The Debconf team is excited to announce that we are now accepting proposals for contributions to this year s Debian conference! We invite you to submit proposals for how you would contribute until the deadline: May 1st, 2010, 23h59 UTC. There are many ways you can contribute, you could present a technical paper, host a panel discussion, put on a tutorial, do a performance, an art installation, a debate, host a meeting (BoFs, or Birds of a Feather Session), or other possibilities that you devise. This year we are also accepting proposals for tracks a thematic grouping around a particular subject, and people to coordinate those tracks. If you are looking for ideas of things that you could contribute, or have ideas for things that you would like to see happen at Debconf, have a look at the Contribution Brainstorm page. DebConf talks will be broadcast live on the Internet where possible, unless otherwise requested. Videos of the talks will be published on the web along with the presentation slides and papers. Step 1. Submit Proposal Proposals should provide an overview of your proposed contribution, similar to an abstract, and be no more than 600 words. Since contributions can cover a range of issues, please describe what your proposal covers, be it political (Free Software, law, advocacy, access, etc.), technical (d-i, OpenPGP, etc.), social (Debian structures and groups). It s okay to hit all three of these. Your proposal should also include some information on why you re qualified to present, or coordinate this topic. For example, you can include links to posts you have made to Debian mailing lists or other material that indicates your qualifications. Proposals and their abstracts will be accepted until May 1st, 2010, 23h59 UTC. To submit your proposal, go to http://debconf10.debconf.org/register.xhtml and register as an attendee. Once you are registered, there is a Submit a proposal link. You will see your proposal on the site. You can choose between different presentation types. If you are unsure what type you should use, please read our definitions first. If it s not there for some reason, or you have questions, please contact us immediately. Step 2. Committee Review The review committee for this year will make its decision by May 1st, 2010. All correspondence will be done by email. Step 3. Paper Submission Like last year, we are asking for papers to be submitted along with the presentations. A full paper is optional, however we strongly encourage you to submit one if possible as we intend to provide written information along with transcripts of the sessions for later viewing. Having written papers in advance will allow us to get translations done to help non-native-English speakers feel more comfortable with the topics presented. Papers are due by July 1st, 2010, and should cover the topic in reasonable depth (3 pages A4 text, plus pictures and diagrams). We will use LaTeX to typeset the proceedings. Please submit your paper formatted in LaTeX. Should you be unfamiliar with LaTeX earlier submission in plain text is also fine. Step 4. Live Presentation Longer presentations may have a break in the middle and should include workshop items that directly involve the participants. If using slides or any other presentation, please consider that your audience will consist of people who use free software, and your choice of application to prepare and display the slides should reflect this if at all possible. Fine Print Publication Rights Debconf requires non-exclusive publication rights to papers, presentations, and any additional handouts or audio/visual materials used in conjunction with the presentation. The authors have the freedom to pick a DFSG-free license for the papers themselves and retain all copyrights. The presentations will be recorded, and may be broadcast over the Internet. Any copies of the presentation will be made available under a license like the MIT/X11 license. Failure to Submit In the event that a deadline is missed we reserve the right to revoke any offer to present.

So in the last week I have read some stuff, seen some presentations, and visited some sites that I have really loved, so here they are to share: Trollcats (this will take my power point slides to a whole NEW level) and here is one for all the free software geeks, in particular. I finally read Manuela Carneiro da Cunha fantastic Prickly Paradigm press book Culture and Culture: Traditional Knowledge and Intellectual Rights. If you don t know jack about the thorny issues around indigenous knowledge an IPR, the first 2/3 provides a pretty darn good introduction rooted not only in an explanation of trade treaties, the limited repertoire available for indigenous groups to politically respond, but a great story about a specific frog that secretes a sticky film that basically F s you up (if you let it seep in your open wounds). It is entertaining. The last 1/3 takes a far more theoretical turn and will be harder to understand for novices (it helps if you have like at least a BA, possibly MA in anthro, best if you have a PhD from her academic home, U of Chicago). It is there where she discusses the relationship between culture as reflexive (hey, peoples of the world, we have x, y, c culture) as lived unreflexively (the unconscious plane of norms that helps guide perception and action). I loved her theoretical somersaults whereby she explained how contradictions between the two are experienced as anything but a contradiction. Ok so today I went to this conference Radars and Fences III (where I presented my anon/scientology talk for the first time 3 years ago!). I was not able to stay the whole day but I saw Ricardo Dominguez & Amy Sara Carroll from the Electronic Disturbance Theater present on the Transborder Immigrant Tool, which I knew about but did not know how infused it was in poetry, poetry that is, in fact, an integral part of its arsenal. Their presentation was fantastic and it reminds me the great political work being done at the interface of art and technology (and believe me, these 2 are rabble rousers. UCSD, who helped fund the project, are not all that happy they did and they also get not hate mail they get but the HATE mail). Then I saw Laila El Haddad & Mushon Zer-Aviv present on an amazing project You are Not Here which is a bit hard to explain briefly but I will try (and their site introduces it as an urban tourism mash-up. It takes place in the streets of one city and invites participants to become meta-tourists of another city. So basically there are two interlinked sites (NYC and Baghdad and Tel Aviv and Gaza) where you can be a tourist (though the physical place to follow the symbols are only in NYC and Tel Aviv). You need a map. You get a map. The map, once put up to the light shows two cities/places with symbols that indicate a special spot on the map. You find the physical spot, there is sticker or other sign with a phone number, you call, and you hear a story not about NYC or Tel Aviv (where you would physically go) but about Baghdad or Gaza and a story that pertains to the area of the map that overlaps where you are in NYC or Tel Aviv. We saw a bunch of examples and they were riveting and powerful.

