This all started when a DSA (Debian SysAdmin (those with root rights on all .debian.org machines)) wanted to upgrade the kernel running on our ftp-master host. It was shortly before dinstall, but hey, there it went, and the machine rebooted into a 2.6.28. Besides murphy taking his share making the machine fsck its huge filesystem that is all fine. What wasn t fine was the result we found. An odd one. Suddenly one tool we run during our dinstall run decided to blow up. Well, it did nt break, it just went dead-slow. Usual runtime had been about 5 minutes before, now we had over an hour - and only about 20% of the work was done. YUCK. Thats sure not going to work. Reboot in a 2.6.27 kernel did not show this problem, going back to .28 had it again. Which meant we had yet another reboot to get a working system. At which point investigation of the problem started. Turns out that pythons popen2.popen2 function is closing all available filehandles before it forks. Thats all fine and also what you usually want. Problem is (and all the glory to have found the cause goes to Peter weasel Palfrader) that the .28 kernel included a patch titled rlimit: permit setting RLIMITNOFILE to RLIMINFINITY (0c2d64fb6cae9aae480f6a46cfe79f8d7d48b59f) that allows, as the title implies, to set the limit for number of files to infinity. More citation from weasels mail: Closer investigation showed that the broken default ulimit did not apply to system processes (like stuff started from init). In the end I could establish that all processes that passed through pam_limit at one point had the bad resource limit. Apparently the pam library in Debian etch (4.0) initializes the limits to some default values when it doesn t have any settings in limit.conf to override them. Turns out that for nofiles this is RLIMINFINITY. Commenting out case RLIMITNOFILE in pam_limit.c:267 of our pam package version 0.79-5 fixes that - tho I m not sure what side effects that has. Debian lenny (the upcoming 5.0 version) doesn t have this issue as it uses a different pam (version). So, whatever the fix might be for etch, if any, there is no way we Ftpmaster can force DSA to live with a 2.6.27 kernel forever on our host. As the problem occurs when using popen2 - lets get rid of it. Luckily popen2 was used in dak by people that either did not know the gzip module python has, or it has been there since before that exists. Don t know, but that made removing popen2 a not too hard deal, done by our newest addition to the Ftpteam, Mike O Connor, stew (Thanks!). A pretty nice side effect is a huge improvement to the speed of the tool Prior, using popen2, it took around 5 minutes to do its job. Now using the gzip module we are down to some 44 seconds. Yes, below one minute, but well, must have some effect if you stop forking a thousand times and all that thousand times close all (1024) available filehandles But that alone isn t enough. There was a second tool also using popen2 (thankfully only once instead of a million times). Fixing that tool got its runtime from 2 minutes down to 0.7 seconds. Yes, less than one second, getting the same result out. Thats the gain you get from not going like get a tempfile, zcat foo > tempfile, filehandle=open(file), dowork including reading its content but foo=gzipfile.readitscontents, dowork(foo) . I like it. And am now sure that avoid popen2 at nearly all costs, if you can is a good motto. :)

Patio Maravillas is a self-managed government-independent social center in Madrid, placed in a squatted building that long ago belonged to school. The place currently belongs to a Real Estate company, Grupo 2 Reunidos. According to the law, the place has to be used for providing services to the community, which hasn t happened for 10 years. Nobody knows what plans they do have for the building, but there are suspicions that it might be related to property speculation. Nothing new on the horizon. The police are throwing them out of the building tomorrow morning, incidentally coinciding with the opening of the Foro Social Mundial (World Social Forum), for which Patio Maravillas was going to be one of the hosting buildings. Madrid isn t really known for supporting social movements in general, and has a conservative government, so feel free to think that the coincidence is not random. Patio Maravillas has been giving courses and workshops to the community since July 2007, and is very well considered and supported by different organizations. Supposedly whatever happens tomorrow will be without violence, but knowing how the Spanish Police behaves in this situations that is not very likely. The event will be streamed and probably recorded, and information will be twittered, so hopefully nothing serious will happen. I really hope the best for them. I d love to be able to be there with them, but as it is really not possible for me, I m giving them all my support from here. Good luck! Keep up the good work!

The monthly board meeting of SPI will take place on irc.oftc.net #spi tonight (Wed 21 Jan) at 20:00 UTC. Members may have seen that the meeting announcement is delayed because the secretary has been ill and it seems that none of the other board members has stepped in to take over. I think the only new associated project currently under discussion is waiting for a legal opinion, so your guess about the meeting contents is probably as good as mine. My guesses: there will probably be a treasurer s report; Martin Zobel-Helas has been filling in the gaps in the 2007-8 minutes, so there ll be two or three sets for approval; the secretary may report on website redevelopment progress; Privoxy might have taken up the offer of associated project status from the SPI December 2008 meeting; and there might be a report on Tux4Kids trademarks. Watch the comments below this article for a link to the summary when posted.

(Apologies in advance for the shameless plug.) It s possibly a little late to talk about new year s resolutions, but if anyone is a Facebook user and has given up smoking (or plans to), you might be interested in Quitclock. My brother Alastair is a health editor for the Bupa private health insurance company, and thought of this neat project which was implemented by my housemate Martin Kleppman, and announced at new year. It helps you keep track of how long since you ve smoked, how much money you ve saved, lets you and your friends know how you re doing, and has health tips about the improvements that you can expect from your new-found abstinence. I m not a smoker but hopefully someone will find it useful.

