At long last, I've finally updated Debian From Scratch (DFS). For those of you not familiar with DFS, it's a single, full rescue CD capable of working with all major filesystems, LVM, software RAID, and even compiling a new kernel. The DFS ISO images also contain a small Debian mirror subset that lets you use cdebootstrap, along with the other utilities on the CD, to perform a manual, "Gentoo-like" installation. It also serves as an excellent rescue CD, with a full compliment of filesystem tools, backup/restore software, and a development environment complete enough to build your own kernels.

DFS also refers to dfsbuild, the tool that generates DFS images. dfsbuild is available as a Debian package. dfsbuild is designed to make it trivial to build your own custom DFS images. You can have your own set of Debian packages on your images, your own kernels, etc. Unlike many other systems, you can go from the example dfs.cfg to a customized DFS build in just a few minutes, even if you've never used dfsbuild before.

Version 0.99.0 is a from-scratch rewrite and port to Haskell. You can read the full list of new features in the announcement, but the biggest is that it now supports standard Debian initramfs kernels in addition to ones that have enough drivers statically linked to be able to read the CD-ROM.

You can also download my DFS images or browse the docs online.

Since it was first proposed I have been following Nicolas on CDIS. I think this is the next step now that a lot of apps are adding DBUS interfaces to different extent. Though this interfaces can also serve a purpose by their own, allowing specialized applications to comunicate one to each other, my opinion is also that the main use of this is desktop integration: being able to automatically pause music when I get an Ekiga call, put my IM client as Away if screensaver starts (meaning that I am not at the keyboard) and so. He seems to be searching for a mentor for Google Summer of Code 2006, so if someone seems inclined to have a better desktop experience I think it will worth.

Just tagged up the latest version of bpgallery which is my rather light bash script for generating static gallerys, this version fixes a couple of (minor) bugs, removes some duplication of code (to make it easier for me to maintain, and because I'm going to need to extend that part of the code for the next release), and fixes an outstanding part of the todo list (i.e. regenerate thumbnails if the required width changes). It's also added a per gallery config file option, so now putting in a file called .bpgallery.rc with the right variables in it (WIDTH, TITLE, BPGALLERY_THEME), will use that file as the last one to get settings from, overriding previous settings (well, unless they're set readonly, in which case it won't ;). Next release should have some extra themes in the release as a demonstration, medium sized images (and the pages to go with them, and an extension to the themeing for this), next and previous 'buttons' on the autogenerated pages, and should generally just be a nice release! Sometime I'll get round to finishing off writing the documentation for it, but until then, if you're using it and get a problem, mail me (or find me on IRC!).

After long time working together with Martin Pitt, I uploaded CUPS 1.2rc2 to experimental archive. This version introduces and improves many features; IPv6, LDAP, localized PPD, hardware detection, etc. Plus, it may make an another bunch of bugs :) For example I noticed KDE-control-center complained by ABI incompatibility around IPP. CUPS 1.2 provides better i18n support. If you're interested in the translation, see upstream's document. (AFAIK Swedish translation is been working by Daniel Nylander.)

Back in January I talked about setting up some scripts to automatically load ssh/gpg keys into the appropriate agents when you plugged in a UBS key. I had quite a number of people ask me for my scripts, but they just weren’t quite ready. I’m still not entirely happy with the solution that I’ve come up with, but I figure its working well enough to get some feedback now. It’s based very heavily on the usb-storage script originally written by Sean Finney, so I think that means I owe him Pizza now. However while its based on the usb-storage script it has changed in a few major ways:

• Use udev rather than hotplug
• Support GPG as well as SSH keys
• Script no longer responsible for mounting partition

The mounting of the partition is the key change and I’m still tossing up whether the way I’m doing it is best or whether I should return to having it handled by the script. The primary reason for changing it was to allow the partition to be mounted in a stable location (as opposed to a random directory under /var/tmp) so that I could symlink from appropriate places in my home directory to the partition on the key. The symlinking is needed to keep GPG happy as the gpg-agent seems to store only the passphrase and requires access to the private key whenever you need to sign/encrypt something. The way ssh-agent works is much nicer in this respect, in that once you’ve loaded a key into the agent it doesn’t need to refer to it on disk again. Currently I’m using autofs to mount the partition as needed and this seems to be working well. It’s probably possible to go back to mounting the partition at a stable location from within the script without too much hassle. You can grab the script from http://www.mattb.net.nz/debian/misc/manage-keys The remaining details for my configuration are below: First, setup udev to rename the key partitions to a static name and then fire the script at the appropriate times
/etc/udev/rules.d/usbkey.rules