So in the last week I have read some stuff, seen some presentations, and visited some sites that I have really loved, so here they are to share: Trollcats (this will take my power point slides to a whole NEW level) and here is one for all the free software geeks, in particular. I finally read Manuela Carneiro da Cunha fantastic Prickly Paradigm press book Culture and Culture: Traditional Knowledge and Intellectual Rights. If you don t know jack about the thorny issues around indigenous knowledge an IPR, the first 2/3 provides a pretty darn good introduction rooted not only in an explanation of trade treaties, the limited repertoire available for indigenous groups to politically respond, but a great story about a specific frog that secretes a sticky film that basically F s you up (if you let it seep in your open wounds). It is entertaining. The last 1/3 takes a far more theoretical turn and will be harder to understand for novices (it helps if you have like at least a BA, possibly MA in anthro, best if you have a PhD from her academic home, U of Chicago). It is there where she discusses the relationship between culture as reflexive (hey, peoples of the world, we have x, y, c culture) as lived unreflexively (the unconscious plane of norms that helps guide perception and action). I loved her theoretical somersaults whereby she explained how contradictions between the two are experienced as anything but a contradiction. Ok so today I went to this conference Radars and Fences III (where I presented my anon/scientology talk for the first time 3 years ago!). I was not able to stay the whole day but I saw Ricardo Dominguez & Amy Sara Carroll from the Electronic Disturbance Theater present on the Transborder Immigrant Tool, which I knew about but did not know how infused it was in poetry, poetry that is, in fact, an integral part of its arsenal. Their presentation was fantastic and it reminds me the great political work being done at the interface of art and technology (and believe me, these 2 are rabble rousers. UCSD, who helped fund the project, are not all that happy they did and they also get not hate mail they get but the HATE mail). Then I saw Laila El Haddad & Mushon Zer-Aviv present on an amazing project You are Not Here which is a bit hard to explain briefly but I will try (and their site introduces it as an urban tourism mash-up. It takes place in the streets of one city and invites participants to become meta-tourists of another city. So basically there are two interlinked sites (NYC and Baghdad and Tel Aviv and Gaza) where you can be a tourist (though the physical place to follow the symbols are only in NYC and Tel Aviv). You need a map. You get a map. The map, once put up to the light shows two cities/places with symbols that indicate a special spot on the map. You find the physical spot, there is sticker or other sign with a phone number, you call, and you hear a story not about NYC or Tel Aviv (where you would physically go) but about Baghdad or Gaza and a story that pertains to the area of the map that overlaps where you are in NYC or Tel Aviv. We saw a bunch of examples and they were riveting and powerful.

Besides the new RcppExamples, another new package RcppArmadillo got spun out of Rcpp with the recent release 0.7.8 of Rcpp. Romain and I already had an example of a simple but fast linear model fit using the (very clever) Armadillo C++ library by Conrad Sanderson. In fact, I had used this as a motivational example of why Rcpp rocks in a recent talk to the ACM chapter at U of Chicago which, thanks to David Smith at REvo, got some further exposure. Now this example is more refined as further glue got added. Given that both Armadillo and Rcpp make use of C++ templates, the actual amount of code in RcppArmadillo is not that large: just over 200 lines in a header file, and a little less for some testing accessor and example functions in a source file. And this makes for some really nice example code: the 'fast regression' example becomes this (where I simply removed two blocks with conditional on the Armadillo version):

#include <RcppArmadillo.h>
extern "C" SEXP fastLm(SEXP ys, SEXP Xs)  
    Rcpp::NumericVector yr(ys);			// creates Rcpp vector from SEXP
    Rcpp::NumericMatrix Xr(Xs);			// creates Rcpp matrix from SEXP
    int n = Xr.nrow(), k = Xr.ncol();
    arma::mat X(Xr.begin(), n, k, false);   	// reuses memory and avoids extra copy
    arma::colvec y(yr.begin(), yr.size(), false);
    arma::colvec coef = solve(X, y);            // fit model y ~ X
    arma::colvec resid = y - X*coef; 		// residuals
    double sig2 = arma::as_scalar( trans(resid)*resid/(n-k) );
    						// std.error of estimate
    arma::colvec stderrest = sqrt( sig2 * diagvec( arma::inv(arma::trans(X)*X)) );
    Rcpp::Pairlist res(Rcpp::Named( "coefficients", coef),
                       Rcpp::Named( "stderr", stderrest));
    return res;
 

No extra copies! Armadillo instantiates directly from the underlying R objects for the vector and matrix, solves the regression equations, computes the standard error of the estimates and returns the two vectors. Leaving us to write about eleven lines of code. Moreover, as Armadillo is well designed and uses template meta-programming to avoid extra copies (see these lecture notes for details), it is about as efficient as it can be (and will use Atlas or other BLAS where available). And, this is just one example. Rcpp should be suitable for other C++ libraries, and provides an easy to use seamless interface between C++ and R. However, we should note that (at about the last minute) we found out about some unit test failures in OS X as well as some issues in a Debian chroot -- cran2deb ran into some build issues on i386 and amd64 in the testing chroot even this 'it all works' swimmingly on our Debian, Ubuntu and Fedora build environments. A follow-up with fixes for either Rcpp and/or RcppArmadillo appears likely.

