Search Results: "xam"

26 March 2010

Steve Kemp: I don't like it when people yell at me for no reason at all

Ubuntu always gets a lot of coverage in blogs, and the recent controvesy realisation that it isn't a 100% community-made distribution has triggered yet another round of this. A lot of the controvesy, coverage, and attention can be laid at the feet of Canonical themselves; I think it is fair to say that the visibility, hype, advertising, and the goal of trying to be all things to all men means that even relatively trivial issues can easily get blown out of proportion, and to a certain extent this is a self-inflicted. Live by the sword media & etc ... I think it is fair to say that Ubuntu has attracted a huge swathe of non-technical users. They want something "easy", "free", and "sexy", but more than that they want to use their computer, not develop the operating system. When a particular bug report, with 400+ comments, hits the press we're primarily seeing a marketing-fail rather than technical-fail. The realisation that yes bugs are reported, but no the community (of users) doesn't get input into every single thing is as it should be. If you look back over "controvesy" in the past you'll see comments from the non-technical users which are tantamoint to blackmail:
This should be fixed ... or I'm gonna .. install .. gentoo. yeah. really.
(Similarly you see many comments of the form "I agree", "oh noes", or "Please revert ASAP", rather than technical arguments.) This non-technical nature of the userbase is also readily apparent if you browse through the answers to problems posted in forums for example "Delete this file, I don't know why it works but it fixes it for me!!2!". (I've seen some truly horrific advice upon Ubuntu forums, even so far as chmodding various parts of the system to allow users to write binaries to /bin.) Similarly you'll see that the launchpad is full of generic linux misunderstandings and bugs that aren't "real". The unfortunate fact is that the Ubuntu bug tracker is a wasteland in many places: The tight timescale of releases combined with the sheer number of incoming bug reports means that often issues are overlooked. (For example one bug that bit a colleague is #402188 - on the one hand it is a trivial bug, on the other hand its readily apparent to users. If something like that can be missed it makes you wonder ..?) ObRandom: Ubuntu has 100 bugs open against its Vim package, some of which have been marked as NEW since 2009 (ie. untouched, ignored). By contrast the Debian vim package has way fewer bugs. I'm sure there are packages where the situation is reversed but I think is not an unusual comparison. Finally in addition to sheer numbers of bugs, and tight timescales, it has to be noted that the relative number of developers to users is miniscule, and this in turn has lead to some interesting solutions. The Ubuntu PPA system (personal package archive) should be a good thing. It should allow people to submit new packages for testing, for bugfixes, and for more visibility. Instead downloading a PPA file is no different than going to download.com and downloading a random binary - sure it might be legit, but there's no oversight, no quality control, and most likely no future updates.
Ubuntu as a distribution is interesting, and I'm not trying to be overly critical - A year or two ago had somebody thrown money at me I might have been inclined to accept it. I think most of the perceived problems stem from a single common source, which is largely the issue of scale. (e.g. bug reports to bug handlers. developer numbers to user numbers.)
There are many good things to be said about Ubuntu (& Canonical) in addition to the negative ones that we see in the press or that I've perceived and mentioned above. The truth is it works for a lot of people, and the growing pains will continue until it either dies or both its audience and itself matures. Either way I don't hate Ubuntu, in the same way that I don't hate Microsoft, Oracle, Fedora, Gentoo, or other mass-entities. There are pros and cons to be made for most of them, (and of course Debian itself is no different).
However I will say that every time I see people write "If you want a sexy/shiny/easy to use Linux desktop then install Ubuntu" I glance over at my Debian Lenny desktop, marvel at how sexy, shiny and easy to use it is, and get a little bit disappointed at our own marketing failure(s).
ObFilm: Day of the Woman

25 March 2010

Russell Coker: Bose vs Bauhn/Aldi Noise Canceling Headphones

Me wearing Bauhn HeadphonesInside the case of Bauhn Noise Canceling Headphones showing the cable and connectorsOutside of the cases of Bauhn and Bose Headphones Overview The German supermarket chain Aldi has been running in Australia for 8 years now [1]. Their standard practice for a long time has been to offer regular special deals on a few items of consumer electronics every week, my chocolate fridge is one thing I bought from Aldi [2]. Today Aldi have started selling Noise Canceling Headphones [3]. These headphones are badged by Bauhn but that name is apparently applied to random products from cheap manufacturers, it may be an Aldi name that is applied to stuff that they sell. The headphones cost $69AU which is really cheap. But the deal will probably end in less than a week when stock runs out. Noise canceling headphones can be used in server rooms and other noisy environments. Every company that has a server room should buy a few sets. One of the features of noise-canceling is that it works best on low frequencies and on regular sounds it specifically doesn t block human voice well. In some noisy environments it will be easier to hear people talk if you wear such headphones! Noise canceling headphones are also very useful to people who are on the autism spectrum and other people who get more annoyed by noise pollution than average people. I have been wearing my Bose headphones on public transport and when walking around in the city, this not only stops traffic noise but it also helps to avoid people thinking that I want to talk to them. Features The first picture shows me wearing the Bauhn NC headphones, it s from the right to show the controls for the built-in MP3 player. I have not yet tested the MP3 functionality. It appears that as the controls are one power button, buttons for next/previous track, and for controlling the volume. This is fairly poor for MP3 functionality, ideally you would want to have a display to see a list of tracks, maybe have directories to store files, etc. I guess this could be a convenient feature on occasion, but you wouldn t buy the headphones for the MP3 functionality.
The next two pictures show a comparison of the Bauhn headset with the Bose QC-15 headset that I bought last year [4]. The cases of the Bauhn and Bose devices are almost exactly the same size and of a very similar shape, the Bose case is tapered and indented and also has a finer weave on the cloth covering it looks much nicer. Both devices come with an adapter for an airline socket and with a detachable cable. They also both have pouches attached to the inside of the case with velcro. But the Bauhn headphones come with an adapter for the 6.5mm TRS connector which could be convenient if you want to plug them in to a larger amplifier, the basic connector is 3.5mm in both cases. The Bauhn device uses a standard TRS connector at the headphone end while the Bose QC-15 use a special connector that matches the shape of the headset and which has a TRRS plug (to cater for the high/low volume switch), so it seems that a damaged Bauhn cable could be replaced cheaply while a replacement Bose cable would have to be purchased from Bose (presumably at great expense and delay). The Bauhn case also has a velcro attached pocket for storing business cards (or maybe a name tag or something). The supplied cable for the Bauhn is described as being 5 feet long which isn t quite long enough to reach a tower PC that is sitting on the floor. The Bose has a cable that is about a foot longer (maybe 6 feet total), but due to the non-standard connector you can t replace it. I presume that I could easily buy a 4 meter cable for the Bauhn headphones, but I could of course buy an extension cable to use with the Bose. Bose advertise the QC-15 headphones as having 35 hours of battery life from a single AAA battery. Aldi advertise the Bauhn headset as having 5 hours of battery life when NC is turned on and they use two AAA batteries. It s widely regarded that rechargeable batteries don t last as long as the batteries used for estimating the battery life (which presumably are the most expensive long-life batteries available). I ve found a single rechargeable AAA battery to last well over 5 hours in my Bose headphones, so it seems that battery life is considerably worse for the Bauhn device. One feature of the Bauhn device is that it can be used without any batteries for playing external music. The Bose headphones can t be used at all without a battery. So while the Bauhn will use the batteries faster it will at least be usable when the batteries run out. But if you are buying headphones for the purpose of avoiding noise then the Bose headphones are simply better. Comfort The Bose headphones have significantly deeper ear wells than the Bauhn about 23mm vs 18mm. If your ears stick out more than 18mm (as mine apparently do) then this is a good reason for choosing Bose. The Bose headphones are a tighter fit, the spring that pushes the ear-pieces together is stronger. But they have better padding so this doesn t cause me any discomfort. Also the Bose headphones have better passive noise reduction due to having a more snug fit around the ears. I ve worn my Bose headphones on a flight from the US to Australia with hardly a break and they were quite comfortable I would never want to do that with the Bauhn headphones. Noise Reduction I tested the Bose and Bauhn products against three noise scenarios, external music, an air-conditioner, and a car engine. The Bose headphones made good reductions of the noise from the external music (Numb by Linkin Park) and the air-conditioner. The Bauhn headphones did little to stop Linkin Park and was not very effective against the air-conditioner noise. I think that this is largely due to the lack of passive noise reduction, the air-conditioner in question makes little vibration noise and the sound of rushing air is generally immune to active noise cancellation. Both headphones were very effective when in a car with the engine idling. The engine noise of vehicles seems to fall in an ideal frequency range for active cancellation. Music Quality When listening to Youtube music played on my Thinkpad I could not notice any quality difference between the two sets of headphones. I did notice that the Bose headphones seemed to have a greater response in the higher frequency range, but that doesn t necessarily mean that one set is better than the other. Maybe if I was listening to FLAC0 encoded music that I had personally ripped from a CD then I would notice a difference. But for most people the Bauhn music quality should be good enough. Design Quality The Bose product is solidly designed, while the Bauhn product appears cheap in every way. Opening the battery compartment on the Bauhn headphones is difficult and if you do it wrong you could easily break the lid off, I expect that every set of Bauhn headphones that is used by children will be broken in a small amount of time but it should still be fully functional with a broken lid. The matt finish of the Bose headphones should hide minor scratches much better than the shiny Bauhn headphones. The Bauhn headphones also have lower quality plastic parts, it appears that the molds used were designed cheaply and without adequate care to prevent marking the final product. The design flaws that affect usage of the Bauhn product are the shallow ear wells, the poor fit of the cushions around the ears (which is probably mostly due to a weak spring pressing the ear cups to the wearer s head), and the battery compartment lid which is difficult to open and appears prone to breakage. The other flaws are all cosmetic. I wonder whether the Bauhn product was made by one of the big name manufacturers who deliberately reduced the quality to avoid competing with their more expensive products. It seems that the major flaws could have been corrected at design time with almost no increase in manufacturing costs. Recommendations If you can afford the Bose QuietComfort 15 Acoustic Noise Cancelling Headphones then they are really worth the extra expense, I have no regrets at all about spending about $320US (including tax) on my Bose QC-15. The Bauhn product is good for when you want something cheap, for example a set to be used in a server room, or for the use of children. I bought a Bauhn headset for a friend who is a pilot, he spent $1,100 on a noise-canceling headset for his plane but had never got around to buying one for recreational use I expect that he will allow his children to use his new Bauhn headphones, if they get broken it s only a $69 expense. The second cheapest NC headphones I ve seen on offer in Australia is Harvey Norman selling Phillips HN-110 Noise Canceling Headphones for $100AU [5]. Amazon sells Philips HN 110 Folding Noise-Canceling Headphones for $50US but doesn t seem to ship them outside the US (at least not to Australia). JB Hifi also has some NC headphones on sale in Australia [6], but they are more expensive at $219 for AKG and $319 for Sennheiser. Also the models they sell are on-ear which means that they will inherently have very little passive noise reduction and will also annoy anyone who doesn t like having their ears squashed. If I was buying NC headphones for my own use and didn t want to spend $300US then I would either buy the Philips HN 110 Folding Noise-Canceling Headphones from Amazon and get a friend in the US to post them to me or I would buy them from Harvey Norman. But the Bauhn product is good if you want cheap headphones to stop engine noise and give reasonable quality when playing music.