ACTION=="add", KERNEL=="sd?2", SYSFS serial ="A0494386139B005B", NAME="%k", SYMLINK="usbkeys", RUN+="/usr/local/bin/manage-keys"
ACTION=="remove", KERNEL=="sd?2", RUN+="/usr/local/bin/manage-keys"
Then setup autofs to mount the partition on demand
/etc/auto.master

/media/usb /etc/auto.usbkey --timeout=10

/etc/auto.usbkey

keys -fstype=ext3,ro,noatime,nosuid,nodev :/dev/usbkeys
I keep only id_dsa and secring.gpg on the key and symlink from the appropriate places in my homedir to /media/usb/keys/

matt@argon:~$ ls -l .ssh/
total 76
-rw------- 1 matt matt 612 2006-04-12 22:45 authorized_keys
-rw-r--r-- 1 matt matt 2694 2006-04-12 22:46 config
lrwxrwxrwx 1 matt matt 22 2006-04-13 01:08 id_dsa -> /media/usb/keys/id_dsa
-rw-r--r-- 1 matt matt 612 2006-04-12 22:46 id_dsa.pub
-rw-r--r-- 1 matt matt 58851 2006-04-12 23:10 known_hosts
matt@argon:~$ ls -l .gnupg/
total 2336
-rw-r--r-- 1 matt matt 126 2006-04-12 22:56 gpg.conf
drwx------ 2 matt matt 4096 2006-04-12 23:07 private-keys-v1.d
-rw------- 1 matt matt 1175737 2006-04-12 23:29 pubring.gpg
-rw------- 1 matt matt 600 2006-04-13 01:51 random_seed
lrwxrwxrwx 1 matt matt 27 2006-04-13 01:08 secring.gpg -> /media/usb/keys/secring.gpg
-rw------- 1 matt matt 10560 2006-04-12 23:27 trustdb.gpg
And that’s basically it. The script takes care of the rest. The main problem I’m having with the script at the moment is that it doesn’t autolock the screen when you remove the key because gnome-screensaver-command is lacking the necessary environment variables to find the DBUS socket it needs to talk to its backend. Need to read up on DBUS/gnome-screensaver and sort out how to fix that tommorrow. Update: Updated example udev config so it doesn’t run a script out of /home

Saturday, I got Terah switched to Serendipity. Went well, though due to a heisenbug in Drupal involving hitting the Back button at certain times, her entire comment table had been wiped out. Fortunately there was a backup and restoration was easy.

And earlier last week I got an air compressor. It's amazing how much fun it is to have pressurized air on hand.

Did I say "fun"? I meant "useful", of course.

I'll have to write about that soon.

Plus, another potentially Really Big Project that I'll write about shortly.

As you may have read it in the latest DWN, Xen is now (almost) supported by Debian. Actually, it is currently stucked in the NEW queue since yesterday. The packages are also available on our Alioth webspace.
Special flavor of glibc, libc6-xen, is also upcoming, thanks to Aurelien Jarno ! Err, what else to say ?
That the Xen upstream sources are not very clean for now. There's still a lot of tools not needed that are furnished, the sources are a mess, and there is no stable API for now. You may have seen Xen kernels in experimental, but the kernel team has removed them for now. It will probably not be possible to distribute Xen-enabled kernels as long as Xen won't be more stabilized. I really wish that it will be integrated in kernel vanilla sources, since this could calm down a bit big changes, and help having a more stable version. Just see that between 3.0.1 and 3.0.2 version, the way used to compile Xen kernels changed from a special arch xen to a subarch xen. That's better, for sure, but such important changes in the same major branch are quite disappointing. Finally, I would say that Xen is now usable with Debian. I use it for more than 6 months now, and it is quite stable, no huge bug. You will just have to wait that #346387 is fixed to compile your own kernels with patches we provide.