Update: The build issues seems to be with 64-bit systems and everything appears cool in 32-bit.

My relationship with Puppet is one of love and hate. I am forced to use it simply because there is no better tool around, but I hate it in so many ways that I don t even want to start to enumerate (hint: most have to do with Ruby, actually). Today I decided to put an end to one thing that has been driving me insane: the fact that puppetd (the client) and puppetmasterd (the server) use the same working directory, /var/lib/puppet. Since I consider and would like to treatthe machine on which puppetmasterd is running just another puppet client, I was running into funky issues related to SSL certificate confusion, obscure errors, and SSL revocation horrors. The following hence assumes that you have installed or are planning to install puppetd on the machine running your puppetmaster, and that you have two fully-qualified domain names for the machine. For instance, I run puppetmaster on vera.madduck.net, and puppetmaster.madduck.net is an alias for the same machine. I ll use these names in the following as examples. The following may be Debian-specific, as I am solely using the puppet and puppetmaster packages for my experimentation and verification. Your mileage may vary, but the concept shall be the same.

1. Stop everything:

   /etc/init.d/puppetmaster stop
   /etc/init.d/puppet stop
   
   

   (also verify that you have not instructed cron to restart these services)
2. Rename the working directory:

   mv /var/lib/puppet /var/lib/puppetmaster
   
   

   and amend /etc/puppet/puppet.conf accordingly:

   [main]
   #  
   vardir=/var/lib/puppetmaster
   ssldir=$vardir/ssl
   #  
   [puppetmasterd]
   certname=puppetmaster.madduck.net
   #  
   
   

   I am doing this in [main], planning to override it for puppetd later, because puppetd is the only program which makes sense to be separated from the rest. Since only the puppetmaster needs a special certificate name, that is set specifically in the [puppetmasterd] section. If you use apache2 or nginx in front of your puppetmasters, make sure to amend the SSL file locations in the virtual host definition and restart (!) the service. You can verify that the configuration has been amended by making sure that there is no output from the following command:

   # puppetmasterd --genconfig   grep -q '/var/lib/puppet/' && echo SOMETHING IS WRONG
   
   

3. Now restart puppetmaster:

   /etc/init.d/puppetmaster start
   
   

   and verify that it starts. If your puppetmaster previously ran under a different name, it will create itself a new certificate and sign it. Since the client will get its own working directory (and thus a new SSL certificate), you want to remove all records of the old certificate:

   # puppetca --list --all
   + puppetmaster.madduck.net
   + vera.madduck.net
   # puppetca --clean vera.madduck.net
   
   

4. Change the configuration file to tell puppetd about its working directory:

   [puppetd]
   server=puppetmaster.madduck.net
   vardir=/var/lib/puppetmaster
   ssldir=$vardir/ssl
   #  
   
   

   This you can verify with the following command, which should not print anything:

   # puppetd --genconfig   grep -q '/var/lib/puppet[^/]' && echo SOMETHING IS WRONG
   
   

5. Now install puppet, or (re)start it if it s already installed:

   # /etc/init.d/puppet stop
   # puppetd --no-daemonize --onetime --verbose --waitforcert 30 &
   info: Creating a new SSL key for vera.madduck.net
   warning: peer certificate won't be verified in this SSL session
   info: Caching certificate for ca
   info: Creating a new SSL certificate request for vera.madduck.net
   # puppetca --list
   vera.madduck.net
   # puppetca --sign vera.madduck.net
   notice: Signed certificate request for vera.madduck.net
   notice: Removing file Puppet::SSL::CertificateRequest vera.madduck.net at '/var/lib/puppetmaster/ssl/ca/requests/vera.madduck.net.pem'
   # fg
   info: Caching certificate for vera.madduck.net
   info: Caching certificate_revocation_list for ca
   [ ]
   # puppetca --list --all
   + puppetmaster.madduck.net
   + vera.madduck.net
   # /etc/init.d/puppet start
   
   

   Do yourself the favour and check that it s all working.
6. Optionally, you can now clean up the client stuff in the server s working directory, for instance like this (it worked for me, but this is the sledgehammer approach):

   # /etc/init.d/puppetmaster stop
   # cd /var/lib/puppetmaster
   # tar -cf /tmp/puppetmaster.workingdir-backup.tar .
   # find ../puppet -type f -printf '%P\n'   xargs rm
   # /etc/init.d/puppetmaster start
   
   

7. If you stopped cron before (and your puppet recipes have not since restarted it):

   /etc/init.d/cron start
   
   

