Last week I was given a development board for a system on chip (SoC) we were looking at using. All i had to do was ensure I could get a reasonable, supportable, bootloader and Linux kernel running on it.

Now I am a fairly competent engineer, I have worked with the ARM processors and SoC for many years. It should not therefor take me four days of almost continuous frustration to get a bootloader and kernel onto a system, but it has.

Firstly the system arrives and we look it over, the hardware design is not exactly elegant but seems like it will get the job done. That is at least a step up from several previous offerings which have been just plain broken. So I power it up and it boots into Fedora core 8, possibly not my first OS choice for a diskless system, but it does work.

Perhaps its worth mentioning that my experience with doing any Open Source development has caused me to have a severe aversion to software which is not upstream, especially kernels. The effort required to run your own patch series and keep it up to date is nothing short of Herculean.

Let us be honest, how many developers do you know who are talented enough to generate good code and patient enough to separately maintain it over a long period of time? I shall not belabor this point as others have repeatedly made it for me in much more eloquent ways. Lets us just say from my point of view. Upstream - good. Long term forks - bad.

With this in mind, the solutions Simtec develop are always with a view to our customers being able to simply download and use the standard upstream software wherever possible. Here is where the story stops being smooth and becomes a rant.

The system was running 2.6.22, one that was patched all which ways. "maybe they just shipped an old kernel" I thought. I opened the CD they provided and...oh, OK its just zips and tarballs of the binaries and source they used (actually that in itself is a minor miracle with a lot of vendors right now - see the almost continuous stream of copyright infringement litigation from the FSF) but sill stuck back in July 2007.

So i did teh normal thing, entered the URL printed on the outside of the box and went looking for the updates. No dice, just the same old stuff. So I contacted the company and recived the news that no there were no updates, that was what was published for the device, thats what I could have.

My initial reaction was of tired resignation...this would not be my first SoC port (probably around the fifth or sixth!) So I responded with cd linux-2.6;git checkout master;git pull and went to see what I could see. and lo and behold, there in the kernel, was full support for not only the SoC but for the other version of the very board I had.

Fortunately after mentioning this on IRC my giraffe loving friend. pointed me at the correct community git tree to find the tiny patch required to support my board.

So the vendor was not only shipping old code but actively dissuading customers from even looking for new stuff, which it turns out was mainline anyway! To add to this somewhere along the lines the company name on the box and contact information has changed and...well confusion reigned.

Right Plain sailing from here on? not quite...that would have been too easy. So you can build a mainline kernel...but you cannot boot it. you guessed it the bootloader they ship on the board is ancient, specifically a u-boot fork from December 2005. Having finally figured out how this was going to go, I went to the uboot repo, pulled the latest and built it for my target. And then I needed to upgrade the u-boot and joy of joys bricked the system.

Fortunately the system has a integrated FDTI serial/JTAG port so re-writing the flash should be as simple as running openOCD configured correctly. Of course this did not work...in the end I resorted to running their binary built versions from the CD (tarfile inside a zip inside a tarfile...whatever) and wrote their original image back to the board...which worked.

Long story short, next day I discover that i need a magic different uboot target (make u-boot.kwb for those that care) write this with the binary openocd build and...success
From then on its all been a bit anticlimactic and straightforward and I now have a system capable of starting a kernel over the network and a root fs on network, disc or flash.

My main complaint from all of this is what the hell are vendors doing shipping crap like this? Why do they all insist on taking a dreadful code drop from the SoC manufacturer when they first brought the part up and shipping that prototype junk until the part reaches the end of its life?!?

All the usual excuses about support etc. will come out, but seriously, you recive *no* support from vendors unless you pay for it and even then they will simply tell you whats on the CD is "it". Btw the diff for u-boot to support this board is larger than the original sources and the 2.6.22 is attacked with a 65MB diff which cannot be good.

The Open Source option is continuously innovating and improving, producing ever better software...but the embedded world seems to be forever stuck shipping crap. Is this just me? Does anyone have any solutions? Or am I stuck with this until I change profession?