This morning I gave a talk at the Security mini-conf of LCA about the status of SE Linux in Debian. Here is a summary of the issues I covered: General Status In Lenny (the new release of Debian that will come out in a month or two) SE Linux is working well. Considerably better than in Debian/Etch. There is an installation document on my documents blog [1], it s very easy, only two scripts need to be run with no parameters to do most of the work (5 commands in total). There is more detail on installing SE Linux in Lenny (and other issues) in the Debian Wiki [2]. The default configuration of SE Linux is targeted . Previously we had separate policy packages for targeted and strict , now they are configuration options for selinux-policy-default. It is also possible to have some users in the unconfined_t domain (like the targeted policy) and some in confined domains such as user_t. Changing to strict can be done one user at a time, this needs further documentation. Backports I maintain an APT repository of i386 and AMD64 packages for better SE Linux support. This includes libraries built to not need an executable stack (see my previous blog post for details [3]). It also includes i386 libraries that don t need text relocations AKA execmod (see my blog post about why i386 must die for details [4]). My Lenny repository includes policy packages before they appear in Testing as well as the packages that are modified to fix the execmod and executable stacks issues. I plan to maintain this repository for some time, at least as long as I am actively using Lenny, but the content will change. I might back-port the newer upstream policy to Lenny at some later date. If I do this it will be near the time that Lenny+1 is released and I will put it in a different location to my current Lenny repository. I am currently deciding what to do with packages from external repositories such as debian-multimedia (see my previous post for the background) [5]. I may have to create a separate repository for non-standard Debian packages which I then modify to better support SE Linux. I also plan to build packages of Security Enhanced PostgreSQL [7] for Lenny and Lenny+1. After demonstrating it s capabilities I will suggest that it be considered for Lenny+1. Play Machine I have been running a Play Machine (open root machine) [6] for most of the last seven years. In the near future (probably the week after LCA) I will upgrade it to Lenny. One thing that I didn t mention is the fact that I plan to demonstrate other things such as SE-PostgreSQL in Play Machines. Training I have a Xen server that is used for my Play Machine, I will run it as a SE Linux training machine and grant temporary ownership of a DomU to anyone who wants to learn and have a document with a list of tasks to complete to learn about SE Linux. I might be able to get it online this week. If so then I ll make it available first to LCA delegates. I will also set up a Bittorrent server for a Xen image for anyone who wants to go through the same SE Linux training program on their own machine - this will allow them a greater time limit and also avoid contention for my server. Unfortunately I have some problems with BitTorrent, I would appreciate any advice about running a torrent tracker. Post Lenny SE PostgreSQL is an exciting new development that I want to get in Debian. Initially I will create my own APT repository for it and include it in my Lenny repository. Hopefully it will become a standard feature in Lenny+1. Security Enhanced X (the X window access controls) is a significant security feature. I hope to have that in Lenny+1, but it might not be possible.

• [1] http://doc.coker.com.au/computers/installing-se-linux-on-lenny/


• [2] http://wiki.debian.org/SELinux/Setup


• [3] http://etbe.coker.com.au/2008/08/11/executable-stacks-lenny/


• [4] http://etbe.coker.com.au/2008/09/11/execmod-and-se-linux-i386-must-die/


• [5] http://etbe.coker.com.au/2009/01/12/debian-multimedia-and-se-linux/


• [6] http://www.coker.com.au/selinux/play.html


• [7] http://wiki.postgresql.org/wiki/SEPostgreSQL

It s been a while now since the 2008 Summer of Code ended. This year, twelve (?) projects were selected. That s twelve students working full time on a Debian-related project during the summer. The Google Summer of Code has sometimes been criticized in the past for having a poor student-developer retention rate inside the host projects. One of the goals of the program has always been to bring new people to budding or established free software organizations and it s a pity that some would leave the project as soon as the program ends. On the other end, poor integration of created code within the project leads to work that is hard to merge in, or worse, doesn t get merged in at all. That s a waste of time and resources and a probably cause of global warming as well. Hopefully, it s not always the case. Some people choose to stay committed within the organization in the long-term. Useful code gets merged in and pushed to the public. I am going to give a talk about this at FOSDEM (go to FOSDEM!) so I m giving you a little preview. I need your help to collect information for my talk. As you know, information is always hard to come by with these kinds of projects so anything can be useful. Without further ado, let s have a look at the cast of the Debian Google Summer of Code 2008: Netconf, a network configuration management system Presentation Netconf is a network configuration management system designed with modern network infrastructures and the needs of roaming users in mind. It is a personal project of Martin Krafft that he started in 2007. He did some presentations about it that you can find on the dev website. The project proposal was introduced by the mentor. The work was mainly about completing the roadmap items for version 1.0. Most of the design was done and code fleshed out. The stated goal was to have netconf ready for lenny. Martin noted that due to lack of regular free time, he couldn t reach that goal by himself. Student Jonathan Roes was a computer science graduate student from the University of North Carolina at Charlotte. He had programming experience as a hobby for a long time and wrote some free games and libraries for the Nintendo DS and some proprietary webapps. He submitted a few little patches in mid-march right after the publication of accepted mentoring organizations and went on to work from mid-may to mid-august. He wrote a lot of code right into the trunk since the whole project was a prototype. Result The last commit by Jonathan was also the last to date in the main netconf git repository. No further progress has been made and obviously netconf didn t get into lenny. I couldn t find any further public involvement of Jonathan within Debian. The ultimate Debian database, all things Debian in a SQL database Presentation The Ultimate Debian database wants to reunite all Debian data sources in a SQL database The project was mentored by Lucas Nussbaum and co-mentored by Stefano Zacchiroli and Marc HE Brockschmidt. The project proposal was introduced by Lucas. Student Christian Neronus Von Essen is.. well, there wasn t much information readily available on him. Result The whole project is coded up and working well with a whole bunch of data sources. There will be a talk at FOSDEM about this so I ll leave it to Lucas to talk about it in detail. I couldn t find any further public involvement of Christian within Debian. Security-beta, a beta testing for Debian security updates Presentation The task is to improve the quality assurance process for security updates by providing a public security update beta test program in addition to the existing QA done for security updates. During the preparation of security updates, there s an inherent delay between the initial upload of the fixed packages and the time until the packages have been built on porter machines. This time gap will be used for a new security update beta program. The project was supposed to be mentored by Moritz M hlenhoff. Student The project was supposed to be done by Nico Nion Golde. He is studying computer sciences at the Technical University of Berlin. He s also a DD. Result There s no nothing. Nico, what happened ? And obviously, he s still developing for Debian. Debgraph, a generic infrastructure for the development of packages management tools Presentation In a large software ecosystem such as Debian Linux, there is the potential for dependencies among software packages to create complex management and technical problems. For example, dependency loops (cycles) in which a package directly or indirectly depends on itself can confuse package management tools as they determine the proper order of package installation. debgraph helps developers to solve this problem by enabling generic queries (e.g., Give me all the nodes that depend on package X ) against the graph of packages and thus automating much of the manual labor that is typically involved in resolving dependency problems. The project was mentored by Robert Lemmen, who introduced the project proposal. The project was already started and the C++ code foundation was done by the time it was proposed. Student The project was executed by Adam Jensen, research assistant in the Software Engineering and Network Systems Laboratory at Michigan State University. Result Adam maintained a blog about his progress and finished ahead of schedule. However, the resulting work seems to be unused, which is a pity since the code could be used within other programs (package managers?). I couldn t find any further public involvement of Adam within Debian.
That s all for now. The information is quite fragmented I admit. Most of it was pulled from Google, mailing lists, commit logs, blogs, whatever. If some projects are lacking in information here, it s because I couldn t find it readily (which is an issue in itself!). In my next post, I ll try to analyze the success and failures to extract some insight. Teaser: pet projects!
If you re a student or a mentor mentioned above, feel free to fill any of the blanks in my report. It s much appreciated. You re not a student or mentor mentioned above and have an opinion on how to improve the next Debian Summer of Code ? Feel free to comment.
Sledge, ping! Here s a list of projects to be described in my next posts:

• Debian NAS, improve support of Debian on NAS devices
• Cran2deb, generate Debian packages from R packages
• Mergemaster, interactively merge changes in configuration files
• PAS NSS Debian Installer, improve support of PAM and NSS at install-time
• Jigdo-ivory, a JavaScript Jigdo client
• Aptitude-gtk, usability and GTK+ GUI for the Aptitude package manager
• Lintian for fuller automated setups
• Debexpo, a generic web-based package repository

OCaml batteries, now with GZip-ed channels This week-end I've spent some time to kick-start my hacking onto OCaml Batteries Included (yes, it deserves a proper website). Last time I wrote about it was with my package maintainer hat on. In the meantime I've got trapped^Winvolved with upstream development as well, after having been so fool to propose integration with Batteries' I/O channels of compression/decompression libraries. Well, here are the first tiny teeny results:

    # open Batteries.System;;
    # let i = File.open_in "/tmp/fstab.gz";;
    val i : InnerIO.input = <abstr>
    # let i2 = GZip.uncompress i;;
    val i2 : InnerIO.input = <abstr>
    # IO.read_line i2;;
    - : string = "# /etc/fstab: static file system information."
    # IO.read_line i2;;
    - : string = "#"
    # (* same goes for output of course *)

i.e., no matter how you created an I/O channel (and with Batteries you can create it out of a lot of entities), you can apply a gzip compress/decompress filter. The underlying library is Camlzip, which also sets a precedent on how to integrate external libraries into Batteries properly. The code is not released yet (hey, Batteries is still alpha!), but is available from the Git repo, (zack/compress branch). Next milestone: bzip2 ... of course with the same interface, so that changing (de)compressor will be as easy as s/GZip/BZip2/g in the code above. tar and zip will come next (but with different interfaces, as old *nix jokes tell us, compressing and archiving are different tasks).

preview of OCaml batteries included Debian packages OCaml batteries included is a wonderful community-driven initiative to standardize the OCaml development platform. It is similar to initiatives sharing the same motto, like Haskell batteries included and Python batteries included (which then has become the legacy Python distribution), but I have always felt that OCaml was more desperately needing a similar initiative. David Teller and the OCaml batteries included team have been the first actually doing something to address the frustration of many otherwise enthusiastic OCaml developers. A couple of days ago, their efforts have given birth to a first milestone: the release of the first alpha version of batteries included. To help out, I've released as quickly as possible the Debian packages of OCaml batteries included. You can find them in experimental (actually in NEW, at the time of writing), and from my people.d.o space. I've only built the packages for amd64, if you need some other architecture you can build on it by yourself, but I recommend not trying to rebuild the -doc package (which takes 10 minutes on my laptop to build). You can reuse the -doc package I've built, which is arch: all, to rebuild only the -dev part unpack the source package and do fakeroot debian/rules binary-arch.