All done. I wish puppet, or at least Debian s puppet packages would do this by default. Please let me know if the above conversion works for you. Then I might start working on an automated migration. NP: Genesis: Selling England by the Pound

Version 0.1.0 of RcppExamples, a simple demo package for Rcpp should appear on CRAN some time tomorrow. As mentioned in the post about release 0.7.8 of Rcpp, Romain and I carved this out of Rcpp itself to provide a cleaner separation of code that implements our R / C++ interfaces (which remain in Rcpp) and code that illustrates how to use it --- which is now in RcppExamples. This also provides an easier template for people wanting to use Rcpp in their packages as it will be easier to wrap one's head around the much smaller RcppExamples package. A simple example (using the newer API) may illustrate this:

#include <Rcpp.h>
RcppExport SEXP newRcppVectorExample(SEXP vector)  
    Rcpp::NumericVector orig(vector);			// keep a copy (as the classic version does)
    Rcpp::NumericVector vec(orig.size());		// create a target vector of the same size
    // we could query size via
    //   int n = vec.size();
    // and loop over the vector, but using the STL is so much nicer
    // so we use a STL transform() algorithm on each element
    std::transform(orig.begin(), orig.end(), vec.begin(), sqrt);
    Rcpp::Pairlist res(Rcpp::Named( "result", vec),
                       Rcpp::Named( "original", orig));
    return res;
 

With essentially five lines of code, we provide a function that takes any numeric vector and returns both the original vector and a tranformed version---here by applying a square root operation. Even the looping along the vector is implicit thanks to the generic programming idioms of the Standard Template Library. Nicer still, even on misuse, exceptions get caught cleanly and we get returned to the R prompt without any explicit coding on the part of the user:

R> library(RcppExamples)
Loading required package: Rcpp
R> print(RcppVectorExample( 1:5, "new" )) # select new API
$result
[1] 1.000 1.414 1.732 2.000 2.236
$original
[1] 1 2 3 4 5
R> RcppVectorExample( c("foo", "bar"), "new" )
Error in RcppVectorExample(c("foo", "bar"), "new") :
  not compatible with INTSXP
R>

There is also analogous code for the older API in the package, but it is about three times as long, has to loop over the vector and needs to set up the execption handling explicitly. As of right now, RcppExamples does not document every class but it should already provide a fairly decent start for using Rcpp. And many more actual usage examples are ... in the over two-hundred unit tests in Rcpp.

Update: Now actually showing new rather than classic API.

I'm looking for a way to do free hosting. But I mean free as in freedom, not free as in beer. Let me explain.

When I'm using a piece of free and open-source software such as OpenOffice.org, Evolution, or anything else, I have certain possibilities, freedoms if you will, of interacting with the software beyond just consuming it. I can look at the source code to study how it works. I can rebuild it to have a higher degree of confidence that I'm actually running that code. I can fix a bug or create an enhancement. I can send the patch upstream and wait for the next release, or in important cases I can create a local build. With the emerge of new project hosting sites such as GitHub, it's getting even easier to share one's modifications so others can use them. And so on.

As a lot of software moves to the web, how will this work in the future? There are those that say that it won't, and that it will be a big problem, and that's why you shouldn't use such services. Which is what probably a lot of free-software conscious users are doing right now. But I think that in the longer run, resisting isn't going to win over the masses to free software.

First of all, of course, the software would need to be written. So a free web office suite, a free web mail suite that matches the capabilities of the leading nonfree provider, and so on. We have good starts with Identi.ca and OpenStreetMap, for example, but we'd need a lot more. Then you throw it on a machine, and people can use it. Now as a user of this service, how do I get the source code? Of course you could offer a tarball for download, and that is the approach that the AGPL license takes. One problem with that is, if you are used to apt-get source or something similar for getting the source, everyone putting a tarball on their web site in a different place isn't going to make you happy. A standardized packaging-type thing ought to be wrapped around that. Another problem is that even if you trust the site's operator that that's the source code that's actually running on your site (even without malice, it could for example be outdated against the deployed version), it probably won't contain the local configuration files and setup scripts that would allow me to duplicate the service. And if I just want to study how the program is running in actuality, there is not much I can do.

Giving everyone SSH access to the box is probably not a good idea, and won't really solve all the issues anyway. In the future, when virtualization is standardized, ubiquitous, and awesome, one might imagine that a packaging of a web service won't be "put these files on the file system and reload a daemon" but instead "put these files and this configuration on that machine and activate it". This might give rise to a new generation of Linux "distributors". Getting the source tarball or "source package" might then involve getting a snapshot of that image, which you can examine, modify, and redeploy elsewhere. That could work for OpenStreetMap, for example, modulo the space and time required for their massive database. (But you might chose to fork only the code, not the data.) But it won't be easy to do the right thing in many cases, because with a web service, there is usually other people's data on the machine as well, which would need to be masked out or something. Maybe this really can't be done correctly, and the future will be more distributed, like in the way Jabber attempted to supplant centralized services such as ICQ. Distributed web mail makes sense, distributed OpenStreetMap perhaps less so.

Ideas anyone? Does anyone perhaps have experiences with running a web service that attempts to give users the freedoms and practical benefits that are usually associated with locally installed software?