Dan Gilbert gave an insightful TED talk about our mistaken expectations of happiness [1]. Don Marti has an insightful post about net neutrality and public property [2]. When net access requires access to public property then it should be sold in a neutral manner. Rachel Pike gave an interesting TED talk about the scientific research behind a climate headline [3]. The people who claim to be skeptical of the science should watch this. Mark Peters wrote an interesting article A Happy Writer Is a Lousy Writer about the correlation between emotional state and work quality [4]. Apparently watching a film about cancer will make people more careful and focussed on details. CERIAS has an interesting short article about Firefox security as well as some philosophy on why web browser security generally sucks [5]. Cory Doctorow writes in the Guardian about Peter Mandelson s new stupidity in trying to legislate against file sharing [6]. This is going to seriously damage the economy of every country that implements it. Charles Stross has been blogging a series of non-fiction essays about space colonisation, in The Myth of the Starship he describes how most ideas of space travel are bad and how the word ship is always going to be unsuitable [7]. Brent T. White is an associate professor of law at the University of Arizona who has written an interesting paper about mortgages [8]. He says that anyone who is underwater (IE owing more than the value of their house) should walk away. The credit damage from abandoning a bad mortgage apparently isn t that bad, and there is the possibility of negotiating with the bank to reduce the value of the loan to match the value of the house. Mako is working on a project to allow prisoners to blog [9]. It s basically a snail-mail to web gateway as the prisonsers are not allowed Internet access. PracticalEthicsnews.com has an article about the special status that homeopathy is given [10]. It also notes that homeopathic medicines include arsenic and mercury. Such quackery should be outlawed, a life sentence for homeopathy would be appropriate IMHO. Cory Doctorow wrote an interesting essay about why he is not selling one of his books in audio form (he s giving it away) [11]. He concludes by noting that he wants no license agreement except don t violate copyright law . The fact that he can t get anyone to sell an audio book under such terms is a good demonstration of how broken the marketplace is. Thulasiraj Ravilla gave an inspiring TED talk about the Aravind Eye Care System a program to bring the efficiency of McDonalds to eye surgery [12]. Hopefully that program can spawn similar programs for other branches of medicine and spread to more countries. In many ways they are providing better service (both in quality and speed) than people in first-world countries who pay a lot of money can expect to receive. Scott Kim gave an interesting TED talk about his work designing puzzles [13]. He is also a big fan of social networking, unfortunately (for people like me who don t like social networking) his web site ShuffleBrain.com relies on Facebook. Gordon Brown (UK Prime Minister) gave an inspiring TED talk about global ethic vs the national interest [14], with a particular focus on the global effort required to tackle the climate change problem. Now if only we could get Kevin Rudd to listen to that. Brough has written an interesting analysis of the AT&T network problems that are blamed on the iPhone [15]. His essential claim is that the problem is due to overly large buffers which don t cause TCP implementations to throttle the throughput. This seems similar to my observations of the Three network in Australia where ping times of 8 seconds or more will periodically occur. One particularly nasty corner case with this is when using a local DNS server I can have a DNS packet storm where basic requests time out while BIND uses a significant portion of available bandwidth (including ICMP messages from receiving ports that BIND has closed). To alleviate this I am now using the Google public DNS service [16] (the Three DNS servers never worked properly).

• [1] http://www.ted.com/talks/lang/eng/dan_gilbert_researches_happiness.html
• [2] http://zgp.org/~dmarti/freedom/property-rights/
• [3] http://www.ted.com/talks/rachel_pike_the_science_behind_a_climate_headline.html
• [4] http://www.good.is/post/a-happy-writer-is-a-lousy-writer/
• [5] http://www.cerias.purdue.edu/site/blog/post/firefox_vulnerabilities_souvenirs_of_windows_95/
• [6] http://www.guardian.co.uk/technology/2009/nov/26/digital-economy-file-sharing-mandelson
• [7] http://www.antipope.org/charlie/blog-static/2009/11/the_myth_of_the_starship.html
• [8] http://blogs.wsj.com/developments/2009/10/30/its-ok-to-walk-away-a-law-professor-argues/
• [9] http://mako.cc/copyrighteous/20091201-00
• [10] http://www.practicalethicsnews.com/practicalethics/2009/12/diluted-evidence-is-there-anything-special-with-homeopathy.html
• [11] http://www.publishersweekly.com/article/CA6709919.html
• [12] http://www.ted.com/talks/thulasiraj_ravilla_how_low_cost_eye_care_can_be_world_class.html
• [13] http://www.ted.com/talks/scott_kim_takes_apart_the_art_of_puzzles.html
• [14] http://www.ted.com/talks/gordon_brown_on_global_ethic_vs_national_interest.html
• [15] http://blogs.broughturner.com/2009/10/is-att-wireless-data-congestion-selfinflicted.html
• [16] http://code.google.com/speed/public-dns/

