Well, I had a very nice run at the start of this year in writing journal entries nearly every day, and then I seem to have gotten much quieter. This is not actually because less stuff is going on, but I started working on larger projects without meaningful daily progress, and I also got drawn into some very rewarding creative work that has kicked my schedule in the ass. Schedules are something that I've always struggled with. I'm fairly convinced that I have even more than the natural human tendency towards a longer than 24-hour schedule. (I lived in 28-hour days and 6-day weeks for one full quarter when I was a college student and rather liked it, but it wasn't practical enough to stay with.) This means that, without applying a lot of discipline, I tend to stay up later and later because I'm engaged in interesting things and don't want to stop, and then drift further and further out of sync with the world. When I was just out of college and working as just another member of a team that wasn't very close-knit, I just shrugged and let it happen. I used to get into work at about two or three in the afternoon and work until well past midnight. It had some lovely properties, such as getting to work most of my "day" after everyone else had left and the building was quiet. Unfortunately, it's really not compatible with a lead position that requires interaction with people and quite a few meetings and other types of coordination. Given that I can't just let my schedule go wherever, I realized a year or two ago that I do much better if I can stick to a fairly reliable and consistent schedule and go to bed at a regular time, even if I'm involved in something. It cuts off my evenings in a way I don't like, but it makes mornings much more pleasant and it makes it easier to schedule and stick with various chores like exercise. But it's remarkably hard to get back into that mode once I've gotten out of it, particularly when I get caught up in things in the evenings. This meander is mostly my way of getting these thoughts out of my head and on a screen in front of me so that I'll think about them and build up enough willpower to go back to a regular schedule. It really is worth it; I was keeping one through most of January and it had a lot to do with why January was awesome. Hopefully a more sustantive update tomorrow.

Tonight I've made a new release of my slaughter automation tool. Recent emails lead me to believe I've now got two more users, so I hope they appreciate this:

• The Definitive Slaughter Guide

That covers installation, setup, usage, and more. Took a while to write, but I actually enjoyed it. I'm sure further additions will be made going forward. Until them I'm going to call it a night and enjoy some delicious cake.

Aaron on Software wrote an interesting series of blog posts about psychology and personal development collectively Titled Raw Nerve , here s a link to part 2 [1]. The best sections IMHO are 2, 3, and 7. The Atlantic has an insightful article by Thomas E. Ricks about the failures in leadership in the US military that made the problems in Afghanistan and Iraq a lot worse than they needed to be [2] Kent Larson gave an interesting TED talk about how to fit more people in cities [3]. He covers issues of power use, transport, space use, and sharing. I particularly liked the apartments that transform and the design for autonomous vehicles that make eye contact with pedestrians. Andrew McAfee gave an interesting TED talk titled Are Droids Taking Our Jobs [4]. I don t think he adequately supported his conclusion that computers and robots are making things better for everyone (he also presented evidence that things are getting worse for many people), but it was an interesting talk anyway. I Psychopath is an interesting documentary about Sam Vaknin who is the world s most famous narcissist [5]. The entire documentary is available from Youtube and it s really worth watching. The movie Toy Story has been recreated in live action by a couple of teenagers [6]. That s a huge amount of work. Rory Stewart gave an interesting TED talk about how to rebuild democracy [7]. I think that his arguments against using the consequences to argue for democracy and freedom (he suggests not using the torture doesn t work and women s equality doubles the workforce arguments) are weak, but he made interesting points all through his talk. Ernesto Sirolli gave an interesting TED talk about aid work and development work which had a theme of Want to help someone? Shut up and listen! [8]. That made me think of Mary Gardiner s much quoted line from the comments section of her Wikimania talk which was also shut up and listen . Waterloo Labs has some really good engineering Youtube videos [9]. The real life Mario Kart game has just gone viral but there are lots of other good things like the iPhone controlled car and eye controlled Mario Brothers. Robin Chase of Zipcar gave an interesting TED talk about various car sharing systems (Zipcar among others), congestion taxes, the environmental damage that s caused by cars, mesh networks, and other things [10]. She has a vision of a future where most cars are shared and act as nodes in a giant mesh network. Madeleine Albright gave an interesting TED talk about being a female diplomat [11]. She s an amazing speaker. Ron Englash gave an interesting TED talk about the traditional African use of fractals [12]. Among the many interesting anecdotes concerning his research in Africa he was initiated as a priest after explaining Georg Cantor s set theories. Racialicious has an insightful article about the low expectations that members of marginalised groups have of members of the privileged groups [13]. Rick Falkvinge has a radical proposal for reforming copyrights with a declared value system [14]. I don t think that this will ever get legislative support, but if it did I think it would work well for books and songs. I think that some thought should be given to how this would work for Blogs and other sources of periodical content. Obviously filing for every blog post would be an unreasonable burden. Maybe aggregating a year of posts into one copyright assignment block would work. Scott Fraser gave an interesting TED talk about the problem with eyewitness testimony [15]. He gave a real-world example of what had to be done to get an innocent man acquitted, it s quite amazing. Sarah Kendzior wrote an interesting article for al Jazeera about the common practice in American universities to pay Adjunct Professors wages that are below the poverty line [16]. That s just crazy, when students pay record tuition fees there s more than enough money to pay academics decent wages, where does all the money go to anyway?