There is an interesting conversation over at about the nature of peer production, and crowd based production over at PBS. Thankfully folks right off the bat noted that the types of activities they are addressing that range from 4chan to open source are so freaken distinct that perhaps it is not all that useful to use one moniker for them. The comments I am most fascinated by are danah s who notes:

We assume that the collective voice will be populist and, more importantly, that it will reflect the diversity of the populous. Yet, as we ve seen time and time again, certain values and attitudes and voices are over-represented in crowd-sourced activities. Who is looking out for those who aren t represented? In what ways are we reinforcing structural inequalities? What are the implications of this?

And then Clay s response:

So, to re-ask your question in a non-rhetorical way, under what
circumstances would we want to make the population of Deviant Art,
say, less white, or Linux less male, and if we wanted to do so, what
would need to happen?

What I find interesting about this discussion (and will be talking about this topic here, next week) is there not enough recognition of two related things: 1) the efforts are there (more on this soon) 2) that perhaps hacking and F/OSS in particular are not fully accessible to all and everyone because they are full-fledged, full-bodied, cultural worlds and all cultural worlds are to some degree not fully accessible and transparent for there are built on particularities, often invisible and unarticulated, forms of value. That is, just as some norms and values of Indo-Guyanese to take one random example, are not of my world, so too is hacking partially inaccessible for the fact that it is culturally configured. But I am starting to suspect that the culture-ness of these domains are often overlooked because they are overwhelmingly white, male, and chock full of computers (and so economically lucrative). All three, I suspect are (incorrectly) seen as lacking culture, as domains of rationality. (I stand rightly corrected and also forget this very fact, though I know it well from all the Brazil/Latin America Debconfs, as this diversity gets a bit lost from a pure US-European perspective, which I was assuming). Other historical factors have also produced certain distortions that don t allow us to see (easily at least) these worlds as culture-full. First is the fact that so many folks outside of this world lobbed onto F/OSS for being radical (and this is partially right in so far as its challenge to intellectual property can be seen as radical). But the portrayal or mere suggestion of these worlds as uber-democratic and populist, made people expect these groups to behave as radical egalitarian collectives. For the most part, they don t and yet never portrayed their own politics and forms of organization as such (openness comes in the form of code and technical merit). But this vision stuck and when some folks realized that larger projects, for example are very organized (which many people addressed only very late), have hierarchies (which are flexible and also allow them to function, which is I think is a good thing), and are not as diverse, there was deep disappointment that they did not conform to the sense that there was something extremely radical going on as opposed to a cultural group really into producing free software. But if I am offering a cultural alibi of sorts in which barriers to participation are to some degree a function of culture, one of the great things about the norms, values, ideas that compose culture is that there are dynamic and changing. They are alive and historical. They are pushed and pulled upon by insiders and outsiders based on wider social values. And there is an answer to these questions about diversity for there has been a dramatic, noticeable, and noteworthy push within this world, one that really started to coalesce I would say in the last year or so, to address these issues and it ranges from Python s mammoth efforts at addressing diversity (and I have been told that there was a great speech on the topic at Pycon recently), the geek feminism wiki, and smaller but increasingly common efforts such as Libre Planet s women s caucus and their funding of women to participate. So while I do think that culture goes at least part of the way to explain why these worlds are not fully open for culture limits this very domain has grown dissatisfied with its representational make-up and are leading some efforts for cultural change.

There is an interesting conversation over at about the nature of peer production, and crowd based production over at PBS. Thankfully folks right off the bat noted that the types of activities they are addressing that range from 4chan to open source are so freaken distinct that perhaps it is not all that useful to use one moniker for them. The comments I am most fascinated by are danah s who notes:

We assume that the collective voice will be populist and, more importantly, that it will reflect the diversity of the populous. Yet, as we ve seen time and time again, certain values and attitudes and voices are over-represented in crowd-sourced activities. Who is looking out for those who aren t represented? In what ways are we reinforcing structural inequalities? What are the implications of this?

And then Clay s response:

So, to re-ask your question in a non-rhetorical way, under what
circumstances would we want to make the population of Deviant Art,
say, less white, or Linux less male, and if we wanted to do so, what
would need to happen?