Oh great, the software patent debate is back. After a long and disgusting campaign where pro-software-patents lobbyists employed all kinds of semi-legal and undemocratic filthy tricks in order to introduce software patents in the EU behind our backs, the European Parliament decided by a large majority to reject the directive "on the patentability of computer implemented inventions" (a.k.a. software patents) in July 2005. Rightly so. It is beyond my imagination how a certain pro-software-patents commissioner (Charlie McCreevy) dares to restart the whole debate after such a clear defeat. Consultation and "public hearing" He has organized a "Consultation and public hearing on future patent policy in Europe" which pretends to collect your views on the software patent issue (which he's trying to introduce through the "Community Patent" backdoor). Alas, the "questionnaire" is inaccessible (it's only available in 5 languages, instead of all 25 (+2) languages of the EU member states), biased towards software patents, very obfuscated and unreadable for the general public. There's no independent working group which conducts or oversees the consultation, no independent studies and reading materials, no mentions of the negative implications of software patents, no public debate, nothing. Now, who would have expected that? The FSF Europe has published a response to the Patent Consultation Questionnaire, which highlights many of the problems. Similarly, the FFII has questioned the validity of the consultation procedure, and gives a very detailed explanation of all the serious flaws of the process. What can I do?

• First things first: the DEADLINE for answering the questionnaire and expressing your views is April 12, 2006!
• Answer the questionnaire! The FFII has prepared a short How to answer guide which you can use as a basis for your answer (per email, snail mail, or fax).
• Raise your concerns about the validity of the consultation process!
• Write your MEPs! Tell them what you think.
• Spread the word! I'm under the impression most people don't even know about this issue, yet!
• Put up banners. I know you all like pretty banners ;-)

Software patents suck (in case you didn't already know) Let me quote Donald Knuth on this:

I strongly believe that the recent trend in patenting algorithms is of benefit only to a very small number of attorneys and inventors, while it is seriously harmful to the vast majority of people who want to do useful things with computers.

(via MJ Ray)

... give me samba, please! I've recently been fighting windows file servers. They run on totally oversized hardware (P4-HT, 8 SATA drives in a 7-active-1-hotspare RAID-5 set) but still don't perform reasonably. (2.5 MB/s write performance is really bad, read performance is somewhat okay, though) And then it's so easy to confuse windows... seems like Windows can't handle directories ending with a dot. But you can easily create such folders over the network with SMB... name a folder "foo." and windows can't handle it any more. Or "...". Windows can't delete or rename it. And I'm talking NTFS, not plain old legacy FAT. So if you're going to hide data on a windows box, just store it using SMB in such a folder. And if you want to be really evil, write a script that autodiscovers writeable network shares around you and creates "You suck." folders there. Windows users will start running around screaming, but obviously you can't be the culprit, since you can't access Windows shares, can you? I've also been porting a python app to Windows. Python is so nice, and PyGTK works like a charm on windows. Now if Windows just wouldn't suck as much... for example, it doesn't have os.fork(). And it's I/O charset semantics are a complete mess. Once you don't use only 7-bit ASCII you're likely to go crazy. Seems like the console on Windows always uses codepage 437. The filesystem probably cp 1252. Windows internally claims to use 16-bit unicode. So if you want a python script to run on windows:

• Use string.decode(sys.getfilesystemencoding()) on any string you get from functions such as os.walk, that might depend on the filesystems character encoding
• Write your app in a fashion you can redirect your output easily to a logfile, because the console on windows is totally borked... "print" just can't print your filenames... or I havn't found the right magic yet.

I can recommend python for cross-platform coding however. The PyGTK GUIs are really nice, much nicer than all that java stuff out there. And these "issues" with windows aren't really Pythons fault, but Windows.

Via reddit (which kicks the crap out of slashdot and digg): What I've Learned From Failure.

The link above is a long, but fascinating piece. I've had to become a lot more interested in how to manage software projects since taking on Xorg maintainance, and the same lessons seem to scale up well to how Debian as a whole manages itself. This article talks about some of the major problems that I've seen myself deal with, and the experiences of this guy echo my own over the past year very strongly. Here's a few examples:

"Getting away from weak teams, another source of failure is the omnipresent threat of "chickens." A chicken is not necessarily a weak individual, but a sign of a weak management structure. A chicken is an individual who has significant authority over your project, but does not make a personal commitment to the success of the project. Significant authority includes the authority to impose constraints on the team."

