Search Results: "ag"

6 February 2021

Andrew Cater: And here we go: Debian 10.8 images release testing process is under way

As is traditional, every three months or so: another Debian point release is being prepared today. This one is 10.8. As ever, not a huge amount of change if you've been updating your Debian machines regularly. CD/DVD/BluRay and other media files are all being produced today.
Images are gradually being built and rsync'ed: tests are under way and the ususal suspects are taking part. A couple of issues: thanks very much indeed to maswan for chasing up early problems with petersson. Some script changes behind the scenes over the last month or so should mean that the images are built significantly more in parallel and this may mean we finish the release process much more quickly today.

Dirk Eddelbuettel: RcppFastFloat 0.0.1: New Package, Already on CRAN

A new package, once again based on wonderful library by Daniel Lemire, is now on CRAN in its initial version 0.0.1. Daniel, in a recent arXiv paper shows that one can convert character representations of numbers into floating point at rates at or exceeding one gigabyte per second. His tests show a fourfold gain over library functions such as strtod. We put a simply package together showing use of the example parser, and containing a simple all-in comparison benchmark (where we time the function call overhead as well) and get roughly 3x. See the repo for details; we are borring the table and figure here: 
> source("comparison.R")
Unit: milliseconds
      expr      min       lq     mean   median       uq      max neval cld
     scanf 218.8936 224.1223 238.5650 227.1901 229.9116 1343.433   100   c
      atof 124.8087 127.3274 129.4104 128.5858 130.9138  146.334   100  b 
    strtod 124.5705 127.2157 129.1238 129.1042 130.7504  137.143   100  b 
      stod 127.1751 129.7343 131.7339 131.4854 133.1425  147.763   100  b 
 fastfloat  40.6219  41.3042  42.5729  42.3209  43.1738   57.788   100 a  
>
Or in chart form: Not much to say yet for the initial release:

Changes in version 0.0.1 (2021-01-31)
  • Initial version and CRAN upload

While the package was waiting to be added to CRAN, Brendan already added a potential as.double() replacement which will be in the next version. If you like this or other open-source work I do, you can now sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

5 February 2021

Thorsten Alteholz: My Debian Activities in January 2021

FTP master This month I could increase my activities in NEW again and accepted 132 packages. Unfortunately I also had to reject 12 packages. The overall number of packages that got accepted was 374. Debian LTS This was my seventy-ninth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 26h. During that time I did LTS and normal security uploads of: With the buster upload of highlight.js I could finish to fix CVE-2020-26237 in all releases. I also tried to fix one or the other CVE for golang packages, to be exact: golang-github-russellhaering-goxmldsig, golang-github-tidwall-match, golang-github-tidwall-gjson and golang-github-antchfx-xmlquery. The version in unstable is easily done by uploading a new upstream version after checking with ratt that all reverse-build-dependencies are still working. The next step will be to really upload all reverse-build-dependencies that need a new build. As the number of reverse-build-dependencies might be rather large, this needs to be done automatically somehow. The problem I am struggling with at the moment are packages that need to be rebuilt but the version in git already increased Another problem with golang packages are packages that are referenced by a Built-Using: line, but whose sources are not yet available on security-master. If this happens, the uploaded package will be automatically rejected. Unfortunately the rejection-email only contains the first missing package. So in order to reduce the hassle with such uploads, please send me the Built-Using:-line before the upload and I will import everything. In December/January this affected the uploads of influxdb and snapd. Last but not least I did some days of frontdesk duties. Debian ELTS This month was the thirty-first ELTS month. During my allocated time I uploaded: Last but not least I did some days of frontdesk duties. Other stuff This month I uploaded new upstream versions of: I improved packaging of: The golang packages here are basically ones with a missing source upload. For whatever reason maintainers tend to forget about this

4 February 2021

Ulrike Uhlig: On anger, misunderstandings, and hearing with different ears

Anger Anger is a feeling that is mostly taboo in our society. People tend to think that anger and rage are the same thing and reject anger. We are taught to suppress it. But: The suppression of anger can cause a lot of trouble, giving rise to virulent progeny such as malice, passive aggression, hostility, rage, sabotage, hate, blame, guilt, controlling behavior, shame, self-blame, and self-destruction. (Quoted from: Anne Katherine, Where to draw the line ). When we talk about anger, we need to distinguish between acting out anger, and feeling anger. In general, when you hear me talking about anger, I m talking about the feeling named anger in English. Anger is a normal feeling with a super power: it gives us the energy to change a situation that we consider to be unsustainable. We can express the feeling of anger verbally by saying for example: That thing makes me really angry , I can t talk right now, I am very angry about what I just heard . Let s also note that there may be other feelings lying below anger, such as sadness, frustration, grief, fear, etc. Mixing emotions This is a page from the wonderful Making Comics by Scott McCloud. (Yes, emotions are complex! See some more of Scott McCloud s pages about emotion in comics)