What I find interesting about this discussion (and will be talking about this topic here, next week) is there not enough recognition of two related things: 1) the efforts are there (more on this soon) 2) that perhaps hacking and F/OSS in particular are not fully accessible to all and everyone because they are full-fledged, full-bodied, cultural worlds and all cultural worlds are to some degree not fully accessible and transparent for there are built on particularities, often invisible and unarticulated, forms of value. That is, just as some norms and values of Indo-Guyanese to take one random example, are not of my world, so too is hacking partially inaccessible for the fact that it is culturally configured. But I am starting to suspect that the culture-ness of these domains are often overlooked because they are overwhelmingly white, male, and chock full of computers (and so economically lucrative). All three, I suspect are (incorrectly) seen as lacking culture, as domains of rationality. (I stand rightly corrected and also forget this very fact, though I know it well from all the Brazil/Latin America Debconfs, as this diversity gets a bit lost from a pure US-European perspective, which I was assuming). Other historical factors have also produced certain distortions that don t allow us to see (easily at least) these worlds as culture-full. First is the fact that so many folks outside of this world lobbed onto F/OSS for being radical (and this is partially right in so far as its challenge to intellectual property can be seen as radical). But the portrayal or mere suggestion of these worlds as uber-democratic and populist, made people expect these groups to behave as radical egalitarian collectives. For the most part, they don t and yet never portrayed their own politics and forms of organization as such (openness comes in the form of code and technical merit). But this vision stuck and when some folks realized that larger projects, for example are very organized (which many people addressed only very late), have hierarchies (which are flexible and also allow them to function, which is I think is a good thing), and are not as diverse, there was deep disappointment that they did not conform to the sense that there was something extremely radical going on as opposed to a cultural group really into producing free software. But if I am offering a cultural alibi of sorts in which barriers to participation are to some degree a function of culture, one of the great things about the norms, values, ideas that compose culture is that there are dynamic and changing. They are alive and historical. They are pushed and pulled upon by insiders and outsiders based on wider social values. And there is an answer to these questions about diversity for there has been a dramatic, noticeable, and noteworthy push within this world, one that really started to coalesce I would say in the last year or so, to address these issues and it ranges from Python s mammoth efforts at addressing diversity (and I have been told that there was a great speech on the topic at Pycon recently), the geek feminism wiki, and smaller but increasingly common efforts such as Libre Planet s women s caucus and their funding of women to participate. So while I do think that culture goes at least part of the way to explain why these worlds are not fully open for culture limits this very domain has grown dissatisfied with its representational make-up and are leading some efforts for cultural change.

Version 0.7.8 of the Rcpp R / C++ interface classes is now on CRAN and in Debian. As of right now. Debian has already built packages for eight more architectures; and CRAN has built the Windows binary. Oh, and cran2deb had Debian packages for 'testing' before I was done with the blog entry. This is a minor feature release based on a over three weeks of changes that are summarised below in the extract from the NEWS file. Some noteworthy highlights are

• something that isn't there: we have split most of the example code and their manual pages off into a new package RcppExamples which can now be released given that 0.7.8 is out
• another new package RcppArmadillo will also be forthcoming shortly: it shows how to use Rcpp with Conrad Sanderson's excellent Armadillo C++ library for linear algebra; this required some internal code changes to seamlessly pass data from R via Rcpp to Armadillo and back;
• there is a new example fastLm using Armadillo for faster (than lm() or lm.fit()) linear model fits
• yet more internal improvements to the class hierarchy as detailed below; more support for STL iterators and algorithms;
• more build fixes; paths with spaces in the name should now be tolerated
• and last but not least a new introduction / overview vignette based on a just-submitted paper on Rcpp.

The full NEWS entry for this release follows:

0.7.8   2010-03-09
    o	All vector classes are now generated from the same template class
    	Rcpp::Vector<int rtype="RTYPE"> where RTYPE is one of LGLSXP, RAWSXP, STRSXP,
    	INTSXP, REALSXP, CPLXSXP, VECSXP and EXPRSXP. typedef are still 
    	available : IntegerVector, ... All vector classes gain methods 
    	inspired from the std::vector template : push_back, push_front, 
    	erase, insert
    	
    o	New template class Rcpp::Matrix<rtype> deriving from 
    	Rcpp::Vector<rtype>. These classes have the same functionality
    	as Vector but have a different set of constructors which checks
    	that the input SEXP is a matrix. Matrix<rtype> however does/can not
    	guarantee that the object will allways be a matrix. typedef 
    	are defined for convenience: Matrix<intsxp> is IntegerMatrix, etc...
    	
    o	New class Rcpp::Row<int rtype="RTYPE"> that represents a row of a matrix
    	of the same type. Row contains a reference to the underlying 
    	Vector and exposes a nested iterator type that allows use of 
    	STL algorithms on each element of a matrix row. The Vector class
    	gains a row(int) method that returns a Row instance. Usage 
    	examples are available in the runit.Row.R unit test file
    	
    o	New class Rcpp::Column<int rtype="RTYPE"> that represents a column of a 
    	matrix. (similar to Rcpp::Row<int rtype="RTYPE">). Usage examples are 
    	available in the runit.Column.R unit test file
    o	The Rcpp::as template function has been reworked to be more 
    	generic. It now handles more STL containers, such as deque and 
    	list, and the genericity can be used to implement as for more
    	types. The package RcppArmadillo has examples of this
    o   new template class Rcpp::fixed_call that can be used in STL algorithms
	such as std::generate.
    o	RcppExample et al have been moved to a new package RcppExamples;
        src/Makevars and src/Makevars.win simplified accordingly
    o	New class Rcpp::StringTransformer and helper function 
    	Rcpp::make_string_transformer that can be used to create a function
    	that transforms a string character by character. For example
    	Rcpp::make_string_transformer(tolower) transforms each character
    	using tolower. The RcppExamples package has an example of this.
        
    o	Improved src/Makevars.win thanks to Brian Ripley
    o	New examples for 'fast lm' using compiled code: 
        - using GNU GSL and a C interface
        - using Armadillo (http://arma.sf.net) and a C++ interface
        Armadillo is seen as faster for lack of extra copying
    o	A new package RcppArmadillo (to be released shortly) now serves 
        as a concrete example on how to extend Rcpp to work with a modern 
	C++ library such as the heavily-templated Armadillo library
    o	Added a new vignette 'Rcpp-introduction' based on a just-submitted 
        overview article on Rcpp

As always, even fuller details are in the ChangeLog on the Rcpp page which also leads to the downloads, the browseable doxygen docs and zip files of doxygen output for the standard formats. A local directory has source and documentation too. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page

Update: Two links corrected.

