Search Results: "ema"

31 March 2013

Enrico Zini: A proposal to solve gender imbalance in Debian

A proposal to solve gender imbalance in Debian We've done all we can so far: Debian Women, the Diversity Statement, the anti-harassment contact, gender neutral language, lots of education all round, but we still suffer from a strong gender imbalance in Debian. I think that the reason is that the majority group of cisgender men in the project, although they don't actively work /against/ the rest, still have /no incentive/ to be inclusive, and generally do not understand what bearing a female name online is like. I think it is about time we addressed that, and after a lot of thinking and discussing with many other concerned debianers, I think I have just the right proposal, which is twofold. The first part is this: since the goal is to have an equal gender perception in Debian, we can just decide to only approve one obviously-male-named DD for every obviously-female-named one. That's right: no new obviously-male-named DD unless an obviously-female-named DD has just been approved. It may sound like affirmative action gone wild, but please stop a moment to think about it: this would create precisely the right incentive for the currently dominant group of developers to be inclusive! People shouldn't just assume they can get a Debian account regardless of what happens around them. We already ask NM candidates to fix RC bugs and, well, gender imbalance should be treated as an RC bug, and everyone should feel compelled to join the effort to fix it! Now, of course since there currently are many male names in NM but not a single female name, it would not be reasonable to just stop the flow of new developers into the project: that would just have the effect to make us starve on personpower. So here is the second part of the proposal: the one-female-name-one-male-name policy will not be enforced for, say, a year. But during this year, everyone currently in NM or joining NM will be asked to adopt a female identity. Crazy? No, genius! It's about time people understood what it means to get advances in private every time they make a public contribution! What better way than just trying it out for themselves? On top of that, as more and more female names appear in Debian changelogs, fake or not, people will finally start to understand that it does not matter what name is used to sign the contribution, but the contribution itself. I don't know if this will give us a community where people realise female or male contributions are equally valuable, which is what I hope, or a community where people will think that everyone is a cisgender man even if they have female names. In the end, really, it does not matter. Either way, we finally get to have a community where everyone is /guaranteed/ to be treated the same. But gender imbalance isn't the only imbalance we have in Debian. People accrue a reputation over time, good or bad, and this reputation tends to stick on you for years, regardless of how you may change, for better or for worse. When we evaluate the merit a contribution, we should not be biased by the reputation of the contributor! How can new contributors be taken seriously otherwise? I believe we are loosing lots of fresh, good ideas this way. And how much damage could be wrecked on the project by a well-respected contributor, like a Debian Account Manager, who is having a funny day? I think we can address this just as I propose to address gender imbalance: let's swap identities from time to time, like it usually happens with nametags at the end of Debconfs. Let's see gregoa upload a patched versions of python3.2, and enrico upload a new upstream version of eglibc! See if we won't finally have some peer review at last! Reputation and real identities have many merits, but we have come to rely too much on them, and it is hurting us. It is time we did something about it, before it is too late!

Nathan Handler: Debian Mobile

For one of my classes, the final project is to work on a personal project for four weeks. Since I have never done mobile programming before, I decided I would use this project as a chance to teach myself the basics of Android development. Paul Tagliamonte recently blogged about a Google Summer of Code project idea for a Debian Android application. It was this post that motivated me to create a Debian Android application for my final project. We are only in the middle of week one, but my plan is to have at least a basic BTS and PTS interface done by the end of the project. Then, depending on a few things, I hope to turn it into a Google Summer of Code project or simply continue developing it on my own. As I mentioned, I am only a few days into the project. One of the first hurdles I encountered was interacting with the SOAP interfaces available for the PTS and BTS. There are a few examples available on the wiki, but there are not any for Java. A Google search also failed to return any clear and simple results. As a result, I decided I would create a Python script that would accept requests from the Java Android application via a REST API and pass them on to the SOAP API before returning the result as JSON. Before I could finish writing the script, Paul mentioned that he had already written a similar program a few months ago. I immediately stopped working on my script and began preparing a patch for Paul's program to add support for some missing PTS SOAP functions as well as the entire BTS. After a few hours, I had the ability to query the PTS and BTS via a REST API from Java. While I normally prefer to use VIM for my programming, I decided to follow Google's recommendation and use Eclipse. I was able to follow their guide to get the SDK setup and a simple demo application running. One of the few hurdles I encountered was when I wanted to make web requests. Due to the ability for such requests to stall, you are required to perform them in a separate thread. This only becomes aparant when you try to test your application on an actual device; the emulator will happily run the process in the main thread. Regardless, I was eventually able to modify the demo application to allow me to make requests to my Python REST server and then parse and display the result. Here are some screenshots of the application running. Main Screen API Functions Information Entered Result If you have any feature suggestions, questions, or comments, feel free to send me an email (nhandler@debian.org). The source code for the Android application is currently not available, but I plan to put it up in a git repository sometime in the near future. The source code for the Python script that provides a REST API to access the PTS and BTS SOAP interface is available on GitHub.

30 March 2013

Michael Stapelberg: Analyzing RC bug messages

Recently, I was wondering how many Debian Developers are actively working on RC bugs in some way or another in the time period of the last release (squeeze) to now (shortly? before wheezy). I therefore grabbed the mailing list archives of debian-bugs-dist@ from gmane, used only those messages whose X-Debian-PR-Message header matches an RC bug (list retrieved from UDD) and then attributed the message counts to the appropriate Debian Developer. I am sure that there are subtle mistakes in the data I retrieved and that there most likely is a better way to achieve the same results, but this is only to get a trend and should be good enough for that. So, it turns out that 514 different Debian Developers have sent messages regarding RC bugs since squeeze. That s about half of our 985 total active Debian Developers. I would love to show a good histogram of the actual message counts (not sure how well received showing the raw data is ), but I suck at visualizing such data in a compact way. Is there anyone familiar with R (or other free data visualization tools) and willing to help? I can send you the CSV file, just send me an email to stapelberg@.