23 March 2010

Miriam Ruiz: Ada Lovelace Day 2010

Today is March 24th, that means Ada Lovelace Day, and it is being pushed as an international day of blogging to celebrate the achievements of women in technology and science. The aim of Ada Lovelace Day is to focus on building female role models not just for girls and young women but also for those of us in tech who would like to feel that we are not alone in our endeavours. There are some very good examples of women that have been important in the development of science and technology, starting with Ada Lovelace herself (the first developer of an algorithm intended to be processed by a machine), Rear Admiral Grace Murray Hopper (developer of the first compiler for a computer programming language), Adele Goldstine (who wrote the complete technical description for the first digital computer, ENIAC), as well as the six women who did most of the programming of if (Kay McNulty, Betty Jennings, Betty Snyder, Marlyn Wescoff, Fran Bilas and Ruth Lichterman), or women scientists, or women inventors, etc. Well, I m not going to write about any of those, even when any of them would surely deserve that and more for sure. I m going to write about a woman who has definitely been very inspiring and supportive for me when I was starting to get in touch with Free Software and Debian, and who is probably the most important single reason I decided to go for it. It is definitely hard to write about someone you admire when she happens to be one of your best friends, and in fact I m pretty sure that most of the people reading this article already know her, so there s no great mistery. I m talking about Amaya Rodrigo, the first european female Debian Developer (AFAIK) and co-founder of the Debian Women project, and also member of Hispalinux Board in the golden days. The first time I met her she was giving a talk in Madrid about a project that was starting then, Debian Women, and it was very inspiring for me. Inspiring enough for me to join the project. Afterwards I ve learnt more about her, how she overcame many dificulties, like starting to work with computers quite late, among others. The real merit of a pioneer is not really to be the best techie out there, but to overcome the difficulties and doing it the best you can, when no one else has done it before. I m not going to write her biography here, it s not really the purpose of this blog entry, and you probably can ask herself directly. This blog entry is, as I said at the beginning, to highlight women in technology that I consider inspiring and relevant. You know, I admire you, Amaya :)

Joerg Jaspert: GSoC

Googles Summer of Code has Debian participating again. And this year I wrote a proposal on my own, to try and see if there is a student out there interested in taking it on. It is easy described, writing a SmartUploadServer and should also fit into the timeline of a GSoC project, at least the server itself. Adapting the upload tools in Debian should also be easy, depending on various decisions taken for the SUS (oh hey, who thought of Windows now?). Especially if one manages to have existing protocols for the transfer and not invent an own one. There are more things available to code all around the archive. Most of them are hard to put into a GSoC project, for example a dak code cleanup doesn t sound all that good. And actually requires more insight, the above Upload Server is a nice self-contained project. It should and has to use parts of dak code and be integrated, but all in all you do not need much prior knowledge there. One other GSoC proposal I like and would want to participate (in the mentors view) is the one from Marc about DeveloperPackageRepositories. His current proposal is limited on the buildd site, I am interested in the archive side of it. Much of what is required for this is actually already there in the code, at least functionality to support it, it just requires glue around it to make it work. And I think such kinds of repositories would be a nice thing to have. This whole thing, as nice as it sounds, has one drawback: I had to create a google account. Evil thing, evil bad data miners over there. I m pretty unhappy with that fact, as I have survived without one for a nice long time. But given my position in this part of Debian (there are only 2 people who currently can change the code that actually runs the archive, for example) I think letting this opportunity pass by would have been the wrong decision. Now it only needs a student to take it! :)

Daniel Kahn Gillmor: Avoiding erroneous OpenPGP certifications

i'm aware that people don't always take proper measures during mass OpenPGP keysignings. Apparently, some keys even get signed with no one at the keysigning present speaking for that key (for example, if the key was submitted to the keysigning via online mechanisms beforehand, but the keyholder failed to show up). Unverified certifications are potentially erroneous, and erroneous certifications are bad for the OpenPGP web of trust. Debian and other projects rely on the OpenPGP web of trust being reasonable and healthy. People should make a habit of doing proper verifications at keysignings. People who make unverified certifications should probably be made aware of better practices. So for future keysignings, i may introduce a key to the set under consideration and see what sort of OpenPGP certifications that key receives. I won't pretend to hold that key in person, won't speak for it, and it won't have my name attached to it. But it may be on the list. Depending on the certifications received on that key (and the feedback i get on this blog post), i'll either publish the list of wayward certifiers, or contact the certifiers privately. Wayward certifiers should review their keysigning practices and revoke any certifications they did not adequately verify. Remember, at a keysigning party, for each key: After the keysigning, when you go to actually make your OpenPGP certifications: Feedback welcome! Tags: keysigning, openpgp, tip