Bottling up feelings Most of the time, people don t get angry suddenly, even though it might seem like that from the outside. Instead, they ve been bottling up feelings for a while, and at some point, a small trigger is enough to make the bottle overflow. The reasons for bottling up feelings can be as diverse as people:
  • Low self-esteem: not thinking one has the right and the capacity to express unpleasant feelings
  • Not knowing how to express unpleasant feelings. For example not having learnt to say: I am not comfortable, I ll leave now, I ll get back to you once I know what s going on / if this is about me / if I feel like it.
  • Not trusting one s own feelings, specifically common in people who have been victims of gaslighting
  • Repressing emotions, specifically anger, sometimes to the point of not being able to feel one s own feelings anymore
  • Not being able to express disagreement and instead applying the fawn response: trying to please the other in order to avoid further conflict. See: Fight, flight, freeze, or fawn
  • Not being able to express boundaries: stop , this is enough , I don t accept this , etc.
  • Not being in a situation or a space in which feelings can be expressed freely, for example a workplace or a hierarchical situation where this might be disadvantageous
These are just some examples I can come up with in 3 minutes, the list is non exhaustive. When someone s bottle overflows, their peers can be confused and not know how to react to what they perceive as a sudden outburst while what they are seeing might just be the other person s first time tentative of saying no or stop . Oftentimes, the responsibility for the situation is then put on the shoulders of the person who supposedly exploded : they have been behaving differently than usual or not within the expectations, right? Well, it s not that simple. Conflicts are relational. The other party might have ignored signs, requests, feelings, and needs of the angry person for a while. Maybe the relationship has been deteriorating since some time? Maybe there was a power imbalance, that has never been revisited, updated, questioned? Or maybe their bottle is being filled by something else in their life and getting too small to contain all the drops of suppressed emotions. People change, and relationships change. We cannot assume that because a person has accepted something for months or years, that they always will. I think that anger can be a sign of such change or need thereof.

A message has four sides and that creates misunderstandings Friedemann Schulz von Thun has created a theory, the four-sides model, that establishes four facets of a message:
  • Fact: What is the message about?
  • Self-disclosure: What does the speaker reveal about herself (with or without intention)?
  • Relation: What is the speaker s relationship towards the receiver of the message?
  • Appeal: What does the speaker want to obtain?
Let me adapt Schulz von Thun s example to a situation that happened to me once: I came to a friend s house and I smelled some unknown thing when I entered the apartment. I asked: what s that smell? I actually never bake, so I don t know anything about whatever it is people put into cakes. I wanted to say: I don t know what that smell is, tell me what it is? She replied: You never like anything I do, my furniture gets criticized, my cake s not right, and you criticize me all the time. We ended up in such a big misunderstanding that I left her house 5 minutes after I arrived. With Schulz von Thun s model we can understand what happened here: The speaker s question What s that smell in the kitchen? has four sides:
  1. Factual: There is a smell.
  2. Self-disclosure: I don t know what it is.
  3. Relational: You know what it is.
  4. Appeal: Tell me what it is!
The receiver can hear the question with 4 different ears:
  1. Factual part: There is a smell.
  2. Self-disclosure: I don t like the smell.
  3. Relationship: You re not good at baking cake.
  4. Appeal: Don t bake cake anymore.
At this point, the receiver will probably reply: Bake the cake yourself next time!

Behind the message Sometimes, we hear more strongly with one ear than with the other ears. For example, some people hear more on the relational side and they will always hear You re not good at . Other people hear more on the appeal side and will always try to guess into a message what the other person wants or expects of them.

Form and contents of a message Getting back to anger, I think that it s often not the contents i.e. the factual facet of a message that triggers our bottle to overflow, but the (perceived) intention of the speaker, i.e. the appeal facet. For example, a speaker might have an intention to silence us by using gaslighting, or tone policing. Or a speaker wants to explicitly hurt us because that s how they learnt to deal with their own feelings of hurt. The actual relation between speaker and receiver also seems to play a role in how anger can get triggered, when we hear with the relational ear. There are many nonverbal underlying layers to our communication:
  • The position of both speaker and receiver to each other: are they equals or is there any kind of power imbalance between them? A power imbalance can be a (perceived) dependency: For example, one person in a friendship has a kid and the other one regularly helps them so that the parent has some time to advance their work or career: this can create a feeling of not being good enough by oneself and having to rely on others. Or there is indeed a dependency in which the speaker is a team lead and the receiver a subordinate.
  • The needs of each person: a need to solve problems quickly for one person might conflict with the need to be involved in decision making of the other person. (See Taibi Kahler s drivers)
  • The inner beliefs of each person: in childhood we might have constructed the inner belief: You re okay, I m not okay , or Nobody cares about what I want , or I have to be nice (friendly, hardworking, strong, etc.) all the time otherwise nobody loves me - as some examples.
So, suppose person A offers to help person B, and what person B hears instead is their overprotective mother instead of their friend. Person A might be surprised to see B overreact or disappear for a while to get back their feelings of autonomy and integrity as an adult. Or person C expresses she d like to handle problem X like this while person D might well not hear this as a proposal to handle a problem, but as a decision made without involving her. Which might propel D back to her childhood in which she could also not take decisions autonomously. Then D might react like she would react as a child, slamming a door, shout, run away, freeze, or fawn.

Communication is complex! So, whenever we hear a message, not only do we hear the message with four ears, but also, we hear it with our position, our needs, and our inner beliefs. And sometimes, our bottle is already full, and then it overflows. At that point, I find it important that both sides reflect on the situation and stay in contact. Using empathy and compassion, we can try to better understand what s going on, where we might have hurt the other person, for example, or what was being misunderstood. Did we hear only one side of the message? Do our respective strategies conflict with each other? If we cannot hear each other anymore or always hear only one side of the message, we can try to do a mediation. Obviously, if at that point one side does not actually want to solve the problem, or thinks it s not their problem, then there s not much we can do, and mediation would not help. The examples above might sound familiar to you. I chose them because I ve seen them happen around me often, and I understand them as shared patterns. While all beings on this planets are unique, we share a common humanity, for example through such patterns and common experiences.

