I’m trying to set up a laptop which needs as much security and privacy as I can get. It turns out the main problem is that I want and need dual-boot: Windows XP Professional and Linux (Debian Etch). Now, Encrypting of all partitions used (except /boot of the Debian installation) is a must. Without dual-boot, this won’t be any problem, but not with the wish to dual-boot. The Linux side isn’t a real problem, I simply use a dm-crypt’ed partition as the only “physical” volume in an LVM volume group, which contains three logical volumes: Swap, / and /home. This means I only need to enter my LUKS/dm-crypt password once during boot. Shared partitions (shared between Windows and Linux) are also encrypted with dm-crypt/LUKS and decrypted by FreeOTFE (which is a really nice little OpenSource tool BTW), formatted as FAT32. The Windows side on its own won’t be too much of a problem either, since BestCrypt, PGP Whole Disk Encryption as well as DriveCrypt PlusPack (this probably isn’t a complete list) allow encryption of the Windows boot partition, but at least the latter two need their pre-boot authentication part (which is needed to be able to decrypt the Windows boot partition) to be installed into the MBR. Now, I wasn’t yet able to get Linux installed to the disk without breaking the Windows decryption. If anyone knows a program which allows encryption of the Windows boot partition and dual-booting into Linux, I would welcome a hint. Preferably, this solution should use grub as the primary boot manager.

I finally got myself a nice digital camera. Nice as in, it fits in a pocket, it takes reasonably good-looking pictures, ant it's not a Canon so I can access it as an USB mass storage device. (For those who care, it's a Kyocera/Contax U4R.) So I've started using F-Spot (which is tremendously cool) and Gallery a bit more intensively than previously, and I noticed something curious: my pictures had wrong times. I thought that digital cameras stored them inside the picture files... Hmm. On to investigate. Time passes as I follow the threads of the information flow (use the source, Luke). Then I scream in horror. Then I go see something I hope is authoritative and therefore likely to have been well thought-out (read the spec, Luke). Then I scream some more. Let it be widely known that the Exif specification, which is the standard for embedding metadata into image files from digital cameras, encodes the date and time of the picture as a string. A fat, ugly, 20-character string. More precisely, the format is YYYY:MM:DD HH:MM:SS. I don't have anything against strings, they are rather easy to parse by humans (as demonstrated by strings /home/roland/images/photos/contax-u4r/kicx0700.jpg head). But they should be done right. In this case, it would have made a lot of sense to enlarge that string to 26 characters and add +ZZZZ or something similar. So as to be able to encode, say, a timezone, for instance, in order to, say, have dates and times that actually mean something, instead of something that may or may not be the current time plus or minus a random number of hours and minutes. I thought I could cheat by starting F-Spot with TZ=UTC f-spot (among my electronic gadgets, those that can't cope with timezones are set to UTC, with the exception of my alarm clock). The result is bizarre: the date is shown as being one hour late. I could understand if it were two (I'm at UTC+2 these days), but where does that one come from? I suppose I'll have to cheat differently, by keeping a patched version of F-Spot that interprets the TimeDate data from Exif as UTC, instead of using the current timezone. Or maybe I could do that in my hotplug script: it already rsyncs images from the digicam to the harddisk then makes sure the digicam's memory has at least $foo megabytes of free space on the card memory. I suppose it could also fiddle with the Exif tags on the fly. Anyway. People need to learn: text without encoding information is useless, cryptography without a web of trust is useless, and date/times without timezone info is useless. If one of my esteemed readers happens to be (or know) a member of the Exif specification group (I understand it's called "JEITA"), please tell them that this needs to be fixed in a future version of the spec. I suppose I'll have to live with it with my current digicam, but maybe the next one will be better in that regard. The pictures themselves are nice, though.