29 March 2013

Dirk Eddelbuettel: R / Finance 2013 Open for Registration

The annoucement below just went to the R-SIG-Finance list. More information is as usual at the R / Finance page:
Now open for registrations: R / Finance 2013: Applied Finance with R
May 17 and 18, 2013
Chicago, IL, USA
The registration for R/Finance 2013 -- which will take place May 17 and 18 in Chicago -- is NOW OPEN! Building on the success of the previous conferences in 2009, 2010, 2011 and 2012, we expect more than 250 attendees from around the world. R users from industry, academia, and government will joining 30+ presenters covering all areas of finance with R. We are very excited about the four keynotes by Sanjiv Das, Attilio Meucci, Ryan Sheftel and Ruey Tsay. The main agenda (currently) includes seventeen full presentations and fifteen shorter "lightning talks". We are also excited to offer five optional pre-conference seminars on Friday morning. To celebrate the fifth year of the conference in style, the dinner will be held at The Terrace of the Trump Hotel. Overlooking the Chicago river and skyline, it is a perfect venue to continue conversations while dining and drinking. More details of the agenda are available at:
http://www.RinFinance.com/agenda/
Registration information is available at
http://www.RinFinance.com/register/
and can also be directly accessed by going to
http://www.regonline.com/RFinance2013
We would to thank our 2013 Sponsors for the continued support enabling us to host such an exciting conference:
International Center for Futures and Derivatives at UIC Revolution Analytics
MS-Computational Finance at University of Washington Google
lemnica
OpenGamma
OneMarketData
RStudio
On behalf of the committee and sponsors, we look forward to seeing you in Chicago!
Gib Bassett, Peter Carl, Dirk Eddelbuettel, Brian Peterson,
Dale Rosenthal, Jeffrey Ryan, Joshua Ulrich
See you in Chicago in May!!

28 March 2013

Eddy Petrișor: The sorry state of the Android universe


Update: Corrected the code name for 4.2.2 is Jelly Bean, not Ice Cream Sandwich as I initially stated. I also described in the comments why the calendar application is also crap.

I recently bought a phone based on the Android platform (version 4.2.2 aka Jelly Bean). Before the purchase I had the wrong idea that this platform - Android - is the best thing since sliced bread. Let me tell you, that idea is so wrong, it's a shame anybody thinks or has ever thought that.

My previous phone was a Nokia E71 and with its stock set of applications and in spite of its old and rusty Symbian OS, I still have a hard time to even match the basic functionalities on the Android phone even using the most praised apps from the Play Store.

The dialer is crap, there is no decent speed dialer, the focus is on the apps instead of the phone functionality, the homescreen-type-to-search-in-contacts functionality of E71 is probably impossible due to the retarded decision to forget you're using a phone, notifications, even important ones, are hidden, to the point that the ones needing attention can be missed (e.g. entering the PIN/confirmation for Bluetooth pairing must be searched for in the notification area), when looking in the agenda there is no straight one step to edit a contact, you must jump to another application and do the edit there, treating SMS conversations as one to one instant messages works until you want to reply to multiple people at once.

Volume for ringing, SMS notification and the headset are controlled all together, so if during the last conversation you turned down the volume because it was too loud, you can miss a call because our will ring at a lower volume.

And these are only broken things in the basic functionality (for a post 2008 cell phone).

Android phones are smart phones, so more advanced features are required: playing audio and video files, GPS related applications, podcasting support, email handling and web browsing are among the features that can be expected on such a phone.

Only web related functionality and simple media playing are at a reasonable level compared with my old E71, maybe due to Google being web oriented and the new phones having better screens than the old Nokia.

But I am an avid podcast listener, so I've been searching for an application that can match Nokia's Podcasts stock application, and I've come to the conclusion Android users which love podcasts either have to wait for Nokia to develop on Android (which seems unlikely) or find one or two talented developers to create a decent application.

I don't understand how can such an application not have a playlist with the downloaded episodes, not have download all new episodes or mark all/selected as listened. I have found applications that have at least one of these issues and have an average of over 4 out of 5 stars in Google Play. Poor users!

In the light of these issues, I'm having so much difficulty coming up with an excuse for Nokia losing its position as a market leader, but our seems technical superiority is not necessary or enough to dominate the mobile phone market. Sadly, that says a lot about our species, and the words aren't nice.

Russ Allbery: wallet 1.0

Finally. The wallet is a system management tool for storing and retrieving secure data. I originally wrote it as part of our Kerberos v5 migration project to replace the old Kerberos v4 system we had for distributing srvtabs. It's still mostly used at Stanford for distributing keytabs, but it's extensible and supports storing arbitrary secure data. We also use it internally for storing database passwords, SSL private keys, and anything else that needs to be kept secure and retrieved later. It supports a rich ACL mechanism and namespace enforcement and is built on top of remctl for security and confidentiality. I did a bunch of development on it originally in 2006 and 2007, but then it solved our immediate problems and I didn't have much time to work on it. I used pre-1.0 versions because there was so much more on it that I wanted to do. But we've been running it in production for years, and while there's still tons more work that needs to be done, it really deserves a 1.0 version. Jon Robertson converted the database backend to DBIx::Class (which added PostreSQL support) and implemented schema upgrading, which were two of the major things that were keeping me from putting a 1.0 version on it. So it's time. Other new features since the previous release include a change to the default ACLs so that owners of objects can destroy them by default, a new ldap-attr ACL type that checks whether the caller has a particular attribute set in LDAP (which will let us use our entitlement system to control access), and support for storing and managing key rotation for WebAuth keyrings. There's also a new acl check command to determine whether an ACL exists and a new comment field and command to store an arbitrary comment about an object. Our local naming policy has also gotten much more complex, so I turned it into a module to provide an example to others of how to implement some reasonably detailed namespace and object autocreation controls. You can get the latest version from the wallet distribution page. I'm going to upgrade Debian packages to experimental or unstable (depending on the freeze status) as soon as I get a chance to write a bit more documentation and hopefully figure out debconf integration with the database setup support inside Debian for the server piece.