Dirk Eddelbuettel: RInside release 0.2.2

The shiny new 0.2.2 release of RInside has just been uploaded to CRAN; it should hit mirrors tommorow. Sources are also at my RInside page. RInside is a set of convenience classes to facilitate embedding of R inside of C++ applications. It works particularly well with Rcpp and now depends on it. This is the first release since version 0.2.1 in early January. Romain and I made numerous changes to Rcpp in the meantime. With this release, RInside is starting to catch up by taking advantage of many new automatic (templated) type converters. We have updated the existing examples, and added several new ones. These are all visibile directly via the Doxygen-generated documentation under the Files heading. Two examples are also shown directly on the RInside page. Also added are new examples showing how to use RInside to embed R inside C++ applications using MPI for parallel computing. This was contributed via two examples files by Jianping Hua, and we reworked the examples slightly (and added two variants that use MPI's C++ API). As it is so short, here is the basic 'Hello, World' example now showing the simpler Rcpp-based variable assignment:
// -*- mode: C++; c-indent-level: 4; c-basic-offset: 4;  tab-width: 8; -*-
//
// Simple example showing how to do the standard 'hello, world' using embedded R
//
// Copyright (C) 2009 Dirk Eddelbuettel
// Copyright (C) 2010 Dirk Eddelbuettel and Romain Francois
//
// GPL'ed
#include <RInside.h>                    // for the embedded R via RInside

int main(int argc, char *argv[])  
    RInside R(argc, argv);              // create an embedded R instance
    R["txt"] = "Hello, world!\n";	// assign a char* (string) to 'txt'
    R.parseEvalQ("cat(txt)");           // eval the init string, ignoring any returns
    exit(0);
 
One minor setback is that the examples currently segfault on Windows. That may be an issue with linking and class instantiation or something related. Romain and I focus much more on Linux and OS X, so this has not gotten a lot of attention. Debugging help would be appreciated.

22 March 2010

Russell Coker: Links March 2010

Blaise Aguera y Arcas gave an exciting demonstration of new augmented reality mapping software from Microsoft that combines video (including live video) with static mapping data and pictures [1]. This is a significant advance over current mapping systems such as Google Earth but it s not released yet either. It will be interesting to see whether Google or Microsoft gets this released first. The New York Review of Books has an insightful atricle by Garry Kasparov about human/computer chess [2]. It s surprising the degree to which a combination of human and computer chess playing can give a good result. Amateur human chess players plus regular PCs can beat grandmasters with computers or high-end computers with human help. It s apparently the quality of human-computer interaction that determines the quality of play. But the article contains a lot more, I recommend reading it. Daniel Kahneman gave an interesting TED talk about the difference between experiential and memory happyness [3]. As the concept of the moment is so short (about 3 seconds) apparently most people try to optimise their actions for the best memories of being happy. But to do so requires some different strategies. For example a two week vacation gives a memory that s not much different from a one week vacation. Therefore it seems that you would be better off staying in a five star hotel for a week than a four star hotel for two weeks, and eat dinner at a Michelin Star restaurant at least once per holiday even if it means eating at McDonalds on other occasions due to lack of funds. Temple Grandin gave an interesting TED talk The World Needs all Kinds of Minds [4] which mostly focussed on teaching children who are on the Autism spectrum. She is concerned that autistic children won t end up where they belong in Silicon Valley . Anupam Mishra gave an interesting TED talk about how the people of India s Golden desert built structures to harvest and store water [5]. Some of their ideas should be copied in Australia, due to mismanagement and stupidity Australians are failing to survive in much more hospitable places. Michael Tieman wrote an insightful and well researched article about the OSI s rejection of the IIPA s attacks on Open Source [6]. This is worth reading by anyone who wants to make a business or social case for free software. Mark Shuttleworth wrote an interesting post about the new visual style for Ubuntu and Canonical [7]. Apparently this includes the creation of a new font set which will be available for free use. Divorced Before Puberty an informative New York Times article by Nicholas Kristof about the links between treatment of women and terrorism [8]. The New York Times has an interesting article on Human Flesh Searches on the Internet in China [9]. It s basically crowds targetting people to find private information and harass them (similar to what some griefers are known for doing on the English-language part of the Internet). But they seem more interested in vigilante justice than lulz. The New York Times has an informative article about the Cult of Scientology (Co$) [10]. Among other interesting news it suggests that the number of cult victims in the US has dropped from 55,000 to 25,000 in the 2001-2008 time period. Senator Xenophon has called for an inquiry into the crimes committed by the cult and a review of it s tax-exempt status [11]. As always Xenu.net is the authoritative source for information on the Cult of Scientology AKA the Church of Scientology. The New York Times has an interesting article about formally studying the skills related to school teaching [12]. It largely focuses on Doug Lemov s Taxonomy of Effective Teaching describes 49 techniques that improve school results and some other related research. The article also mentions that increasing teacher salaries is not going to help much due to the large number of teachers, it s only professions that employ small numbers of people that can potentially have their overall skills improved by increasing salaries. Andy Wingo wrote an interesting article about Julius Caesar [13] based on the book The Assassination of Julius Caesar: A People s History of Ancient Rome by Michael Parenti. It seems that Caesar was more of a populist than a despot. Interesting article in The Register about the Large Hadron Collider (LHC) [14]. Apparently one 3.5TeV proton beam has as much energy as a British aircraft carrier running at 8 knots.

Ian Wienand: What exactly does -Bsymblic do? -- update

Some time ago I wrote a description of the -Bsymbolic linker flag which could do with some further explanation. The original article is a good starting place. One interesting point that I didn't go into was the potential for code optimisation -Bsymbolic brings about. I'm not sure if I missed that at the time, or the toolchain changed, both are probably equally likely! Let me recap the example...
ianw@jj:/tmp/bsymbolic$ cat Makefile 
all: test test-bsymbolic
clean:
	rm -f *.so test testsym
liboverride.so : liboverride.c
	       $(CC) -Wall -O2 -shared -fPIC -o liboverride.so $<
libtest.so : libtest.c
	   $(CC) -Wall -O2 -shared -fPIC -o libtest.so $<
libtest-bsymbolic.so : libtest.c
		     $(CC) -Wall -O2 -shared -fPIC -Wl,-Bsymbolic -o $@ $<
test : test.c libtest.so liboverride.so
     $(CC) -Wall -O2 -L. -Wl,-rpath=. -ltest -o $@ $<
test-bsymbolic : test.c libtest-bsymbolic.so liboverride.so
	$(CC) -Wall -O2 -L. -Wl,-rpath=. -ltest-bsymbolic -o $@ $<
$ cat liboverride.c 
#include <stdio.h>
int foo(void)
 
	printf("override foo called\n");
	return 0;
 
$ cat libtest.c 
#include <stdio.h>
int foo(void)  
    printf("libtest foo called\n");
    return 1;
 
int test_foo(void)  
    return foo();
 
$ cat test.c
#include <stdio.h>
int test_foo(void);
int main(void)
 
	printf("%d\n", test_foo());
	return 0;
 