I've been after a python library to mess with lucene indexes for a bit, we use/write a fair few things that use lucene at the backend at work, and just occasionally it would be very useful to be able to fiddle in them (read: search from the command line) without having to do the "write java, compile, test, recompile because you got something wrong, retest, and again" type loop for simple things. Using X11 Forwarding over ssh over a shared with the rest of the office 2M line to use Luke on the indexes is just not fun at all! So, now that I've got pylucene compiled and know the right options (ish), and it compiles on Debian Sarge (both i386 and amd64 variants), I might just build me a package for installing on our servers so that there's an "easy" option for us sysadmin types that just need stuff that we can use, quickly, without messing about! Semi-planning writing a luke-alike using PyLucene and the ncurses library to make it easier to diagnose/look in to the indexes on remote servers, but that's not going to happen this week! Quite impressed with the speed though - looks *fast* - but then, I suppose if you compile the Java using gcj to get native code, then you can expect it to be a *bit* quicker than running in the vm, right? At least, that's what I'm attributing it to at the moment, well, that and python startup time is likely to be a little bit quicker than java startup time. Also, in my travels, I found Divmod Xapwrap, which is a python library round Xapian which seems to be another (interesting) full text indexing engine. Haven't played with that yet - but could be worth a look in the future. Core library written in C++ so should be reasonably quick. The bit that I like the looks of though is """Xapian can search across several databases as easily as searching across a single one. Simply call Xapian::Database::add_database() for each database that you wish to search through.""" which sounds very useful if you start thinking about distributing indexes across a number of machines. I've not read enough Lucene documentation to know wether you can do a similar thing there. Right - enough of that - time to put things back together in the office and go home (again!). Hopefully tomorrow morning I won't be rudely awoken at 5.30am by someone asking a question that could have been better asked via e-mail (where "better asked" means "wouldn't have woken me up and annoyed the hell out of me because I couldn't get back to sleep", though - I did then play with some things and watched American Pie: The Wedding before heading in to the office the first time round...).

October is a busy month for us. October 14th is my birthday, and October 16th is our wedding anniversary. On our honeymoon in 2004, we took a trip to wt:Charlevoix at the mouth of the Saguenay fjord in Quebec. Then, in October 2005, Amita June had just been born, so we took a short trip to Ottawa for the weekend. At this point, I think we've established an anniversary tradition of short weekend trips to cities in Eastern Canada. This year, Maj started arranging a trip to St. John's in Newfoundland. I'm pretty fascinated by wt:Newfoundland -- it's one of the oldest settlements in North America, yet very isolated. Its culture is a unique blend of Celtic, English, and a smattering of French Canadian with an idiosyncratic accent and great music. But St. John's is just too remote for a relaxing, romantic anniversary weekend. We kept trying to find easier ways to get there, and nothing was working out. So we decided to save Newfoundland for a spring trip. My crazy-cuckoo dream is to drive from Montreal to Labrador City and then out to Goose Bay in Labrador on the mainland, take the ferry to Newfoundland, drive around a bit there, then back to Montreal on a car ferry. Good trip, eh? So, we decided to take things a little easier and go to another part of Canada. We've wanted to visit wt:Halifax for a long time, and now it looks like it's going to work out. It's only 1-1/2 hours by plane from Montreal, and it's supposed to be a very charming, fun city. I got good deals on Air Canada for the two of us, plus baby, and we're staying at the posh Lord Nelson hotel in the middle of town. Even though it's the "Splurge" hotel on the Wikitravel Sleep section, I was able to get a discount with my CAA card that makes the price just about acceptable for a special occasion weekend. Now we have to plan what to do when we get there. We've only been to Nova Scotia once, and that was just a jaunt across the border from New Brunswick for kcks. I'm going to pore over the Wikitravel and World66 articles to see what I can come up with, and hopefully do some research while we're on the road. Really, that's the best part for me. I probably shouldn't look so far ahead -- we've got Hudson (New York) still to do this weekend. Like I said, a busy month! tags: anniversary october st. johns halifax newfoundland travel nova scotia