• [1] http://www.aaronsw.com/weblog/dweck
• [2] http://tinyurl.com/bxtvl2f
• [3] http://tinyurl.com/8nz8zjr
• [4] http://tinyurl.com/cpu7ahx
• [5] http://topdocumentaryfilms.com/i-psychopath/
• [6] http://tinyurl.com/aejpwkr
• [7] http://www.ted.com/talks/rory_stewart_how_to_rebuild_democracy.html
• [8] http://tinyurl.com/cbv7lvc
• [9] http://www.youtube.com/user/WaterlooLabs
• [10] http://www.ted.com/talks/robin_chase_on_zipcar_and_her_next_big_idea.html
• [11] http://tinyurl.com/48dfthu
• [12] http://www.ted.com/talks/ron_eglash_on_african_fractals.html
• [13] http://www.racialicious.com/2012/12/10/privilege-and-low-expectations/
• [14] http://falkvinge.net/2012/12/10/declared-value-system/
• [15] http://tinyurl.com/d8v9zax
• [16] http://tinyurl.com/8bdmn3p

Update: I apologise for spamming all the nice people on Planet Debian with this unrelated post in foreign language it got mis-tagged and (although I tried classifying it correctly and removing it from the separate Debian-only RSS feed going to the Debian Planet) Planet software just keeps it around until admins get a spare moment to remove it manually. The basic idea of the post is that there is a e-government service by the Latvian government that provides any citizen a way to check what their pension would be, but it is kinda useless, because it calculates what you pension would be if you decided to retire right now. So in the post below I provide a few simple steps on how to estimate what the real pension could be (in todays currency values) if a person kept paying into the system at the same rate until the normal retirement age. Latvija.lv ir r ks savas n kotnes pensijas prognoz anai, ta u tas ir, maigi izsakoties, bezj dz gs tiem, kas nepl no iet pensij tuv k gada laik . tri apskatoties atteic gos likumus un noteikumus es nonacu pie lietder g kas metodes. Vispirms m s varam dro i ignor t pensiju indeks ciju un visas ar to saist t s pensiju kapit la p rr in anas vai iemaksu palielin anos ir skaidrs, ka gadiem ejot uz priek u b s kaut k ds infl cijas procents, kura d palielin sies algas, palielin sies iemaksas pensiju kapit l un tiks p rr in tas vis das izmaksas, ta u t pati infl cija tie i ietekm s ar to cik v rt gs b s katrs gala pensijas lats taj br d , kad pensija tiks sa emta, l dz ar to infl cijas efekts tiek neitraliz ts, ja m s v rt jam gala ciparu br a cenu kontekst t.i. ja gal san ks, ka pensija b s 400Ls, tad to vai tas ir daudz vai maz j dom br a cen s, nevis m inot izdom t k das b cenas p c 30 gadiem. To visu emot v r pensijas apr ins stipri vienk r ojas:

1. Pa emam atskaiti no t Latvija.lv pakalpojuma. Tas mums dos uz o br di uzkr to pensijas kapit lu (U) un aptuvenu ciparu par to k ds ir kapit la ikgad jais piaugums (P)
2. Apr inam cik v l gadi ir paliku i l dz pension an s vecumam (t) t.i. l dz 62 gadiem. Es pat r in tos ar to, ka ap to laiku m r a vecums jau b s 65.
3. Sar inam to cik b s aptuvenais pensijas kapit ls pension anas vecuma, ja m s turpinam iemaksas k tagad K = U + ( P * t )
4. Apr inam k da san k ikm ne a pensija no da pensijas kapit la Pensija = K / G / 12, kur G ir emts no pension an s vecumam atbilsto s rindi as MK noteikumos, piem ram 62 gadiem tas ir 18.43

Piez me: G ir statisti u apr in ta prognoze par to cik vid ji gadus Latvijas iedz vot ji nodz vo ja vi i ir sasniegu i attiec go pension an s vecumu, t.i. t ir prognoze par to cik gadus vid ji jums b s tas prieks baud t pensiju. Ja rezult ts san k par k mazs, tad j em v r , ka summa neiek auj dividendes no 2 un 3 pensijas l me a, kas p ris gadu desmitu laik var b t t ri iespaid gs. Da as prognozes ir t das, ka 2ais un 3ais pensijas l menis kop var tu dod v l aptuveni t du pa u pensiju kl t k 1ais l menis. Ta u tas ir stipri atkar gs no fondu tirgus ilglaic gas dinamikas. Man to visu apr inot san k ap 400 Ls pensijas prognoze. Ja piepild s paredz jumi par 2o un 3o pensijas l meni, tad, ja es iedom jos sevi tagad k pension ru ar 600-800 Ls pensiju zin nav ne vainas.