An apparently little known fact about dpkg is that it clears suid bits when upgrading packages. This defeats the hardlink-a-suid-binary-and-wait-for-exploit attack that used to be a worry, and which apparently still is to some.

joey@gnu:~>ln /usr/bin/sudo
joey@gnu:~>dir sudo
-rwsr-xr-x 3 root root 112K Jul  6  2008 sudo*
joey@gnu:~>sudo apt-get --reinstall install sudo
Reading package lists... Done
[...]
Get:1 http://ftp.egr.msu.edu unstable/main sudo 1.6.9p17-1 [177kB]
Fetched 177kB in 1s (91.0kB/s)    
Created commit e5523fe: saving uncommitted changes in /etc prior to apt run
 1 files changed, 14 insertions(+), 0 deletions(-)
(Reading database ... 167780 files and directories currently installed.)
Preparing to replace sudo 1.6.9p17-1 (using .../sudo_1.6.9p17-1_i386.deb) ...
Unpacking replacement sudo ...
Processing triggers for man-db ...
Setting up sudo (1.6.9p17-1) ...
joey@gnu:~>dir sudo 
-rw------- 1 root root 112K Jul  6  2008 sudo

dpkg has done this since version 1.10.18.1, released in 2004. PS, Can any rpm users tell me if rpm does this? PPS, If you find yourself making statements like "While noexec is only a weak defense, it gives a little bit more protection", you are probably not really talking about security, but instead about a warm fuzzy feeling. PPS, If shellcode can create a suid root executable, it can create it in /root or some other directory that is not mounted nosuid.

I am happy to announce general availability of darcs 2.2.0. Getting the release For this release, we have decided to provide two flavours, depending on the build system used:

1. The source tarball, http://www.darcs.net/darcs-2.2.0.tar.gz, which can be built using the traditional autoconf-based system. This is the fully supported version. After downloading and unpacking, you can issue:

   $ ./configure
   $ make
   

   and possibly

   # make install
   

   More detailed instructions inside the tarball (file README). Please note that we had at least one report of build failure, with quickcheck-related message. The currently best workaround, if this happens to you, is to use the cabal version of the package instead, see below.
2. Cabalised source. You can either download a tarball from http://hackage.haskell.org/packages/archive/darcs/2.2.0/darcs-2.2.0.tar.gz and build manually (see the build instructions in README inside the tarball), or, alternatively, you can use cabal-install to obtain a copy:

   $ cabal update
   $ cabal install darcs
   

   This will give you a darcs binary in ~/.cabal/bin you should probably add that to your PATH.

In addition to source tarballs, we expect binary packages for various UNIX platforms will be available in due time. For Windows users, Salvatore Insalaco has prepared a binary build, available from http://homepage.mac.com/kirby81_it/darcs/darcs-2.2.0-win1.zip. You just need to unpack the directory somewhere and add it to your path (if you like). Moreover, an experimental TortoiseDarcs release for darcs 2 has been made available by Kari Hoijarvi and is looking for home. It can be found at http://datafed.net/darcs (unfortunately, at the time of this writing, the site seemed unreachable If you can help with hosting, please mail Kari.) What s New The summary of changes since version 2.1.2 (released last November) follows:

• In interactive record, it is now possible to get a list of currently selected hunks (command l). (Christian Kellermann)
• It is now possible to specify --in-reply-to when using darcs send, to generate correct references in the mail header. (Pavel Shramov)
• New repositories with --no-pristine-tree can no longer be created. This only has effect on legacy darcs-1 repositories.
• Improvements in Windows support. (Salvatore Insalaco)
• Performance improvements in darcs repair and robustness improvements in darcs check. (Petr Ro kai)
• Extensive manual and online help improvements. (Trent W. Buck)
• Support for GHC 6.10.
• Overhaul of the make-based build system. (Trent W. Buck)
• Cabal is now supported as a build method for darcs. (Duncan Coutts, Petr Ro kai, Gwern Branwen)
• First stab at libdarcs when building through Cabal, all of darcs implementation is now exposed in modules. No API guarantees whatsoever. (Eric Kow)
• Additions to Haddock documentation of the existing darcs modules for improved development experience.
• Improvements in the testing infrastructure. (Christian Kellermann, Gwern Branwen)
• Low-level optimisations in filesystem code. (Ganesh Sittampalam)
• Numerous major and minor bug fixes, refactorings and cleanups by David Roundy, Eric Kow, Jason Dagit, Dmitry Kurochkin, Thorkil Naur, Salvatore Insalaco, Christian Kellerman, Florent Becker, Duncan Coutts, Reinier Lamers, Ganesh Sittampalam, Petr Ro kai.

And a summary of issues that have been fixed in darcs since version 2.1.2 (compiled by Thorkil Naur): 525 amend-record => darcs patches show duplicate additions
971 darcs check fails (case sensitivity on filenames)
1006 darcs check and repair do not look for adds
1043 pull => mergeAfterConflicting failed in geteff (2.0.2+)
1101 darcs send cc recipient not included in success message
1117 Whatsnew should warn on non-recorded files
1144 Add darcs send in-reply-to or header In-Reply-To: x@y.z
1165 get should print last gotten tag
1196 Asking for changes in /. of directory that doesn t exist gives changes in entire repo
1198 Reproducible mergeConflictingNons failed in geteff with ix
1199 Backup files darcs added after external merge
1223 sporadic init.sh test failure (2.1.1rc2+472)
1238 wish: darcs help setpref should list all prefs
1247 make TAGS is broken
1249 2.1.2 (+ 342 patches) local drive detection on Windows error
1272 amend-record not the same as unrecord + record
1273 renameFile: does not exist (No such file or directory)
1223 sporadic init.sh test failure (2.1.1rc2+472) I would like to thank all contributors for making this release possible. Future The next release will be 2.2.1, fixing low-risk issues found in 2.2.0, or those that have been excluded for 2.2.0 due to freeze. This release will appear in two or three weeks time, depending on circumstances. The next major release will be 2.3, due in June or July this year. The focus of this release will be new features and further work on performance. Moreover, we expect that it will use Cabal as its default build system and will make first steps towards sustainable libdarcs API.