Free Books I've been planning to go to the local Wiki Wednesday here in [wt:Montreal], so I was reviewing the Montreal Wiki Wednesday page for previous events. Although we've made it to a few of the previous ones, we definitely haven't made it to all the ones we said we would... so be it. One of the previous speakers was Hugh McGuire, a Montrealer who started an excellent project called Librivox. Librivox is a project to create free audiobooks, with chapters contributed over the Internet by readers around the world. They take books from Project Gutenberg (which is apparently a MediaWiki wiki site now... who knew?) and volunteers read them and then the whole thing gets munged into a nice little package. Everything stays in the public domain (bless their generous souls) and they even have a Librivox podcast just in case you swing that way. I'm super-hot for audio books. I love listening to them while driving, especially for long road trips. Maj is lukewarm on the idea, but she occasionally gets into them when we've got a good book going. The big downside is that they're ridiculously expensive -- $50+ for some books. The only thing that bothers me a bit about Librivox is that there arent CD Audio ISOs available. We have an MP3 CD player in our car, and I think it should work fine, but for sharing it's awful nice to have real CDs. UPDATE (from Hugh): There are mp3 ISOs available here: LibriVarc, but no aiff files. mega storage space, bandwidth and transfer problems to do that, but if anyone is interested in providing such CDs, or helping manage such a project, we'd love to know about it. tags: librivox audio books books on tape roadtrip project gutenberg

BarCampMontreal And while drifting through Hugh McGuire's blog, what do I see but a link to the newly-announced BarCampMontreal -- the first BarCamp to happen here in The City Without a Nickname. I had thought that the loose plan was to do a BarCamp to coincide with RecentChangesCamp in May 2007, but this plan seems more impetuous and uninhibited -- just like a BarCamp. There are just too many people to invite here in Montreal, though... we have something like 20 Debian developers, a whole passel of bloggers and wikitistas, lots of games developers and folks like that. Lots of work before the big weekend. Did I mention that October is a busy month? tags: barcamp montreal barcampmontreal

Day against DRM And look at that... October 3 is the Day against DRM per Defective by Design. A new DRM info clearinghouse, cleverly named drm.info, launched today, too. I've been in the weird situation lately of fighting against over-protectiveness w/r/t DRM in the Creative Commons licenses, when in fact I think DRM is twisted and dumb. It's a bill of goods being sold to entertainment companies by shady technology groups, it's rarely effective, and its only value is to punish law-abiding citizens. It's gotta go. A passionate and profanity-laced article I wrote about DRM coders for Pigdog Journal was linked from ars technica and BoingBoing last year. Although my writing style is a bit different (cough cough) than it once was, I still feel the same about DRM: a shameful and hostile way for technologists to treat each other. tags: dayagainstdrm drm pigdog journal

Are you experienced? So, I like the TV show Lost a lot, but I had no idea about this immersive alternate reality game The Lost Experience. Seems like just the kind of intense investigation game to keep losties busy for the entire summer. (You know, while they weren't trying to figure out the truth about lonelygirl15.) I'm not really that into figuring this stuff out, but I do enjoy reading the details once people have worked them through. tags: lost lost experience alternate reality game

In B rangers blog, there was this short notice on my cut-down on SELinux work. There are several comments to it, some of which are seriously inaccurate. Quoting bad information in Wikipedia doesn't make it more true either.

>SELinux is OpenSource. The kernel parts *are* in the regular Linux kernel.
Absolutely not. SELinux is a heavily patched Kernel + some tools.
Read http://en.wikipedia.org/wiki/Security-Enhanced_Linux if in doubt.

Sorry, but Wikipedia has a really old quote in there. SELinux is (use the source, luke!) in the mainstream "vanilla" Kernel by Linus Torvalds. There are some improvements which aren't in there yet, but in order to run a SELinux system, you do not need to patch your kernel. Anymore. The code in the Linux kernel works just fine. No serious bugs, just some new features are "incoming", and will go into the next Linux kernel. The last larger change in SELinux was around kernel 2.6.9 or so I think (depends on your definition of "large" of course. But the last time I patched my kernel with a SELinux patch was around version 2.6.7 or 2.6.8.) All the SELinux code is opensource, has rather strict coding guidelines and there are no magic patches from NSA being applied. (Well, basically use the coding style used in the Linux kernel...) Have a look at the mailing list archives on how patches in SELinux work. The NSA would have a hard time hiding secret spying backdoors in these patches, that will go through some more reviews before ending up in the Linux kernel. So you can trust them exactly as much as the Linux kernel itself. And definitely a lot more than the nvidia or ATI drivers. If I were the NSA and wanted to get a backdoor to many systems, I'd ask ATI and Nvidia to put the backdoors into their drivers. There is plenty of room in there. AppArmor is not in the stock Linux kernel. And havn't received a warm welcome so far...