I like this and I've noticed it in the XSF and in Debian as a whole. People are free to work on what they want how they want, and this tends to work out well for us. But we also have no structure in which people must actually commit to what they do. As such, there's no accountability. This frees Debian developers from the preassure of having to work on something they don't enjoy, but it also creates abandoned packages, ignored bugs, and frustrated release schedules. In the past I've described a need for a stick in addition to a carrot for Debian developers, and the sentiment here echoes that idea. I've spoken with Manoj about his conception of personal responsibility in Debian, and I think it may truly be the bedrock on which Debian needs to rest. I still don't have a good mechanism for this yet though.

"Another sign of a weak team is poor development hygiene. There are dozens of development practices that seem trivial to the inexperienced outsider or to the manager focusing on "big wins." Examples of development hygiene include source code versioning, maintenance of an accurate bug or issue database, significant use of automated testing, continuous integration, and specifications that are kept current (whether incredibly detailed or high-level overviews)."

This is a something I myself have had a problem with over the past year. Branden was extremely good about keeping the XSF svn repo and the BTS up to date and well managed. I've done just about the opposite over the past year, and it's bitten me a few times. This however, was a conscious decision on my part, knowing that I was so far behind upstream that it was going to be hard to effectively manage the BTS without a recent codebase deployed to our users. So I focused on packaging instead, and luckily that road is nearly finished. Also fortunately, everyone else in the XSF managed the BTS for me, most notably (in alphabetical order by last name) Julien Cristau, Michel D nzer, Eugene Konev, and David Martinez Moreno, and they've managed to keep it relatively tidy. I'm going to spend some serious effort over the coming months to clean out the BTS so it's more manageable both for users and developers again. Luckly our SVN repo is in good shape still, so for the most part we're doing pretty well here. Debian as a whole also seems to be doing better at this, with lots of public svn repos springing up on alioth.

"It's mandatory to fail early. You need to know you're in trouble right away. That's essential when taking over an existing project or starting something new. You have to find out how you're doing within weeks. Not quarters, not months. The longer you wait, the more inertia the failure will have."

We're getting better at this, and I've sort of made it my mantra for this release cycle. Get things in to experimental as fast as possible, and then when I've fixed the majority of the bugs that show up there, put it in unstable as fast as possible. It worked out well for all the releases I've done so far and I'm going to keep doing it. Michel is really pushing me to keep CVS (or git as of Real Soon Now) snapshots from upstream in experimental, and I really like this idea and plan to follow through with it for this reason. This also echoes some of aj's ideas about speeding up development pace. Hopefully he'll implement them whether or not he becomes DPL, because I think they're going to be important for Debian as a whole.

"Dates are sacred."

We learned this during the sarge release cycle.

"The net result is that I've tried to find the happy medium where I generate weekly management reports on projects. A management report is something that is used to actually make a decision. Everything else is garbage. I've learned that when I haven't had management reports for a project, failure has resulted."

This is an interesting idea. It sort of echoes how I try and provide status updates on my blog, as well as the "Bits from" emails, but perhaps something more like this would be useful. I may try and play with this idea in the near future.

There's a lot more in there, but this entry already got way too long. Hopefully there's some food for thought in there for everyone who's interested in how Debian is run. The Debian development model has carried us very far, but I can't shake the feeling that we need to make some critical changes for it to continue. This will require a certain degree of boldness, but in order to fix the problems with the project I think we just need to clench our teeth and go for it. With that, I'll leave you with one last line from the above: "And if you decide to make changes, have the courage to go 100% with your gut. I've failed more than once when I watered down my convictions in order to appease dissenters. The only thing worse than evangelizing change and failing is looking back and realized you might have succeeded if you'd held firm on your convictions."

So remember Jerry Taylor, the man from Tuttle, OK that threatened to call the FBI on a Linux vendor because an unrelated hosting company had misconfigured Apache?

Well, this story is just getting funnier and funnier.