John Goerzen: A Simple, Delay-Tolerant, Offline-Capable Mesh Network with Syncthing (+ optional NNCP)

A little while back, I spent a week in a remote area. It had no Internet and no cell phone coverage. Sometimes, I would drive in to town where there was a signal to get messages, upload photos, and so forth. I had to take several devices with me: my phone, my wife s, maybe a laptop or a tablet too. It seemed there should have been a better way. And there is. I ll use this example to talk about a mesh network, but it could just as well apply to people wanting to communicate on a 12-hour flight that has no in-flight wifi, or spacecraft with an intermittent connection, or a person traveling. Syncthing makes a wonderful solution for things like these. Here are some interesting things about Syncthing: Syncthing works by having you define devices and folders. You can choose which devices to share folders with. A shared folder has an ID that is unique across Sycnthing. You can share a folder from device A to device B, and then device B can share it with device C, even if A and C don t know about each other or have no way to communicate. More commonly, though, all the devices would know about each other and will opportunistically communicate the best way they can. Syncthing uses something akin to a Bittorrent protocol. Say you re syncing videos from your phone, and they re going to 3 machines. It doesn t mean that Syncthing has to send it three times from the phone. Syncthing will send each block, most likely, just once; the other nodes in the swarm will register the block availability from the first other node to get it and will exchange blocks with themselves. Syncthing will typically look for devices on the local LAN. Failing that, it will use an introduction server to see if it can reach them directly using P2P. Failing that, perhaps due to restrictive firewalls or NAT, communication can be relayed through volunteer-run Syncthing servers on the Internet. All Syncthing communications are cryptographically encrypted and verified. You can also configure Syncthing arbitrarily; for instance, to run over ssh or Tor tunnels. So, let s look at how Syncthing might help with the example I laid out up front. All the devices at the remote location could communicate with each other. The Android app is quite capable of syncing photos and videos using Syncthing, for instance. Then one device could be taken to the Internet location and it would transmit data on behalf of all the others perhaps back to a computer at your home, or to a server somewhere. Perhaps a script running on the remote server would then move files out of the syncthing synced folder into permanent storage elsewhere, triggering a deletion to be sent to the phone to free up storage. When the phone gets back to the other devices, the deletion can be propagated to them to free up storage there too. Or maybe you have a computer out in a shed or somewhere without Internet access that you go to periodically, and need to get files to it. Again, your phone could be a carrier. Taking it a step further If you envision a file as a packet, you could, conceivably, do something like tunnel TCP/IP over Syncthing, assuming generous-enough timeouts. It can truly handle communication. But you don t need TCP/IP for this. Consider some other things you could do: You can start to see how there are a lot of possibilities here that extend beyond just file synchronization, though they are built upon a file synchronization tool. Enter NNCP Let s look at a tool that s especially suited for this: NNCP, which I ve been writing about a lot lately. NNCP is designed to handle file exchange and remote execution with remote computers in an asynchronous, store-and-forward manner. NNCP packets are themselves encrypted and authenticated. NNCP traditionally is source-routed (that is, you configure it so that machine A reaches machine D by relaying through B and C), and the packets are onion-routed. NNCP packets can be exchanged by a TCP call, a tar-like stream, copying files to something like a USB stick and physically transporting it to the remote, etc. This works really well and I ve been using it myself. But it gets complicated if the network topology isn t fixed; it is difficult to reroute packets due to the onion routing, for instance. There are various workarounds that could be used but why not just use Syncthing as a transport in those cases? nncp-xfer is the command that exchanges packets by writing them to, and reading them from, a directory. It is what you d use to exchange packets on a USB stick. And what you d use to exchange packets via Syncthing. It writes packets in a RECIPIENT/SENDER/PACKET directory structure, so it is perfectly fine to have multiple systems exchanging packets in a single Syncthing synced folder tree. This structure also allows leaf nodes to only carry the particular packets they re interested in. The packets are all encrypted, so they can be freely synced wherever. Since Syncthing opportunistically syncs a shared folder with any device the folder is shared with, a phone could very easily be the NNCP transport, even if it has no idea what NNCP is. It could carry NNCP packets back and forth between sites, or to the Internet, or whatever. NNCP supports file transmission, file request, and remote execution, all subject to controls, of course. It is easy to integrate with Exim or Postfix to use as a mail transport, Git transport, and so forth. I use it for backups. It would be quite easy to have it send those backups (encrypted zfs send) via nncp-xfer to Syncthing instead of the usual method, and then if I ve shared the Syncthing folder with my phone, all I need to do is bring the phone into Internet range and they get sent. nncp-xfer will normally remove the packets out of the xfer directory as it ingests them, so the space will only be consumed on the phone (and laptop) until we know the packets made it to their destination. Pretty slick, eh?

2 February 2021

Jonathan Carter: Free Software Activities 2021-01

Yikes, my head is still spinning from what a crazy month January was. Only managed to squeeze in a few uploads. I ve also been working on an annual DPL summary that I got to about 80% in December and was barely able to touch it during January, might end up simplifying it just so that I can get it released. In the meantime there s a lot of interesting stuff happening, stay tuned :) 2021-01-08: Sponsor package python-strictyaml (1.1.1-1) for Debian unstable (Python team request). 2021-01-12: Sponsor package buildbot (2.10.0-1) for Debian unstable (Python team request). 2021-01-12: Sponsor package peewee (3.14.0+dfsg-2) for Debian unstable (Python team request). 2021-01-12: Sponsor package crashtest (0.3.1-1) for Debian unstable (Python team request). 2021-01-12: Sponsor package sqlobject (3.9.0+dfsg-1) for Debian unstable (Python team request). 2021-01-12: Upload package kpmcore (29.12.1-1) to Debian unstable. 2021-01-12: Upload package xabacus (8.3.2-1) to Debian unstable. 2021-01-13: Upload package partitionmanager (20.12.1-1) to Debian unstable. 2021-01-13: Review package clikit (Waiting on dependencies) (Python team request). 2021-01-26: Upload package gdisk (1.0.6-1) to Debian unstable.