It has been so very long since I have left a trace here. I guess moving to two new countries (Canada and Quebec), starting a new job, working on Anonymous, and finishing my first book was a bit much. I miss this space, not so much because what I write here is any good. But it a handy way for me to keep track of time and what I do and even think. My life feels like a blur at times and hopefully here I can see its rhythms and changes a little more clearly if I occasionally jot things down here. So I thought it would nice to start with something that I found surprising: famed information designer, Edward Tufte, a professor emeritus at Yale was a phone phreak (and there is a stellar new book on the topic by former phreak Phil Lapsley. He spoke about his technological exploration during a sad event, a memorial service in NYC which I attended for the hacker and activist Aaron Swartz. I had my wonderful RA transcribe the speech, so here it is [we may not have the right spelling for some of the individuals so please let us know of any mistakes]:

Edward Tufte s Speech From Aaron Swartz s Memorial
Speech starts 41:00 [video cuts out in beginning]
We would then meet over the years for a long talk every now and then, and my responsibility was to provide him with a reading list, a reading list for life and then about two years ago Quinn had Aaron come to Connecticut and he told me about the four and a half million downloads of scholarly articles and my first question is, Why isn t MIT celebrating this? .
[Video cuts out again]
Obviously helpful in my career there, he then became president of the Mellon foundation, he then retired from the Mellon foundation, but he was asked by the Mellon foundation to handle the problem of JSTOR and Aaron. So I wrote Bill Bullen(sp?) an email about it, I said first that Aaron was a treasure and then I told a personal story about how I had done some illegal hacking and been caught at it and what happened. In 1962, my housemate and I invented the first blue box, that s a device that allows for free, undetectable, unbillable long distance telephone calls. And we got this up and played around with it and the end of our research came when we concluded what was the longest long distance call ever made, which was from Palo Alto to New York time-of-day via Hawaii, well during our experimentation, AT&T, on the second day it turned out, had tapped our phone and uh but it wasn t until about 6 months later when I got a call from the gentleman, AJ Dodge, senior security person at AT&T and I said, I know what you re calling about. and so we met and he said You what you are doing is a crime that would , you know all that. But I knew it wasn t serious because he actually cared about the kind of engineering stuff and complained that the tone signals we were generating were not the standard because they record them and play them back in the network to see what numbers they we were that you were trying to reach, but they couldn t break though the noise of our signal. The upshot of it was that uh oh and he asked why we went off the air after about 3 months, because this was to make long distance telephone calls for free and I said this was because we regarded it as an engineering problem and we made the longest long distance call and so that was it. So the deal was, as I explained in my email to Bill Bullen, that we wouldn t try to sell this and we were told, I was told that crime significance would pay a great deal for this, we wouldn t do any more of it and that we would turn our equipment over to AT&T, and so they got a complete vacuum tube isolator kit for making long distance phone calls. But I was grateful for AJ Dodge and I must say, AT&T that they decided not to wreck my life. And so I told Bill Bullen that he had a great opportunity here, to not wreck somebody s life, course he thankfully did the right thing.
Aaron s unique quality was that he was marvelously and vigorously different. There is a scarcity of that. Perhaps we can be all a little more different too.
Thank you very much.

Almost two years ago my good friend Phil Hands invited me to attend a workshop at bath university to build a 3D printer. I had previously looked at the Reprap project and considered building the Darwin model, alas lack of time and funds had prevented me form proceeding.

In a previous entry I wrote about the technology of additive manufacture and the use in printing three dimensional objects.

It is now almost two years since I built my own 3D printer and I keep getting asked by colleagues and friends about the technology and often what printer to buy.

I will answer the purchase question first and then describe my experiences which have lead to the conclusion in another post. This may seem a bit backwards but the explanation is long and is not necessary if you are happy to learn from my mistakes.

Of all the options available right now, and there are many, I would choose a Mendal90 kit from Chris Palmer. The complete kit including everything to build the machine is 499 plus shipping. If I could afford it this is what I would buy myself to replace my current machine.

This is a Fused deposition modelling (FDM) printer similar to my Prusa Reprap but better engineered to produce repeatable results without the numerous issues of the other models. In Europe I would also recommend faberdashery as a materials source as their product is first rate every time.

