective-C, Ada, and Vala. Of these, I ve been reading a lot about OCaml It seems a fine and expressive language, with decent foundations, object-oriented extension, broad standard library and (with JoCaml) concurrency Also it might give me the proper excuse to finally wrap my mind around a functional language! People keep me pointing to Java and Erlang Well for using Java I would much prefer using JRuby. Erlang, ITOH, has a weird syntax (at least to me) and it seems much of what makes it great will, eventually, be part of Ruby (or already is using libraries) either that or I ll just wait for Reia to be ready. Besides, neither can be compiled to native code (ok, that argument can be stretched both ways, so just ignore it). So, what do you think? Any advice?

As well as being a member of TTLLP, I m a member of the Co-operative Group, which (amongst other things) runs the co-operative shops in areas where there is no regional cooperative society, including Weston-super-Mare and Worle. Congratulations to our Chief Executive Peter Marks for being named Business Leader of the Year this week. Co-operatives employ 10% more people in the world than all the multinationals and their subsidiaries put together (according to according to Peter Couchman). It s nice to see our business success being recognised in popular awards.

An announcement for this meeting just dropped into my inbox with Apologies for the lateness of this announcement; some crossed wires . It will be in #spi of irc.oftc.net as usual, at 2000 UTC. The agenda is available online and someone will email the logs to spi-general afterwards.

Ok, so following the trend, I created some time ago a new GPG key, which I'm now transitioning too. I've set up a transition document, available at http://molly.corsac.net/~corsac/key-transition.txt. It's signed by both the old and the new keys and is reproduced below:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160,SHA512
Wed, 11 Nov 2009 13:44:05 +0100
I've recently set up a new RSA-based GPG key, and will be transitioning away
from my old DSA-based one.  The old key will be revoked soon, so I prefer all
future correspondence to use the new one.  I would also like to ensure that
this new key is well-integrated into the web of trust.  This message is signed
by both keys to certify the transition.
The old DSA key was:
pub   1024D/C5C05BAE 2004-11-11
      Key fingerprint = DE26 2FC4 7097 FFC6 DE2C  D8C0 4D44 C020 C5C0 5BAE
The new RSA key is:
pub   4096R/71EF0BA8 2009-05-06
      Key fingerprint = 4510 DCB5 7ED4 7040 60C6  6476 3055 0F78 71EF 0BA8
If you already know my old key, you can verify that the new key is
signed by the old one:
  gpg --check-sigs 71EF0BA8
If you don't already know my old key, or if you're extra-paranoid, you
can check the fingerprint against the one given above:
  gpg --fingerprint 71EF0BA8
If you have previously signed my old DSA key, and if you're satisfied
that you've got the correct new RSA key, then I'd appreciate it if you
would sign my new key as well:
  caff 71EF0BA8
The caff program is in the signing-party package in Debian.  Please be careful
to generate signatures that don't rely on the weakening SHA-1 hash algorithm,
which requires some careful configuration even if you've already configured
gpg correctly.  See http://www.gag.com/bdale/blog/posts/Strong_Keys.html for
the gory details.
Thanks,
- --
Yves-Alexis Perez
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEAREDAAYFAkr6sqQACgkQTUTAIMXAW64HiACeIyabQueDHAeiAX8EkIeApiDj
++UAn2z7YkjHx0lQh0+s5WdhikG0YztiiQIcBAEBCgAGBQJK+rKkAAoJEDBVD3hx
7wuodUcQAKMbG9Rehxz+uZ6fST99cHt5Fjnv9TorY4hQaQK+85ZgiwPaHMHfYM1G
5hcrXI+JFUpz8j40deZuaWuspOdHBHwnHNQril8MqT0CJgtB6HFTo+w/7Lmmui5M
DDMMed39UJl7bF73hV9ywGecxPpeh+dtoVnh0VT16uK2xTvW6ICEZgaPw1xfPUHS
+jxQ7I05X1OWQkPpmhxXJqGclDyO+qx4CJZsOxUAvt2LphHxhZxB3QE5OUdudGKQ
AH6KhC4rpNQdJVMX20SG8PybL/AipN3Y8N/63VkoqVC2heRlaQ69HjsuqIAkIyan
hHnqmJH8Q+TDTbdKZvOQv6jcd4o3VSibz0T9MwnOfqQ0uRYyTpaXC0vLUH6lXaC4
eK+VVWbY8vCAFHR3h80Q61i2me2HU5ly7a/W22dz19zzDNNC5q9MO78uIYkUK78N
Z0wzJrmOxRyhvs5DOSOpNVlXZhffNQM1f42xxG8cUDaIf7pR5jK+xqHV7tIBQE1D
CrD0mt+YQCnngK0i4wQTO7VT/vjypf4A9W+VSsoJJpRhBbngU4pHu9JWqO84/7AA
j5FN8ug15MWysaS+FQ/EqzHmT7BGBWaTPv3yGlHKUjx0w4bPEpbH7y3fwHAcmOFf
xFRzvZFQ03zeer06yAqTVNuwr77HZgrCzgyQVgIkegAg6iUPiZcs
=CBT+
-----END PGP SIGNATURE-----

