Yesterday morning the IP phones I'd ordered turned up, so that wrote off a few hours of the day. I ordered a Grandstream GS-102 and a Sipura SPA-841. They've both got their pluses and minuses, but I think overall, the Sipura comes out on top.

Grandstream GS-102

The good

• Backlit screen
• Passthrough Ethernet port (built-in single port hub)
• Does remote syslogging

The bad

• Pocket-calculator style screen
• Doesn't seem able to work behind a NAT without hardcoding the address of the gateway
• Won't sync with my NTP server
• Central configuration seems to be a paid-for extra

Sipura SPA-841

The good

• Extremely comprehensive web-based configuration
• 2 line support
• Oooh, does remote syslogging as well

The bad

• No screen backlighting
• Out of the box, DTMF didn't work with my Australian phone banking, so I don't know if it's generally not right (but it was fixable, the default tone length was too short it seemed)
• XML central configuration file format documentation seems to cost extra

Overall, if I'd just bought a Grandstream, I think I'd be quite unhappy with my purchase. If the Sipura just did backlighting, I'd be totally happy with it. A passthrough Ethernet port would be a bonus.

I watched last weekend Crash, a movie from 2004 that was played this year in Spanish theatres. It's is also an opera movie in which there are quite a lot of different stories happening at the same time and that are completely tied in one or other different ways. Very well written it is sometimes a drama and sometimes a thriller, or perhaps both at the same time, showing how differently behave and think characters with different racial backgrounds. One interesting thing is to see how stressed cops are in Los Angeles, because of everyone carrying a gun (or possibly), and how they behave aiming first their guns and being rude. This is completely different in Spain (and most of Europe), where a cop have to had a very powerful reason to pull his gun out of its holder.

Yesterday I noticed that Epiphany in Ubuntu (and probably Debian too) is now build with Zeroconf support, which means it will detect any web sites exported over Zeroconf and add them to the bookmarks. This totally rocks, as instead of having a number of bookmarks for various administration pages on my machines, the machines can export them over Zeroconf and when I am at home and those machines are on, they'll appear magically. The first step to having Zeroconf enlightenment is to ensure avahi-daemon is installed on all machines. It doesn't matter if there are some machines that it cannot be installed on (i.e. router running embedded software), as other machines can publish their name and services on their behalf. The first service I published is the web-based admin pages for my printer. The printer is connected to a small server called Melchett (a Buffalo LinkStation) which is running CUPS. By creating /etc/avahi/services/cups.service on Melchett with the following contents, the web site is published:

<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
  <name>Epson Stylus Photo R220 Admin</name>
  <service>
    <type>_http._tcp</type>
    <port>631</port>
    <txt-record>path=/printers/epson-stylus-photo-r220</txt-record>
  </service>
</service-group>

Each .service file in /etc/avahi/services defines a group of services. A group has a name, and a set of services. Each service has a number of properties:

Type

Specifies what the type of the service is (_http._tcp is HTTP over TCP). There is a canonical list of types available. This is a required element.

Port

What port the service is listening on. This is a required element, there is no default port 80 for _http._tcp services.

Text Record

This sets arbitary key-value pairs, which are interpreted on a per-service manner. For _http._tcp services the valid keys are u (username), p (password) and path.

There are also domain-name and host-name properties, but these are not used in this service description as the service is on the local machine. In summary, you can see that I have specified that there is a web page accessible via HTTP on this machine, available on port 631 at the path /printers/epson-stylus-photo-r220. When other machines search the network for web pages they'll find this service entry (with the hostname properties filled in by Avahi), and generate the URL http://melchett.local:631/printers/epson-stylus-photo-r220 A quick pop into Epiphany shows that this is indeed the case, there is now a Local Sites category in the bookmarks containing Epson Stylus Photo R220 Admin. There is one other thing I need to explain: how to publish services on behalf of other machines. Until this afternoon this required something to run avahi-publish-address to give the machine a Zeroconf name, but this afternnon Trent committed static name mapping to Avahi. When this is in a released version, I'll continue this article.