27 March 2013

Bits from Debian: Debian Project Leader elections 2013: interview with Moray Allan

We have asked Moray Allan, one of the three candidates for DPL elections 2013, to tell our readers about himself and his ideas for the Debian Project. You can also read the interviews to the other two candidates: Lucas Nussbaum and Gergely Nagy.
Please tell us a little about yourself. I'm Moray Allan, from Edinburgh in Scotland. I'm 32. After working in academic research for a few years, I'm now working freelance on a wide mixture of topics, with recent projects in Indonesia, Romania and Kuwait. When I'm not working, I'm likely to be found walking through a city or the countryside, or otherwise relaxing at home reading a novel in French or Spanish. What do you do in Debian and how did you started contributing? In recent years, most of my Debian time was taken up organising the annual Debian conferences. But I still have a load of packages, mostly connected to an upstream Linux-on-handheld-computers project I was working on before I joined Debian to create packages for it. Why did you decide to run as DPL? I've been involved in Debian for about 10 years now, including working for the last few years in DebConf in a way similar to how the DPL acts within overall Debian. Previously I'd ruled out running due to lack of time, but currently I'm in a more flexible work situation. It seems the right time to put myself forward, and see if the ideas in my platform interest project members. Three keywords to summarise your platform. Transparency, communication, openness. (Three ways I'd like us to think about teams in Debian.) What are the biggest challenges that you envision for Debian in the future? I think the biggest challenges are for free software in general.
End-users are moving to more closed hardware -- will our software be able to run on the phones and tablets people are shifting towards? At the same time, end-users and server users are moving to "the cloud", and often depending more heavily on non-free infrastructure outside their own control. What are, in your opinion, the areas of the project more in need of technical and/or social improvements? In my platform I give a few ideas about teams and delegations, coordination and mediation, and both internal and external communication, including more organised fundraising. These are areas where I think relatively simple changes can give big benefits. Why should people vote for you? I have proven leadership experience within Debian, as I've been working on coordination and mediation tasks for some years already. At the same time, I do regular packaging work, and work in other parts of Debian like the press and publicity teams, so I'm in touch with the experience of normal Debian contributors. People should vote for me if they support my platform, which is about coordination-level changes that I would have no mandate or authority to push through unless I am elected. Name three tools you couldn't stay without. APT, emacs, ssh. What keep you motivated to work in Debian? I've used Debian on all my computers for a long time, and by now working on the distribution myself feels a natural part of that.
Fortunately I'm constantly positively surprised by Debian and by the Debian community. Are there any other fields where you call yourself a geek, besides computers? Certainly history (such as the eastern Mediterranean region in late antiquity), languages (including dead ones) and music (especially Josquin to Monteverdi).

Bits from Debian: Debian Project Leader elections 2013: interview with Gergely Nagy

We have asked Gergely Nagy, one of the three candidates for DPL elections 2013, to tell our readers about himself and his ideas for the Debian Project. You can also read the interviews to the other two candidates: Lucas Nussbaum and Moray Allan.
Please tell us a little about yourself. I was born in Hungary, a little bit over three decades ago, as a son of a biochemist and a pharmacist, who gave me the name Gergely Nagy (however, online - and offline too by now - I'm mostly known by my nickname, algernon). I went on to study human arts (hungarian grammar & literature, in particular), and to support this passion, I work as a software engineer, one who gets paid to work on free software. As such, I'm in a fortunate situation where my hobby supports my passion, and my hobby aligns well with my Debian work too. What do you do in Debian and how did you started contributing? At the moment, apart from maintaining a few packages, I'm doing a few other, mostly invisible things, like reassigning misfiled bugs so they don't end up being forgotten; or review newly uploaded packages before they enter the archive, making sure we are allowed to distribute them, and that their quality is up to our standards. I used to do quite a lot of other things, but I chose to spend the past year mostly invisible, learning. I started contributing by packaging an editor I was using at the time, but quickly ended up adopting another package - things escalated from there quickly. Why did you decide to run as DPL? There were two reasons that motivated me to run: one is that I believe I can bring something new to the table, that I can help Debian expand in new directions. The other reason is that I'm always on the lookout for new ways to contribute back to Debian, and being the project leader is a position where I believe I could contribute most at this point in time. Three keywords to summarise your platform. Non-technical contributors. What are the biggest challenges that you envision for Debian in the future? The biggest challenge is growing up, to become more than a group of computer geeks creating an amazing distribution. To become a community of a wide variety of people, where both computer geeks and art geeks feel equally at home. Yet, at the same time, where we as a project, keep our focus straight, and be the champions of Free Software. We just need to realize that there's much more to Free Software than the software itself. What are, in your opinion, the areas of the project more in need of technical and/or social improvements? I believe that while we do have many areas where we could use technical improvements, we are reasonably safe there, because we do have very skilled technical people to help us solve these problems. We can make our tools better, we can develop our infrastructure better to aid us even more - and so on and so forth. While we need work on many areas, we're on the right track there. However, when it comes to social issues, we're at a loss. We have serious trouble keeping certain topics civilised on mailing lists, we have trouble attracting women, and we have trouble reaching people who are not naturally exposed to Debian (or Free Software). We could really use a more diverse community, but that requires us to overcome quite a lot of social roadblocks, so to say. Outreach is one particular area where we need much more technical and social improvements. Why should people vote for you? People should vote me, because they found my platform, my answers on debian-vote@, and my ideas and goals convincing and worthy to pursue. People should vote me, because they trust I'll be able to serve the project well. Name three tools you couldn't stay without. Emacs, git and a pencil. Because with these three, I can pretty much do anything. What keep you motivated to work in Debian? The community. Over the years, I had the good fortune to meet with a lot of people I hold in high esteem, whose enthusiasm and motivation I found inspiring. For any other common goals Debian and I may share, in the end, it is the people within Debian that keep me motivated. Are there any other fields where you call yourself a geek, besides computers? I'm not quite there yet, but I'm working hard on becoming a human arts geek, or at least a geek of the hungarian language.