In words; libtest.so provides test_foo(), which calls foo() to do the actual work. libtest-bsymbolic.so is simply built with the flag in question, -Bsymbolic. liboverride.so provides the alternative version of foo() designed to override the original via a LD_PRELOAD of the library. test is built against libtest.so, test-bsymbolic against libtest-bsymbolic.so. Running the examples, we can see that the LD_PRELOAD does not override the symbol in the library built with -Bsymbolic.
$ ./test
libtest foo called
1
$ ./test-bsymbolic 
libtest foo called
1
$ LD_PRELOAD=liboverride.so ./test
override foo called
0
$ LD_PRELOAD=liboverride.so ./test-bsymbolic 
libtest foo called
1
There are a couple of things going on here. Firstly, you can see that the SYMBOLIC flag is set in the dynamic section, leading to the dynamic linker behaviour I explained in the original article:
ianw@jj:/tmp/bsymbolic$ readelf --dynamic ./libtest-bsymbolic.so 
Dynamic section at offset 0x550 contains 22 entries:
  Tag        Type                         Name/Value
 0x00000001 (NEEDED)                     Shared library: [libc.so.6]
 0x00000010 (SYMBOLIC)                   0x0
...
However, there is also an effect on generated code. Have a look at the PLTs:
$ objdump --disassemble-all ./libtest.so
Disassembly of section .plt:
[... blah ...]
0000039c <foo>:
 39c:   ff a3 10 00 00 00       jmp    *0x10(%ebx)
 3a2:   68 08 00 00 00          push   $0x8
 3a7:   e9 d0 ff ff ff          jmp    37c <_init+0x30>
$ objdump --disassemble-all ./libtest-bsymbolic.so
Disassembly of section .plt:
00000374 <__gmon_start__@plt-0x10>:
 374:   ff b3 04 00 00 00       pushl  0x4(%ebx)
 37a:   ff a3 08 00 00 00       jmp    *0x8(%ebx)
 380:   00 00                   add    %al,(%eax)
        ...
00000384 <__gmon_start__@plt>:
 384:   ff a3 0c 00 00 00       jmp    *0xc(%ebx)
 38a:   68 00 00 00 00          push   $0x0
 38f:   e9 e0 ff ff ff          jmp    374 <_init+0x30>
00000394 <puts>:
 394:   ff a3 10 00 00 00       jmp    *0x10(%ebx)
 39a:   68 08 00 00 00          push   $0x8
 39f:   e9 d0 ff ff ff          jmp    374 <_init+0x30>
000003a4 <__cxa_finalize@plt>:
 3a4:   ff a3 14 00 00 00       jmp    *0x14(%ebx)
 3aa:   68 10 00 00 00          push   $0x10
 3af:   e9 c0 ff ff ff          jmp    374 <_init+0x30>
Notice the difference? There is no PLT entry for foo() when -Bsymbolic is used. Effectively, the toolchain has noticed that foo() can never be overridden and optimised out the PLT call for it. This is analogous to using "hidden" attributes for symbols, which I have detailed in another article on symbol visiblity attributes (which also goes into PLT's, if the above meant nothing to you). So -Bsymbolic does have some more side-effects than just setting a flag to tell the dynamic linker about binding rules -- it can actually result in optimised code. However, I'm still struggling to find good use-cases for -Bsymbolic that can't be better done with Version scripts and visibility attributes. I would certainly recommend using these methods if at all possible. Thanks to Ryan Lortie for comments on the original article.

21 March 2010

Russell Coker: Citing Wikipedia

A meme that has been going around is that you can t cite Wikipedia. You can t Cite Wikipedia Academically Now it s well known and generally agreed that you can t cite Wikipedia for a scientific paper or other serious academic work. This makes sense firstly because Wikipedia changes, both in the short term (including vandalism) and in the long term (due to changes in technology, new archaeological discoveries, current events, etc). But you can link to a particular version of a Wikipedia page, you can just click on the history tab at the top of the screen and then click on the date of the version for which you want a direct permanent link. The real reason for not linking to Wikipedia articles in academic publications is that you want to reference the original research not a report on it, which really makes sense. Of course the down-side is that you might reference some data that is in the middle of a 100 page report, in which case you might have to mention the page number as well. Also often the summary of the data you desire simply isn t available anywhere else, someone might for example take some facts from 10 different pages of a government document and summarise them neatly in a single paragraph on Wikipedia. This isn t a huge obstacle but just takes more time to create your own summary with references. When Wikipedia is Suitable The real issue however is how serious the document you are writing is and how much time you are prepared to spend on it. If I m writing a message to a mailing list or a comment on a blog post then I probably won t bother reading all the primary sources of Wikipedia pages, it would just waste too much of my time. Wikipedia is adequate for the vast majority of mailing list discussions. If I m discussing several choices for software with some colleagues we will probably start by reading the Wikipedia pages, if one option doesn t appear to have the necessary features (according to Wikipedia) then we may ask the vendor if those features are really missing and if so whether they will be added in the next version but we may decide that we don t really need the features in question and modify our deployment plans. Many business decisions are made with incomplete data, time is money and there often isn t time to do everything you want to do. Using Wikipedia as a primary source for business decisions is a way of trading off a little accuracy for a huge time saving. This is significantly better than the old fashioned approach of comparing products by reading their brochures companies LIE in their advertising! When writing blog posts the choice of whether to use Wikipedia as a reference depends on the point that you are trying to make and how serious the post is. If the post isn t really serious or contentious or if the Wikipedia reference is for some facts that are not likely to be disputed then Wikipedia will probably do. For some posts a reference to a primary source will be better. A blog post that references data that is behind a pay-wall (such as a significant portion of academic papers and news articles) is practically of less use than a post that cites Wikipedia. In most cases Wikipedia references free primary sources on the Internet (although it does sometimes refer to dead tree products and data that is behind a pay-wall). In the minority of cases where the primary references for a Wikipedia page are not available for free on the Internet there will be people searching for freely available references to replace the non-free ones. So if you refer to a Wikipedia page with non-free references a future reader might find that someone has added free references to it. The Annoying People One thing that often happens is that an Internet discussion contains no references for anything it s all just unsupported assertions. Then if anyone cites Wikipedia someone jumps in with you can t cite Wikipedia . If you want to criticise Wikipedia references then please first start by criticising people who state opinions as fact and people who provide numbers without telling anyone where they came from! The Guinness Book of Records (now known as Guinness World Records ) was devised as a reference to cite in debates in pubs [1]. It seems that most of the people who dismiss references to Wikipedia on the net would prefer that Internet debates have lower requirements for references than a pub debate. When Wikipedia is cited in an online discussion it is usually a matter of one mouse click to check the references for the data in question. If Wikipedia happens to be wrong then anyone who cares can correct it. Saying the Wikipedia page you cited had some transcription errors in copying data from primary sources and some of the other data was not attributed, I ve corrected the numbers and noted that it contains original research would be a very effective rebuttal to an argument that relies on data in Wikipedia. Saying you can t cite Wikipedia means little, particularly if you happen to be strongly advocating an opposing position while not providing any references. If one person cites an academic paper and someone else cites Wikipedia then it seems reasonable to assume that the academic paper is the better reference. But when it s a choice between Wikipedia and no reference then surely Wikipedia should win! Also references to non-free data are not much good for supporting an argument, that s really just unverified claims as far as most people can determine therefore the issue becomes how much the person citing the non-free reference can be trusted to correctly understand and summarise the non-free data. Also it has to be considered that not all primary sources are equal. Opinion pieces should be considered to have a fairly low value and while they are authoritative for representing the opinion of the person who wrote them they often prove little else unless they happen to cite good references which brings them to the same level as Wikipedia. The main benefit for linking to opinion pieces is that it saves time typing and gives a better product for the readers it s sometimes easier to find someone else expressing an opinion well than to express it yourself. So please, don t criticise me for citing Wikipedia unless others in the discussion are citing better references. If most people are not citing any references or only citing opinion pieces then a Wikipedia page may be the best reference that is being provided!

19 March 2010

MJ Ray: Co-ops at the North Somerset Initiative

On Wednesday, I went to a meeting of the Business Initiative for North Somerset for Cooperatives-SW (our regional cooperative cooperative). It was the first time anyone from the cooperative and mutual sector was present.

platform
Conference Bank of England The first speaker was Geoff Harding from the Bank of England, who talked through topics in their agents summary and related news. One interesting graph showed a steep rise in the percentage of household income being saved. Answers to questions suggested that more of that goes to mutuals and building societies, but they find it difficult to be competitive while the banks are keen to increase their balances. There was mention of employment hoarding businesses short-time working, redeploying or shutting down temporarily to keep trained workers under contract, rather than make them redundant and rehire later. People from both the Federation of Small Businesses and the Hoteliers Association made strong comments about the banks claiming to government that they are willing to lend, but still offering deeply unattractive depth-of-recession rates and terms. If the regional agents get details of such cases, they pass them to the central bank. South West Regional Development Agency The second main speaker was Ann O Driscoll, who covers business development for the West of England (what many people call CUBA Councils that Used to Be Avon). She introduced their four strategic priorities:-