Yes the kit requires some assembly but the commonly available commercial printers either cost many times more to deliver equivalent results, use an SLS or other print strategy requiring very expensive consumables or are from a company with dubious track record with the community.

If forced to recommend one, the 3DTouch from Bits From Bytes is not awful, but really do not be afraid of the kit, you will learn more about how it all fits together and save lots of money for your materials.

One thing anyone buying a 3D printer right now should understand is that this technology is nowhere near as polished as the 2D equivalent. With the exception of the SLS systems like shapeways and the like use (and have price tags to match) The output will have clear "layering" and some objects simply cannot be created using the FDM process.

I guess what I am saying is do not expect a thousand pound machine to produce output that looks like that of a hundred thousand pound printer. To be clear you will not be printing complex moving machines on an FDM process more simple things that need assembly.

Having said that I have some pretty good results my favourite has to be the working recorder though, I might have said the whistles except my sons have them and they are way too loud.

You will spend a lot of time designing your things in 3D CAD packages and fair warning they all SUCK and I mean really, really badly. Add to that all the rest of the tools in the workflow are also iffy and I do wonder how anyone every gets anything printed.

My (open source) workflow is:

• 3D CAD with OpenSCAD
• STL file
• meshlab to clean up the STL
• slic3r to create a toolpath
• Gcode file
• printrun to run the gcode on the printer.

Which is probably a case of "least bad" tool selection though I warn you now that OpenSCAD is effectively a bad editor (I wish I could use emacs) for a 3D solid macro language with visualisation attached and definitely not a graphical tool.

The test/[ command is home to several bashisms, but as I believe I have demonstrated: incompatible behaviour is to be expected.

The "-a" and "-o" binary logical operators are no exception, even if documented by the Debian Policy Manual.

One feature of writing something like the following code, is that upon success of the first command, the second won't be executed: it will be short-circuited.

[ -e /dev/urandom ]   [ -e /dev/random ]

Now, using the "-a" or "-o" bashisms even in shell interpreters that support them can result in unexpected behaviour: some interpreters will short-circuit the second test, others won't.

For example, bash doesn't short-circuit:

$ strace bash -c '[ -e /dev/urandom -o -e /dev/random ]' 2>&1 grep /dev
stat64("/dev/urandom", ...) = 0
stat64("/dev/random", ...) = 0

Neither does dash:

$ strace dash -c '[ -e /dev/urandom -o -e /dev/random ]' 2>&1 grep /dev
stat64("/dev/urandom", ...) = 0
stat64("/dev/random", ...) = 0

But posh does:

$ strace posh -c '[ -e /dev/urandom -o -e /dev/random ]' 2>&1 grep /dev
stat64("/dev/urandom", ...) = 0

And so does pdksh:

$ strace pdksh -c '[ -e /dev/urandom -o -e /dev/random ]' 2>&1 grep /dev
stat64("/dev/urandom", ...) = 0

output of strace redacted for brevity

So even in Debian, where the feature can be expected to be implemented, its semantics are not very well defined. So much for using this bashism... better avoid it.

Remember, if you rely on any non-standard behaviour or feature make sure you document it and, if feasible, check for it at run-time.

Some little birds had already been whispering about it, but I didn't want to jinx it and told myself I would wait with an announcement until the booksellers have (at least) placeholder pages. And as I learned from Duncan Murdoch via email earlier today, at least Chapters/Indigo had a page up, presumably scraped from the publisher page, so here it goes:

I have in fact handed a complete draft of my book about Seamless R and C++ Integration with Rcpp to Springer a few weeks ago. With a bit of luck on the production side, we could be seeing physical copies by May of a new title in their popular UseR! Series series.

And to the slowly growing new Rcpp site, I have added a a formal page about the Rcpp book where one can find information about it, including a link to the Springer page, links to a few bookseller's pages --- as well as a few wonderfully flattering endorsements. Eventually, errata and other support material should be available via this page too. Can't wait til I hold a physical copy in hand...

After 27 hours of travel, I'm finally back from my first Linux.conf.au. This was a great conference! Some of my favorite highlights:

• Out for dinner the first night, my whole table started spontaneously talking about Haskell, including details of IO management frameworks like conduit and pipes, and a new one that's waiting in the wings. That just doesn't happen in the real world. A lot of us continued to do Haskell stuff in the hallway track, although for some reason there were no Haskell talks on the official schedule. Maybe it's time for a Haskell miniconf at LCA?
• Meeting Josh, Jamie, Sarah, Brendan, Craig, and others I've worked with online but never encountered IRL. Also reconnecting with old friends (some I'd not seen in 13 years) and finding new ones.
• The speaker's dinner in a revolving restaurant overlooking Canberra. Leave it to a restaurant full of geeks to invent an asychronous communications medium in such a setting. (Notes attached to windows to be read and answered by tables as they rotated by.)
• Meeting quite a lot of git-annex users, Kickstarter backers, and people interested in using git-annex. Thanks to everyone who came up to me for a chat.
• The evening pickup board game sessions. Especially my wiping out three other Tsuro players at once by forcing them all to end on the same square. ;) These were where I felt the most at home in Australia.
• Robert Llewellyn dropping in and mingling with fans of Red Dwarf and Scrapheap Challenge. One of the very few actors I could possibly fanboy on, and LCA not only somehow got him, but constructed an atmosphere that allowed for this photo of us.

---

My git-annex talk went ok, despite technical problems with the video output, which the video team did a great job of working around. The first demo went well, and the Q&A was excellent. The demo of the git-annex assistant webapp was marred by, apparently, a bad build of the webapp -- which I ironically used rather than my usual development build because I assumed it'd be less likely to fail. At least I may have a way to reproduce that hang somewhat reliably now, so I can get on with debugging it. I will be redoing a demo of the webapp as a screencast.

---

Here are some of the best talks I attended. (I have quite a lot more queued up to watch still, and had to cut several due to space.) Click titles for videos, or browse all the videos.

• Git for Ages 4 and Up
  Schwern has found a new, excellent way to explain git. I felt rather bad for using up a seat, especially once people were kicked out when the room was filled over capacity. But I enjoyed every minute of it. (Also has the best speaker intro ever. "Schwern once typed git pull --hard and pulled GitHub's sever room across the street.")

  BTW, I must confess: I left the red apple on teacher's desk.

• Radia Perlman's keynote
  Network protocol design and poetry from one of the quiet heros of our field. I knew Spanning Tree Protocol was used in ethernet, but it just works, so like many I never paid much attention to it. This talk felt like the best lectures, where you're learning from a master on multiple levels at once. Well done work often becomes an unremarked part of the landscape, which I sometimes find unrewarding, so it was great to have Radia give some perspective on what that's like over the course of decades.
• Lightning Talks
  A 90 second time limit really helps. Too many conferences have 5 minute talks, which is less exciting. If you still find them boring, skip forward to 13:50, where pjf does two talks in 90 seconds! (If a 20 second talk on depression is too .. manic, there's an encore at the end.)
• The IPocalypse 20 months later
  A reality check, with real data. Very important stuff here. We need to work to avoid this worst case scenario, and we also need to design around it.
• REPENT!!! FOR THE END OF THE UNIX EPOCH IS NIGH!!!
  Wildest talk beginning I've seen since RMS put the hard drive halo on his head. And to an important point: Any programs that deal with dates 25 years in the future already need to be fixed today to deal with the epoch rollover. This got me digging around in Haskell date libraries, to make sure they're ok.
• Building Persona: Federated and Privacy Sensitive Identity for the Web
  This talk and some previous conversation with Francois have convinced me that Persona (AKA Browserid) has a design that can succeed. I will be adding Persona login support to ikiwiki.
• Beyond Alt Text: What Every Project Should Know About Accessibility
  I missed the first half due to giving my talk, but the second half was full of rather a lot of excellent information, some of which I'd only guessed at before.
• Git: Not Just for Source Code Anymore
  Good overview of the new ways to use git. Also kept giving examples from my body of work, which is some nice ego stroking, thanks Josh. ;-)

(This rant was originally part of the live streaming series, but I moved it to a separate article because people got stuck on it instead of responding to the actual subject of the article.) Before I get flamed for attacking Pulseaudio (PA), let's just settle this: I don't like it. I think PA is over-engineered and tries to do too many things at once. I used to (until just now) systematically purge pulseaudio-related packages from my system, mainly because PA has this awful tendency of automatically starting and staying around eternally, which wouldn't be so bad except PA has also the bad habit of hogging the audio device exclusively, which makes regular programs like mplayer, ogg123 fail to simply play audio, unless they go through the PA straight-jacket. (Update: this seems to be a bit better in newer versions of PA, where the audio device is released when sound is not being played. Thanks Philipp Kern for the correction.) In the GNU/Linux audio stack, we already have another system that supports multiple accesses: ALSA itself, so I believe that PA should at least behave nicely to other apps, and it seems I am always having problems with that. (The fact that ALSA itself is over-engineered is also telling of the poor state of the audio stack in GNU/Linux.) The other beef I have with PA is the Not Invented Here syndrome: instead of extending existing tools like ALSA or Jack, people just figured they could do everything better and start from scratch. So now we just have one more "standard" way of playing audio, good job Lennart.