There are few things I really hate. One of them is regressions. Regressions are bad because they usually take away things we are used to rely on, and leave us with the idea that perhaps the technical improvements didn t really improve our lifes as a user, despite putting less burden on the developers. Software is made for users, after all. As part of my work on WebKitGTK+, I always keep an eye on regressions, both from previous WebKitGTK+ releases, and those imposed on embedding applications on their migration away from Gecko, and try to focus some of my efforts into lowering their numbers, whenever I can. In recent times I have worked on removing a few very user-visible regressions in Epiphany, which I see as the most demanding WebKitGTK+ user in GNOME, such as save page not working, missing
favicon support, failing to
perform server-pushed downloads (such as GMail attachments), and not being able to view source. An example of a regression from a previous version of WebKit also exists: in 1.1.17 we started advertising more than we should as supported by the HTML5 media player, causing download to be almost completely broken. All of these are working if you are using WebKit and Epiphany from trunk/master, so should be on the next development versions of WebKitGTK+ and Epiphany. Other people have also fixed many other regressions; a few examples: Xan has reimplemented the Epiphany customization of the context menu, Frederic Peters provided a work-around for mailto: links while we don t have SoupURILoader yet, and Joanmarie Diggs keeps rocking on the accessibility front! If you find regressions, keep them coming! If you have a patch, even better! =) Next week WebKitGTK+ team gets together to work furiously on improving WebKitGTK+ in a hackfest sponsored by Collabora, and Igalia, and hosted/organized by Igalia. While there I should also get my hands on one of these. Can t wait! =)

Barnes and Noble's new nook ebook reader is now shipping to people. Mine[1] is due to turn up tomorrow, but the instruction manual is available for download already. Quoting from it:

Notwithstanding anything to the contrary in this Agreement, certain components of the
Software are licensed subject to the General Public License Version 2.0, a copy of which is attached
as Exhibit A (the GPL License ). You may not use these components except in compliance with
the GPL License. In addition, you may have additional rights with respect to such components
under the GPL License, including, without limitation, the right to obtain the source code for such
components from us. You may obtain a copy of such source code by contacting us through the
contact information provided on the Web Site. We will provide such source code in accordance
with the GPL License.

Which is all very promising[2], except contacting them via either phone or email reveals that nobody has the faintest idea what I'm talking about. I can certainly imagine that they have other concerns right now (delaying your initial shipments by up to two weeks depending on how early people ordered suggests some kind of utter failure somewhere in the chain), but it's depressing that approximately nobody appears to be able to get this right.

Updated:

After further conversations with tech support, I was told that I'll be mailed a CD of source within two weeks.

[1] I had a Sony, which unfortunately had a bit of an accident. On the other hand, it was running 2.4, so maybe it was a lucky escape of some sort?
[2] Well, apart from the traditional confusion of the GPL as something that claims to restrict use

Transforming data is hard. When I joined my current company, there were stupendous amounts of Perl/PHP/Bash/<insert random programming language here> scripts that would run on a cron job and do magic things to our data. They d create reports, they d tell the purchasers when we were running out of stock, they d synchronise data between our Frontend and backend databases, they d collect, they d collate, they d do everything and anything. Except, with all these scripts, in all these random languages, written by a multitude of previous developers (at different skill levels), they weren t particularly maintainable (and sometimes, they weren t particularly readable or understandable either imagine a 6000 line perl script that pretty much ran different permutations of the same data over and over again) Enter Pentaho, and specifically it s Kettle project. (since renamed Pentaho Data Integration ), a tool that lets you manipulate your data in pretty much any way you can imagine, in the simplest and easiest way imaginable.