/etc/init.d/cryptmount: 16: source: not found
/etc/init.d/cryptmount: 19: Syntax error: "(" unexpected

Another bashism. Policy violation in section 10.4. Severity "serious", but trival to fix. I thought we had managed to get rid of all unnecessary bashisms. Any Debian Developer should use e.g. dash as /bin/sh to avoid these bugs. It's faster, and bugs triggered by that are rare. Speaking of cryptmount: Dear Lazyweb, how do I get pmount/gnome ask for the luks passphrase using a graphical prompt? Right now, if Gnome tries to automount the encrypted drive, the password will be asked on some /dev/null device and pmount will hang.

Maj went out for her birthday party with a passel of ladies, so I stayed home and ate pizza and watched Twelve Monkeys with the baby. We had a good time, but as the baby is approaching 1 years old, my going-to-sleep tricks are becoming somewhat outdated. My main way to put the baby to sleep is to walk her from the front door of our apartment all the way back to the laundry room, and then turn around and walk out to the front door again. I sing during the entire process, mostly Neil Young and Johnny Cash tunes, but also a mix of 80s pop, reggae, songs, and goofy children's songs. Really, it's anything I can remember the words to, or that I can bridge over with some ad-libbing. This worked pretty well when she was teensy-tiny, and it's still the best way for me to get her to sleep. But as she's approaching 15kg, it's getting to be a serious workout for me to slog up and down the hallway 50 times belting out Take the Skinheads Bowling at high volume. We have a few baby books on how to get a child to sleep easier, but I've been taking the path of least resistance. I'll probably have to take the plunge and get her to fall asleep in bed soon -- which will probably mean some angry baby moments. Still, putting the baby to sleep is one of the most satisfying things in my life right now -- I highly recommend it. tags: baby amitajune sleep neil young singing

Programmer hierarchy Luke Welling's programmer hierarchy, based on The Brunching Shuttlecocks' classic Geek Hierarchy, is humorous and accurate. tags: programming languages haha

Tag improvements So, I've made some improvements to the tagging system on this blog. Instead of doing a full-text search at runtime to lookup which pages contain which tag, I instead keep a map of tags to page names in a separate db, and then look up in that index at runtime. The bummer is that I'm not figuring out a way to keep that db up-to-date easily. The best action, of course, would be to have the tags db updated at write time, but I can't figure out how to make that work. I tried it with a write macro, but you can't get the title of the current page with a write macro, unfortunately. I might just add a hook to the commit action -- that's about all I'm coming up with right now. It's annoying that Wiliki doesn't have hooks enabled anywhere. Gar. tags: wiliki tagging optimization

Let the flames begin... (via Luke Welling)

When I give talks on geeks and hackers, I often get the question, what defines a geek or something like that. Well now, I have a
few nifty diagrams that can help me answer the question.

Hello Planet Debian! Goodbye University Vacations!:-)

[Debian]

Thanks to Luk Claes, new translate-docformat was uploaded to fix Policy 7.6 Violation. madcoder has a list of affected packages. During the weekend I work on my packages, I'm waiting for my sponsor to get them uploaded to the archive closing the "adoption process" and fixing a few bugs and lintian warnings. There are some news from the DDTP and no news from the CVS pserver for non-DDs (and unfortunately, in this case: no news, bad news). I also sent a mail do debian-l10n-portuguese about the future of our list, we need to change a few points, create and update documentation, change our coordinators in some areas (they are MIA for quite a while now) and structure the team to be ready for future changes and also to work focused to get as much translations as possible in "etch".

[Life]

That's it... end of my University Vacation. Back to classes, busy schedule for the semester, I hope to manage everything in a very good way, so I can keep up-to-date with my Debian work.