Our Chair of Software Engineering at the ETH Zurich is addicted to the Eiffel programming language. Thus, a PhD student is working on an Eiffel Multimedia Framework, named EiffelMedia, and I'm doing the Debian packaging. After working the second year with Eiffel stuff now, I can say that packaging Eiffel programs (not the language itself) is a major PITA, with respect to the following two aspects: Eiffel is different

• Build tool is an Ant clone written in Eiffel, called geant (part of Gobo Eiffel).
  
  
• Paths are not hardcoded into the binaries, they are set by environment variables. You guessed it right - it's not a bug, it's a feature.
  
  
• There is no Eiffel compiler, just Eiffel-to-C wrappers which then issue the compilation to objectcode by a C compiler. Generating executables from Eiffel sources takes longer than from any other language.

Eiffel is non-free

There are not one... not two... but three incompatible Eiffel compilers arround. Oh yeah...

• EiffelStudio, developed by Betrand Meyers company Eiffel Software (formerly known as Interactive Software Engineering) reflects the reference implementation of the Eiffel language. Last summer, Eiffel was accepted as ECMA standard 367. Version 5.6 of EiffelStudio released back in fall 2005 does implement this standard.
  
  EiffelStudio is proprietary software (speaking of EiffelStudio means actually EiffelStudio Free Edition). Last year, I bitched Eiffel Softwares employees for about 3 month continuously to change the EULA for allowing non-modified redistribution. Thanks to be not ignored by Larry Miller from Eiffel Software, in the beginning of 2005 the EULA was changed and I could provide packages publicly. Theoretically, I could have moved them over to Debian non-free, but it's quite a large piece of software (190MB, source and binary packages) and the important parts (compiler and IDE) are still provided binary-only (so the archive would have to carry three arch specific version, makes 570MB in total per revision), thus no upload was considered. Additionally, EiffelStudio is available on Linux only for the i386, powerpc and amd64 architectures. All other platforms where Linux runs on are not supported.
  
  Another annoying problem with EiffelStudio is its nasty disclaimer flooding allover the buildlogs. It's built into every binary and displayed as the first 19 lines of every output of those:
  

  This program has been produced with a demo or non-commercial version
  of ISE EiffelStudio, the full lifecycle object-oriented development
  environment from Eiffel Software.
  This version is reserved for non-production use of Eiffel. Any other
  use requires purchase of a license.
  Eiffel Software offers commercial and academic licenses and
  support/maintenance contracts covering diverse needs.
  For more information please contact
  Eiffel Software at the address below or consult the Eiffel products page
  at http://www.eiffel.com/products/.
          Eiffel Software
          356 Storke Road
          Goleta CA 93117 USA 
          Telephone 805-685-1006, Fax 805-685-6869
          E-mail sales@eiffel.com
          http://www.eiffel.com
  

  This could have been "designed" a bit more discreet. However, as I do have to use wrapper scripts anyways for all binaries in the packages of any Eiffel program, I stripped that out by the occasion.
  
  
• Visual Eiffel developed by Object Tools was a proprietary Eiffel IDE and compiler suite. In November 2004, the compiler and the standard library were made free and are licensed under GPL.
  
  Unfortunately it was never fully compatible to EiffelStudio, actually years behind. It's not suprising that the project seemed never to be alive. Because it's still stuck with an old Eiffel language specification, it's even less useful today than it ever was.
  
  
• SmartEiffel (formerly know as SmallEiffel), developed by the LORIA Laboratory is a GPL licensed Eiffel compiler.
  
  But SmartEiffel does not and will not implement the recently published Eiffel ECMA standardization (roumors has it that they fork the Eiffel language in some essential parts caused by some technical and/or personal missunderstandings between Bertrand Meyer and the leader of the development team of SmartEiffel, they know each other from earlier).