I was referred to Creating a World Without Poverty during a discussion on advogato some months ago, but it took rather a long time to obtain the book for various reasons and then I forgot about this review until a recent discussion on new Cooperatives-UK Chief Ed Mayo s site. Better late than never, here s my review of it. Let me know what you think of this book. About the Book Author Muhammad Yunus is founder of the Grameen Bank, Bangladesh, one of the microcredit pioneers, but that story has been told in another book Banker to the Poor. The prologue of this book starts with the creation of Grameen Danone a joint venture between the bank and the France-based Groupe Danone then part one describes problems in capitalism and introduces the idea of Social Businesses as a complement to what the book calls Profit-Maximising Businesses (PMBs), or what most people know as usual shareholder companies. Part two then covers the Grameen Group from its start in banking, through an impressive list of short company case studies some Social, some PMBs, some joint-ventures up to the first year or so of Grameen Danone. The final part then talks about creating a marketplace which is open to Social Businesses, harnessing Information Technology to spread these ideas (more on this in a later article on this site) and using those innovations to banish poverty from the world. The epilogue is the Nobel Prize Lecture Poverty Is a Threat to Peace which seemed to read almost as a simplified summary of the book s main ideas. Annoyance I got quite annoyed with this book because I feel there is a lurking absurdity in its main big idea:- On the one hand, the argument seems to be that profit-maximising businesses are problematic because of their single-minded focus on profit-maximisation. This is an argument that I largely agree with, as you may remember from my short review of Joel Bakan: The Corporation. On the other hand, it proposes to remedy this by creating Social Businesses with equally single-minded focus on social problems this seems like a recipe for disaster! If profit-maximisers threaten to wreck the environment, human rights or whatever else isn t in their goals, why won t Social Businesses using similar single-purpose company formation rules just as easily threaten to wreck whatever mentioned isn t in their goals? If this book is correct and entrepreneurs are multi-faceted human beings who will act to promote social aims (which they must if they are to invest in Social Businesses), then the only robust way forward is to promote businesses that do not try to simplify that multi-faceted nature, whether for profit-maximisation or for a subset of social aims. The best form of businesses that I know for trying to represent all interests of their owners are cooperatives. Dismissed after less than a page Cooperatives are examined in part one of the book and dismissed after less than a page (p35) because they are not inherently oriented towards helping the poor or producing any other specific social benefit (which is a misleading claim because concern for community is a basic principle of cooperatives which all should uphold), they can be owned equally by the wealthy as well as the needy (why is this a problem?) and they can sometimes be demutualised into PMBs. Ultimately, if that s the will of the people, that can t be completely prevented, but recent developments have found ways to make that much less attractive (so-called anti-carpetbagging rules). Doing what people want is not usually a problem in other spheres it s democracy. What s really infuriating is that the author proceeds to describe Social Business which are aimed at specific social benefits (rather than all), can only be owned by the needy but can access the resources they need by donations from the wealthy or by forming joint ventures with them (even very unequal ones) and can be desocialised into profit-maximisers (p178). The same problems which were used to reject cooperatives exist just as badly, if not worse! Conclusion: a bit disappointing So, ultimately, I found this book a bit disappointing. There are lots of good ideas, but when presented with a ready-made round wheel for the basic problem of tempering profit maximisation, this book reinvents an oval one. I suppose I shouldn t be surprised. The misleading criticism of cooperatives is sadly typical of much of the current social enterprise movement, which I mentioned as a drawback in the recent case study of our co-op by Cooperatives-UK. I don t know if social enterprise enthusiasts are informed by the thinking of people like Muhammad Yunus, or if the high-profile authors simply reflect the movement. Have you read this book? Did you spot this contradiction? Do you feel it has other problems that I m ignoring? Or is it a work of genius and I shouldn t be disappointed with it?