Benjamin Mako Hill: The Institute for Cultural Diplomacy and Wikipedia

A month ago, Mark Donfried from the Institute for Cultural Diplomacy (ICD) an organization dedicated to promoting open dialogue sent me this letter threatening me with legal action because of contributions I ve made to Wikipedia. Yesterday, he sent me this followup threat. According to the letters, Donfried has threatened me with legal action because I participated in a discussion on Wikipedia that resulted in his organization s article being deleted. It is not anything I wrote in any Wikipedia article that made Donfried so upset although Donfried is also unhappy about at least one off-hand comment I made during the deletion discussion on a now-deleted Wikipedia process page. Donfried is unhappy that my actions, in small part, have resulted in his organization not having an article in Wikipedia. He is able to threaten me personally because unlike many people I edit Wikipedia using my real, full, name. Donfried s letter is the latest step in a saga that has been ongoing since last June. It has been a frustrating learning experience for me that has made me worried about Wikipedia, its processes, and its future. In Wikipedia, debates can be won by stamina. If you care more and argue longer, you will tend to get your way. The result, very often, is that individuals and organizations with a very strong interest in having Wikipedia say a particular thing tend to win out over other editors who just want the encyclopedia to be solid, neutral, and reliable. These less-committed editors simply have less at stake and their attention is more distributed. The ICD is a non-profit organization based in Berlin. According to its own website, a large part of the organization s activities are based around arranging conferences. Its goals peace, cultural interchange, human rights are admirable and close to my heart. Its advisors and affiliates are impressive. I had never heard of the ICD before their founder, Mark Donfried, emailed me in April 2012 asking me to give a keynote address at their conference on The 2012 International Symposium on Cultural Diplomacy & Human Rights. I replied, interested, but puzzled because my own research seems very far afield of both cultural diplomacy (which I had never heard of) and human rights. I replied saying:
What would you like me to talk about I ask because I don t consider myself an expert in (or even particularly knowledgeable about) cultural diplomacy. Did someone else refer you to me?
Donfried replied with a long message seemingly copy and pasted thanking me for considering attending and asking me for details of my talk. I replied again repeating text from my previous email and asking why he was interested in me. Donfried suggested a phone call to talk about details. But by this point, I had looked around the web for information about the ICD and had decided to decline the invitation. Among things I found was a blog post by my friend James Grimmelmann that suggests that, at least in his case, the ICD had a history of sending unsolicited email and an apparently inability to take folks off their email lists even after repeated requests. I also read the Wikipedia article about the ICD. Although the Wikipedia article was long and detailed, it sent off some internal Wikipedian-alarm-bells for me. The page read, to me, like an advertisement or something written by the organization being described; it simply did not read to me like an encyclopedia article written by a neutral third-party. I looked through the history of the article and found that the article had been created by a user called Icd_berlin who had made no other substantive edits to the encyclopedia. Upon further examination, I found that almost all other significant content contributions were from a series of anonymous editors with IP addresses associated with Berlin. I also found that a couple edits had removed criticism when it had been added to the article. The criticism was removed by an anonymous editor from Berlin. Criticisms on the article included links to a website called Inside the ICD which was a website that mostly consisted of comments by anonymous people claiming to be former interns of the ICD complaining about the working conditions at the organization. There were also many very positive descriptions of work at the ICD. A wide array of pseudonymous users on the site accused the negative commenters of being liars and detractors and the positive commenters of being ICD insiders. I also found that there had been evidence on Wikipedia also removed without discussion by an anonymous IP from Berlin of an effort launched by the youth wing of ver.di one of the largest trade unions in Germany to campaign for good internships at the ICD. Although details of the original campaign have been removed from ver.di s website, the campaigned ended after coming to an agreement with the ICD that made explicit a set of expectations and created an Intern Council. Although the article about ICD on Wikipedia had many citations, many were to the ICD s own website. Most of the rest were to articles that only tangentially mentioned the ICD. Many were about people with ICD connections but did not mention the ICD at all. As Wikipedia editor, I was worried that Wikipedia s policies on conflict of interest, advertising, neutrality, and notability were not being served by the article in its state. But as someone with no real experience or knowledge of the ICD, I wasn t sure what to do. I posted a request for help on Wikipedia asking for others to get involved and offer their opinions. It turns out, there were several editors who had tried to improve the article in the past and had been met by pro-ICD editors reverting their changes. Eventually, those editors lost patience or simply moved on to other topics. By raising the issue again, I kicked off a round of discussion about the article. At the termination of that discussion, the article was proposed for deletion under Wikipedia s Articles for Deletion policy. A new Wikipedia editor began working enthusiastically to keep the article by adding links and by arguing that the article should stay. The new user edited the Wikipedia article about me to accuse me of slander and defamation although they removed that claim after I tried to explain that I was only trying to help. I spent quite a bit of time trying to rewrite and improve the article during the deletion discussion and I went link by link through the many dozens of citations. During the deletion discussion, Mark Donfried contacted me over email and explained that his representatives had told him that I was working against the ICD in Wikipedia. He suggested that we meet. We had a tentative plan to meet in Berlin on an afternoon last July but, in the end, I was too busy trying to submit my thesis proposal and neither of us followed up to confirm a particular time within the time window we had set. I have still never met him. My feeling, toward the end of the deletion discussion on Wikipedia, was mostly exasperation. Somewhat reluctantly, I voted to delete the article saying:
Delete This AFD is a complete mess for all the reasons that the article itself is. Basically: there are a small number of people who seem to have a very strong interest in the Institute for Cultural Diplomacy having an article in Wikipedia and, from what I can tell, very little else. Hessin fahem, like all the major contributors to the page, joined Wikipedia in order to participate in this issue. This article has serious problems. I have posted a detailed list of my problems on the article talk page: primary sources, conflict of interest for nearly all substantive contributions and reading like an advert are the biggest issues. My efforts to list these problems were reverted without discussion by an anonymous editor from Berlin. I have seen no evidence that the Institute for Cultural Diplomacy satisfies WP:ORG but I agree that it is possible that it does. I strongly agree with Arxiloxos that articles should always be fixed, and not deleted, if they are fixable. But I also know that Wikipedia does not deserve this article, that I don t know to fix it, and that despite my efforts to address these issues (and I ll keep trying), the old patterns of editing have continued and the article is only getting worse. This ICD seems almost entirely based around a model that involves organizing conferences and then calling and emailing to recruit speakers and attendees. A large number of people will visit this Wikipedia article to find out more about the organization before deciding to pay for a conference or to join to do an internship. What Wikipedia shows to them reads like an advert, links almost exclusively to of pages on the organizations websites and seems very likely to have been written by the organization itself. We are doing an enormous disservice to our readers by keeping this page in its current form. If somebody wants to make a serious effort to improve the article, I will help and will happily reconsider my !vote. But after quite a bit of time trying to raise interest and to get this fixed, I m skeptical this can be addressed and my decision reflects this fact. mako 05:18, 12 June 2012 (UTC)
I concluded that although the organization might be notable according to Wikipedia s policies and although the Wikipedia article about it might be fixable, the pattern of editing gave me no faith that it could be fixed until something changed. When the article was deleted, things became quiet. Several months later a new article was created again, by an anonymous user with no other edit history. Although people tend to look closely at previously deleted new pages, this page was created under a different name: The Institute of Cultural Diplomacy and was not noticed. Deleted Wikipedia articles are only supposed to be recreated after they go through a process called deletion review. Because the article was recreated out of this process, I nominated it for what is called speedy deletion under a policy specifically dealing with recreated articles. It was deleted again. Once again, things were quiet. In January, it seems, the Inside the ICD website was threatened with a lawsuit by the ICD and the maintainers of the site took it down with the following message:
Apparently, the ICD is considering filing a lawsuit against this blog and it will now be taken down. We completely forgot about this blog. Let s hope no one is being sued. Farewell.
On February 25, the Wikipedia article on ICD was recreated once again out of process and by a user with almost no previous edit history. The next day, I received an email from Mark Donfried. In the message, Donfried said:
Please note that the ICD is completely in favor of fostering open dialogue and discussions, even critical ones, however some of your activities are raising serious questions about the motives behind your actions and some even seem to be motives of sabotage, since they resulted in ICD not having any Wikipedia page at all. We are deeply concerned regarding these actions of yours, which are causing us considerable damages. As the person who initiated these actions with Wikipedia and member of the board of Wikipedia [1], we would therefore request your answer regarding our questions below within the next 10 days (by March 6th). If we do not receive your response we will unfortunately have to consider taking further legal actions with these regards against you and other anonymous editors.
I responded to Donfried to say that I did not think it was prudent to speak with him while he was threatening me. Meanwhile, other Wikipedia editors nominated the ICD article for deletion once again and unanimously decided to delete it. And although I did not participate in the discussion, Donfried emailed again with more threats of legal action hours after the ICD article was deleted:
[A]s the case of the ICD and its presentation on the Wikipedia has seriously worsened in recent days, we see no alternative but to forward this case (including all relevant visible and anonymous contributors) to our legal representatives in both USA and Europe/Germany as well as to the authorities and other corresponded organizations in order to find a remedy to this case.
Donfried has made it very clear that his organization really wants a Wikipedia article and that they believe they are being damaged without one. But the fact that he wants one doesn t mean that Wikipedia s policies mean he should have one. Anonymous editors in Berlin and in unknown locations have made it clear that they really want a Wikipedia article about the ICD that does not include criticism. Not only do Wikipedia s policies and principles not guarantee them this, Wikipedia might be hurt as a project when this happens. The ICD claims to want to foster open dialogue and criticism. I think they sound like a pretty nice group working toward issues I care about personally. I wish them success. But there seems to be a disconnect between their goals and the actions of both their leader and proponents. Because I used my real name and was skeptical about the organization on discussion pages on Wikipedia, I was tracked down and threatened. Donfried insinuated that I was motivated to sabotage his organization and threatened legal action if I do not answer his questions. The timing of his first letter the day after the ICD page was recreated means that I was unwilling to act on my commitment to Wikipedia and its policies. I have no problem with the ICD and I deeply regret being dragged into this whole mess simply because I wanted to improve Wikipedia. That said, Donfried s threat has scared me off from attempts to improve the ICD articles. I suspect I will not edit ICD pages in Wikipedia in the future. The saddest part for me is that I recognize that what is in effect bullying is working. There are currently Wikipedia articles about the ICD in many languages. For several years, ICD has had an article on English Wikipedia. For almost all of that period, that article has consisted entirely of universally positive text, without criticism, and has been written almost entirely by anonymous editors who have only contributed to articles related to the ICD. In terms of the ICD and its article on Wikipedia, I still have hope. I encourage Donfried and his representatives to create accounts on Wikipedia with their full names just like I have. I encourage them to engage in open dialogue in public on the wiki. I encourage them go through deletion review, make any conflicts of interest they have unambiguously clear, and to work with demonstrably non-conflicted editors on Wikipedia to establish notability under Wikipedia s policies. The result still can be an awesome, neutral, article about their organization. I have offered both advice on how to do this and help in that process in the past. I have faith this can happen and I will be thrilled when it does. But the general case still worries me deeply. If I can be scared off by threats like these, anybody can. After all, I have friends at the Wikimedia Foundation, a position at Harvard Law School, and am close friends with many of the world s greatest lawyer-experts on both wikis and cyberlaw. And even I am intimidated into not improving the encyclopedia. I am concerned by what I believe is the more common case where those with skin in the game will fight harder and longer than a random Wikipedian. The fact that it s usually not me on the end of the threat gives me lots of reasons to worry about Wikipedia at a time when its importance and readership continues to grow as its editor-base remains stagnant.
[1] It s a minor mistake but worth pointing out that I am not on the board of Wikipedia ; I am on its advisory board which carries no power or responsbility within the organization. Sometimes, the foundation asks for my advice and I happily give it.