1 February 2021

Raphaël Hertzog: Debian on Thinkpad T14

I switched my main computer and this time I opted for Lenovo s Thinkpad T14 that comes with an AMD Processor. It s the first time that I have 8 cores in my laptop with this AMD Ryzen 7 PRO 4750U CPU and it gives a real performance boost together with the 32GB of RAM. Despite the fact that it s a laptop I use it mainly on my desktop where it s now connected to the USB-C Dock Gen2 so that I can connect it with a single USB-C cable to power/ethernet/keyboard/mouse and two external displays. I use the display port output and I had some hiccups with the HDMI output where the screen would become blank for a few seconds The Linux support of this hardware is rather good so far but I went through a few hiccups when I started using it, in particular I m not sure what made the external display work as they were not working after the initial install but they ended up working after installing all the packages that I had on my former computer. But the suspend/resume works fine even when you unplug the laptop from the dock with the lid closed. It might be seen as a given but the suspend/resume was broken on my old X260 (at least on recent kernels, I was able to keep using Linux 4.19 where it worked). I tried to document relevant information in the wiki, have a look at https://wiki.debian.org/InstallingDebianOn/Thinkpad/T14 and I have uploaded a Linux hardware database probe if you want to look the gory details including the firmware version that I upgraded to before starting any setup.

Utkarsh Gupta: FOSS Activites in January 2021

Here s my (sixteenth) monthly update about the activities I ve done in the F/L/OSS world.

Debian
This was my 25th month of contributing to Debian. I became a DM in late March 2019 and a DD on Christmas 19! \o/ This month was bat-shit crazy. Why? We ll come to it later, probably 15th of this month?
Anyway, besides being crazy, hectic, adventerous, and the first of 2021, this month I was super-insanely busy. With what? Hm, more about this later this month! ^_^ However, I still did some Debian stuff here and there. Here are the following things I worked on:

Uploads and bug fixes:

Other $things:
  • Attended the Debian Ruby team meeting.
  • Mentoring for newcomers.
  • Moderation of -project mailing list.
  • Sponsored golang-github-gorilla-css for Fedrico.

Debian (E)LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group of volunteers and companies interested in making it a success. And Debian Extended LTS (ELTS) is its sister project, extending support to the Jessie release (+2 years after LTS support). This was my sixteenth month as a Debian LTS and seventh month as a Debian ELTS paid contributor.
I was assigned 26.00 hours for LTS and 36.75 hours for ELTS and worked on the following things:
(however, I worked extra for 9 hours for LTS and 9 hours for ELTS this month, which I intend to balance from the next month!)

LTS CVE Fixes and Announcements:

ELTS CVE Fixes and Announcements:

Other (E)LTS Work:
  • Front-desk duty from 28-12 until 03-01 and from 25-01 until 31-01 for both LTS and ELTS.
  • Triaged dropbear, gst-plugins-bad1.0, phpmyadmin, qemu, firefox-esr, thunderbird, openldap, libdatetime-timezone-perl, tzdata, jasper, ckeditor, liblivemedia, wavpack, and ruby-redcarpet.
  • Marked CVE-2019-12953/dropbear as postponed for jessie.
  • Marked CVE-2019-12953/dropbear as postponed for stretch.
  • Marked CVE-2018-19841/wavpack as not-affected for jessie.
  • Marked CVE-2019-1010315/wavpack as not-affected for jessie.
  • Marked CVE-2019-1010317/wavpack as not-affected for jessie.
  • Marked CVE-2021-21252/phpmyadmin as no-dsa for stretch.
  • Marked CVE-2021-20196/qemu as postponed for stretch.
  • Marked CVE-2021-21252/phpmyadmin as no-dsa for jessie.
  • Marked CVE-2021-20196/qemu as postponed for jessie.
  • Marked CVE-2020-11947/qemu as postponed for jessie.
  • Marked CVE-2021-3326/glibc as no-dsa for jessie.
  • Marked CVE-2021-3326/glibc as no-dsa for stretch.
  • Marked CVE-2020-35517/qemu as not-affected instead of postponed for jessie.
  • Marked CVE-2021-2627 1,2 /ckeditor as postponed for jessie.
  • Marked CVE-2020-24027/liblivemedia as no-dsa for stretch.
  • Marked CVE-2021-2627 1,2 /ckeditor as postponed for stretch.
  • Auto EOL ed csync2, firefox-esr, linux, thunderbird, collabtive, activemq, and xen for jessie.
  • Got my first ever CVE assigned - CVE-2021-3181 for mutt. Weeeehooooo! \o/
  • Attended the monthly LTS meeting. Logs here.
  • General discussion on LTS private and public mailing list.

Interesting Bits!
  • This January, on 23rd and 24th, we had Mini DebConf India 2021 online.
    I had a talk as well, titled, Why Point Releases are important and how you can help prepare them?". It was a fun and a very short talk, where I just list out the reasons and ways to help in the preparation of point releases . I did some experimentation with this talk, figuring out what works for the audience and what doesn t and where can I improve for the next time I talk about this topic! \o/
    You can listen to the talk here and let me know if you have any feedback! Anyway, the conference lasted for 2 days and I also did some volunteering (talk director, talk miester) in Hindi and English, both! It was all so fun and new. Anyway, here s the picture we took:
  • In another exciting news, I got my first CVE assigned!!! \o/
    No, it is not something that I found, it was discovered by Tavis Ormandy. I just assigned this a CVE ID, CVE-2021-3181.
    This is my first, so I am very excited about this! ^_^
  • Besides, there s something more that is in the pipelines. Can t talk about it now, shh. But hopefully very sooooooon!