A periodic security review at our co-op suggested switching PasswordAuthentication no on even more hosts. One of those caused a bit of a heated discussion about the benefits of increased security and the drawbacks of making emergency access harder, reminding me of the old joke about a secure computer being one encased in a block of concrete, not connected to anything and buried in a secret location. More usefully, I found a Discussion summary on improving SSH which seemed to cover the basics pretty well. It also suggests that nearly two thirds of all SSH private keys were stored on disk with no password protection which is scary and can server admins even detect that sort of risky behaviour? One thing I ve not really noticed before is how common brute-force ssh attacks are. There are some denyhosts statistics which make interesting pictures and Strong passwords no panacea as SSH brute-force attacks rise summarises some data from last year. So what can we do? libpam-cracklib seems like a first step, along with denyhosts. While searching around, I noticed sslh ssl/ssh multiplexer which looks like a useful trick that I might try somewhere. It entered debian testing earlier this week and looks simple to backport to the stable version. What tips would you give? Do you think it s worth having at least one reasonably secure host with PasswordAuthentication enabled, just in case of disasters disabling private keys? Are you a fan of port-knocking and other more sophisticated things? Do you know more numbers about ssh security?

The debian project defines a critical bug as makes unrelated software on the system (or the whole system) break, or causes serious data loss, or introduces a security hole on systems where you install the package. FSF Europe reported that Windows 7, is currently shipping with a potentially serious defect [...] a high-risk vulnerability in the SMB2 protocol. This can be exploited over the network to shut down a computer with a Denial of Service (DoS) attack. (Full details) You d be hard pressed to know this from all the Windows 7 launch ra-ra on the BBC and others. Where was the Public Service part of the broadcast, warning customers about this awful problem? Please, when picking your software, when choosing your next operating system, select one that is mainly cooperatively-developed and which makes a promise like we will not hide problems . debian, fedora and centos all make promises of openness. Check whether your system does and if it does, mention it in the comments here. If it doesn t please ask its developers!

This was a Freedom of Information request to Companies House. The request was partially successful. I asked:

How many companies have been incorporated with the word co-operative in their name in the last few years and how many have been refused approval for the word co-operative?

After a bit of shuffling, the answer was:

we do not collate information on applications for company names that have been refused [...] As at the end of July there were 1,286 companies on the register with co-operative in their name. You may also wish to note that there were an additional 56 companies with cooperative in their name. [...] The figures for the companies that were incorporated within the last 3 years, and are still live, are 114 for co-operative and 14 for cooperative .

So, there has been about a 10% increase in cooperative names registered Companies House in the last three years, but there s no indication that Companies House are policing it effectively. Are you seeing more cooperatives around you recently? At least in the UK, the recession-support programmes offered to our co-op favour private companies over co-ops, but maybe new start-up co-ops can also access some funding? Have you met something called a co-op (apart from a computer game) which wasn t a co-op?

The debian GNU/Linux kernel s firmware content is one of the most troubling bugs, and (as I understand it):

• it mostly came from upstream (so fixing it only in debian isn t sustainable),
• it s something some FSF supporters kick us for (often while ignoring other not-aiming-for-100%-free systems and turning a blind eye to the non-program problem in their own back yard) and
• it s actually pretty hard to fix and even harder to get paid for fixing.

The latest Bits from the kernel team included: A constructive discussion was held about the outstanding firmware issues, how the team addresses them and how we might work with upstream to address our DSFG issues with kernel sources. The fuller minutes expand it a little: The main topic was concerned with continued splitting of non free firmware and ensuring Debian kernels remain useful even with our DSFG challenges. Discussion about upstream firmware releases and general agreement was reached to talk to Dave Woodhouse about this (as he did most of the upstream firmware splits) . Action item for Vince and Max to talk to Dave Woodhouse. Good luck and thanks for working on this! Another interesting point for our co-op is that xen dom 0 patches will be included in the squeeze kernel release subject to ongoing stabilisation work. The feature will be marked as deprecated and will not appear in future releases. vserver (which I still use on one server) is also going away, but that s less of a surprise. It appears that OpenVZ is the only one with continuing support in the debian kernel, so I guess I d better take another look at it (after it failed messily last time I tried). Will you be changing your virtualisation approach? Do you think debian will get any encouragement for its firmware-splitting, or more flaming for not going far enough?