Michal Čihař: I did it again

phpMyAdmin's website just got small facelift from me. The motivation was to make navigation easier in some parts and to come up with consistent color schema. This time changes are not that major as in past - basically just CSS changes and few minor changes to HTML code. The structure of the website is still pretty much same and I did not touch the texts at all. Unfortunately this is still not responsive design, so it will not look that good in small or huge resolutions, but I hope to get back to this later.

Filed under: English Phpmyadmin 2 comments Flattr this!

Matthew Garrett: Secure Boot and Restricted Boot.

I gave a presentation at Libreplanet this weekend on the topic of Secure Boot and Restricted Boot. There's a copy of the video here - it should be up on the conference site at some point. It turned out to be excellent timing, in that a group in Spain filed a complaint with the European Commission this morning arguing that Microsoft's imposition of Secure Boot on the x86 client PC market is anticompetitive. I suspect that this is unlikely to succeed (the Commission has already stated that the current implementation appears to conform to EU law), and I fear that it's going to make it harder to fight the real battle we face.

Secure Boot means different things to different people. I think the FSF's definition is a useful one - Secure Boot is any boot validation scheme in which ultimate control is in the hands of the owner of the device, while Restricted Boot is any boot validation scheme in which ultimate control is in the hands of a third party. What Microsoft require for x86 Windows 8 devices falls into the category of Secure Boot - assuming that OEMs conform to Microsoft's requirements, the user must be able to both disable Secure Boot entirely and also leave Secure Boot enabled, but with their own choice of trusted keys and binaries. If the FSF set up a signing service to sign operating systems that met all of their criteria for freeness, Microsoft's requirements would permit an end user to configure their system such that it refused to run non-free software. My system is configured to trust things shipped by Fedora or built locally by me, a decision that I can make because Microsoft require that OEMs support it. Any system that meets Microsoft's requirements is a system that respects the freedom of the computer owner to choose how restrictive their computer's boot policy is.

This isn't to say that it's ideal. The lack of any common UI or key format between hardware vendors makes it difficult for OS vendors to document the steps users must take to assert this freedom. The presence of Microsoft as the only widely trusted key authority leaves people justifiably concerned as to whether Microsoft will be equally aggressive in blacklisting its own products as it will be in blacklisting third party ones. Implementation flaws in a (very) small number of systems have resulted in correctly signed operating systems failing to boot, requiring users to update their firmware before being able to install anything but Windows.

But concentrating on these problems misses the wider point. The x86 market remains one where users are able to run whatever they want, but the x86 market is shrinking. Users are purchasing tablets and other ARM-based ultraportables. Some users are using phones as their primary computing device. In contrast to the x86 market, Microsoft's policies for the ARM market restrict user freedom. Windows Phone and Windows RT devices are required to boot only signed binaries, with no option for the end user to disable the signature validation or install their own keys. While the underlying technology is identical, this differing set of default policies means that Microsoft's ARM implementation is better described as Restricted Boot. The hardware vendors and Microsoft define which software will run on these systems. The owner gets no say.

And, unfortunately, Microsoft aren't alone. Apple, the single biggest vendor in this market, implement effectively identical restrictions. Some Android vendors provide unlockable bootloaders, but others (either through personal preference or at the behest of phone carriers) lock down their platforms. A naive user is likely to end up purchasing a device that will, in the absence of exploited security flaws, refuse to run if any system components are modified. Even in cases where the underlying components are built using free software, there's no guarantee that the user will have the ability to assert any of those freedoms.

Why does this matter? Some of these platforms (notably Windows RT and iOS, but also some Android-based devices) will even refuse to run unsigned applications. Users are unable to write their own software and distribute it to others without agreeing to often onerous restrictions. Users with the misfortune of living in the wrong country may be forbidden from even that opportunity. The vendor may choose to block applications that compete with their own, reducing innovation. The ability to explore and tinker with the components of the system is restricted, making it harder for users to learn how modern operating systems work. If I own a perfectly functional phone that no longer receives vendor updates, I don't even have the option of paying a third party to ensure that I can't be compromised by a malicious website and risk the loss of passwords or financial details. The user is directly harmed by these restrictions.

I won't argue that there are no benefits to curated software ecosystems. I won't even argue against devices shipping with a locked down policy by default. I will strongly argue that the owner of a device should not only have the freedom to choose whether they wish to remain within those locked-down boundaries, but should also have the freedom to impose their own boundaries. There should be no forced choice between freedom and security.

Those who argue against Secure Boot risk depriving us of the freedom to make a personal decision as to who we trust. Those who argue against Secure Boot while ignoring Restricted Boot risk depriving us of even more. The traditional PC market is decreasing in importance. Unless we do anything about it, free software will be limited to a niche group of enthusiasts who've carefully chosen from a small set of devices that respect user freedom. We should have been campaigning against Restricted Boot 10 years ago. Don't delay it even further by fighting against implementations that already respect user freedom.