In a comment on my post Shared Objects and Big Applications about memlockd [1] mic said that they use memlockd to lock the entire root filesystem in RAM. Here is a table showing my history of desktop computers with the amounts of RAM, disk capacity, and CPU power available. All systems better than a 386-33 are laptops a laptop has been my primary desktop system for the last 12 years. The columns for the maximum RAM and disk are the amounts that I could reasonably afford if I used a desktop PC instead of a laptop and used the best available technology of the day I m basing disk capacity on having four hard drives (the maximum that can be installed in a typical PC without extra power cables and drive controller cards) and running RAID-5. For the machines before 2000 I base the maximum disk capacity on not using RAID as Linux software RAID used to not be that good (lack of online rebuild for starters) and hardware RAID options have always been too expensive or too lame for my use.

Year	CPU	RAM	Disk	Maximum RAM	Maximum Disk
1988	286-12	4M	70M	4M	70M
1993	386-33	16M	200M	16M	200M
1998	Pentium-M 233	96M	3G	128M	6G
1999	Pentium-2 400	256M	6G	512M	40G
2000	Pentium-2 600	384M	10G	512M	150G
2003	Pentium-M 1700	768M	60G	2048M	400G
2009	Pentium-M 1700	1536M	100G	8192M	4500G
2010	Core 2 Duo T7500 2200	5120M	100G	8192M	6000G

The above graph shows how the modern RAM capacities have overtaken older disk capacities. So it seems that a viable option on modern systems is to load everything that you need to run into RAM. Locking it there will save spinning up the hard drive on a laptop. With a modern laptop it should be possible to lock most of the hard drive contents that are regularly used (IE the applications) into RAM and run with /home on a SD flash storage device. Then the hard drive would only need to be used if something uncommon was accessed or if something large (like a movie) was needed. It also shows that there is potential to run diskless workstations that copy the entire contents of their root filesystem when they boot so that they can run independently of the server and only access the server for /home. Note that the size of the RAM doesn t need to be larger than the disk capacity of older machines (some of the disk was used for swap, /home, etc). But when it is larger it makes it clear that the disk doesn t need to be accessed for routine storage needs. I generated the graph with GnuPlot [2], the configuration files I used are in the directory that contains the images and the command used was gnuplot command.txt . I find the GnuPlot documentation to be difficult to use so I hope that this example will be useful for other people who need to produce basic graphs I m not using 1% of the GnuPlot functionality.

• [1] http://etbe.coker.com.au/2009/12/19/shared-objects-and-big-applications/
• [2] http://www.gnuplot.info/

Almost nothing interesting happened recently in X.org in Debian. But interesting things are coming soon.
First, radeon KMS and DRI2 will enter unstable soon. xserver-xorg-video-radeon 1:6.12.191-1 is currently in experimental. People seem to be happy with it so far, and upstream is taking very good care of bug reports as usual. The next 2.6.32 kernel will contain DRM from 2.6.33. It first means that the radeon KMS driver not in staging anymore. Once this new kernel is uploaded, I'll put the new xserver-xorg-video-radeon in unstable (6.13.0 is expected soon, but 6.12.191 already looks good so far). DRM from 2.6.33 will also brings nouveau support. It means that we will build libdrm-nouveau and upload a new xserver-xorg-video-nouveau. However, it also means that we need somebody to maintain this. And nobody in the team has a nvidia board to test packages so... If you want nouveau in Debian, please help.
While waiting for all these, we have been triaging the BTS a bit. Kibi is helping a lot by triaging recent intel bugs (many regressions fixed in recent kernels). I spent some time during the week-end triaging some old bugs. I closed more than a hundred of them, and pinged another hundred. We still have more than 1100 bugs open. It is not so bad compared to 1500-2000 when nobody maintains X (aka often), but still way too much. Some of my bug closing might look a bit rude. But we had so many bug reports a couple years ago that are irrelevant today. Keeping them open would be meaningless. For instance, many input problems are obsolete since a lot of the input code was rewritten, we switched to input-hotplug, and then hal to udev. Another example is intel lockups (we had a lot of them after driver 2.2 arrived). But XAA and EXA were dropped in favor of UXA, DRI1 was dropped for DRI2, and KMS arrived. So it's useless to keep these obsolete and irrelevant bugs that cannot be debugged nowadays.
As usual, the Debian X team needs a lot of help. Again, if you want nouveau in Debian, please help.