Except from some fundamental programs like Gobo Eiffel or the Eiffel Wrapper Generator (they support both all three compilers), nearly all programs are written according to the current Eiffel specifcation. So there is no real alternative to the proprietary EiffelStudio. Beeing binary-only is a major drawback too: EiffelStudio on Linux/powerpc is dynamically compiled against glibc-2.3.5, but Sarge has glibc-2.3.4. So one needs a backport of glibc, which taints the system in an unneccessary and stupid way. Please: Eiffel Software, if you are reading this, open the sources of EiffelStudio now and turn it into free software, for the greater good of us all. Make additional ports to other architectures possible and allow us, the packagers and upstreams of Eiffel programs, to drop the cumbersome support for other ancient Eiffel compilers. Let's focus us to one, single implementation and improve it.

I'd been planning on waiting to blog about the issuing of my Social Security number until I actually received the card, but as it seems that it has been lost in the mail, I could be waiting a while... So I was doing my regular weekly "what the fuck is going on with my Social Security number application?" phone call to the San Jose Social Security Administration office on January 12, when for a change, they couldn't actually find my application by the reference number that they'd given me. Lo and behold, my number had been allocated two days earlier. They told me that my card would be mailed out in 10 working days from the date of allocation, or that I could come into the office and get a bit of paper that told me what the number was. Let's just say that I'm glad I didn't wait for the card, or I'd still not be getting paid... So ten working days passed, and then some, and no card. This made me somewhat concerned, since everyone's been telling me how the SSN is the Primary Key of All Things, and that if it gets stolen, you're screwed as your identity can be stolen, with all the bad things that accompany that. So I rang the San Jose office back, to see if they had anything useful to say for themselves, and of course, they didn't. They couldn't tell me anything. They couldn't even tell me what address they had on record to ship the card to. They couldn't offer any postal tracking information, and they said that if it bounced for some reason, it would go back to Baltimore, where it would be destroyed. Oh goody. So after the trip to the DMV today, I thought I'd drop into the Mountain View Social Security office to request a new card. Well, let me just say that I can see why they zip-tie the chairs together... After waiting for over an hour and a half to get to speak to someone, they said that they would need to request secondary verification of something or other before they could issue me a card, and that it could take up to four weeks (the same secondary verification that took nearly 2 months in the first place). Or I could go to the San Jose office, where they already had the verification on file, and they could request a new card for me immediately. I was so flabbergasted that I just walked out of there. In hindsight, I should have told them to just go ahead and request the secondary verification, as so far I haven't actually needed to present the card to anyone wanting my SSN, and it's a lot more convenient (I think) to have to deal with the Mountain View Social Security office than the San Jose one. What absolutely blows me away is that there is no trust, no communication between offices. The fact that one Social Security office has already requested (and received) secondary verification of my existence from Immigration isn't sufficient for another office. They can't even ship a copy of that from one office to another? The mind boggles at the inefficiencies. I want that hour and a half of my life back.

Last Monday, Sarah and I visited the fine institution that is the California Department of Motor Vehicles, so that we could get ourselves California drivers licences. We had to do both a written test and a behind the wheel test. The written test was your standard multiple-guess exam (36 questions, maximum of 6 incorrect answers to pass). Annoyingly, all the material on the exam was not in the California Driver Handbook, which the handbook tried to make out was the case. Fortunately it was largely a case of common sense. I got two wrong. The funniest thing was that Sarah and I both got the same exam paper, and Sarah did her test just after I finished mine, and we were allowed to keep the paper, so she could see which two I got wrong. One of the more unusual things I found about the process was that they allocated me a licence number before I'd even sat the test. Last Thursday Sarah had her behind the wheel test, and today I had mine. It was pretty easy. No reverse-parking, no emergency stopping. I just had to drive around for 15 minutes. I passed without any faults. Given it took me four attempts to get my original licence in Australia, I was pretty pleased with this. (I failed my Queensland licence a number of times due to nerves). The other thing that I was amazed to discover was that I don't get the licence for another four to six weeks! They mail it out. The DMV processes over here are just mind boggling. The fact that you can't get a licence on the spot, and that it takes something like three months to get licence plates for a new car just blows me away. It's nothing like the process in Australia.