comment count unavailable comments

26 March 2013

Ryan Kavanagh: Setting up full-disk encryption in OpenBSD 5.3

I recently decided to try out a snapshot of OpenBSD 5.3, intrigued by the notice that
softraid(4) RAID1 and crypto volumes are now bootable on i386 and amd64 (full disk encryption).
I ve always used an encrypted LVM (as setup by the alternate CD) with a fully encrypted root on my netbook and laptop when running Debian/Kubuntu and never noticed much a performance hit. Unfortunately, I m not the only one who has noticed a significant drop in performance with full-disk encryption on OpenBSD. Although the steps required to setup full-disk encryption (as opposed to requiring manual intervention at boot or the equivalent of loop-mounted encrypted images via vnconfig(8)) on OpenBSD are not explicitly documented anywhere, searching through the mailing lists, man pages, and trial and error provided the following steps:
  1. Boot from your install media. Select the (S)hell option.
  2. Assuming the disk you re installing to is wd0 , run fdisk -i wd0 if you re on an i386. If I m not mistaken, you can skip to the following step otherwise.
  3. Run disklabel -E wd0. Create a label (typically b) of the appropriate size of type swap for swap, and then add a label a using the remainder of the space of type RAID. We aren t going to put swap on our crypto device since OpenBSD has encrypted the swap partition by default since 2005.
  4. Setup the crypto volume as described in bioctl(8). You will be prompted for a passphrase and presented with a message along the lines of softraid0: SR CRYPTO volume attached as sd0 on successful setup. I used bioctl -c C -l /dev/wd0a softraid0 where - -c C specifies a device with raidlevel CRYPTO , - -l /dev/wd0a specifies the label of type RAID created in step 3 to use for the CRYPTO device, and - softraid0 is the softraid device to configure (this value should work unless you already have a softraid0 device).
  5. exit from the shell and (I)nstall as normal, installing to the disk sd0 (or whichever disk the crypto volume got attached as). In the partitioning dialog, you may need to manually adjust things since the auto-partitioning creates an additional swap label on sd0, which we don t need given we already have wd0b.
  6. Using ed(1), add the line 1a8bab44e9cc178d.b none swap sw to /mnt/etc/fstab, assuming that 1a8bab44e9cc178d is the DUID associated with wd0 (you can find this out by running sysctl hw.disknames, which will output something like hw.disknames=wd0:1a8bab44e9cc178d,cd0:,rd0:6ce80c78714fa32f,sd0:fce7bfa23c8ec20d; just search for the DUID associated with wd0). Alternatively, wait until you boot into your system, and add it to your /etc/fstab using vi(1) or mg(1).
  7. Reboot, and you ll be prompted for your passhprase. You re done!
Here s a screenshot of steps 1 through 4. Steps 1 through 4 Here s a screenshot of the passphrase prompt, after successfully entering the passphrase: Passphrase prompt If I ve made any errors in the steps above, please point them out in the comments below or by sending me an email.

Craig Small: procps-ng 3.3.7 Released

procps-ng version 3.3.7 was released today. It has some new and interesting features in the top program that Jim has been busy working on. There is a new filter feature which can exclude fields that match a value for example. The remainder of the changes are small bug fixes and getting the compile warnings count down with -Wall enabled. The library revision was updated but this did not involve an API or ABI change. procps-ng can be downloaded off the sourceforge page which has the current and previous releases stored there. Alternatively you can visit our gitorious page if git fetch is more your thing. Debian packages will be going into experimental until the freeze is over and we get things unblocked.

25 March 2013

Russ Allbery: kadmin-remctl 3.3

kadmin-remctl is a remctl wrapper around the kadmin protocol that we use at Stanford to provide an easier API to Kerberos administration (for Java applications in particular, but also somewhat for humans) and to use a finer-grained ACL than Kerberos kadmin provides. This package is still kind of a mess, with some Stanford-specific bits and a whole lot of messy Perl code, but we had some serious bugs that I needed to deal with. So this is mostly a bug-fix release without the much-delayed cleanup. (More on that in a moment.) The primary problem this release addresses is a very annoying network problem that we've been having at Stanford. Some interaction between our new OpenFlow fabric and our current firewalls causes some number of TCP connections to just be dropped under heavy load. Since we do a lot of kadmin queries (although we're working on various caching strategies to cut down on that), kadmin sees this a lot, which results in failures that cause user-noticable problems in various applications. After some experimentation, though, we found that most of the failures were on the original connection, so catching connection failure and retrying works around most of the problem (at the cost of a delay). That was only the beginning of the odyssey, however. When I added the retry code, I found that we were improperly configuring Heimdal::Kadm5 to actually throw exceptions. And then, even after fixing that, I found that error messages were still printed to standard error. It turns out that the underlying Heimdal libraries print warnings to standard error by default unless the application directs the log messages somewhere else, and Heimdal::Kadm5 doesn't have a look available to do that. So I ended up adding a bunch of ugly code to close standard error while doing the initial connection. This release also cleans up a bunch of the error handling, including going back to the behavior that the code always should have had: check_passwd returns a non-zero status if the password is rejected. I lost an argument with a co-worker about that years ago, but they've since left and I still think that's the right thing to do. The new code also uses IPC::Run to run commands, which makes for much shorter and saner code, and improves error reporting when trying to change the password of a disabled account with Heimdal's kpasswd. It also strips whitespace from the username in passwd_change. At some point, I'm going to rewrite this software completely, but what that really needs is a much saner underlying Kerberos module. One of the problems with all existing Kerberos Perl modules is that they all use various hacks to try to build with different Kerberos libraries within the ExtUtils::MakeMaker framework, which is totally inadequate. (That's also why there aren't any Perl modules linked with the server version of the kadmin libraries, so they're all painfully slow and require a keytab even when running directly on the KDC.) I think the answer is a brand new Perl module that incorporates my portability layer on top of Kerberos libraries and a configure script that does proper probing for Kerberos library functionality, and then integrates that Autoconf probing into a Module::Build infrastructure. There are some bits on CPAN that one could start with, but not all the proper glue, so this is a bit of a project. I also have to figure out how to link different extensions in the project with different libraries, since having separate distributions for the server and client kadmin modules (which share 95% of their code) is dumb, but they have to be separately linked with the appropriate library. Sometime, when I have some time, I'll do that, and then rebuild a remctl interface on top of that infrastructure with a much better protocol. In the meantime, you can get the latest version of kadmin-remctl from the kadmin-remctl distribution page.