Thanks to Cl ment Stenac (zorglub), my nice AM, this diary now appears in Planet Debian. Two old posts already appeared, but this is the first post that I made being aware that it will appear in Planet. :-) Thanks to Cl ment and Paul Wise.

I agree with Destiny -- this letter from wp:Steely Dan to wp:Luke Wilson is just excellent. If only all creative property disputes were handled this way. tags: steely dan luke wilson destiny

Hot in the City tonight It's been a hot last couple of days in Montreal -- I mean, not hot like wt:California or wt:Europe but hot enough that it feels pretty bad. According to Sacr Blues -- one of my favorite books about wt:Quebec -- Montreal has the highest variation in temperature of any inhabited place on earth -- from highs of 40C in the summer to lows of -40C in the winter. We're at the high part now. Yesterday was my Primary Caregiver ("PCG") day, so I took the opportunity to take the baby for a long walk in Parc La Fontaine, under the gigantic poplars, where it's always cool and fresh. We also went for a nice dip in the baby pool. That kept things pretty nice.

Bonne F te Speaking of hotness, last night was the 30th birthday party for my friend Niko Ritoux. Maj and I took the opportunity to do our first evening out as a couple without the baby -- our great babysitter Julia came by with her boyfriend Antoine and took Amita June to a jazz concert at the Theatre de Verdure in Parc La Fontaine. How great is that? Anyways, we had a good night with Niko. We went to Le 2, the teensy but uber-cool bistro-bar our friend Daran co-owns. It's in possibly the most valuable real estate in all Montreal -- the corner of St. Laurent and Sherbrooke -- but it's unassuming and doesn't have that Lower Main clubbed-out fake tan feel. We had a great dinner of "international tapas" -- the little appetizers that remind me a lot of Toqu -style gourmet micro-meals -- and lots of liquor and good fun. I saw a lot of people I hadn't seen in a while -- P.E. and his girlfriend Ode, who were living in Taiwan for a long time; Fred; Daran and his new friend Annie; Joannie; and our own lovely Italian princess the Other Annie. After dinner (11:30PM!) we hustled up to Bily Kun on Mont Royal and then Plan B across the street. Nicely, for a Friday night, everything was open and airy -- Montreal bars can get so damn crowded, but in the summer everyone's in Cottage Country and there's plenty of room for dedicated barflies. I'm not sure when I got home, but I think Niko had a good time. tags: birthday niko jf joannie le 2 bily kun plan b

And more time Today I spent my time creating data feeds of Wikitravel content for researchers at the University of Zurich who are doing some sort of work on the reliability and development of online travel information. I can't wait to find out how their research comes out. Maj, Amita June and I went up on the Pont Jacques-Cartier tonight to watch the last event in the International des feux at La Ronde. One of the great things about being in Mtl for the summer is this months-long fireworks festival, in which national teams compete every Saturday and Wednesday night. This is the first time I've been on the bridge for the event, and it was amazing -- much louder and bigger than when we've watched from home. Amita June, of course, was dumbfounded by the fireworks -- she gawked open-mouthed through the whole thing. I thought she'd be scared by the lights and noise and the crowd, but she loved it -- reached out and pointed for each explosion, and even said ooooooooh for the big finale. She conked out on the 8-block walk home, which gave Mama and Papa a little extra rest. tags: amitajune fireworks montreal la ronde maj

GPLv3 and license compatibility According to this article on Linuxworld.com, compatibility with other licenses like the Apache 2.0 is going to be a major focus of the GPLv3 development process. I say huzzah to that. Trivial differences between licenses are a shameful waste of time and energy for hackers who have better things to do. The world needs too much good Open Source software for us to waste time with license incompatibilities. Hopefully this same philosophy will bleed over into the FDL. Creative Commons made an overture for unilateral compatibility between the Attribution and Attribution-ShareAlike licenses and the FDL, which got stony silence from the FSF. It's time to start thinking of the users and playing nice with each other. tags: gplv3 licenses open source compatibility