That s right, it s a GUI for data manipulation.

I know a lot of you are probably sceptical right now. The first time I ever saw this was when a previous boss of mine put it forward as a potential solution for one of our problems (getting our orders from the front end database down to the office/warehouse). I saw it, and I thought GUI? Nah, that s not how real programmers do things! , so after the development team put forward another proposal to solve this, and it got accepted, I thought I d never see the thing again.

That was until my current boss started playing with it, trying to work out what it was doing so that he could get these evil GUI based scripts into something manageable, like nice, pretty code. Thing s, when my boss plays with things that he doesn t know about, he tends to read up, research, and, 9 times out of 10, change his mind.

We wiped the previous server (it was rather noisy! We re glad it s no longer switched on!) and set up a new server to house our BI platform . Starting off with a few scripts, my boss learnt to love this tool, and then, as I m his 2nd in command (aka general lackey) started making me learn how to use it.

Again, I was sceptical, I didn t want to learn, and I put up resistance, but my boss was going away for nearly a month, and by this time, a few of our key business processes relied on Kettle, so, grudgingly, I sat down, and started to learn.

You may be wondering now, why I started off this story talking about all those magical and wonderful scripts that no one seemed to know the inner workings of. These scripts, as I ve already mentioned were unwieldy, and at times, god-damned awful. The plan was to move them to the BI system (as my boss had been doing already).

I like to think of Kettle as a bridge between the process-flow diagram, and the code. I started converting these scripts, and I was astonished by the fact that most of the conversions I was doing was converting a long perl script into 3 or 4 Integration steps

I m totally besotted with this program now. Any time I have to do data manipulation, I turn to it. I can t describe how (once you ve got used to it s quirks) easy it is to use, how simple it is, and how much it just makes sense. Best of all, most of those evil scripts are gone now, and replaced with pretty diagrams that do the work for you.

If you have to play with large data sets on a regular basis, I urge you to try it out. You can buy me a beer for reccommending it next time you see me at $conference.

I'd like to make pyroman IPv6 capable. That is actually the one big thing before calling it a version "1.0".I must admit that I havn't been very active on Pyroman (or Debian in general) the last years. This goes even so far as that "pyroman" was considered "abandoned" by Fedora or so. It is not; I use it on all my servers. It's still in use at the network I developed it for (after all there is not that much benefit for a workstation setup, where a 10 line iptables script will do the job just perfectly.).Anyway, I'd like to get IPv6 support into pyroman, but there is one big issue here: I don't have any machine using IPv6, so I havn't used ip6tables myself yet, so I don't know about all the magic involved ...So if you use IPv6, it would be very cool if someone would jump in to get full IPv6 support into pyroman. Madduck had already done some preliminary stuff, but I didn't get around to have a look at the integration or completeness yet.The '--no-act' and '--print' modes of pyroman should even allow development without any IPv6 support or root permissions in the system.Other things remaining on my pyroman wishlist:

• Fully automatic iptables firewall visualization
• Keeping traffic counters over firewall reloads
• Configuration UI
• A fancy 'arsonist' icon and a web page design

Some uploads this week:

• There s a 2.49.2~dfsg-1 package for Blender sitting in unstable. Despite its version string, it s actually 2.49b (release logs). Looks like there s a good reason for ~dfsg vs. +dfsg.
• There s a pending package for Blender 2.5 alpha 0, but some things still need ironing out. As stated in #558083, it ll probably go to experimental first, given its dependency on Python 3.1.
• Speaking of which, some dozens of X.Org drivers (xserver-xorg-input-* and xserver-xorg-video-*) were meant to be uploaded to experimental last night, but due to sbuild s #559659 and lintian s #542747, they ended up in unstable instead. If you see packages with a Depends: on X.Org stuff from experimental, that s normal, wait until xorg-server 1.7 moves to unstable, go and fix some bugs instead of reaching for reportbug.

Some time ago we decided in phpMyAdmin team to create yet another team meeting (after five years) at FOSDEM 2010. It took some time, but now I should have all travel things arranged (thanks to my employer who sends me there). So if anybody wants to meet there, just drop me an email and I will try to put you on my schedule.