First off is this story from the Tuttle Times. It basically repeats Taylor's view that the CentOS people were expected to help him with his problem, and that he was somehow entitled to their help. But there are some funny tidbits in the story:

"Phone calls from across the country started coming in to the newspaper and city offices, and e-mails from Switzerland, Australia, Wales and England were received. Many of the web sites discussing the exchange are in foreign languages." I hate to break it to you, but Australia, Wales, and England all speak English.

(Ok, so they did switch from talking about email to web, but it still sounds funny.)

"In their search to find out more, web surfers discovered that the Tuttle Times online forums were hacked, and theorized that it was in retribution for the e-mails. Those forums, however, were corrupted several months ago, and the newspaper s now former web hosts did not repair it after numerous requests. New forums should be available at the Times site in the coming weeks." I'm so glad to know that your forums were merely corrupted for months and not hacked. Sounds like the IT problems in this town extend well past the city building.

Taylor said: "[CentOS is] a free operating system that this guy gives away, which tells you how much time he s got on his hands." Grumble.

Quoting Tuttle Mayor Paxton (trying to say what was more important than this): "We have issues with sewer. People here want better park facilities. They want a library." I think this has just validated every stereotype people have about Oklahoma.

Tuttle is more than 7 times larger than my hometown in Kansas, and yet my hometown has had a library for years.

Jerry Taylor also reported having 500 e-mails and numerous phone messages when he arrived to work Monday.

There's a new blurb on the Wikipedia page about Tuttle about all this. And in their talk page about the now-deleted article on Jerry Taylor, one person wrote: "Mr. Taylor's actions have coined a new term of art "Tuttled", in reference to the invocation of criminal consequences by one who is ignorant of the true situation. Since this is now a part of the English vernacular the story behind the term should be explained to give it an historical context. It is no longer about the action of a single person and an attempt to publicly vilify him, it is about a world-wide common experience of dealing with a Kafka-esque minor government official who, through ignorance, creates problems far beyond their normal sphere of influence. The page should be returned to the public."

The Register has two new stories about it. The first reports that Taylor has been interviewed by all sorts of media and says that he did the right thing. The second, Linux conquered, Tuttle man takes on London is a story about the grandson of the namesake of Tuttle, OK -- who happens to be the current US ambassador to the UK. This person is refusing to pay the regular London car fees. The mayor of London said: "It would actually be quite nice if the American ambassador in Britain could pay the charge like everybody else and not skive out of it like some chiseling little crook."

And finally, there's some incredibly funny photoshop work on this one over at fark.com (you have to scroll down a ways). Also, this comment:

"A small-town American politician wants a British newspaper to turn off the Internet.

Say that to yourself a few times. Please."

After having some fun with madwifi-ng and hostap already, I decided to put the Atheros MiniPCI card I bought some months ago in my laptop to be able to use the cool madwifi-ng drivers there as well. Unfortunately after putting it in and booting you get that:

  1802: Unauthorized network card is plugged in -
  Power off and remove the miniPCI network card.

Some investigation brought up that this is caused he card's PCI-ID being checked against a whitelist in the BIOS. I liked IBM ThinkPads, and especially my X41, quite much so far, but this check hardly seems to have a technical background. It just forces people to buy IBM authorized cards.. Anyway, I wanted to use an Atheros card. So what were the possibilities? Buying a PCMCIA card with Atheros chip? No.. I already had an Atheros card around and wanted to use the integrated wifi. Some people reported that the check could be switched of by flipping a CMOS bit. That doesn't seem to work with my X41. I could still have flashed the BIOS with a version with a changed whitelist, but I didn't want to fuck up a 1,600 EUR laptop. Therefor I decided to change the PCI-ID of my card. Only 40 EUR would have been lost if I did it wrong. I found a nice article that explains how to do that very well. Basically you need to

• remove the MiniPCI wifi card
• switch the laptop on
• put the card in while the laptop is running (after the BIOS checks and before the Linux kernel boots)
• install madwifi
• use a special tool to change the PCI-ID to the ID of an authorized card
• hack the driver to recognize the card with the new PCI-ID
• go outside, enjoy the nice weather and hack

Life can be so easy.