Other $things! \o/ This month was tiresome, with most of the time being spent on the Debian stuff, I did very little work outside it, really. The issues and patches that I sent are:
  • Issue #700 for redcarpet, asking for a reproducer for CVE-2020-26298 and some additional patch related queries.
  • Issue #7 for in-parallel, asking them to not use relative paths for tests.
  • Issue #8 for in-parallel, reporting a test failure for the library.
  • Issue #2 for rake-ant, asking them to bump their dependencies to a newer version.
  • PR #3 for rake-ant, bumping the dependencies to a newer version, fixing the above issue, heh.
  • Issue #4 for rake-ant, requesting to drop git from their gemspec.
  • PR #5 for rake-ant, dropping git from gemspec, fixing the above issue, heh.
  • Issue #95 for WavPack, asking for a review of past security vulnerabilites wrt v4.70.0.
  • Reviewed PR #128 for ruby-openid, addressing the past regression with CVE fix merge.
  • Reviewed PR #63 for cocoapods-acknowledgements, updating redcarpet to v3.5.1, as a safety measure due to recently discovered vulnerability.
  • Issue #1331 for bottle, asking for relevant commits for CVE-2020-28473 and clarifying other things.
  • Issue #5 for em-redis, reporting test failures on IPv6-only build machines.
  • Issue #939 for eventmachine, reporting test failures for em-redis on IPv6-only build machines.
Until next time.
:wq for today.

Bits from Debian: Arduino is back on Debian

The Debian Electronics Team is happy to announce that the latest version of Arduino, probably the most widespread platform for programming AVR micro-controllers, is now packaged and uploaded onto Debian unstable. The last version of Arduino that was readily available in Debian was 1.0.5, which dates back to 2013. It's been years of trying and failing but finally, after a great months-long effort from Carsten Schoenert and Rock Storm, we have got a working package for the latest Arduino. After over 7 years now, users will be able to install the Arduino IDE as easy as "apt install arduino" again. "The purpose of this post is not just to announce this new upload but actually more of a request for testing" said Rock Storm. " The title could very well be WANTED: Beta Testers for Arduino (dead or alive :P).". The Debian Electronics Team would appreciate if anyone with the tools and knowledge for it could give the package a try and let us know if he/she finds any issues with it. With this post we thank the Debian Electronics Team and all previous contributors to the package. This feat would have not been achievable without them.

Junichi Uekawa: When I am doing video conference size of window becomes important.

When I am doing video conference size of window becomes important. When the window is too large the remote participant can't see what I'm seeing. It seems like the sweet spot is around 1280x720 these days, because people may have higher resolution displays but they don't typically see your window fullscreen. But it isn't obvious unless you happen to use a window manager that shows you. I've created a web page that shows the inner and outer metrics. So that I can tell.

31 January 2021

Paul Wise: FLOSS Activities January 2021

Focus This month I didn't have any particular focus. I just worked on issues in my info bubble.

Changes

Issues

Review

Administration
  • Debian ports: fix header on incoming.ports.d.o/buildd
  • Debian wiki: unblock IP addresses, approve accounts

Communication
  • Initiate discussions about aptly, Linux USB gadgets maintenance
  • Respond to queries from Debian users and contributors on the mailing lists and IRC
  • Invite organisations to post on FOSSjobs

Sponsors The samba work, apt-listchanges work, pytest-rerunfailures upload, python-testfixtures/python-scrapy bugs and python-scrapy related backports were sponsored by my employer. All other work was done on a volunteer basis.

Sean Whitton: gemini:// space

Recently I have become curious about the Gemini Project and the content that people have made available to be retrieved over the gemini:// protocol. I m not convinced by the arguments for not just using http, and mostly it s just that I typically find more things that I am interested in casually reading through on people s gemlogs than I would on, say, reddit, and similar aggregators. But presumably advocates of gemini:// and the text/gemini format would argue that it s various respects in which it differs from the web that makes geminispace conducive to the production of the sort of content you find there. So I m remaining open minded about the possibility that having a completely separate protocol is important, and not just an annoyance because rss2email doesn t work and I had to spend time writing gmi2email. I now have a games console at home for the first time in some years, which I bought in response to the ongoing pandemic, and one thing that I have noticed is that using it feels like being offline in a way that playing games on a regular computer never would. It has a WiFi connection but it doesn t have a web browser, and I am glad that using it provides an opportunity to be disconnected from the usual streams of information. And perhaps something similar ought to be said in favour of how the Gemini project does not just use http. There is, perhaps, a positive psychological effect induced by making the boundary between text/gemini and the web as hard as it is made by using gemini:// rather than http. Something about which I find myself much more sceptical is how the specification for gemini:// and text/gemini is not extensible. Advocates of Gemini have this idea that they can t include, say, a version number in the protocol, because the extensibility of the web is what has led to the problems they think it has, so they want to make it impossible. Now on the one hand perhaps the people behind Gemini are in the best position that anyone is in to come up with a spec which they will finalise and render effectively unchangeable, because a lot of them have been using Gopher for decades, and so they have enough experience to be able to say exactly what Gopher is missing, and be confident that they ve not missed anything. But on the other hand, Gemini is one technological piece in attempts to make a version of the Internet which is healthier for humans the so-called small Internet movement and maybe there will be new ideas about how the small Internet should be which would benefit from a new version of the Gemini specification. So it seems risky to lock-in to one version. Comments on Hacker News.