Once you release something what gets at least a little bit popular, you can expect to receive fixes in various strange forms. Since I started to use Git for Gammu development merging all these crazy things is much more easier. The problem with these changes in past was that they are generally based on some random old versions (for example random daily snapshot). Now I just find the right place in history where to start (ChangeLog usually gives good hint where to search in the history), create branch and start to apply changes I received. I worst case (like it happened today) the "changes" is whole tarball with different changes made to different files. Fortunately I recently found great git add -i, which allows me to pick whatever changes I want from the patch. When all this is done, all I need is to merge changes back to master and Git is usually clever enough to handle it. PS: And yes, I'd really love if people would be able to send me series of patches, but it does not seem to happen in near future.

Linux 2.6.32 was released overnight. This has been a fairly busy release for ASoC, with changes including:

• Redone power sequencing code, giving shorter power sequences which
  should reduce the effect of any artifacts that exist.
• Reporting of power management decisions via debugfs, enabling much
  easier diagnosis of path setup problems.
• Beginning of work to factor out the register access and caching code
  from the individual CODEC drivers into a shared file. This needs to
  be rolled out over more CODEC drivers.
• New CODEC drivers for AD1836, AK4642, MAX9877, WM8523, WM8776, WM8961, WM8974 and WM8993
• New CPU support for multi-channel Blackfin SPORT, DaVinci McASP, i.MX2x SSI, and OMAP 1510 McBSP.

This post is about Barbara Liskov, for the Ada Lovelace Day. Barbara Liskov is the first woman in the United States of America that obtained a Ph.D. from a Computer Science department, in 1968. However, this isn't by any chance her greatest achievement. She's the creator of the CLU programming language, a language created in the mid-70s, that we would find crufty and ugly nowadays, but that with its strong emphasis in abstraction, the use of clusters (basically equivalent to what we call classes today) and iterators, was to become the rock foundation of Object Oriented Programming. Apart from that, she worked in the design of a timesharing operating system, called Venus; designed another programming language, called Argus, that was oriented to distributed applications, and also set the foundations for much of what is currently done as distributed computing. Aged 70, she's currently still working at MIT, as the leader of the Programming Methodology Group, researching ways to tolerate byzantine faults. For all this work, she received the John von Neumann medal in 2004, and the Alan Turing award in 2008. All in all, what I find the most inspiring of all her life, is the fact that she was able to pursue her career, working on a new way of creating programs, while she was also a wife and a mother; and that today, aging 70, she's still researching, leading a group, and working towards making computing better.

Well that all happened rather quickly. This morning, we met with our agent to go through all of the offer paperwork, at the bright and early time of 7:30am after (for me at least) a bad night's sleep staring at the ceiling. It wasn't that bad. A lot of disclosures, a lot of initialling and signing. Here's what the stack of paperwork looked like: The existing building reports didn't come back with any red flags. There's a little bit (around $1,000) of termite damage. We put in the contract that the sellers have to fix that. The hot water tank needs to be strapped to the wall to be in earthquake compliance. We put that in the contract too. A couple of hours later, we'd got all of the paperwork out of the way, and Nick said he'd present the offer to the seller's agent at 3pm. I got a phone call at about 5pm from Nick saying that they'd accepted the offer, with all of our conditions, so we're all ready to go for closing on the 23rd. Apparently the reason the sellers are so motivated is because they borrowed against the equity in this condo to buy a house, so they're eager to close the deal. We managed to negotiate the price down slightly to $519,000 (anything lower would have been a short sale for them, and we already know all about what that can entail). Even for that price, they've made a tidy profit on the $180,000 they paid 14 years ago. So this is working out really well, timing-wise. We'll close on the 23rd, go visit Chris, Bri and Clara in Atlanta for Christmas, and then have all of January to do any work on the place before our current lease expires. Just got to wait for the finance approvals and an international money transfer now. I'm slightly miffed that I booked it yesterday at 0.90 cents, and the AUD has risen to 0.92 cents today.