  1. Low Carbon Economy apparenly our region has good wind, wave and solar experience. However, Vestas were mentioned and I know that when Vestas closed the UK s only wind turbine blade factories in August 2009, the RDAs were criticised for not acting against the subsidy-chasing, socially irresponsible conduct of Vestas and related companies continue to worry workers. If Vestas is one of the praised companies, I wonder whether we re attracting sustainable work to the region. On a related note, North Somerset Council and NS Enterprise Agency are organising a Climate Change forum on 1st April, but it s at Cadbury House Hotel, which is awkward to get to except by car: no footpath to the door, a mile-and-a-half walk along a busy road from a train station, bad roads for biking, wheelbending speedhumps on the drive, I can t remember if there is bicycle parking and its website doesn t say
  2. Successful Businesses SWRDA funds our rather poor Business Link service. Does someone in the South West have some good news about Business Link? If so, please leave a comment on this article.
  3. Prosperous Places intervention in areas like south Bristol or central Weston.
  4. United Approach co-ordinating with other regional groups.
The main activities introduced were: The questions were fascinating, except for mine. The best one was probably about the forthcoming election and the Conservatives pledge to shut down the RDAs and Business Links. The answer was that much of the work will still need to be done somehow, so it s more a question of who will do it, rather than what the name on the door says. So I don t think axing RDAs is going to achieve more than shuffling people between organisations. When allowed to ask a question, I got too excited and ranted a bit about how the Co-operative Group s co-operative enterprise hub is doing work that Business Link should have been funding, but the RDA doesn t understand social enterprise and treats it as a ghetto service. I ll try to take that up in a more coherent form later. Overview I think Cooperatives-SW were invited to the North Somerset Initiative largely because of pressure from software.coop for co-ops to be represented better in the Local Strategic Partnership, which has treated us badly. NSI holds one of the three business places on the partnership board, with the other two being held by NSEA and Bristol International Airport. I think it s a bit off that a private company and an enterprise agency are both represented by other groups and also have their own board seats while co-ops don t even have a collective seat, so that pressure for a representative organisation for co-operatives and mutuals to have a board place (in line with national government guidance) should continue, useful though the NSI meetings seem to be. The other thing which would really help is some funding for co-operative business development specialists to work in North Somerset at strategic tasks like this, instead of it being left to ordinary workers from other sectors. I don t know where that funding will come from and until then, I ll continue to try my best. We need to make sure that local strategy at least does no harm to the sector.

18 March 2010

Joachim Breitner: libnss-gw-name: A stable name for your gateway

I often find myself running /sbin/route to get the IP address of the current gateway, especially when using a wireless LAN while traveling. For example, if the Internet does not work I usually ping the local gateway to see where the connectivity problem lies. I also need the IP if I want to access the routers configuration web interface. This is somewhat tedious, so I wrote libnss-gw-name, and now:
$ sudo apt-get install libnss-gw-name
[...]
$ ping gateway.current
PING gateway.current (172.20.239.1) 56(84) bytes of data.
64 bytes from hhicalvin.stud.uni-karlsruhe.de (172.20.239.1): icmp_seq=1 ttl=64 time=2.16 ms
64 bytes from hhicalvin.stud.uni-karlsruhe.de (172.20.239.1): icmp_seq=2 ttl=64 time=1.48 ms
64 bytes from hhicalvin.stud.uni-karlsruhe.de (172.20.239.1): icmp_seq=3 ttl=64 time=2.73 ms
^C
--- gateway.current ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.482/2.129/2.739/0.513 ms
Once libnss-gw-name is installed, it hooks into the system s Name Service Switch, which is, among other things, responsible for resolving hostnames to ip addresses. It will only react on the name gateway.current , checking the system s routing table and returning the IP address of the current default gateway. It s a pretty simple and small tool, but it could well prove very handy to the power user. I uploaded libnss-gw-name to Debian sid, you can download the source code or access the git repository. Update: Changed the name to gateway.localhost, as that is within a reserved top-level-domain.

C.J. Adams-Collier: IronRuby on OS X

We had a visitor on #ironruby today asking for help getting IR running on his mac. I gave him the following directions, and they seemed to work aside from one glitch. I tested them on my wife s mac, and it worked for me, too. Install Mono You can grab the Mono .dmg from go-mono.com. This will install the framework and put the required programs (mono, xbuild) in your PATH. Fetch the IronRuby source Since Jim Deville likes macs, I m sure more recent versions will work, but this is the one we ve recently packaged up for Debian and tested on Ubuntu. If you want to be certain that the IronRuby code you write on Debian works on OS X, then you should probably build from the same version of the source. You should probably also install version 2.4.3 of Mono, but that may be more effort than it s worth ;) http://github.com/mletterle/ironruby/tarball/20090805+git.e6b28d27 Unpack the tarball Open up a terminal and unpack the thing you just downloaded:

$ mkdir ~/src/
$ cd ~/src/
$ tar xfz ~/Desktop/mletterle-ironruby-e6b28d2.tar.gz
$ cd mletterle-ironruby-e6b28d2/
Build IronRuby At this point, you should be able to build the IronRuby assemblies using xbuild. I don t recommend using rake, as it has some dependencies, and I m not a fan of dependencies.

$ xbuild /p:TreatWarningsAsErrors=false Merlin/Main/Languages/Ruby/Ruby.sln
<snip/>
Build succeeded.
	 2817 Warning(s)
	 0 Error(s)
Time Elapsed 00:00:28.8378230
Run the IronRuby interactive interpreter Our guest mentioned that he was using a terminal with a white background. Do note that the font color of the interactive interpreter (aka Read-Eval-Print Loop or REPL) is white, so if you re using a white background, you might want to change it. IIRC, there is a way to change the font color using a configuration setting. Figuring it out is left as an exercise for the reader.

$ mono Merlin/Main/Bin/Debug/ir.exe
IronRuby 0.9.0.0 on 2.6.3 (tarball Wed Mar 10 18:18:12 MST 2010)
Copyright (c) Microsoft Corporation. All rights reserved.
>>> 1+2
=> 3
>>> exit()
Extra credit: IronPython The tarball you downloaded also included the source to IronPython. The procedure to build/run IronPython is pretty similar to IronRuby. Build IronPython Unlike IronRuby s .sln, this version of IronPython s .sln does not have a default configuration parameter, so we need to specify it with the /p:Configuration=Debug argument.

$ xbuild /p:TreatWarningsAsErrors=false /p:Configuration=Debug Merlin/Main/Languages/IronPython/IronPython.sln
<snip/>
	 69 Warning(s)
	 0 Error(s)
Time Elapsed 00:00:38.8057450
Run the IronPython interactive interpreter IronPython has a REPL interface like IronRuby s. Or is it the other way around? Anyway, here s an example.

$ mono .//Merlin/Main/Bin/Debug/ipy.exe
IronPython 2.6 Beta 2 DEBUG (2.6.0.20) on .NET 2.0.50727.1433
Type "help", "copyright", "credits" or "license" for more information.
>>> 1+2
3
>>> ^D

Andrew Pollock: [life/americania] We've officially left our mark on the US

We received our US census form the other day. Sarah's already filled it out, but I wanted to look at it before we mailed it back, just out of curiosity. I'm astounded at how incredibly basic it is. Literally all it asks is name, age, date of birth and race. It's somewhat laughable how you're either "white", or one of a bazillion other racial ethnicities. They don't seem to be interested that I'm Australian. Or if I were a white Samoan, for example. I can only remember having filled out one Australian census since I moved out of home, which was the 2001 census. I missed the 2006 census since I was living in the US. The US census seems to be a 10 year affair, compared to Australia's 5 years. "Census night" was always a big deal in Australia. You were supposed to fill out the form on that particular date, for whoever was in that particular dwelling. So you really didn't want to be out visiting friends that night. The US census form claims to care about the state of affairs on April 1, but it also says to mail it back immediately. It seems to only care about "full-time residents", so the whole visitor problem doesn't seem to exist over here. Wikipedia tells me that the 2006 Australia Census had 60 questions, all compulsory, except for the questions about religion. I'm still gobsmacked by how small an amount of data the US tries to collect. I just quickly reviewed the 2001 Australia Census form, and I'm rather amazed at how many questions it asked. I remember there being a meme at the time of the 2001 census to put down "Jedi" as your religion, with the word on the street being that if enough people said that was their religion, it would become officially recognised as one.