Chris Lamb: Free software activities in January 2021

Here is my monthly update covering what I have been doing in the free software world during January 2021 (previous month):

Reproducible Builds One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes. The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised. This month, I:
I also made the following changes to diffoscope, our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues, releasing version 164, version 165 and version 166 as well as triaging and merging many contributions from others:

Debian Uploads Debian LTS This month I worked 18 hours on Debian Long Term Support (LTS) and 12 hours on its sister Extended LTS project. You can find out more about the project via the following video:

John Goerzen: The Hidden Drawbacks of P2P (And a Defense of Signal)

Not long ago, I posted a roundup of secure messengers with off-the-grid capabilities. Some conversation followed, which led me to consider some of the problems with P2P protocols. P2P and Privacy Brave adopting IPFS has driven a lot of buzz lately. IPFS is essentially a decentralized, distributed web. This concept has a lot of promise. But take a look at the IPFS privacy document. Some things to highlight: So in this case, you have traded giving information about what you request to specific sites to giving it to potentially hundreds of untrusted peers, some of which may be logging this for nefarious purposes. Worse, you have a durable PeerID that can be used for tracking and tied to your IP address a data collector s dream. This PeerID, combined with DHT requests and the CIDs (Content ID) of the things you host (implying you viewed them in the past), can be used to establish a picture of what you are requesting now and requested recently. Similar can be said from everything like Scuttlebutt to GNU Jami; any service that operates on a P2P basis will likely reveal your IP, and tie your identity to it (and your IP address history). In some cases, as with Jami, this would be limited to friends you add; in others, as with Scuttlebutt and IPFS, it could be revealed to anyone. The advantages of P2P are undeniable and profound, but few are effectively addressing the privacy implications. The one I know of that is, Briar, routes all traffic over Tor; every node is reached by a Tor onion service. Federation: somewhat better In a federated model, every client connects to a server, and there are many servers participating in a federation with each other. Matrix and Mastodon are examples of a federated model. In this scenario, only one server your own homeserver can track you by IP. End-to-end encryption is certainly possible in a federated model, and Matrix supports it. This does give a third party (the specific server you use) knowledge of your IP, but that knowledge can be significantly limited. A downside of this approach is that if your particular homeserver is down, you are unable to communicate. Truly decentralized P2P solutions don t have that problem thought they do have a related one, which is that clients communicating with each other must both be online simultaneously in order for messages to be transmitted, and this can be a real challenge for mobile devices. Centralization and Signal Signal is centralized; it has one central server farm, and if it is down, you can t communicate or choose any other server, either. We saw it go down recently after Elon Musk mentioned it. Still, I recommend Signal for the general public. Here s why. Signal brings encryption and privacy to meet people where they re at, not the other way around. People don t have to choose a server, it can automatically recognize contacts that use Signal, it has emojis, attachments, secure voice and video calling, and (aside from the Musk incident), it all just works. It feels like, and is, a polished, modern experience with the bells and whistles people are used to. I m a huge fan of Matrix (aka Element) and even run my own instance. It has huge promise. But it is Not. There. Yet. Why do I saw this about Matrix? Again, I love MAtrix. I use it every day to interact with Matrix, IRC, Slack, and Discord channels. It has a ton of promise. But would I count on it to carry a my car s broken down and I m stranded message? No. How about some of the other options out there? I mentioned Briar above. It s fantastic and its offline options are novel and promising. But in common usage, it can t deliver a message unless both devices are online simultaneously, and doesn t run on iOS (though both are being worked on). It also can t send photos or do voice or video calling. Some of these same limitations apply to most of the other Signal alternatives also. either that, or they are encryption-optional, or terribly hard to set up and use. I recently mentioned Status, which shows a ton of promise, but has no voice or video calling capabilities. Scuttlebutt is a fantastic protocol with extremely difficult onboarding (lengthy process, error-prone finding a pub, multi-GB initial download, etc.) And many of these leak IP addresses as discussed above. So Signal gives people: If you are going to tell someone, it s so EASY to get your texts away from Facebook and AT&T , then Signal is the thing you ve got to point them to. It may not be in two years, but for now, it is. Do not let the perfect be the enemy of the good. It advances the status quo without harming usability, which nothing else does yet. I am aware of all of the very legitimate criticisms of Signal. They are real and they are why I am excited that there are so many alternatives with promise, some of which I use actively. Let us technical people use, debug, contribute to, and evangelize the alternatives. And while we re doing that, tell Grandma to contact us on Signal.

30 January 2021

Dirk Eddelbuettel: RcppDate 0.0.2: Regular Update

RcppDate wraps the date library by Howard Hinnant for use with R. This header-only modern C++ library has been in pretty wide-spread use for a while now, and adds to C++11/C++14/C++17 what will be (with minor modifications) the date library in C++20. Since the original 0.0.1 CRAN release I have also added this package along with RcppCCTZ and nanotime (which uses / requires both) to Debian so an apt based install is also possible for some. Release 0.0.2 arrived on CRAN yesterday. It simply updates the included library to version upstream version 3.0.0, and touches up some packaging internals for continued integration.

Changes in version 0.0.2 (2021-01-29)
  • Added GitHub Actions CI via run.sh from r-ci
  • Updated to upstream version 3.0.0 (plus newer commits)

If you like this or other open-source work I do, you can now sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Sylvain Beucler: Android SDK 11 Rebuild

Android Rebuilds provides freely-licensed builds of Android development tools from a Mountain View-based company.
Proprietary binaries are rebuilt from source, build recipes are reverse-engineered. SDK 11 (API 30) is mostly available, as unattended Docker build scripts, build documentation as well as convenience binaries.
Only the x86 system image currently fails to build.