Put one foot in front of the other I nearly forgot to mention: Amita June took her first step today. She's been "cruising" (walking around holding onto furniture) for about 6-8 weeks now, and she loves walking around holding onto Mama or Papa's fingers. And she's been spending longer and longer periods standing on her own -- up to about 20-30 seconds. Today, she was standing up, and she wanted to walk so I held out my finger just a little out of her reach. She extended her arm for it, then took two little steps to get to me. Ta-da! Maj and I took turns getting her to stand up on her own then walk to us. She's only got about 3-4 steps in her right now before she freaks out and sits down, but it's still pretty amazing. tags: amitajune first steps maj baby

Being around other geeks is bad, sometimes. Over the weekend I went to the UKUUG Linux conference along with a fair number of the other UK Debian gang. I had a great time, although the conference clashed with the football so I missed some talks. I also saw Wookey and Luke using their TomTom sat-nav units. I couldn't resist the temptation for long, and I've just ordered one for myself too. The 510 looks like a good choice - small, runs Linux, and is apparently compatible with OpenTom.

Today (one day before my birthday), I got accepted as a Debian Developer. I would like to thank the following persons (in order of appearance) which supported me in the one or other way within the NM process over the last two years. Sponsors

• Rene 'rene' Engelhard
• Gerfried 'alfie' Fuchs aka Rhonda
• Christoph 'myon' Berg
• Luk 'luk' Claes

Advocate

• Gerfried 'alfie' Fuchs aka Rhonda

Application Manager

• Rene 'rene' Engelhard

New Maintainers Front Desk

• Marc 'he' Brockschmidt aka HE
• Christoph 'myon' Berg

Debian Account Managers

• Jörg 'joerg' Jaspert aka Ganneff
• James 'elmo' Troup

For the sake of completeness: This is my old and my new QA packages overview, my NM status page, my NM application report, and my account name is 'daniel' (although my nickname is 'panthera').

This is in Finnish, since it internal to Finland. Sorry. FLUG, FIMUG, FUUG ja Linux-Aktivaattori pistiv t pystyyn nettiaddressin sen puolesta, ett valtionhallinto k ytt isi vapaita tiedostomuotoja. Kannatan. Menk lukemaan ja allekirjoittamaan: addressi.

Three weeks ago, I left Oaxtepec and didn't have the time to blog about it so far. To make it short: DebConf 6 was my first DebConf and it was really great! Actually, I don't know what to tell about it, now that it's over. Just one thing... I went to Mexico with the idea in mind having to work for two weeks full-time on Debian, basically of two reasons: First, because I like to work on Debian and second, because I got a full sponsorship which is kind of an honor to me. If Debian (or Debians sponsors, doesn't matter) are paying money to bring me to Mexico, then I should be worth the money and give something back in the form of good work, to value and acknowledge their investment (some people may say, that this is a typically Swiss attitude - I will not disagree on that :). However, while the first week, there was only hardly internet access, so I couldn't really work on the things I had on my todo list, as they all required quite large downloads or checkouts. Luk knew that I was oviously a bit disappointed about hat and, as the very wise guy he apparently is, told me then, that DebConf isn't (only) for working, but for socializing with the other people (he's the master of it). Of course, I do not blame anyone for anything... I did enjoy the two weeks, certainly more than I would have when having good Internet connection all the time. Thank you all for comming, and a special thanks goes to the DebConf-team and the sponsors who made this great event possible. I'm eagerly looking forward to next years DebConf... :) ...and for those who don't read Planet Debian frequently: This is the group foto and that's me :) Update: I'm so sorry, I almost forgot... Marga and Maxy, we all love you for your excellent pancakes!

The first of my New Model Advocate sponsorships to get a package into the archive is Simon Boulet, who takes over rsnapshot after the previous maintainer went MIA and I became temporarily disconnected from the package tracker (kudos to luk for stepping in). In this first round, we've learnt about the keyring, lintian, the bug tracker and bits of package-building - and I mean *we*'ve learnt: I've found out some stuff I didn't know before, which I'll use in the future. Thank you and welcome, Simon Boulet. [cont. with links]

I'm currently looking into "serious" backup solutions (such as Amanda or Bacula) for work and personal backups. While I may switch to one of those soonishly, I'm currently using a pretty simple script to backup my laptop contents to an external, dm-crypt/LUKS encrypted USB hard drive via rsync.