17 March 2010

Gunnar Wolf: Getting away from Panam

Several months ago, around the Central American Free Software Encounter (ECSL) in Estel , Nicaragua, I started stirring the waters The Central American regions have vibrant, beautiful Free Software communities, but have mostly (with some very notable examples, of course) shied away from being active participants in major development projects. What was I to do about it? Of course, try to get them to become Debian contributors! During the following weeks, I talked about it with several friends from the region, and the result was an announcement and lots of arguments that followed it. Panam was decided as the host country, and many people have put a lot of work into making the MiniDebConf happen. Mauro Rosero and Anto Recio came up with what appears to be a wonderful local venue and a set of sponsored amenities, and the Debian project is sponsoring what is needed in terms of transportation for people from the whole region (spanning from Mexico to Ecuador and Venezuela IIRC). I am very sorry, however, that I cannot attend this meeting. This very same weekend, I will fly three hours, but in the opposite direction: I will go to Tijuana, where fate decided I will present my first round of CENEVAL equivalence exams (Acuerdo 286 Licenciatura). I expect that to be the topic of another post, to come soon. So, while my friends will be having a good time and talking about Debian and group work, I will sit through three periods of four hours, answering an exam for the first time in a very long time. Fun, hah? Anyway, I will meet Guillermo Amaral (thanks for hosting me! ;-) ), which ensures I will not miss all of the fun ;-)

Martin Michlmayr: Using the installer to flash the kernel again

Every once in a while someone asks how they can use the Debian installer to access their system on disk to run commands, for example to write the kernel and ramdisk to flash again. This is particularly useful on headless NAS devices. So here's how to do it:
  1. Start the Debian installer.
  2. Remove the SSH key from ~/.known_hosts because the installer will always generate a new key.
  3. Connect to the installer with SSH: ssh installer@...
  4. Follow the installer until you reach the partitioner, then choose "go back".
  5. Open a shell (look for Execute a shell towards the end of the menu).
  6. Run the commands below (the example assumes that /boot is /dev/sda1 and / is /dev/sda2.
mkdir -p /target
mount /dev/sda2 /target
mount /dev/sda1 /target/boot
mount --bind /dev /target/dev
mount -t proc none /target/proc
mount -t sysfs none /target/sys
chroot /target /bin/sh
# the prompt will change
# make modifications to the system and regenerate the initramfs
update-initramfs -u
exit
# the prompt will change again as you're leaving the chroot
umount /target/sys
umount /target/proc
umount /target/dev
umount /target/boot
umount /target
reboot

David Pashley: Letter to my MP regarding the Digital Economy Bill

I have just sent the following email to my MP, David Lepper MP, outlining my concerns about the Digital Economy Bill. I urge you to write to your MP with a similar letter. Open Rights Group's guide to writing to your MP
From: David Pashley <david@davidpashley.com>
To: David Lepper
Cc: 
Bcc: 
Subject: Digital Economy Bill
Reply-To: 
Dear Mr Lepper, 
I'm writing to you so express my concern at the Digital Economy Bill
which is currently working its way through the House of Commons. I
believe that the bill as it stands will have a negative effect on
the digital economy that the UK and in particular Brighton have
worked so hard to foster. 
Section 4-17 deals with disconnecting people reported as infringing
copyright. As it stands, this section will result in the possibility
that my internet connection could be disconnected as a result of the
actions of my flatmate. My freelance web development business is
inherently linked to my access of the Internet. I currently allow my
landlady to share my internet access with her holiday flat above me.
I will have to stop this arrangement for fear of a tourist's actions
jeopardising my business. 
This section will also result in the many pubs and cafes, much
favoured by Brighton's freelancers, from removing their free wifi. I
have often used my local pub's wifi when I needed a change of
scenery. I know a great many freelancers use Cafe Delice in the
North Laine as a place to meet other freelancers and discuss
projects while drinking coffee and working.
Section 18 deals with ISPs being required to prevent access to sites
hosting copyrighted material. The ISPs can insist on a court
injunction forcing them to prevent access. Unfortunately, a great
many ISPs will not want to deal with the costs of any court
proceedings and will just block the site in question. A similar law
in the Unitied States, the Digital Millenium Copyright Act (DMCA)
has been abused time and time again by spurious copyright claims to
silence critics or embarrassments.  A recent case is Microsoft
shutting down the entire Cryptome.org website because they were
embarrassed by a document they had hosted.  There are many more
examples of abuse at http://www.chillingeffects.org/
A concern is that there's no requirement for the accuser to prove
infringement has occured, nor is there a valid defense that a user
has done everything possible to prevent infringement. 
There are several ways to reduce copyright infringement of music and
movies without introducing new legislation. The promotion of legal
services like iTunes and spotify, easier access to legal media, like
Digital Rights Management free music. Many of the record labels and
movie studios are failing to promote competing legal services which
many people would use if they were aware of them. A fairer
alternative to disconnection is a fine through the courts. 
You can find further information on the effects of the Digital
Economy Bill at http://www.openrightsgroup.org/ and
http://news.bbc.co.uk/1/hi/technology/8544935.stm
The bill has currently passed the House of Lords and its first
reading in the Commons. There is a danger that without MPs demanding
to scrutinise this bill, this damaging piece of legislation will be
rushed through Parliament before the general election.
I ask you to demand your right to debate this bill and to amend the
bill to remove sections 4-18. I would also appreciate a response to
this email. If you would like to discuss the issues I've raised
further, I can be contacted on 01273 xxxxxx or 07966 xxx xxx or via
email at this address.
Thank you for your time.
-- 
David Pashley
david@davidpashley.com
Read Comments (0)