Reproducible Builds (diffoscope): diffoscope 166 released

The diffoscope maintainers are pleased to announce the release of diffoscope version 166. This version includes the following changes: 
[ Chris Lamb ]
* New features and bugfixes:
  - Explicitly remove our top-level temporary directory.
    (Closes: #981123, reproducible-builds/diffoscope#234)
  - Increase fuzzy matching threshold to 130 ensure that we show more
    differences. (Closes: reproducible-builds/diffoscope#232)
  - Save our sys.argv in our top-level temporary directory in case it
    helps debug current/errant temporary directories.
  - Prefer to use "magic.Magic" over the "magic.open" compatibility
    interface. (Closes: reproducible-builds/diffoscope#236)
  - Reduce fuzzy threshold to 110 to prevent some test failures.
    (Closes: reproducible-builds/diffoscope#233)
* Output improvements:
  - Show fuzzyness amount in percentage terms, not out of the
    rather-arbitrary "400".
  - Improve the logging of fuzzy matching.
  - Print the free space in our temporary directory when we create it, not
    from within diffoscope.main.
* Codebase improvements:
  - Tidy the diffoscopecomparators.utils.fuzzy module.
  - Update my copyright years.
  - Clarify the grammar of a comment.
  - Clarify in a comment that __del__ is not always called, so temporary
    directories are not neccessary removed the *moment* they go out of scope.
[ Conrad Ratschan ]
* Fix U-Boot Flattened Image Tree ("FIT") image detection for larger image
  files. (MR: reproducible-builds/diffoscope!75)
You find out more by visiting the project homepage.

29 January 2021

Jamie McClelland: So... is Signal good or bad?

After Facebook updated their Whatsapp privacy policy, and a certain rich capitalist who doesn't like Facebook for reasons different then mine told the world to use Signal, Signal's downloads went up by 4,200%. As often happens when something becomes popular, the criticisms start to fly! For the record, I currently think promoting Signal is an important tactical strategy for the left. [I also think we should promote and install federated chat apps like conversations and element and delta chat whereever it is possible.] Here are some of the main criticisms I hear that I think are a distraction: Here are some criticisms that I think are nuanced: These last two are not exactly two sides of the same coin, but they are related. How Signal manages to balance privacy and protection from abuse will be the real test as to whether promoting Signal continues to be a useful strategy for the left.