Call For Papers for the 4th. World Forum on Free Knowledge is now released in english (non-official translation, sorry for mine) and spanish. The WFFK is a Community-organized Forum, made possible by the sponsorship of Government Enterprises and Private Enterprises, as well as Volunteers and Donations. The first was made in Caracas, on November 2004, in the installations of the Universidad Bolivariana de Venezuela, with the sponsorship of the Venezuelan Oil Company, PDVSA. The second WFFK was made in Thiruvananthapuram, in Kerala-India, under the name Free Software, Free Society in May 2005, and the third WFFK was made in Maracaibo, Venezuela, with the support of several Institutions, including PDVSA, CONATEL and serveral others. Impressed by the success of the 3rd. WFFK, a group of people is organizing the fourth, which will take place in Puerto La Cruz, Venezuela, in October 2006. This is the first ocassion a Call For Papers is being done, because the Forum will have a Congress inside it, as well as selected articles. In the past, we only had selected articles and invited speakers on a certain basis. This time, a Call For Papers will also be done, so we can invite nice speakers to come and share with the attendance. Last time in Maracaibo we had David Moreno Garza with us, as well as several Debian Maintainers and Co-Maintainers with us, from Venezuela and Colombia: Ernesto Hern ndez-Novich, Polkan Garc a, Ernesto Crespo, V ctor P rez, Ana Delgado, Gerardo Curiel, Manuel Garc a, V ctor P rez and myself (am I missing someone?). So this was quite a MiniDebConf! Let’s make the 4th. a complete one

I’m taking Rojo for a spin, mostly because of recent upgrades that add some interesting features, including a “sort by relevance” function that lives alongside the usual “sort by date”—a “personalized digg”, as some have called it. One thing I like about Rojo is that it’s a River of News style aggregator, which means all feeds get combined into a single stream that’s very easy to scan for interesting items, rather than serving as just another way of filling my inbox with stuff I won’t have time to read anyway (the “aggregator as an extention to the email client” model). With River of News style aggregators, it’s no big deal if you miss something, kinda like it’s no big deal if you don’t read every last article in the newspaper every morning. Trouble is, how do you make sure you read the most important stuff first, so in the event you don’t get through everything, the likelihood you miss something is small? “Sort by relevance” would appear to solve this problem nicely. Rojo appears to calculate “relevance” by analyzing a few things: What I read (i.e., what I click on), what I tag (either by giving it “mojo” or by tagging it in the Web 2.0 sense of the word), and what my contacts read and tag. That seems like a reasonable enough algorithm. Problem is: 1. most of the things I read Rojo doesn’t know anything about (they’re in my browser clickstream); 2. I already have about a year’s worth of tags accumulated at del.icio.us, and I have no intention of moving those tags anywhere else (ironically enough, because del.icio.us gives me the ability to do just that); and 3. I already have more social networks and contact silos than I know what to do with, and I certainly don’t want another one. So, Rojo’s new features are less interesting than they appear at first glance. Guess I’m going to have to continue doing without, either until I decide to dump all my stuff in one place (ahem) or until small pieces loosely joined evolves a bit further. Update: On second look, it looks like relevance is actually calculated by the total number of reads and tags rather than by the number of reads or tags by me or my contacts. Not sure how that can be called personalized, but I guess those are the words of others, not Rojo’s.

Anyone who enjoyed Fight Club should read the entire five parts of My Crowd, Or, Phase 5: A report from the inventor of the flash mob from this month’s Harper’s Magazine, which, fortunately, is online unlike much of Harper’s content. This was one of the most enjoyable and relevant pieces I’ve read in Harper’s in quite a while. I was beginning to think that Harper’s was, as a friend characterized it, “for people who don’t read blogs,” but this piece proves the magazine can still be relevant.

Looks like I will be celebrating my 30th in Spain. I arrive in Madrid on my b-day. Oddly the only presents I want are also only apparently only available for shipping to Europe, so that works out pretty well, in theory: This is a pretty good kite design, my only other one in this design is fanny pack sized and works pretty well. If you ever wondered how to make my happy with just 2 euros, this is how. Er, that was my idea, so it's only fair..