As I move to having more and more machines on my internal LAN, I felt the time had finally come that I sit down, and rebuild my network to take advantage of things such as gigabyte networking, LDAP, single-user sign on, and so forth. I'm doing partially for fun, and partially because its an interesting experiment to see how Linux from an IS environment compares to a Windows 200x IS environment (one of my former jobs was a 2000/XP/2003/Vista sysadmin position).

So, here's my current network setup
blacksteel <- *wireless* ---------------------------------------------- cerberus <-> Internet
/
dawn <------ *wired*-----------------------------------------------------
/
360 <---- *wired* -----------------------------------------------------

Online machines:
cerberus - WRT51GS
backsteel - My laptop
dawn - Development machine
360 - Xbox 360, used to play media from blacksteel

Offline machines (aka, machines I have, but haven't fired up since moving:
helios (PowerMac G4)
apollo (old Dell P3)
junker (RS/6000 rescued from the dumpster, might be dead)
alexandria (NSLU2; gave up its plug for dawn)
coldfusion (Coldfire Board, might be dead; ethernet controller is faulty, but might be able to use a USB based one to breath some life into it; can't autoreboot due to built in bootloader not supporting it; and no JTAG to sanely change the default bootloader).
siren (old MacBook Pro, has a dead internal HDD, but runs fine from an external hard drive. Was my Debian test box until its HDD went to dawn)
exodius - second WRT54GS used to be part of a WDS bridge.
unnamed dev box (not here yet, but likely soon).

Of all these machines, only apollo has a wireless card which ATM is non-functional. In addition, the wired bits of my network are 100Mbps, with a g based wireless hotspot (WPA secured). Futhermore, blacksteel, helios, and siren have gigabyte ethernet. apollo has 100MBps ethernet card. alexandria and dawn have 10MBps, which is painful, especially for NFS root.

I'll drop another 1Gbps NIC into apollo, replacing its wireless card, and give dawn, alexandria, and maybe coldfusion USB based NICs once I get around to resurrecting systems (alexandria and coldfusion don't have hard drives at the moment)

What I would like to do is use an Linux-based router and replace Cerberus. Helios has two gigabyte NICs, so it will take up this duty, as well as provide DHCPv4, and radvd (for IPv6) for the internal network. It's an old computer, and has an onboard model, and its position in my apartment will be close to a phone jack; maybe I'll set it up so I can dial in from outside the LAN in case something goes down (although my phones here are VoIP based so I dunno how useful that's going to be :-)).

Another box (I might task this to apollo, or helios) will run LDAP and NFS services, providing both a netboot based installation with preseed for fast re-installation, and NFS home folders for all machines except blacksteel (unless someone knows a great solution for having a laptop sync NFS and local home folders. helios will run mail, news, and any other untrusted net facing services, with everything else shielded behind it. All machines will run IPv4 and 6.

Anyway, this is the start of my plan in a nutshell, and I intend to continue discussion as I slowly build and implement this updated setup. Wish me luck :-).

Since about 2002 I have been using a iPaQ [1] for taking notes while on the move. I have a pair of H3950 iPaQs that were given to me for the purpose of some software development work. As modern mobile phones have telephony as a small part of their feature set I think it s worth comparing a 2002 iPaQ with a 2009 mobile phone in terms of the note taking functionality. I have just got myself an LG U990 Viewty mobile phone [2]. It has a screen resolution of 240*320 which is the highest resolution that is remotely common for a mobile phone - and the same resolution as my 2002 model iPaQ. The LG KC910 Renoir has a resolution of 240*400 and seems to be the only phone that my carrier provides which has a higher resolution. The iPhone [3] has a resolution of 480*320. So it seems that the most expensive modern mobile phone that is available in Australia has a screen resolution that is only twice that of a 2002 PDA. I believe that in Japan you could buy a PDA with a higher resolution than 240*320 in 2002. My iPaQ is running Linux, so I can do whatever I want with it. I have a bar at the bottom of the screen with icons to launch, I configure it with the programs that I need most often and they are always one click away. While with my mobile phone I always have two large icons for paid services from my telco and I can t add icons for the things that I want. My iPaQ has a virtual keyboard that can be displayed in portrait or landscape mode. The above pictures show it in the portrait mode which allows the greatest area of screen space for text. The landscape mode is good for entering long lines of text even though the total number of words that can be displayed on screen is smaller. The size of my iPaQ is 134mm in height, between 77 and 84mm in width (it tapers) and 15.9mm thick without it s protective sleeve. The protective sleeve (shown in the second picture) adds about another 5mm to the width and thickness. My iPaQ is 1.76* the volume of my Viewty phone and at 184g vs 112g is 1.64* the mass. With it s sleeve on it is about 2.4* the volume. It s larger but with the sleeve it s a lot more solid, a touch-screen is very fragile so putting a touch-screen device in your back pocket without a sleeve is not a viable option. So I now own a mobile phone that has more storage, RAM, and CPU power than my iPaQ, but is less useful for the basic task of writing small documents and seems to have no facility for drawing diagrams. Most recent mobile phones have the ability to record voice (my Viewty can store 34 hours on it s internal storage and supports mini-SD cards for extra storage). But my Viewty lacks the ability to pause voice recording so if I wanted a series of notes during a meeting I would get a series of short voice recordings rather than a single file with many items. The todo list is also fairly poor in the Viewty, so even disregarding the poor keyboard on the touch-screen it would compare badly to the iPaQ. So it seems that an iPaQ that is almost seven years old when running Linux and the GPE Palmtop Environment [4] with with default configuration handily beats one of the latest and greatest mobile phones for all areas of common functionality. If the Viewty had it s source code available I would be tempted to contribute some patches (even if it was not free software). Finally, before someone suggests an Android [5], Greenphone [6] or other phone that s relatively open and programmable, I wanted a phone that had a good camera (by phone standards) and came essentially for free on an affordable contract. Maybe in two years time (when my current contract ends) there will be such a phone on offer. Mobile phones aren t THAT important to me, so while I would like to encourage the development of open telephony platforms it s a much lower priority than about a dozen free software projects. I expect that in the future something like an Android will become a great mobile phone with great PDA functionality. But for the moment I ll use an iPaQ and a Viewty.