Biggest, in terms of money involved, piece of equipment is a nice piece of glass to put in front of our camera. Since my wife had been using a Canon SLR since forever (and we stayed with that when moving from the EOS 300 to the current EOS 40D), the choices to upgrade from the kit EF-S 17-85mm f/4-5.6 basically have been:

• EF-S 15-85mm f/3.5-5.6 IS USM: since it's been announced with the 18Mp 7D it should be quite good on the 10Mp 40D. Newest design, certainly one of the best IS on Canon, true wide angle.
• EF 24-70mm f/2.8 L USM: The old trusted one. No IS, but a constant f/2.8. Narrowest zoom range of the lot. A real tank, at almost 1kg.
• EF 24-105mm f/4 L IS USM: The other full frame L lens. Not quite as big, longer, but only f/4.
• EF 24-70mm f/2.8 L IS USM: including waiting for it to be announced and available, of course.

In the end I got the EF 24-70mm f/2.8 L USM, because the EOS 40D is no high ISO monster (we don't plan to upgrade immediately.) Also: I bought the Tokina AT-X 116 PRO DX (11-16mm, f/2.8) a while back and we're quite happy with that so wide-angle is covered. And since we're often shooting indoors (family and other events), f/2.8 is a big plus. On the tele end, there's quite a gap from the 24-70 to the old EF 100-300mm f/4.5-5.6 USM [age of the page to reflect the age of the lens ;-) ] but then the latter is probably the next lens to be replaced anyway. Since I only got 24-70 I can not directly compare these lenses. But after a few early tests I think I'm happy with the 24-70: while it seems to be a bit soft wide open at 24mm and at 70mm, it seems to be very sharp center to edge even at f/2.8 when used in the 35-50mm range. (Note that the 40D is a crop sensor camera, so I'm nicely using the sharp center area of a lens designed for full frame!) Yes, it's huge, so for casual walking around the 17-85mm will probably still get some use. Time will tell. And since it can, potentially at least, be used on a a EOS 5D Mk II, I now have another gadget to covet. Although this would mean giving up the Tokina 11-16mm. Anyway, not for quite some time yet... (The test also included the venerable EF 50mm f/1.8, Mk I, and I must say I'm quite surprised how sharp that one is in the f/4 to f/11 range.)

It took some time since last Photo uploader release, but it's not dead an now comes new release. It mostly just fixes imageshack interaction and moves development to Git on Gitorious. News in this release:

• Fixed grabbing URL from imageshack.
• Fixed defaults to not open browser.
• Default to imageshack.us service.

savs seemed to agonise about posting it but I think his Top 10 crimes of Developer Engagement is spot on even if it might not be as amusing as Aral Balkan s similar message. I think it applies to my recent RFID development work too: the public information is fluffy and you have to hunt or reverse-engineer most of the technical info, the supplier websites are painful and there s almost no interaction. In the past, I d been factoring in something between 50 and 100% extra time when our co-op needed to coordinate with unknown non-co-ops. With RFID hardware work, it was well over 300% when I last calculated it and that s even though there was one pretty helpful RFID supplier. This sort of nonsense is painful, slows development massively, could kill useful technologies at birth and re-emphasises my commitment to use Open Standards as much as reasonable. Have other people got similar horror stories to share? Can we get savs s Top 10 Crimes under the noses of some high-profile people?

I got a new computer at home a week ago and finally got around to assemble all the parts. Which wasn t as easy as expected, especially fitting the CPU cooler was a hard fight. Specs For the curious, here are the specs:

CPU

AMD Phenom II X4 965 (4 3.4 GHz)

Mainboard

MSI 790GX-G65

Graphics

ATI Radeon HD 3300 (on-board)

RAM

8 GB, DDR3

Hard drives

2x SATA 1.5 TB (by Western Digital)