I had nothing important to do this weekend, so I played a bit with kerberos. Pretty fun, that, and the Debian packages make it all so easy. First, when setting up Kerberos, you should note that there are two competing implementations: one is heimdal, the other is the MIT reference implementation. The former has some additional features (like storing principals in LDAP rather than plain files), but I found that krb5 was useful enough to me, so I didn't investigate further. Also, storing principals in LDAP isn't as useful as it sounds—kerberos is designed to make password replication unnecessary, so you want to store it on a machine with little or (preferably) no other jobs to do. You certainly do not want to store it in a server which will put it out to the world for all to see. Anyway. It's pretty well documented in info krb5-install (in the krb5-doc package); and the Debian packages let you do most of the setup through maintainer scripts and debconf questions, except for creating a new realm, which you do through a provided script. ... and this means that setting up kerberos on Debian is peanuts. Really. You need (at least) one KDC, which you do by installing the krb5-kdc package. For exactly one KDC (which will be your master KDC) you also need the admin daemon; you can get that one by installing krb5-admin-server. Then on the hosts in your network, you want to install krb5-utils, and libpam-krb5.so for authentication. After configuring them (as explained in the krb5-install document), you have a live kerberos system. It takes you about five minutes to do the initial setup (once you understand how the system works), and about 10 seconds to add a host to the system. Of course, doing kerberos setup is useless if all you want is to be able to log on to one system. But if you have more systems, you might want to use, e.g., the Kerberos support that is in OpenSSH, which you can do by adding the following two lines to both /etc/ssh/sshd_config and /etc/ssh/ssh_config (though obviously not on the same hosts:

KerberosAuthentication yes
GSSAPIAuthentication yes

... and with that, you'll have a kerberized setup. Fun.

Sad day for Free Software. The so-called VU/SACEM/BSA (for Vivendi-Universal/French Artists Societey/Bullshit Software Alliance) amendment to the DADVSI law presented by the French government has been voted. For details about DADVSI, see EUCD.info web site. This amendment says (bad English translation of course): "(Est) puni de trois ans d'emprisonnement et de 300.000 euros d'amende le fait de mettre sciemment la disposition du public ou de communiquer au public, sous quelque forme que ce soit, un logiciel manifestement destin la mise disposition du publ (une copie?) non autoris e d'oeuvres ou d'objets prot g s." "The fact of voluntarily make available to the public or communicate to the public, in any possible way, software obviously intended for making available to the public an unauthorized copy of protected work shal be punished by 3 years jail and 300.000 euros fine". (again sorry for the bad legalese English...). People interested may read this very complete analysis (in English) from the EUCD.info site. In short, as it has been written for instance by Sun France Head Security Officer, Gilles Gravier, this bans a vast majority of free software such as BitTorrent, Apache, FTP servers and the like. I think you get the point. It seems time for Debian to think about dropping French mirrors....and for French free software authors to emigrate (which I'll never do....I have too much attachment for this country anyway).

This is probably one of the worst flames I've seen in a long time. The funny part is that he complains about "AA zealots", while he clearly is a "non-AA-zealot" just as bad as any "AA zealot" can possibly be. I know a few (definitely a minority) of people who dislike AA fonts. But as far as I can tell, it's really easy to disable them. And from all I the average user will like them better, so it makes for a sane default to enable them. So, yes, you zealot, I want my fonts blurry, because I find them easier to read. Sorry for having a different personal taste. Oh, and then there is an explanation why AA fonts can actually be easier to read then black-and-white fonts. Because they grey levels are more consistent (which btw, is one of the tings LaTeX does very well, keeping the grey level) than if you have to make each pixel either black or white. Let's say we want to make a line 2 pixels to the right and 1 pixel down. In fonts these things happen... Here are your options: (Sorry, I forgot one: the hole in the middle...) the right one is obviously using AA and is "blurred". The left one is "too dark in the middle" and the other two are deformed. Now let's blur them a bit, like the average non-eagle would see them: The last one clearly is the best representation of the intended shape (a diagonal line of even thinkness). This is of course different if the intended shape was that it becomes slightly "fatter" here, or deformed. The only sane default for vector fonts is to assume that lines should well, not become deformed or thicker. I agree that a excellently made black-and-white pixel font might be done in a way that these deformations don't hurt. It doesn't apply to your favourite Helvetica font IMHO, because that font was designed for printing quality. Now go, and play configuring your "window manager", while I get some work done with openbox as my WM of choice. Because it just sits there in the background and allows me to have all my windows maximized on their own desktops except for my terminals which tile nicely without any zealot WM.