16 March 2010

Russell Coker: Starting with KVM

I ve just bought a new Thinkpad that has hardware virtualisation support and I ve got KVM running. HugePages The Linux-KVM site has some information on using hugetlbfs to allow the use of 2MB pages for KVM [1]. I put vm.nr_hugepages = 1024 in /etc/sysctl.conf to reserve 2G of RAM for KVM use. The web page notes that it may be impossible to allocate enough pages if you set it some time after boot (the kernel can allocate memory that can t be paged and it s possible for RAM to become too fragmented to allow allocation). As a test I reduced my allocation to 296 pages and then increased it again to 1024, I was surprised to note that my system ran extremely slow while reserving the pages it seems that allocating such pages is efficient when done at boot time but not so efficient when done later. hugetlbfs /hugepages hugetlbfs mode=1770,gid=121 0 0 I put the above line in /etc/fstab to mount the hugetlbfs filesystem. The mode of 1770 allows anyone in the group to create files but not unlink or rename each other s files. The gid of 121 is for the kvm group. I m not sure how hugepages are used, they aren t used in the most obvious way. I expected that allocating 1024 huge pages would allow allocating 2G of RAM to the virtual machine, that s not the case as -m 2048 caused kvm to fail. I also expected that the number of HugePages free according to /proc/meminfo would reliably drop by an amount that approximately matches the size of the virtual machine which doesn t seem to be the case. I have no idea why KVM with Hugepages would be significantly slower for user and system CPU time but still slightly faster for the overall build time (see the performance section below). I ve been unable to find any documents explaining in which situations huge pages provide advantages and disadvantages or how they work with KVM virtualisation the virtual machine allocates memory in 4K pages so how does that work with 2M pages provided to it by the OS? But Hugepages does provide a slight benefit in performance and if you have plenty of RAM (I have 5G and can afford to buy more if I need it) you should just install it as soon as you start. I have filed Debian bug report #574073 about KVM displaying an error you normally can t see when it can t access the hugepages filesystem [6]. Permissions open /dev/kvm: Permission denied
Could not initialize KVM, will disable KVM support One thing that annoyed me about KVM is that the Debian/Lenny version will run QEMU instead if it can t run KVM. I discovered this when a routine rebuild of the SE Linux Policy packages in a Debian/Unstable virtual machine took an unreasonable amount of time. When I halted the virtual machine I noticed that it had displayed the above message on stderr before changing into curses mode (I m not sure the correct term for this) such that the message was obscured until the xterm was returned to the non-curses mode at program exit. I had to add the user in question to the kvm group. I ve filed Debian bug report #574063 about this [2]. Performance Below is a table showing the time taken for building the SE Linux reference policy on Debian/Unstable. It compares running QEMU emulation (using the kvm command but without permission to access /dev/kvm), KVM with and without hugepages, Xen, and a chroot. Xen is run on an Opteron 1212 Dell server system with 2*1TB SATA disks in a RAID-1 while the KVM/QEMU tests are on an Intel T7500 CPU in a Thinkpad T61 with a 100G SATA disk [4]. All virtual machines had 512M of RAM and 2 CPU cores. The Opteron 1212 system is running Debian/Lenny and the Thinkpad is running Debian/Lenny with a 2.6.32 kernel from Testing.
Elapsed User System
QEMU on Opteron 1212 with Xen installed 126m54 39m36 8m1
QEMU on T7500 95m42 42m57 8m29
KVM on Opteron 1212 7m54 4m47 2m26
Xen on Opteron 1212 6m54 3m5 1m5
KVM on T7500 6m3 2m3 1m9
KVM Hugepages on T7500 with NCurses console 5m58 3m32 2m16
KVM Hugepages on T7500 5m50 3m31 1m54
KVM Hugepages on T7500 with 1800M of RAM 5m39 3m30 1m48
KVM Hugepages on T7500 with 1800M and file output 5m7 3m28 1m38
Chroot on T7500 3m43 3m11 29
I was surprised to see how inefficient it is when compared with a chroot on the same hardware. It seems that the system time is the issue. Most of the tests were done with 512M of RAM for the virtual machine, I tried 1800M which improved performance slightly (less IO means less context switches to access the real block device) and redirecting the output of dpkg-buildpackage to /tmp/out and /tmp/err reduced the built time by 32 seconds it seems that the context switches for networking or console output really hurt performance. But for the default build it seems that it will take about 50% longer in a virtual machine than in a chroot, this is bearable for the things I do (of which building the SE Linux policy is the most time consuming), but if I was to start compiling KDE then I would be compelled to use a chroot. I was also surprised to see how slow it was when compared to Xen, for the tests on the Opteron 1212 system I used a later version of KVM (qemu-kvm 0.11.0+dfsg-1~bpo50+1 from Debian/Unstable) but could only use 2.6.26 as the virtualised kernel (the Debian 2.6.32 kernels gave a kernel Oops on boot). I doubt that the lower kernel version is responsible for any significant portion of the extra minute of build time. Storage One way of managing storage for a virtual machine is to use files on a large filesystem for it s block devices, this can work OK if you use a filesystem that is well designed for large files (such as XKS). I prefer to use LVM, one thing I have not yet discovered is how to make udev assign the KVM group to all devices that match /dev/V0/kvm-*. Startup KVM seems to be basically designed to run from a session, unlike Xen which can be started with xm create and then run in the background until you feel like running xm console to gain access to the console. One way of dealing with this is to use screen. The command screen -S kvm-foo -d -m kvm WHATEVER will start a screen session named kvm-foo that will be detached and will start by running kvm with WHATEVER as the command-line options. When screen is used for managing virtual machines you can use the command screen -ls to list the running sessions and then commands such as screen -r kvm-unstable to reattach to screen sessions. To detach from a running screen session you type ^A^D. The problem with this is that screen will exit when the process ends and that loses the shutdown messages from the virtual machine. To solve this you can put exec bash or sleep 200 at the end of the script that runs kvm. start-stop-daemon -S -c USERNAME --exec /usr/bin/screen -- -S kvm-unstable -d -m /usr/local/sbin/kvm-unstable On a Debian system the above command in a system boot script (maybe /etc/rc.local) could be used to start a KVM virtual machine on boot. In this example USERNAME would be replaced by the name of the account used to run kvm, and /usr/local/sbin/kvm-unstable is a shell script to run kvm with the correct parameters. Then as user USERNAME you can attach to the session later with the command screen -x kvm-unstable . Thanks to Jason White for the tip on using screen. I ve filed Debian bug report #574069 [3] requesting that kvm change it s argv[0] so that top(1) and similar programs can be used to distinguish different virtual machines. Currently when you have a few entries named kvm in top s output it is annoying to match the CPU hogging process to the virtual machine it s running. It is possible to use KVM with X or VNC for a graphical display by the virtual machine. I don t like these options, I believe that Xephyr provides better isolation, I ve previously documented how to use Xephyr [5]. kvm -kernel /boot/vmlinuz-2.6.32-2-amd64 -initrd /boot/initrd.img-2.6.32-2-amd64 -hda /dev/V0/unstable -hdb /dev/V0/unstable-swap -m 512 -mem-path /hugepages -append "selinux=1 audit=1 root=/dev/hda ro rootfstype=ext4" -smp 2 -curses -redir tcp:2022::22 The above is the current kvm command-line that I m using for my Debian/Unstable test environment. Networking I m using KVM options such as -redir tcp:2022::22 to redirect unprivileged ports (in this case 2022) to the ssh port. This works for a basic test virtual machine but is not suitable for production use. I want to run virtual machines with minimal access to the environment, this means not starting them as root. One thing I haven t yet investigated is the vde2 networking system which allows a private virtual network over multiple physical hosts and which should allow kvm to be run without root privs. It seems that all the other networking options for kvm which have appealing feature sets require that the kvm process be started with root privs. Is KVM worth using? It seems that KVM is significantly slower than a chroot, so for a basic build environment a secure chroot environment would probably be a better option. I had hoped that KVM would be more reliable than Xen which would offset the performance loss however as KVM and Debian kernel 2.6.32 don t work together on my Opteron system it seems that I will have some reliability issues with KVM that compare with the Xen issues. There are currently no Xen kernels in Debian/Testing so KVM is usable now with the latest bleeding edge stuff (on my Thinkpad at least) while Xen isn t. Qemu is really slow, so Xen is the only option for 32bit hardware. Therefore all my 32bit Xen servers need to keep running Xen. I don t plan to switch my 64bit production servers to KVM any time soon. When Debian/Squeeze is released I will consider whether to use KVM or Xen after upgrading my 64bit Debian server. I probably won t upgrade my 64bit RHEL-5 server any time soon maybe when RHEL-7 is released. My 64bit Debian test and development server will probably end up running KVM very soon, I need to upgrade the kernel for Ext4 support and that makes KVM more desirable. So it seems that for me KVM is only going to be seriously used on my laptop for a while. Generally I am disappointed with KVM. I had hoped that it would give almost the performance of Xen (admittedly it was only 14.5% slower). I had also hoped that it would be really reliable and work with the latest kernels (unlike Xen) but it is giving me problems with 2.6.32 on Opteron. Also it has some new issues such as deciding to quietly do something I don t want when it s unable to do what I want it to do.

Ian Wienand: Handling hostnames, UDP and IPv6 in Python

So, you have some application where you want the user to specify a remote host/port, and you want to support IPv4 and IPv6. For literal addresses, things are fairly simple. IPv4 addresses are simple, and RFC2732 has things covered by putting the IPv6 address within square brackets. It gets more interesting as to what you should do with hostnames. The problem is that getaddrinfo can return you multiple addresses, but without extra disambiguation from the user it is very difficult to know which one to choose. RFC4472 discusses this, but there does not appear to be any good solution. Possibly you can do something like ping/ping6 and have a separate program name or configuration flag to choose IPv6. This comes at a cost of transparency. The glibc implementation of getaddrinfo() puts considerable effort into deciding if you have an IPv6 interface up and running before it will return an IPv6 address. It will even recognise link-local addresses and sort addresses more likely to work to the front of the returned list as described here. However, there is still a small possibility that the IPv6 interface doesn't actually work, and so the library will sort the IPv6 address as first in the returned list when maybe it shouldn't be. If you are using TCP, you can connect to each address in turn to find one that works. With UDP, however, the connect essentially does nothing. So I believe probably the best way to handle hostnames for UDP connections, at least on Linux/glibc, is to trust getaddrinfo to return the sanest values first, try a connect on the socket anyway just for extra security and then essentially hope it works. Below is some example code to do that (literal address splitter bit stolen from Python's httplib).
import socket
DEFAULT_PORT = 123
host = '[fe80::21c:a0ff:fb27:7196]:567'
# the port will be anything after the last :
p = host.rfind(":")
# ipv6 literals should have a closing brace
b = host.rfind("]")
# if the last : is outside the [addr] part (or if we don't have []'s
if (p > b):
    try:
        port = int(host[p+1:])
    except ValueError:
        print "Non-numeric port"
        raise
    host = host[:p]
else:
    port = DEFAULT_PORT
# now strip off ipv6 []'s if there are any
if host and host[0] == '[' and host[-1] == ']':
    host = host[1:-1]
print "host = <%s>, port = <%d>" % (host, port)
the_socket = None
res = socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_DGRAM)
# go through all the returned values, and choose the ipv6 one if
# we see it.
for r in res:
    af,socktype,proto,cname,sa = r
    try:
        the_socket = socket.socket(af, socktype, proto)
        the_socket.connect(sa)
    except socket.error, e:
        # connect failed!  try the next one
        continue
    break
if the_socket == None:
    raise socket.error, "Could not get address!"
# ready to send!
the_socket.send("hi!")