FOSDEM 2013 is over and it's time to look what interesting I have seen there on Saturday. First of all the most important for me is to meet people. As usual, I came with SUSE folks, but it's not that unusual to meet people from company where you work :-). I've met some current and former phpMyAdmin developers and surprisingly I've met few Weblate users or people who consider using it on their project. This gave me some important feedback and one of first thing you will see in near future is remade Weblate website to give more information about some of it's unique features. As for the talks, I think I've managed to visit quite lot of them. How we made the Jenkins community explained some ways Jenkins has used to build good community - mostly focused on extensibility of the code and having everything as an extension, but with some focus on social things as well (and important thing that with Git people are not that motivated to join the team). Better software through user research was about various way to gather information of what your users hate on the software. It was pretty interesting, though many of that can not easily be used on small scale free software product. OSS code goes in and never comes out talk focused about licensing issues of various software as a service platforms. As I've never used Amazon cloud or such, it was quite surprising how these behave in relation to GPL and actually made me thing more about AGPL and attend related panel discussion later. An Integrated Localization Environment is Mozilla approach to online translation, quite different than anything we have before, but mostly for reasons which were explained later on Sunday talk on l20n. Maybe reverse ordering of these would make it easier to understand the motivation. Scale your Jenkins build pipeline automatically to minimize test time was not that useful as I thought - increasing test speed by buying EC2 instances and pushing part of the work to them is not something what will help me in near future. Trends in Open Source Security explained what is going on in distributions security, mostly focused on Redhat (but touching Debian as well). It has some interesting thoughts about sharing the information between vendors, so let's see if it will really work in future. QML s many faces showed some other ways to use QML besides using QtQuick. Some uses were quite interesting, though I'm not really fan of creating yet another buildsystem based on it. Panel Discussion: GNU Affero General Public License, version 3 was last thing I've visited on Sunday and it was really interesting to listen all that opinions on AGPL. Still I was not confirmed to consider switching to this license.

Filed under: Debian English Phpmyadmin Suse Weblate 0 comments Flattr this!

Today we where packing back our holiday decorations into boxes. We also had a music box to put away. Do you see the defect in the picture? ;) No? Okay ... some years ago my oldest daughter broke it into some pieces and a friend of us (Hi muempf! ;) did glue all together. When he showed us the nice music box, it was recovered very well, but one detail was changed from original. One horseman wasn't reassembled as the other onces. If you you didn't found the defect, please have a look here. You had fun with this? Maybe this is another one for you, I took that photo on christmas eve when my youngest daughter had placed her new 'Lisa Plastic': Keep smiling!

Well I m back from LCA 2013 and what a great week it was. I learnt plenty of things over the week, including:

• Cloud computing into the government will be coming but will be hard to do in a significant way
• It wasn t just me that found the GTK 2 to 3 API change hard going
• OpenStack is the next cool kid on the block and there is a lot going on here
• Try out novaprova for testing C programs
• SELinux shouldnt slow my computer down and yes ill try it soon
• git-annex looks very interesting, I m just trying to find a use-case for it for me
• The development methods for Free Software have come a long way since a decade ago
• Test and release processes are important on large software projects
• Pretty much everyone I knew has changed companies, at least once.
• For multi-process communication, 0mq looks interesting

It was great to actually meet people who I ve known for years (over 10 for some) only as emails or irc chats as well. I ve not been to Mount Stromlo for almost as long and its somewhere I d like to visit again. Argh, the wordpress editor is still not fixed