Okay, something bugs me, and it's somewhat irrational, and somewhat rational. I totally hate really long URLs needed to "verify" that the sign-up is valid. There are more than one type of these, sometimes they are required to continue into the site, sometime just for extra features, but they are more often that not, very long. Now, I don't like long URLs in general in emails, because there are many services which allow you to shorten them for public use. Recently I signed up for 30 boxes and they sent me this monstrosity:

http://30boxes.com/signup.php?action=finishSignup&d=aSDFJKLa43da
safjdAL5RLKj4afjrafa45J5kljtyTGJrALKJgFKLsaj5klJ4jkljakljdkalflk
fASJKjdfa4r23890fdfjskl342390fakjlei309dk390ujkal39032kd03j9djd9

Okay, so lets look at this rationally for a bit. How many unique strings can they have from that huge behemoth of an identifier. There are 145 characters. They are using the entire uppercase (26), lowercase (26) and numbers (10), so there are a total of 62 unique symbols for each spot. That gives us a total of 62¹⁴⁵ different strings. That's

78848779858160540639233408124436328679807474352650645474403652978
77812230999983634922053904324829205441837830921209410767866820350
39259149646534571887966722870103317751633817974743087029882020930
78213775489032524047364643001443429901072761743321026356976812032

different combinations. In scientific notation, thats 7.8 × 10²⁵⁹. Just for comparison, the entire number of atoms in the universe is high-balled at 6 × 10⁷⁹ (on this page). That's more than a googol of identifiers for EACH ATOM, EVERYWHERE. Isn't naming each atom once enough? Then you would only need 45 characters, which would nicely fit in one line of my email client if you just shortened your "finishSignup" to "fS" and action to "a". As a bonus, it also saves you approximately 117 bytes of bandwidth per email. UPDATE: Apparently it has ALL the information, in addition to being completely too long. I replaced it with random crap.

Why are more and more mailing list archives put behind https URLs with self signed certs? What exactly are they securing? What does it achieve other than pissing people off who have to accept the cert just in order to see a mailing list post? GNUCash is the one I happened to hit today, but it seems to be a not infrequent thing.

As I mentioned yesterday, I noted that Blosxom was misbehaving with RSS feeds where a flavour was used to customise the character set of the feed. Tonight I made time to look under the hood, and found:

      if ($content_type =~ m \Wxml$ )  
        # Escape <, >, and &, and to produce valid RSS
        my %escape = ('<'=>'&lt;', '>'=>'&gt;', '&'=>'&amp;', '"'=>'&quot;');  
        my $escape_re  = join ' ' => keys %escape;
        $title =~ s/($escape_re)/$escape $1 /g;
        $body =~ s/($escape_re)/$escape $1 /g;
       

Which I promptly changed to

      if ($content_type =~ m \Wxml(; charset=.*)?$ )  
        # Escape <, >, and &, and to produce valid RSS
        my %escape = ('<'=>'&lt;', '>'=>'&gt;', '&'=>'&amp;', '"'=>'&quot;');  
        my $escape_re  = join ' ' => keys %escape;
        $title =~ s/($escape_re)/$escape $1 /g;
        $body =~ s/($escape_re)/$escape $1 /g;
       

and now I can have my cake and eat it: UTF-8 encoded RSS feeds.

Recently there was a discussion on whether BitTorrent should get some encryption (or obfuscation, more likely) added. Right now, you can filter out BitTorrent traffic with the following iptables command (note: this needs iptables 1.3.4 and a recent kernel):

iptables -I OUTPUT -j DROP -m string --string "BitTorrent protocol" --algo bm --from 0 --to 100