• [1] http://en.wikipedia.org/wiki/Ipaq


• [2] http://en.wikipedia.org/wiki/Viewty


• [3] http://en.wikipedia.org/wiki/Iphone


• [4] http://gpe.handhelds.org/


• [5] http://en.wikipedia.org/wiki/Android_(operating_system)


• [6] http://en.wikipedia.org/wiki/Greenphone

(This post is somewhat late, the final release is in two days. However, we still need testing and reports of possible issues.) I am pleased to announce that darcs 2.2 is coming along nicely. I would like to ask everyone to give a ride to darcs 2.2, release candidate 1. This release again comes in two flavours:

1. The source tarball, http://repos.mornfall.net/darcs/darcs-2.2.0rc1.tar.gz, which can be built using the traditional autoconf-based buildsystem. This is the fully supported version. After downloading and unpacking, you can issue:

   $ ./configure
   $ make
   $ ./darcs --version
   

   or

   # make install
   

   More detailed instructions inside the tarball (file README).
2. Cabalised source. You can either download a tarball from http://repos.mornfall.net/darcs/darcs-2.1.99.0.tar.gz and build manually (see the build instructions in README inside the tarball), or, alternatively, you can use cabal-install to obtain a copy (the release candidate is now available on hackage):

   $ cabal update  
   $ cabal install darcs
   

   This should give you a darcs binary in ~/.cabal/bin you should probably add that to your PATH.

This is a preliminary changelog since version 2.1.2 (released last November):

• In interactive record, it is now possible to get a list of currently selected hunks (command l). (Christian Kellermann)
• It is now possible to specify --in-reply-to when using darcs send, to generate correct references in the mail header. (Pavel Shramov)
• New repositories with --no-pristine-tree can no longer be created. This only has effect on legacy darcs-1 repositories.
• Improvements in Windows support. (Salvatore Insalaco)
• Performance improvements in darcs repair and robustness improvements in darcs check. (Petr Ro kai)
• Extensive manual and online help improvements. (Trent W. Buck)
• Support for GHC 6.10.
• Overhaul of the make-based build system. (Trent W. Buck)
• Cabal is now supported as a build method for darcs. (Duncan Coutts, Petr Ro kai, Gwern Branwen)
• First stab at libdarcs when building through Cabal, all of darcs implementation is now exposed in modules. No API guarantees whatsoever. (Eric Kow)
• Additions to Haddock documentation of the existing darcs modules for improved development experience.
• Improvements in the testing infrastructure. (Christian Kellermann, Gwern Branwen)
• Low-level optimisations in filesystem code. (Ganesh Sittampalam)
• Numerous major and minor bug fixes, refactorings and cleanups by David Roundy, Eric Kow, Jason Dagit, Dmitry Kurochkin, Thorkil Naur, Salvatore Insalaco, Christian Kellerman, Florent Becker, Duncan Coutts, Reinier Lamers, Ganesh Sittampalam, Petr Ro kai.

Preliminary list of issues that have been fixed in darcs since version 2.1.2: 1223 sporadic init.sh test failure (2.1.1rc2+472)
525 amend-record => darcs patches show duplicate additions
1247 make TAGS is broken
1273 renameFile: does not exist (No such file or directory)
1165 get should print last gotten tag
1249 2.1.2 (+ 342 patches) local drive detection on Windows error
1238 wish: darcs help setpref should list all prefs
1199 Backup files darcs added after external merge
1043 pull => mergeAfterConflicting failed in geteff (2.0.2+)
1117 Whatsnew should warn on non-recorded files
1101 darcs send cc recipient not included in success message Thanks to Thorkil Naur for compiling this list. I would like to thank all contributors developers, testers, bystanders for helping darcs get along further. It s been hard times recently for darcs, as many of you probably know. Nevertheless, we are regaining confidence in future darcs development. No way are we going to leave darcs fall by the road. I am sure that this one time, I speak for everyone in our developer and user community.

After lot of development, I finally decided to release new testing release of Gammu. The biggest changes are in SMS daemon, which got lot of improvements and is now in separate binary gammu-smsd. It can log better (support for syslog and Windows Event Log has been added), it can work as a proper daemon or Windows Service, it can be debugged easier (Gammu logs go to same log as other messages, SQL queries can be logged), can reload configuration on the fly. In libGammu, debugging has also improved (you can now use callback to process messages), some memory leaks were fixed and some minor bugs has been fixed. Command line interface now supports text for text messages to be entered through parameter and not only using standard input, it has a new command chekfirmware which obsoletes UsePhoneDB configuration option and other bug fixes has happened, for example messages sending is now again working on Windows. And last but not least, SMS daemon, all related things and gammu configuration files now have man pages, which boosts documentation level from none to almost perfect ;-). As a special bonus for Czech users, Gammu translation is now more complete and all new man pages are translated to Czech. Full list of changes:

• Fix some memory leaks found by cppcheck.
• Fix unsafe sprintf usage in some modules.
• Improve debugging facilities to use state machine debug configuration when possible.
• Separate SMS daemon out of gammu binary.
• SMSD now requires [gammu] section in config file.
• UsePhoneDB option replaced by chekfirmware command.
• Added pkgconfig support for gsmsd (SMSD library).
• Debug logging can be handled by custom function in application.
• SMSD log now includes gammu log messages.
• SMSD now can log to syslog.
• SMSD can now deamonize itself.
• All callbacks can now pass user data along.
• SMSD can now write PID file.
• Added man pages for gammu-smsd(1), gammu-smsdrc(5) and gammurc(5).
• SMSD can now natively run as a Windows service (bug #451).
• SMSD debugging can be now enabled by DebugLevel directive.
• Proper reconnecting support for MySQL.
• Better error logging of PostgtreSQL SMSD service.
• SMSD now properly frees allocated memory.
• SMSD now handles SIGHUP for rereading configuration.
• Added LSB init script for SMSD.
• SMSD can now log to stderr/stdout.
• RunOnReceive now can get IDs of received messages.
• Avoid duplicating of same code in command line and tests for messages displaying.
• New binary gammu-smsd-inject to inject messages to SMSD.
• Gammu binary now does not support any SMSD operations.
• Sending TEXT message now accepts text using -text parameter.
• Improved logging differentiation of SMSD log messages.
• Properly remove messages from queue when sending fails (bug #778).
• Use own test handler instead of asserts.
• Separate gammu and libgammu messages, libgammu no longer sets textdomain.
• Use po4a for translating man pages.
• Dump more information in dct3trac, thanks to Duncan Salerno.
• SMSD cal log to Windows Event Log.
• Added man pages for SMSD backend services.
• Dropped static configuration files for MSVC, they were broken anyway and CMake now works good with MSVC.
• Script gammu-config supports also cdialog.
• Reduce stack usage on message composing (fixes crash on Windows).
• Fixed returned saved location on AT engine.
• Added support for dropping privileges in SMSD.

You can download from usual place: http://cihar.com/gammu/, Debian users will find packages in experimental as soon as they will go through NEW queue.

In June of 2005, I finished reading "The Professor and the Madman" by Simon Winchester, which is an intriguing story of two significant contributors to the Oxford English Dictionary, or OED. I first heard this book mentioned in an interview on the Charlie Rose show, and it sounded interesting, so I bought a paperback copy, and it was indeed an interesting read. I wrote these thoughts down then, but neglected to post them until now. That was likely in part because others beat me to the punch. In particular, I think I remember listening to a presentation by Nat Friedman on the topic at around that time. In any case, I stumbled today over the text I wrote back then, and thought the words were still worth sharing. The most interesting thing I learned in reading this book wasn't actually about the principal characters, but instead involves a speech given by Richard Chenevix Trench to the Philological Society, entitled "On Some Deficiencies in Our English Dictionaries." This is the talk that eventually led to the creation of the OED, and the intriguing bit to me is an idea Trench proposed that was new at the time, but absolutely fundamental to the Open Source & Linux world today. Trench well understood that an undertaking of such magnitude as compilation of an exhaustive dictionary of the English language, detailing the history and lifetime of each word illustrated with many example of usage from existing literature, could never be accomplished by one individual. Instead, he proposed explicitly involving a large group of unpaid volunteer contributors. Winchester claims that while this may sound obvious today, that this idea had never been put forward before for such an undertaking. Absolutely brilliant. As an up-close observer of the evolution of the community approach to software development and maintenance, I couldn't help but draw connections. We are today engaged in an equally grand effort that may well have an enduring impact, that fundamentally would not be possible to accomplish without the contributions of an astoundingly diverse array of unpaid volunteer contributors...

Some months ago, I got a phone call from Rafael Fern ndez Flores. He wanted to interview me for a book he was working on regarding the history of computers in Mexico. The first computer in Latin America was installed in 1958 at my University (UNAM), and last year there were several activities conmemorating it. One of said activities is the publication of the book Historias de la Historia del c mputo en m xico, by Rafael Fern ndez and Margarita Ontiveros.
The book was printed in November, and Rafael gave me my copy in early December. It is quite an entertaining read - I mostly enjoyed the archaeological parts of it, referring to the 1950s and 1960s, and with many people that I know first hand (as my father is one of the founding researchers of the Centro de Investigaci n en Matem ticas Aplicadas, Sistemas y Servicios, CIMASS, now IIMAS).
I do believe, anyway, the book is focused too heavily on what happened in the large-scale computer world during a fundamental point in time for me (late 1970s, early 1980s) - It shows that the authors were very involved in the important projects the University set foot on, but they overlook fundamental pieces of the history. Very important developments were made in smaller venues (it was shocking for me to find only one mention, and just as a reference, to Fundaci n Arturo Rosenblueth and its great Centros Galileo, where many hundreds of kids (me included) learned to love computers, to program, and had a thriving socialization place. I also missed mentions of the BBS scene in Mexico, for which there are various exponents. And, just to single out one person, I found it absurd to have me interviewed and not to include La Mancha de la Calabaza que Ladra.
One of the last chapters -there are over 40 chapters, stemming from over 30 individual interviews- publishes the talk I had with Rafael. I must say there are small errata in its transcription (the first example that comes to my mind: I told him that one of the fruits of the OLPC project was the appearance of the now-popular netbooks, partly due to the appearance of lower cost parts, but I must reiterate I didn't say the Asus EEE is a part of said project). You can I am attaching my interview (as scanned, low-res images) to this post, in case you are interested.
Anyway - If the topic interests you, you will find many interesting passages, many passages you will surely laugh with and probably remember. The book is very well laid out. And it is a great joy to be part of it!