Brianna Laugher wrote a blog post about the speaking stack used in the free software activism BoF at LCA 2013 [1]. Occupy Wall St uses what they call a progressive speaking stack this means that white men step back in the queue and people from marginalised groups step forward [2]. During the free software activism BoF the speaking queue that was used was that people who hadn t already spoken had priority over those who had spoken before. This was a really good idea and could be used a lot more in LCA and other conferences. It is fairly common that a small number of delegates take up the vast majority of question time. I suggest that all white men watch the questions and observe how many are asked by white men and how many are asked by everyone else. Also note the way that questions are asked, who shouts a question, who wins when two delegates ask at the same time, and who waits until the end of the talk. The Reasons for a Speaking Stack In Occupy Wall St there is a real benefit in giving priority to members of minority groups. The political needs of white men are generally reasonably well publicised due to disparities in media coverage. As the aim of the occupy movement is not to replace one group of white men with another there is an obvious need to get opinions from members of minority groups. Bugs in software generally affect members of all groups equally (with the exception of bugs related to accessibility features). But even so I think it is important to encourage diversity among people who ask questions. When someone is in the audience sees that no-one who is in their minority group is asking questions they will get the impression that they are just watching someone else s conference. We should aim to have a conference for everyone. How to Implement it When taking questions for one of my talks I generally try to give priority to people who find it difficult to be heard. But doing that requires some concentration and I often don t have any to spare when giving a demanding technical talk. I think that this needs to be managed by the moderator/MC/microphone holder. Someone who doesn t need to think much about the content of the talk can concentrate on choosing the best people to ask questions. Also a significant issue is questions that are called out during a talk. Some speakers insist that questions are only asked at the end of their talk. But I prefer some degree of interaction with the audience so my talks often end up being more about having a conversation with the audience than reading from a script. The difficulty with an interactive talk is that it strongly favors those who are prepared to shout a question over those who wait their turn. I think I ll try to make a strict policy of having people raise their hand to ask a question in future to address this issue, but I will need assistance from someone who s not concentrating on the technical issues. For a conference I think it would make sense for the people who hold the microphones to keep a mental list of who s asked questions. If someone asks their share of questions on the first day of the conference then they would deserve a lower priority for questions on later days. This would also encourage delegates to consider whether their question is really worth asking during the lecture or whether they should save their question quota and talk to the speaker afterwards. Also we could ask delegates to exercise restraint. One suggestion I heard was that people should set themselves a quota of 3 questions per conference or 1 per day. In a conference with ~600 delegates and ~33 sessions per day if everyone asked a question each day that would be about 18 questions per session more than is typical. So it seems that anyone who asks a single question per day is still likely to be asking more than 1/600 of all questions. Exceptions There are occasions when multiple questions and comments make sense. One example is where a member of the audience has significant expertise in the topic in question. Another is when a speaker completes significantly before the end of their allotted time and some questions from the MC or an experienced member of the audience can help them spend all their time educating the audience. But I think there needs to be a compelling reason that has a clear benefit for the audience. General Benefits How many of the repeat questions are useful to the audience? It seems to me that there is a correlation between multiple questions and questions that are more about the person asking than about clarifying issues that are likely to matter to the audience. Would such limits improve the quality of the discussion even for people who don t care about diversity? Also I have asked a disproportionate number of questions in the past. I am reducing the number of questions that I ask although I think I asked more than 3 at this conference.

• [1] http://tinyurl.com/aens6vr
• [2] http://tinyurl.com/3s8exu4

WebAuth is the site-wide web authentication software that we use at Stanford. We're about to start another round of intensive development on multifactor authentication support, so I wanted to get a minor release out with the other things that have accumulated in the past month and a half. The main feature change in this release is to add support for another WebLogin configuration callback. This one is run whenever WebLogin is attempting to establish the user's identity and can return any identity it wishes, so it's available as a generic callback to determine identity information from the environment. The most likely use will be to inspect the results of client-side certificate authentication (which Apache puts in various environment variables) and interpret them in a site-specific way. Also in this release I refactored the WebLogin scripts so that they use FastCGI more correctly. The application objects are now instantiated only once and then reused for the lifetime of the FastCGI script, rather than torn down and set up for each new request. This is primarily of interest to those using the new features that require a memcached connection, since that connection will no longer be constantly set up and torn down, but it should help with speed in other situations. This is the riskiest change, since if I didn't get it exactly right it would be possible for information to leak from one request to the next. I've audited it fairly carefully, though, and think I've gotten everything. Finally, besides some documentation updates, I've switched the Perl build to Module::Build from ExtUtils::MakeMaker. This should mostly be transparent, but it means some additional Perl modules from CPAN will be required to build the distribution with --enable-webkdc for versions of Perl older than 5.10. (5.10 is fairly old, so I doubt this will be a serious issue.) You can get the latest release from the official WebAuth distribution site or from my WebAuth distribution pages.

Recently, I got to try out working in a couple different environments. Working in these environments helped me formalize some of the things that I like and some of the things I don't like. With these new environments I've come to realize my style of development. It's called penance driven development. It's called this because there are two important things:
1) It's better to ask forgiveness than for permissions
2) You need to be deserving of forgiveness.

So the concept is simple, whenever you break something, you first fix the symptom, then you improve the infrastructure so similar breaks should be harder to do. The cost of the penance doesn't have to be huge, but the penance has to be done, otherwise technical debt accumulates and people believe there is no downside to breaking things.

What needs to be improved depends on what is missing. For example, if an engineer broke a feature, but that feature didn't have a test, the penance should be to write a test. Even if the one that broke the feature isn't the owner or the one that wrote the feature. If someone breaks the build and no one noticed because the continuous build didn't email, the fix could be setting up the continuous build to email out build failures, or even better, run each change on a build bot before allowing commits.

I think I'll have to start a penance of the day blog/twitter stream.

I've been practicing this style of development for most of my career, and it's similar if less precise than the 5 whys . As mentioned in the The Lean Startup, the cost of the penance should be proportional to the cost of the break.