(Note: match is not optimized, the range of 0 to 100 and algo bm is arbitrary) The nice thing is, that this match is very unlikely to match non-Bittorrent traffic. Linux users can use it to filter out all BitTorrent traffic or mark it for speed restrictions. Network operators are very interested in filtering this traffic: it slows down more important traffic (and if you are e.g. using stochastic fair queing, the large number of connections for P2P filesharing will make it get a larger share than other apps!) and can cause costs. If you have mobile users, who e.g. connect their laptop to your network, they will occasionally use BitTorrent at home, and forget to disable it when they connect to your network. That's really bad, it happens and it's not like this is intentional "malbehaviour" or "sabotage"! So back to the original topic - obfuscating BitTorrent traffic. Let me explain what network operators might do when BitTorrent can't be slowed or filtered any more (Note that this already applies to some services such as Skype or Kazaa as far as I know): First of all, they might decide to filter all connections to non-standard ports. This effectively eliminates (most of) filesharing - but also e.g. Skype and some IM and chat services. Basically any non-standard service. (Note that "professional" VoIP services using SIP may still be whitelisted). Secondly, they could decide to slow down all connections to non-standard ports. This would make filesharing, Skype, IM etc. still possible, but for example file transfers via IM will be really slow. No video via Skype, probably, depending on the limits set in traffic shaping. Thirdly, they could disable all outgoing connections and require you to use proxies for that. Then you need to enable/disable your proxy all the time when switching networks, and you'll only be able to use a limited set of services. Again, Telephony via SIP is still technically possible, using a SIP proxy or by whitelisteing major SIP providers. Skype is no longer possible. IM needs whitelisting, and will likely be blocked, too. None of these options are very favourable for the users. So please do not support "obfuscated" Protocols such as Kazaa or Skype, or an obfuscated variant of BitTorrent. Stick with stuff administrators can set up policies for - and be nice to your admins. Tunneling via non-standard ports, hiding services will only get you into trouble, and probably even make innocent other users suffer. After all, filesharing - especially illegal downloading movies and music - is not THAT important, is it? So please make the important services not suffer from it. Thank you. Oh, and please use SIP, not Skype. Because your admin can whitelist your SIP provider if you tell him you need it for work or setup a proxy for that - and with Skype, he might be afraid that you become a supernode and cause high traffic costs. And then there is a much larger software choice for SIP, including many OpenSource solutions, including PBX software such as Asterisk.

Heh, its been more than a day now since I got back from Manila after the Ubuntu AsiaBusinessTour, and even then I have some stuff to do here (both IRL and IOL work) before I could find some time to blog Here are the highlights of my trip:

• Feb 1 - Arrived in Manila around 6 in the evening; spent the early part of the evening looking for an internet cafe to check on mail. libmemcache got ACCEPTED, but it FTBFS on powerpc $DEITY, I sure wish I had my desktop with me! (or at least some access to a ppc Looked for someone on #debianPPC to help me solve it (and indeed got the hint by the next day Slept late.
• Feb 2 - Woke up late, checked mail only to be told by Jerome to GO HERE NOW to the Peninsula Manila for the ABT breakfast meeting. After a short tirade with some Ayala traffic enforcers about crossing pedestrian lanes, I was able to arrive (already late) to Garcia Villa, seeing Jerome, Charo, Clair, and Dom, providing a nice representation for both PLUG and Ubuntu-PH. The Inceptions folks (who I met last time at LinuxWorld) were there as well. Mark was already talking when I arrived, while Hande and Malcolm from Canonical were at the back with the local media; and after that, I got to talk with the SABDFL, of all things, about my Debian packaging adventure last night :/ After lunch, we then transferred to the National Computer Center at UP Diliman (Canonical in the chopper, Ubuntu-PH and PLUG in Jerome’s Picanto) to continue the Tour for government representatives and CIOs (which didn’t go quite well in my opinion; imagine crickets signing in the night), NGOs, and academe (which was much better, especially since Doc Pablo Manalastas asked the last question regarding backports.) Mark and company had to leave early, which left us PLUG/Ubuntu-PH people going to the UP Shopping Center for snacks, some talk, and an early wrapup. I however still slept late. Photos by Charo are visible.
• Feb 3 - After doing some errands in the morning, I went to Makati to meet up with Shelley, Markku, and Rommel of Inceptions. I will be doing a project with them