I was happy to receive Dov Zamir s email announcing the creation of a fork of the DSPAM anti-spam filter, called dspam-community. I have been using DSPAM for a while now, and am very happy with it, but was quite anxious that the project is left out by Sensory Networks (the company took over DSPAM in May 2007). I give all my confidence in the fork as the original author, Jonathan Zdziarski, is part of the new development team! I have prepared EXPERIMENTAL packages of the first RC of DSPAM-Community.

These are only meant for testing and should not be used in a production environment! I haven t tested these packages in depth (only tested installation or upgrade from previous official/unofficial packages).
There might still be problems due to the new names. I have built packages for i386 and amd64 architectures. They are built against current unstable distribution. They might be used on Ubuntu, but I haven t tested this yet. I have setup a quick page for these packages. All the applied patches are available for review and possible merge into git: http://packages.kirya.net/dspam-community/debian-patches/ To use these packages, add these lines to your /etc/apt/sources.list: The repository uses secure-apt, you can hence check packages integrity thanks to my dedicated GPG key: or Fingerprint: 97A0 69D9 A150 687E 599F F168 EEFB 43B2 FBAB B737 Feel free to test the packages and the first DSPAM-Community RC.
Any comment is welcome! To the official DSPAM packaging team: feel free to take these packages as a basis for your work in case you are interested in packaging DSPAM-Community!

I was thrilled to be part of a successful Debian bug squashing party organized by MIT's Student Information Processing Board on December 13th. Greg Price, who helped organize the event, did a wonderful write up which he sent to the debian-devel email list. I though it was worth mentioning the BSP now because I think it's a wonderful model that I'd love to see replicated in Debian and beyond. The event was initiated, organized, run, and executed by people with little or no direct experience with the project. While the organizers went out of their way to recruit several Debian developers and other experts to the party, these experts' role was more in answering questions and helping others. The the majority of the participants -- around 30 of them in total -- had no previous experience doing Debian development. While the 11 bugs closed or dealt with are the most visible outcome, I'm not sure that it is the most important. The event acted as an important learning experience for everyone involved and, perhaps most centrally, an important first step for most participants from using free software to giving back and participating in the community. You don't need experience, connections, or a @project.org email address to organize a party like this for Debian or your own free software project. All you really need is a few people, some technical knowledge, an Internet connection, and the desire to make it happen. Other things can help, of course. In particular, the SIPB folks have packaged up some scripts they used to select bugs to work on and put them online.

The Copyrighting the Future: Keeping ahead of the game consultation finishes in a month s time (6 February). They actually called it that - copyrighting the future - can you believe it? In case you haven t seen it yet, this is the consultation that ignores the Gowers review findings and tries to start it all over again. Please respond and try to avoid term extension, DRM/TPM and other similar landmines. Any comments you can leave me to help us all would be very much appreciated!

(or echo "blosxom hold" sudo dpkg --set-selections) A few people had pointed out to me that my blog was appearing weirdly in Google Reader. I myself read my blog via Planet Debian and Planet Linux Australia, where it appears fine, so I hadn't noticed the problem first hand. I did some digging tonight with the Feed Validator, and I think I've figured it out. Funnily enough, it all started with a previous session with the Feed Validator... I wanted my blog to be UTF-8, with it being the new hotness and all. Blosxom was spitting it out as ISO-8859-1. I've just learned from this evening's debugging, that this is the behaviour of CGI.pm's header() function if not provided with the -charset parameter. I'd previously worked around this by defining my own content_type for the RSS and HTML flavours. In this file, I just put text/xml; charset=utf-8and text/html; charset=utf-8, respectively. Unfortunately, this then breaks Blosxom's internal HTML-escaping-for-RSS-feed code, which is conditional on the content type being XML:

if ($content_type =~ m \Wxml$ )  
        # Escape <, >, and &amp;, and to produce valid RSS
        my %escape = ('<'=>'&lt;', '>'=>'&gt;', '&'=&gt;'&', '"'=>'&quot;');  
        my $escape_re  = join ' ' => keys %escape;
        $title =~ s/($escape_re)/$escape $1 /g;
        $body =~ s/($escape_re)/$escape $1 /g;
       

This block of code was being ignored because the regex was anchored. "text/xml; charset=utf-8" didn't match "\Wxml$". Whenever I last had an attempt to make my blog's feed pass the Feed Validator, I must have edited the Blosxom source code to make this regex not be anchored. Then on November 11, 2008, I updated my Blosxom package to 2.0-14+etch1, to address CVE-2008-2236 (incidentally, there doesn't appear to be a Debian Security Advisory for this?), and my local modification got clobbered. That'll teach me to make local modifications and not put the package on hold. Blah. It seems I'm screwed, there's no way to have a well-formed UTF-8 RSS feed without requiring a source-code modification to Blosxom. I've either got to change the way the header() function is being called, or I've got to change the regex to allow me to specify a charset in the flavour file, and not disable HTML escaping. Speaking of screwed, Blosxom seems incapable of making a well-formed RSS 0.91 feed anyway. It wants to put the <pubDate> tag inside an <item>, which is a violation of the DTD. There's supposed to be one for the whole <channel>, not one per item (or "story" in Blosxom-flavour-speak). You can't just move that from the story flavour file to the head flavour file, because a pile of variables that you'd otherwise use seem to only get set on a per-story basis. Double blah. I'm starting to feel like Blosxom is outliving its usefulness, but I really do not feel like embarking on a wholesale move to a new blogging platform, I'm fairly entrenched.