It's not too obvious how to test email receive handlers in Appengine. The important observation is that the handlers take HTTP POSTs with multipart/form-data encoded data. In python you can build an email to be handled with the following code:

from email.message import Message 

def test_email(self):
  body = Message()
  body.add_header('to', 'test-unknown@other-app.com')
  body.add_header('from', 'test@app.com')
  body.add_header('Content-Type', 'multipart/alternative', boundary=self.boundary)
  text = Message()
  text['content-type'] = 'text/plain'
  text.set_payload('I am I! Don Quixote!  The man of La Mancha!')
  body.attach(text)

  post(payload=body.as_string())

Debian-installer is a great piece of software, which allows one to install the system in a variety of situations: manually, on a serial console, graphically, automatically, there are a number of scenarios it handles well. However, there is one issue: when installing Debian to a machine that requires firmware just to get at the network, getting things to work can be a hassle. There is a tarball containing the most-often required firmware blobs in order to be able to use the installer on such systems; but since they fail the DFSG, these cannot be part of Debian, for political reasons. To use them, you need to write the required firmware packages to a directory "/firmware" on a USB stick or similar, and put that in the system when asked. This is acceptable when you have just one system to install and have a USB stick handy; but if you have a lot of systems to install, or (as recently happened to me) you don't have a USB stick handy, then things become slightly more problematic. Luckily, there's an easy solution: you can update the initrd image so it contains the firmware packages already on it; when doing that, you don't need to deal with USB sticks anymore. Of course, using such an initrd image will cause the installer to automatically install all provided firmware packages, even if your hardware will function (at a basic level) without said firmware. Additionally, if you pass firmware packages to the installer in any way (through a USB stick, or through the method I'm about to describe, that makes no difference), and the installer determines that it might help to install one of these firmware packages, then the installed system will have them installed, and have the non-free repository enabled, which is not the default. Don't do this if you don't want that. Anyway, on to the actual procedure now:

• First, get yourself a "netboot.tar.gz" tarball from one of Debian's mirrors. This will get you a pxeboot.0 file, a set of pxeboot configuration files, a linux kernel file, and an initrd.gz file. It's the latter file that we need to modify
• Create a directory where you'll unpack the initrd image, 'cd' to it, and run zcat path/to/initrd.gz cpio -vi. This will unpack the initrd into your current directory. You can explore it if you want to see how debian-installer works, but other than that it's not very interesting.
• Add a directory "firmware" in the top-level extracted directory that you just created.
• Into this "firmware" directory, add all the firmware package files that you'll need.
• Now, run find . cpio -ov -H newc gzip --best > path/to/initrd.gz.

Tadaa! You've now created an initrd image that will not ask you for firmware images, instead just install them.

I'm struggling a little to keep to a schedule since the weekend, so I both didn't follow my normal evening exercise schedule nor did I write this up earlier when I could add more details. Ah well. But I'm still going to post something today, since I like this streak of (mostly) providing some useful or at least hopefully entertaining content. Today, I converted the Perl module build system inside WebAuth to use Module::Build instead of ExtUtils::MakeMaker, and it was a rousing success. I highly recommend doing this, and am going to be doing this with all of my other Perl packages, both embedded in larger packages and standalone. I have several packages where Perl XS modules are embedded within a larger Autoconf and Automake project that includes a shared library used by the Perl module. The largest problem with doing this is integrating the build systems in such a way that the Perl module is built against the in-tree version of the shared library, rather than some version of it that may already be on the system. I've managed to do this with ExtUtils::MakeMaker, but it was horribly ugly, involving overriding internal target rules and setting a bunch of other variables. With Module::Build and ExtUtils::CBuilder, it's much easier and even sensible. Both support standard ways of overriding Config settings, which provides just the lever required. So this:

    our $PATH = '@abs_top_builddir@/lib/.libs';
    my $lddlflags = $Config lddlflags ;
    my $additions = "-L$PATH @LDFLAGS@";
    $lddlflags =~ s%(^  )-L% $additions -L%;
    package MY;
    sub const_loadlibs  
        my $loadlibs = shift->SUPER::const_loadlibs (@_);
        $loadlibs =~ s%^(LD_RUN_PATH =.*[\s:])$main::PATH(: \n)%$1$2%m;
        return $loadlibs;
     
    package main;

(comments stripped to just show the code) became this:

    my @LDFLAGS = qw(-L@abs_top_builddir@/lib/.libs @LDFLAGS@);
    my $LDDLFLAGS = join q   , @LDFLAGS, $Config lddlflags ;

plus adding config => lddlflags => $LDDLFLAGS to the standard Module::Build configuration. So much better! At some point, I'll write up a set of guidelines on how to embed Perl XS modules into Automake projects.