Ubuntu installation For testing and having a first look, I installed Ubuntu karmic koala (amd64). Installation went like a breeze, everything was detected and worked out of the box. Well, kind of graphics performance was dreadful. Which was kind of expected. Debian installation I originally thought about using Debian only inside virtual machines or change roots. Still, Ubuntu does not really feel like the real thing . So I went to install Debian, aiming at a sid/unstable installation. The first boot using the official squeeze snapshot netinst image (Binary-1 20091128-11:21) went fine. Up to the first prompt: No input was possible. Probably a problem with the USB keyboard I had connected (Logitech wireless). Out of curiosity I tried the graphical installer, which did not even get so far. It was stuck in an endless loop trying to start an X11 server. So I dug for a PS/2 connected keyboard and had more luck. I got to the point where the installer searches for the CD-ROM drive. As I did not want to dismantle my old system yet, I used an external USB DVD/RW drive. This was not detected by the installer so I was unable to continue installation. I guess, the NIC driver was also on the disc so no ethernet either. Today I installed the DVD burner into the tower and had more luck. It still amazes me how easy it is to create my default storage setup using d-i (LVM on RAID). However, the installer failed to reread the partitions after I created two on each drive, interestingly telling me about /dev/sda2 being busy. Perhaps a left-over swap partition from the Ubuntu install? Anyway, after running fdisk manually and writing the same partition table again, I was able to continue. The remaining d-i steps went fine, with just a nuisance: I was asked for the console font setting twice. And I had no idea what it was asking of me, AFAIK UTF-8 should be fine for all possible uses. I selected # Latin1 and Latin5 western Europe and Turkic languages. Not that I will see the console unless Xorg fails to run After having the base system running, I rebooted without selecting any more software, partly because I knew that the resync on md1 will need restarting after booting into the new system. The new system booted fine and I called aptitude to install build-essential, Xorg and both KDE and Gnome desktops. This pulled in MySQL via akonadi-server (ouch!) and I was asked for a MySQL root password. Seriously, I don t care, this is a desktop system. I tend to forget the password anyway and the last time, root was able to reset it. So I just hit Enter, leaving no password set. This lead to the installation asking me two more times for the password, which really sucks given that the server is only used by Akonadi for whatever reason and the last time I looked, it creates its own MySQL configuration. Albeit my old system is 8 years old, the new system still seemed slower. Which of course is due to disk latencies, given that /dev/md1 was being synchronized in the background. Anyway, I was eager to test the desktop experience and started gdm. X came up fine, but again I had no mouse and no keyboard (USB mouse, keyboard connected as well as PS/2 keyboard). I also was unable to switch to a VT, so I logged in remotely and rebooted the new system. After the reboot, hal obviously picked up the input devices and X11 worked fine now. At this point, I stopped as the sunday almost passed already. Summary: Debian installation still needs some improvements I think. Maybe our distribution is just too stable, after all my last install is 3 years back due to a disk crash Relevant Debian bugs

• #558679: My installation report with some logs included.
• #558681: Nagging about MySQL root password.
• #558686: Failure to reload partition table.
• #545933: No USB keyboard support
• #315553: Installation from optical drive on usb fails (but this is for kernel 2.4)
• #558691: No keyboard and mouse after fresh installation of xserver-xorg.

RCBW - week #12 Here is this week squashes, by yours truly:

• 23/11/2009 bug #553122 - libtcl-chiark-1 - add missing ldconfig invocation, for *.so in linker locations
• 24/11/2009 bug #528152 - tulip - replace ttf-bistream-vera w/ dejavusans (patch from James Westby)
• 25/11/2009 bug #533993 - solfege - remove net need for xmllint (patch from Ubuntu by Alessio Treglia)
• 26/11/2009 bug #531220 - nut - fix ntp.conf postinst processing to avoid overwriting user settings
• 27/11/2009 bug #523912 - mit-scheme - add missing build-dep + tricky build due to bootstrap
• 28/11/2009 bug #521964 - libapache2-mod-lisp - fix APR version detection, patch by Antonio Radici
• 29/11/2009 bug #553257 - pidgin-hotkeys - remove unappropriate e-Xclusion in dh_shlibdebs

The funniest part of this RCBW issue is probably that Luk has started handing over RC bugs to me: from time to time I just get a /query from him with bug numbers In fact, this is more useful than one can imagine, because a considerable amount of time in periodic RC squashing is taken by triaging the RC bug list to choose your targets. Of course there is no guarantee that I'll be willing/able to fix handed-over bugs but, as a RM, Luk has evidently well-trained feelings about how hard would be to fix a given bug. All in all, for this week it worked well: 4 of the above 7 came from SchindlerLuk's list. ... and of course, let's welcome Simon on board! He is definitely doing a better job at spotting packages that should be removed from the archive rather than resurrected (potential negative effect that a NMU can indeed have on a package, de facto "saving" it from testing/release exclusion). In fact, the dilemma of "NMU vs Request Removal" raises various tricky questions. For instance, while we currently have pretty clear guidelines on how and, more importantly, when doing NMUs, we are more stringent on "Non-Maintainer Removals". Quoting from the Package Removal Requests wiki page:

    In all cases, if there is a maintainer and it's not you, mention the
    maintainer's opinion or, if you don't know it, mention how and when you
    tried to contact him.