15 March 2010

Jaldhar Vyas: 7DRL Challenge - Final days

I'm afraid that in the end I failed the challenge. As the last minutes of Saturday night ticked down, I was still mired in the minutiae of C++ Run-Time Type Identification (RTTI.) Sunday was my 12th wedding anniversary and I know from past experience that this is one day when it is advisable to step away from the computer. So I have to concede defeat for now. But I only actually spent about 48 hours on this project this week so if you really think about it, I still have 120 hours available. That's what I choose to believe anyway. The galling thing is in theory I know how this is supposed to work. A.L.F.s model (in the model-view-controller design pattern) is a class called World. World has an array of Rooms which represent rooms in the dungeon. In my original almost working version of a few days back, this Room class had all manner of verious members for different objects in the dungeon but I decided to redesign it the right way by consolidating all the redundant bits into an abstract base class called Item which would have concrete subclasses: Potion, Treasure, Monster etc. Room now only has to hold a pointer to the Item associated with that room. (Later on I will consider allowing multiple items per room but for now there can only be one.) A factory function creates Items and assigns them to each Room (or leaves them empty) It returns a pointer to an object of the appropriate class but we can access that object through the Item* because they are derived from Item. So far so good. The fun part happens when we want to know what the Item* really is. For example, combat makes sense for Monsters but not for Treasure. I only want to activate combat if the Item* is a Monster*. It's easy in theory:

if(dynamic_cast<Monster*>(contents))
    return FIGHT;
                            
...but it didn't work. Problem number 1. C++ RTTI only works on polymorphous classes. (Ones that contain atleast one virtual member.) So a little redesign of my classes was necessary. Problem #2, once you start slinging pointers around, segfaults soon follow. I had to go back and make absolutely sure I wasn't double-deleting objects and things of that nature. As I write this, I think I have finally got it all sorted out. So I am going to persevere and finish this game, its just going to take a bit longer than 7 days.

Russell Coker: Types of Security Tokens

The Security Token Wikipedia page doesn t seem to clearly describe the types of token. Categories of Security Token It seems to me that the following categories encompass all security tokens:
  1. Biometric tokens which seems rather pointless to me. Having a device I control verify my biometric data doesn t seem to provide a benefit. The only possible benefit seems to be if the biometric token verifies the identity of the person holding it before acting as one of the other types of token.
  2. Challenge-response devices. The server will send a challenge (usually a random number) and will expect a response (usually some sort of cryptographically secure hash of the number and a shared secret). A challenge-response device may take a password from the user and combine it with the challenge from the server and the shared secret when calculating the response.
  3. Time-based tokens (one-time passwords). They will provide a new pseudo-random number that changes periodically, often a 30 second time interval is used and the number is presumably a cryptographically secure hash of the time and a shared secret. This requires a battery in the token and the token will become useless when the battery runs out. It also requires that the server have an accurate clock.
  4. Use-based tokens. They will give a new pseudo-random number every time a button is pressed (or some other event happens to indicate that a number has been used). These do not work well if you have multiple independent servers and an untrusted network.
Here is my analysis of the theory of token use, note that I am not sure how the implementations of the various token systems deal with these issues.
  1. Biometric security seems like a bad idea for most non-government use. I have seen a retina scanner in use at a government office that made some sense as the people being scanned were in a secure area (they had passed some prior checks) and they were observed (to prevent coercion and the use of fake eyes). Biometric authentication for logging in over the net just seems like a bad idea as you will never know if you can trust the scanner.
  2. It seems to me that challenge-response devices are by far the most secure option. CR is resistant to replay attacks provided that it is not possible to have re-used challenges. If the calculation of the response includes a password (which is performed on some tokens that resemble pocket calculators) then a CR token will meet the something you have and something you know criteria.
    One potential problem with CR systems is that of not including the server or account ID in the calculation. So if I was to use a terminal in an insecure location to login to a server or account with data that is not particularly important then it would be possible for an attacker who had compromised the terminal to perform a Man In The Middle (MITM) attack against other servers. Of course you are supposed to use a different password for each account, if you do this then a CR token that includes a password will be resistant to this attack but I expect that people who use tokens are more likely to use one password for multiple accounts.
  3. Time-based tokens have a weakness in that an attacker who can immediately discover the number used for one connection could then immediately login to other servers. One example of a potential attack using this avenue would be to compromise a terminal in an Internet cafe, steal a hash used for logging in to server A and then immediately login to server B. This means that it may not be safe to use the same token for logging in to servers (or accounts) that have different sensitivity levels unless a strong password was used as well I expect that people who have hardware tokens tend to use weaker passwords.
    Also one factor that will make some MITM attacks a lot easier is the fact that the combination of the hash from the token and the password are valid for a period of time so an attacker could establish a second connection within the 30 second interval. It seems that only allowing one login with a particular time-coded password is the correct thing to do, but this may be impossible if multiple independent servers use the same token.
    Time based tokens expire when the battery runs out. The measures taken to make them tamper-proof may make it difficult or impossible to replace the battery so a new token must be purchased every few years.
  4. Use-based tokens are very similar to time-based tokens, it s just a different number that is used for generating the hash. The difference in the token is that a time-based token needs a battery so that it can track the time while a use-based token needs a small amount of flash memory to store the usage count. The difference at the server end is that for a use-based token the server needs a database of the use count of each token, which is usually not overly difficult for a single server.
    One problem is the case of a restore from backup of the server which maintains the use count database. The only secure way of managing this is to either inspect every token (to discover it s use count) or to issue a new password (for using password plus token authentication). Either option would be really painful if you have many users at remote sites. Also it would be required to get the database transaction committed to disk before an authentication attempt is acknowledged so that a server crash could not lose the count this should be obvious but many people get these things wrong.
    An additional complication for use-based tokens comes with the case of a token that is used for multiple servers. One server needs to maintain the database of the usage counts and the other servers need to query it by secure links. If a login attempt with use count 100 has been made to server A then server B must not accept a login with a hash that has a use count less than or equal to 100. This is firstly to cover the case where a MITM attack is used to login to server B with credentials that were previously used for server A. The second aim of this is to cover the case where a token that is temporarily unguarded is used to generate dozens of hashes while the hashes could be immediately used it is desirable to have them expire as soon as possible, and having the next login update the use count and invalidate such hashes is a good thing.
    The requirement that all servers know the current use count requires that they all trust a single server. In some situations this may not be possible, so it seems that this only works for servers within a single authentication domain or for access to less important data.
Methods of Accessing Tokens It seems that the following are the main ways of accessing tokens. To avoid driver issues and allow the use on random machines it seems that the USB keyboard and manual entry types of token are best. While for corporate Intranet use it seems that a SmartCard is best as it can be used for opening doors as well, you could use a USB keyboard token (such as a Yubikey) to open doors but it would be slower and there is no off the shelf hardware. For low cost and ease of implementation it seems that use-based tokens that connect via the USB keyboard interface are best. For best security it seems that a smart-card or USB interface to a device with a keypad for entering a password is ideal.

Next.

Previous.