I’ve adopted opendchub, rccp, and xshisen from Grzegorz Prokopski too Heh, I’ll be quite busy this coming week…

The nomination period for the Debian Project Leader is on again. This means that the Finnish winter is at its worst, and indeed, as I write this, it is -22 degrees Celsius outside. The sun went down about six hours ago; I woke up quite late, so I only saw half the sunset. Back in November, while vacationing, I spent some time thinking about what the role of the DPL is, and now seems a good time to say it. The actual work of developing and maintaining Debian is done by package maintainers, translators, a handful of infrastructure teams or other special purpose teams, bug reporters, and others. It is not the job of the DPL (in their role as DPL) to take charge of the actual development: the DPL is not expected to administer debian.org machines, to fix RC bugs themselves, or to make decisions about release management. Instead, the DPL's job is to help everyone else do those things. If some part of project isn't working well due to resource shortage, or personality conflicts, or other issues, it is ultimately the DPL who needs to facilitate, mediate, or otherwise deal with it. This is not uniquely the DPL's job: any Debian member could step into a situation and help, but the project does need someone whose job it is to do that if no-one else will or succeeds. Another important job of the leader (again not uniquely) is to provide inspiration. Our leaders in the past few years have provided fairly little of that. I would like us to have a DPL that inspires the project into setting and achieving goals that make us happy and make Debian the best operating system ever. The important thing is to inspire, not to force, cajole, or otherwise unilaterally decide. Not quite sure now how that should happen. Perhaps the Finnish military saying that "leading is best done at the front" is applicable: an inspiring DPL is one who by his own work, and his own behavior, shows by example what a good, productive member of the Debian development community is like. A third important job of the leader is to be the project's public face to the rest of humanity. Again, not uniquely, we have other members who are often prominently in the public eye, such as release managers or security people, but the DPL is the main such public face. And finally, the fourth important job of the leader is to do the tasks assigned to him in the Debian Constitution. These are not daily tasks, but they're important, and these, at least, are uniquely the DPL's domain.

I am pretty sure this cluelessness at its best:
m26s25:~# swaks -s spam-is-theft.sput.nl. -f'<>' -t rob@sput.nl -q rcpt
[...]
-> RCPT TO:<rob@sput.nl>
<** 550 Host name is listed in abuse.rfc-ignorant.org. Get yourself another ISP.
According to the web interface the host 83.151.30.59 is definitely not listed on abuse.rfc-ignorant.org. Anyway, should you read this, the answer to your question is: It has been reported before bug 326160 and is suppposed to be documented (although I fail to parse right now, due to being slightly tired) perhaps unknown_in_list should be added to log_selector. Just finished reading: Jane Austen's Pride and Prejudice which was a pleasure to me.

Following up on the previous entry I have now got a exim4.conf that has survived basic testing. I have checked exim4 -bt for all major routers and found and fixed a fair number of bugs in the initial version. Any further changes I would (like to) make would result in different behavior than the current exim v3 setup, so I am not wasting time on that until somebody from debian-admin says they want me to. Conservative suggestions include copying the "deny local_parts = funky characters" settings from the default configuration, disabling domain-literals (or at least accepting only incoming postmaster@[local.ip] instead of only outgoing), and perhaps recipient verification.

The latest burning of different consulates by outrageous and uncivilized muslims only shows again one thing: they ask for respect for his way of thinking while at the same time they don't respect at all others way of thinking. Clearly, islamic movement is being used lately as comunism was used some time ago in Europe, as a way of control people and make them not thinking freely. Watching those images on TV makes me change my mind on respect to the islamic world. And while I think that perhaps those Mohammed cartoons could be offensive for muslims, their reaction makes me think that they deserve those. But what can you say of people that behave as the year they live in: 1441.

If you haven’t signed the petition for abrotman to come to DebConf6, sign it now! We are still 13 votes behind of our goal. Here is a picture so you can think on friendship

DebConf6’s abrotman petition, only 13 votes left! (and he thought, at the beginning, the petition wouldn’t get any vote, but mine )…