It is of course reasonable to be more stringent on a measure that is way more invasive than a "simple" NMU. But if we start to rely on NMU-time as an important trigger for removal requests, then we could probably use a more aggressive and more distributed process for removals.

The story behind it Recently, I decided to set up a subscription with a VoIP provider, Phonzo, here in Norway. On their webpage, Phonzo advertised a VoIP service which actually gave you the SIP information and allowed the user to connect their own equipment to this service. That s really cool , I thought. I can play with Asterisk on the PSTN now! . They also advertised an offer with rent of a Linksys SPA2102 included, at a very affordable rate. Now, I suspected that the box might be locked as I d heard they were with some providers so I searched all over their webpage for any hint that it might be. None was to be found and since they included the specific model designation of the adapter rather than mentioning a generic Analogue Telephone Adapter , I basically assumed it wouldn t be crippled. But when it did arrive (impeccable delivery time, and telephony worked out of the box, btw), I found to my dismay that the box was indeed locked. So I sent a polite email to customer service, saying basically that I know this is a matter mostly interesting to enthusiasts, but they ve advertised an SPA2102 , and what I have receieved is a crippled SPA2102 . They basically replied It says rent , so it belongs to us. I replied Renting does not exempt you from marketing laws; you ve sold me something else than what I paid for . I got the reply: We can t open it, it contains sensitive information and it s not crippled, it s optimized for Phonzo service[sic] (!). Yeah, that s really what they said. A few more emails back and forth, and nothing of value came forth. When I received a letter from customer service saying Stop your nonsense, we re providing you a service and the adapter is a part of it I realized I wasn t getting anywhere there. I ve sent an email to the address in the SSL certificate (who also seems to be one of the founders) hoping I d get in touch with someone of relevance, but I don t have great hopes. (There s a copy of the correspondance in Norwegian, if you re interested.) So over to my plan B. The Linksys SPA2102 has two interfaces for an administrator: The first is the HTTP interface bog-standard, with an admin password. The second is the Interactive Voice Response menu you know the kind, Press 1 for x, 2 for y, . Now, this menu has several different options, including one to enable HTTP access on the WAN port . By default, this option is set to False, and changing it requires an administrator password. But how do you enter an alphanumeric password on a DTMF dialpad? Aha the admin passnumber is derived from the admin password! The mapping is 1=1, [2ABCabc] = 2, [3DEFdef] = 3, , (everything else) = 0. This reduces the keyspace quite dramatically! So basically, what I ve done is kludged together a shell script which tries the different combinations and sounds them out using a software DTMF tone generator, with earphones serving as acoustic couplers. (For now, I ve skipped numbers containing a 1 . The number 1 only represents itself, and thus its value is quite low.) It then tries port 80 on its WAN IP every 100 attempts to see if a passnumber has succeeded. The shellscript is accessible here: http://simula.gunkies.org/~toresbe/dtmfbruteforce.bash. The phone adapter has two lines, but the second one is locked by Phonzo however, it is not possible to disable the IVR menu on this thing, so I have full use of the box while this is happening. (It nearly goes without saying that I ve spoofed the DNS so it connects to my Asterisk box. ) I m now averaging about one passkey per second. According to my calculations of each passkey representing the number of symbols per digit raised to the power of the number of digits, I am trying 16807 passwords per second and will be trying 117649 passwords per second when I get to six digits. I have a quite technical readership so please do correct me in the comments if I ve made an error in either the calculations or anywhere else. If there are any Phonzo users out there with an SPA2102, I would very much appreciate it if you contacted me brute force works a whole lot better when it s parallelized. I am currently at #302362. I have not yet been contacted by anyone in the same situation.