Jonathan McDowell: Working better with an online whiteboard

LCD Writing Tablet One of the challenges I find about being fully remote is that one of the ways I think while I explain things is I draw diagrams. I m not artistic in any manner (my brothers got that skillset), but a set of boxes and lines and some text scribbled as I talk really helps. I do think even for myself, which is obviously as easy to replicate at home as in the office; I have plenty of paper and a whiteboard in my study. It s not so easy when having a design discussion with someone remotely. Doodling with a mouse doesn t quite work; my art skills are bad enough without then factoring in the fact it s not a pen-like device I m using to do it. I ve previously tried a proper graphics tablet, but there s a disconnect between where you are writing and where the output appears. That makes doing things like labelling within a diagram, or going back to draw an update, quite difficult. Or it does if you re me anyway. The modern solution is probably a laptop with a stylus capable touchscreen, but I ve shied away from such things because I don t want fingerprints all over my screen and don t want to pay extra for something I haven t previously thought I d use. An alternative is a tablet with a stylus capable screen, but those turn out to be premium models these days (remember when resistive was the cheap option because no one wanted to use the stylus?) and mine doesn t support it. You can get capacitive styli (styluses?) but then when you lean on the tablet it all gets confused. When I m due a technology refresh of my laptop or tablet I ll perhaps factor such things in, but what to do now, when I m not entirely sure how much usage I ll get out of such a device and thus can t justify a major expense on it? Buy a random thing from the internet, of course! It turns out there are a range of LCD writing tablets out there, which let you scribble on a screen and then erase it at the press of a button. An electronic etch-a-sketch, as it were. Most of them don t count as smart , with power only needed for the erase, but there appears to have been a device called the Boogie Board Sync in the past which offered some ability to save things. Searching around I found the NEWYES 10 Bluetooth Archive Writing Tablet from BangGood. Which looked like it had enough smarts to be able to send the images over bluetooth and therefore might be hackable in some manner. At 45 it seemed a reasonable punt, so I ordered one. It arrived within 2 weeks and I was surprised to find that when plugged in as a USB device it actually presented as a tablet. So much for a hackery requirement! It was detected by the kernel fine:
kernel dmesg output 
usb 1-1.2: new full-speed USB device number 19 using xhci_hcd
usb 1-1.2: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice=30.00
usb 1-1.2: New USB device strings: Mfr=5, Product=6, SerialNumber=0
usb 1-1.2: Product: LetSketch
usb 1-1.2: Manufacturer: LetSketch
hid-generic 0003:6161:4D15.0010: hiddev0,hidraw4: USB HID v1.11 Device [LetSketch LetSketch] on usb-0000:00:14.0-1.2/input0
input: LetSketch LetSketch as /devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1.2/1-1.2:1.1/0003:6161:4D15.0011/input/input35
hid-generic 0003:6161:4D15.0011: input,hidraw5: USB HID v1.11 Device [LetSketch LetSketch] on usb-0000:00:14.0-1.2/input1
lsusb output 
Bus 001 Device 016: ID 6161:4d15  
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x6161 
  idProduct          0x4d15 
  bcdDevice           30.00
  iManufacturer           5 LetSketch
  iProduct                6 LetSketch
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x003b
    bNumInterfaces          2
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              480mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      2 Mouse
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      18
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               2
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      2 Mouse
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      83
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               2
Device Status:     0x0003
  Self Powered
  Remote Wakeup Enabled
Nice. X wasn t happy though:
non-working Xorg log 
(II) config/udev: Adding input device LetSketch LetSketch (/dev/input/event8)
(**) LetSketch LetSketch: Applying InputClass "libinput tablet catchall"
(II) Using input driver 'libinput' for 'LetSketch LetSketch'
(II) systemd-logind: got fd for /dev/input/event8 13:72 fd 34 paused 0
(**) LetSketch LetSketch: always reports core events
(**) Option "Device" "/dev/input/event8"
(**) Option "_source" "server/udev"
(II) event8  - LetSketch LetSketch: is tagged by udev as: Tablet
(EE) event8  - LetSketch LetSketch: libinput bug: missing tablet capabilities: resolution. Ignoring this device.
(II) event8  - LetSketch LetSketch: device is a tablet
(II) event8  - failed to create input device '/dev/input/event8'.
(EE) libinput: LetSketch LetSketch: Failed to create a device for /dev/input/event8
(EE) PreInit returned 2 for "LetSketch LetSketch"
(II) UnloadModule: "libinput"
I ended up digging into the libinput source to figure out what was going on here, and it turned out to be the fact there was no report of the physical size of the tablet, so no indication of what the resolution was. That s solvable with an entry in the udev hwdb for evdev devices, so I sent a patch upstream and with that applied (or just dropped into /etc/udev/hwdb.d/61-evdev-local.hwdb and then running systemd-hwdb update and replugging the device) everything looks much happier:
working Xorg log 
(II) config/udev: Adding input device LetSketch LetSketch (/dev/input/event8)
(**) LetSketch LetSketch: Applying InputClass "libinput tablet catchall"
(II) Using input driver 'libinput' for 'LetSketch LetSketch'
(II) systemd-logind: got fd for /dev/input/event8 13:72 fd 86 paused 0
(**) LetSketch LetSketch: always reports core events
(**) Option "Device" "/dev/input/event8"
(**) Option "_source" "server/udev"
(II) event8  - LetSketch LetSketch: is tagged by udev as: Tablet
(II) event8  - LetSketch LetSketch: tablet 'LetSketch LetSketch' unknown to libwacom
(II) event8  - LetSketch LetSketch: device is a tablet
(II) event8  - LetSketch LetSketch: device removed
(**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:08.1/0000:04:00.3/usb1/1-1/1-1.2/1-1.2:1.1/0003:6161:4D15.000A/input/input24/event8"
(II) XINPUT: Adding extended input device "LetSketch LetSketch" (type: TABLET, id 20)
(II) event8  - LetSketch LetSketch: is tagged by udev as: Tablet
(II) event8  - LetSketch LetSketch: tablet 'LetSketch LetSketch' unknown to libwacom
(II) event8  - LetSketch LetSketch: device is a tablet
(II) libinput: LetSketch LetSketch: needs a virtual subdevice
(**) LetSketch LetSketch Pen (0): Applying InputClass "libinput tablet catchall"
(II) Using input driver 'libinput' for 'LetSketch LetSketch Pen (0)'
(II) systemd-logind: returning pre-existing fd for /dev/input/event8 13:72
(**) LetSketch LetSketch Pen (0): always reports core events
(**) Option "Device" "/dev/input/event8"
(**) Option "_source" "_driver/libinput"
(II) libinput: LetSketch LetSketch Pen (0): is a virtual subdevice
(**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:08.1/0000:04:00.3/usb1/1-1/1-1.2/1-1.2:1.1/0003:6161:4D15.000A/input/input24/event8"
(II) XINPUT: Adding extended input device "LetSketch LetSketch Pen (0)" (type: STYLUS, id 21)
(**) Option "AccelerationScheme" "none"
(**) LetSketch LetSketch Pen (0): (accel) selected scheme none/0
(**) LetSketch LetSketch Pen (0): (accel) acceleration factor: 2.000
(**) LetSketch LetSketch Pen (0): (accel) acceleration threshold: 4
The only additional piece I ve done is tie the tablet to a single screen, so I can then full screen whichever whiteboard system I m using on that screen and have it map to the tablet - haven t worked out how to tie it to just the application window yet, but the fullscreen approach works fine, using my smaller laptop screen. To do that I use xinput list to figure out the ID of the tablet and then xinput map-to-output 23 eDP-1 to map it to the eDP-1 output (the internal laptop screen), assuming the ID that comes out of the list is 23. But is it any good? Well, the quality of the screen isn t fantastic - no fine art or anything here - but the tablet part seems fine (complete with some pressure sensitivity) and the fact I can see what I ve drawn where I m trying to draw something new makes it a lot more useful for me. I ve had a play with just screen sharing the GIMP and doodling in that, but equally work has an O365 subscription and the Microsoft Whiteboard turns out to be pretty good without anyone I m sharing with needing to install anything. Of course my artistic skills are still dreadful, but I have actually managed to use it for drawing out a couple of things while discussing them, so I m considering that a win. Saved Tablet image

Russ Allbery: INN 2.6.4

INN 2.6.4 has been released. This is a bug fix and minor feature release over INN 2.6.3, and the upgrade should be painless. You can download the new release from ftp.isc.org or my personal INN pages. The latter also has links to the full changelog and the other INN documentation. As always, thanks to Julien LIE for preparing this release and doing most of the maintenance work on INN! Changes in this release:

Next.

Previous.