Julien Danjou: Announcing Climate, the OpenStack capacity leasing project

While working on the XLcloud project (HPC on cloud) it appeared clear to us that OpenStack was missing a critical component towards resource reservations.
A capacity leasing service is something really needed by service providers, especially in the context of cloud platforms dedicated to HPC style workload. Instead of building something really specific, the decision has been made to build a new standalone OpenStack components aiming to provide this kind of functionnality to OpenStack. In the spirit of others OpenStack components, it will be extensible to fullfil a large panel of needs around this problematic.
The project is named Climate, and is hosted on StackForge. It will follow the standard OpenStack development modal. This service will be able to handle a calendar of reservations for various resources, based on various criteria. The project is still at its early design stage, and we plan to have a unconference session during the next OpenStack summit in Portland to present our plans and ideas for the future!

Benjamin Mako Hill: MIT LaTeX Stationery

Color MIT LetterHead Example The MIT graphic identity website provides downloadable stationery templates for letterhead and envelopes. They provide both Microsoft Word and LaTeX templates. But although they provide both black and white and color templates for Word, they only provide the monochrome templates for LaTeX. When writing cover letters for the job market this year, I was not particularly interested in compromising on color and was completely unwilling to compromise on TeX. As a result, I ended up modifying each of the three templates to include color. In the process, I fixed a few bugs and documented one tricky issue. I ve published a git repository with my changes. It includes branches for each version of three of the old black and white templates as well as my my three new color templates. I hope others at MIT find it useful. I ve tried to keep the changes minimal. I ve emailed the folks at MIT Communication Production Services to see if they want to publish my modified versions. Until then, anyone interested can help themselves to the git repository. LaTeX user that you are, you probably prefer that anyway.

24 March 2013

Sune Vuorela: Announcing Rawatar Qt5 libravatar client library

So. following up on my previous post about implementing a libravatar server, this will be an announcement of a quick Qt5 based client library for libravatar so that everyone can put avatars everywhere! Get it while it is hot on
git.kde.org There isn t much screenshots to show off, given it is effectively just converting a string with an email into a URL for a image. And thanks to Martin Sandsmark for coming up with such a great name. Now I expect him to show off what it can be used for. Another thanks goes to Andreas Hartmetz for going thru the code & api.

19 March 2013

Daniel Pocock: My low-tech investment strategy

People often ask me why I invest in low-tech, old-school investments like gold and silver bullion. Surely for somebody working with technology every day, I would have some advantage in the world of investment? The events of Cyprus this week should provide a clear answer: we've all been told that there is nothing safer than cash in the bank, protected by a Government deposit insurance scheme. Yet it appears that in a pattern reminiscent of the real life Ocean's 11 bank robbery, the culprits waited for a long weekend and set about doing the unthinkable after the lights went out on a Friday night. Three days wasn't enough for them to complete their plan (or getaway?), and so Cypriot banks are closed for a further two days. Just like in the type of bank robbery seen in the movies, the money was put there by people who worked for it, and it is taken away by people who didn't. Sadly, this is also a reflection on a society as a whole. As a result of apathy, contentedness, obsession with non-issues such as immigration, or excuses about how we don't care about politics, nobody has bothered to watch the politicians. The 2008 British film The Bank Job showed real robbers sent into a bank in the traditional manner (it is based on the true story of the 1971 Baker Street robbery). Although not substantiated, conjecture in the press suggests that British authorities were involved and got real crooks to make it look authentic. Today's press suggests that Cypriot authorities are in a similar way trying to make it look like Germany is the bad guy. Back to the gold and silver. A recent report in Science Magazine suggests it takes 100,000 years for natural processes such as earthquakes to create even small deposits of precious metals. Most politicians are taking their pension in less than 10 years and wouldn't have the time or power to interfere with or manipulate such an inherently natural physical phenomenon, and this is why bullion has remained a consistent and respected investment for thousands of years. Does anyone imagine that fresh reserves of gold are forming in the cavities under Cyprus during this week's tremors? Or will those cavities be somewhat more sparse?

Sune Vuorela: Simple Libravatar service

So, since recently bugs.debian.org has started using libravatar avatars. Not yet the federated service, but that s supposedly in the works. But for that, one of course need to run each own service. Which I wanted to do. In a simple way. So I did it.
_avatars._tcp.pusling.com. 43200 IN SRV 10 10 80 static.pusling.com.
and in my root dir for that one I have source/ and avatar/
$ ls
avatar source
In source, I have default.png which I m serving and a series of avatars for various email addresses
$ ls source/
debian@pusling.com default.png
and then I have a simple script to generate the right file names:
#! /bin/sh (cd avatar;
ls while read file ; do [ -L $file ] && rm $file ; done
)
for i in source/*@* ; do ln -s ../$i avatar/$(echo -n $(basename $i) sha256sum sed s/-// ) ; done
for i in source/*@* ; do ln -s ../$i avatar/$(echo -n $(basename $i) md5sum sed s/-// ) ; done
and the last piece of magic to get everything to work:
$ cat avatar/.htaccess
ErrorDocument 404 /source/default.png
ForceType image/png <Files index.html >
ForceType text/html
</Files>
and a set of index.html files created with touch . So there you go. A simple libravatar service, ignoring some pieces of the spec, but it should be good enough for most people. I might save my rants about the libravatar spec for another day. But it involves implementing a complete redirecting service and scaling of images. When will debian.org and kde.org start providing avatar services?

16 March 2013

Lucas Nussbaum: Ideas from the -vote@ DPL election discussions

After one week of campaign on -vote@, many subjects have been mentioned already. I m trying here to list the concrete, actionable ideas I found interesting (does not necessarily mean that I agree with all of them) and that may be worth further discussion at a less busy time. There s obviously some amount of subjectivity in such a list, and I m also slightly biased ;) . Feel free to point to missing ideas or references (when an idea appeared in several emails, I ve generally tried to use the first reference). On the campaign itself, and having general discussions inside Debian: On getting new users and contributors to Debian: Infrastructure, processes, releases: Relationships with upstreams/downstreams: This list could be moved to wiki.d.o if others find sufficiently useful to help maintaining it.

Next.

Previous.