#!/bin/sh
#------------------------------------------------------------------------------
# File: rsync_backup
# Author: Uwe Hermann 
# URL: http://www.hermann-uwe.de/files/rsync_backup
# License: GNU GPL (http://www.gnu.org/licenses/gpl.html)
# $Id: rsync_backup 511 2006-05-15 16:44:08Z uh1763 $
#------------------------------------------------------------------------------
SOURCE='/svn /etc /var/www /var/log /root /home'
DEST=/mnt/samsung300gb/backup
time rsync -a --progress --stats --delete-during $SOURCE $DEST

Just to let you know ;)

So it seems that Steve Kemp is finding out that, whilst being a brilliant idea in theory, CFEngine is just plain weird in practice. I was the person who originally encouraged Steve to look at Puppet when he was originally talking about this stuff about a month ago. I was arguing from a position of weakness then, as I'd never tried Puppet then (although I was already eminently familiar with CFEngine and it's issues). Since then, I have started using Puppet on a project for a client, and let me just say that it is "all that and a bag of potato chips". Luke Kanies, the main man behind Puppet, is immensely supportive, quick to work up new features when suggested (< 24 hour turn around, in some cases) and really knows his systems-management stuff. The configuration language itself is quite easy to learn, it's wonderfully extensible, and the system as a whole doesn't have nearly the same number of "WTF?" moments as CFEngine (and Luke has already, in the week or so I've been using Puppet, fixed up two of them based on my suggestions). There's only one thing in CFEngine that I use that Puppet doesn't have, and that's editfiles. This is by design, apparently -- there is no consensus, even within the CFEngine diehards, that editfiles is a good thing, and Luke isn't really keen on implementing it (it's a big feature, and there's known better ways of solving most of the problems that editfiles solves anyway). I still feel that it's useful to use editfiles in some circumstances, but not having it certainly hasn't cramped my Puppet style excessively so far. Oh, Steve -- about Ruby being "un-perl" -- that's not a bug, it's a feature!

Note: Somebody help me name this thing! Serves 8.

Base liquid
4 dl	water
2 dl	(red) grape juice
0.5 dl	white vinegar (10 % acid)
50 g	baker’s yeast
100 g	sugar
Base solids
2 dl	oatmeal
1 dl	oat bran
1 dl	rye bran
2 dl	textured soy protein
Seasoning
1 g	cardamom
to taste:
	garlic
	oregano
	mint
Flour
ca. 6 dl	wheat flour (bread flour)
Finishing touches
1 dl	oil
100 g	grated cheese

1. Mix the base liquid ingredients in the tin, making sure that the finished liquid is lukewarm (~37 °C), and that the yeast is thoroughly dissolved. The tin must be large enough that this mixture takes less than a third of the volume available.
2. Add the base solids and mix thoroughly.
3. Add the seasonings.
4. Add the flour in small batches, kneading the would-be dough well after each batch. There is enough flour in the mixture when it starts behaving like dough instead of gruel. The dough can well be fairly loose.
5. Mix in the oil.
6. Put the tin containing the dough in a warm place with no draught, cover it with a cloth, and let the dough leaven for about 30 minutes, or until the dough has doubled in size.
7. Bake in an oven preheated to 200 °C for an hour.
8. When the pie is almost ready, cover it with the cheese and put it back to the oven, letting the cheese melt.

Serve warm (reheating if necessary) with fresh vegetables. Rough nutrient breakdown Computed from recipe and individual ingredient nutrient content.

	recipe
Energy	16200 kJ (3870 kcal)
Carbohydrates	494 g	52 E%
– sugar	100 g	10 E%
Protein	143 g	15 E%
Fat	139 g	33 E%
Dietary fiber	38 g	2.32 g/MJ

This pie is high in both fat and sugar, but both are within the limits of recommended intake for healthy adults. Just make sure to have the other parts of the meal to be similarly or better balanced in terms of sugar and fat