I finally got a few hours free this morning to check an item off my home system administration checklist: upgrading the wireless router's firmware to OpenWRT. There were a couple motivations for this, including the fact that my SoundBridge Radio couldn't maintain a connection to my firefly server using the built-in firmware, and I had read that OpenWRT would work better. Since this is posted on Planet Debian, I should mention why I didn't use DebianWRT. The basic answer is this text at the top of the DebianWRT homepage:

Currently the most common methods used to run Debian on these systems is to install OpenWRT or a similar firmware, add disk space either by USB storage or NFS, create a debian chroot by either running cdebootstrap from inside OpenWRT or debootstrap --foreign on a PC, and running Debian from this chroot. For example, instructions for the WLHDD.

I'm not sure whether this is because DebianWRT is experimental, or because its goal is to use routers as cheap general computers. Either way, it sounds way too complicated and/or fragile for what I'm interested in (i.e., a wireless router with better software). The goal here is to get something that does a better job than the built-in WRT firmware, but doesn't require too much tinkering to get working or to maintain. I have plenty of outlets for my tinkering urges already. Nothing here was exactly difficult, but it was hard to find all the information I needed to get things working. Hopefully documenting the steps I went through here will save someone else some time. Step 1: acquire the firmware This was trickier than you might think. If you click on the download link at the OpenWRT web site, you end up at the top of an FTP server populated with a vast quantity of stuff. Worse, when you find the actual firmware images, you'll quickly discover that there are piles and piles of them divided between sixteen directories, and no guidance as to which one to pick. And picking the wrong one will turn your beautiful router into a doorstop. Luckily, the OpenWRT documentation contains a section called "Getting Started". Unluckily, that section consists of the following text:

1.1 Getting started 1.1.1 Installation 1.1.2 Initial configuration 1.1.3 Failsafe mode

Whoops, someone forgot to execute on a TODO. Undeterred, I consulted the usual fallback reference, Google. It pointed me at several references, some of which were hidden on other parts of the OpenWRT site. Armed with these, I was able to determine that:

1. My WRT54GL v1.1 probably uses a Broadcom 5352 chipset.
2. The correct firmware, according to multiple sources, is probably in the kamikaze top-level director, the latest version's subdirectory, and the bcrm-2.4 directory under the version (the link is to 8.09.2, which is current as of March 6, 2010). Apparently the bcrm47xx directory doesn't have wireless support; it helpfully contains a file called NO-BROADCOM-WIRELESS to warn you off, but unhelpfully doesn't include any additional information in that file (like what exactly is broken or that you can find a working firmware in a sibling directory) ... oh well.
3. The firmware file that you want is openwrt-wrt54g-squashfs.bin, even though it doesn't match the model number of the router. This directory could use a README file explaining which hardware is supported by each of the dozen or so firmware files it contains.

Step 2: install the firmware After Step 1, this was a real relief. I just used the built-in Linksys firmware installer, pointed it at the .bin file, and it went. Step 3: configure the router The installation guide I followed was pretty much silent about what to do after I got the firmware on. Luckily, this is just a software problem, meaning it's much more familiar territory for me.

1. First things first: I checked that I could still get a DHCP lease. It worked.
2. Armed with that, I tried telneting to the router. I used the resulting root prompt to set a password on the root account.
3. I logged out and tried telneting in. Apparently the router is configured to disallow root logins over telnet if you don't have a password. Good for them (although why allow telnet at all?); oops for me.
4. Luckily, an ssh server was installed by default. I like using keys to log in, so I tracked down the documentation on configuring the server to use public-key authentication; it turns out there's a single global key file named /etc/dropbear/authorized_keys that's exactly like OpenSSH's per-user authorized_keys file. No idea what would happen if I had multiple users, but I won't.
5. The next obstacle: I didn't have an Internet connection. For some reason, my cable modem didn't want to give the router a DHCP lease. On the off-chance that it was remembering too much, I rebooted it and ran ifup wan. That fixed the problem. I still don't know why.
6. Not a step, but a useful note: in the process of figuring the above out, I found readlog. It's basically dmesg for syslog files; it shows the most recent lines written to syslog. This is useful because there isn't a real syslog file, due to the fact that there would be no room to store it on the 54GL.
7. Finally, I had to get wireless working. The documentation is very helpful when it comes to describing the syntax of the wireless configuration. Unfortunately, I read the list of encryption options and missed the section right below where their meanings are explained (although, to be honest, I might not have understood the implications of the explanation without the research I did anyway).

   option encryption none, wep, psk, psk2, wpa, wpa2

   I wanted WPA2 encryption, so I entered wpa2. And nothing worked. After a good hour of trying different options on the client, swapping software components in and out on the router, experimenting with the encryption key syntax, and crawling Google, I finally found my answer. If you just want WPA2 encryption, you must not use wpa2 as the encryption type. Instead, use psk2. It turns out out that wpa2 actually means use WPA2 and also use an external RADIUS server for authentication. psk2 is the system you're familiar with from a typical consumer wireless router.

Step 4: enjoy And with that, it works. Unfortunately, contrary to what I wrote here originally, my Roku still doesn't work. On the other hand, having a real Linux installation is helpful for debugging it. Currently my suspicion is that the router isn't passing multicast packets between the wired and wireless interfaces (broadcast works fine, multicast doesn't). That said, it seems like if I restart Firefly just before I start playing music, I can play reasonably reliably -- as long as I don't stop, because if I do, the Roku forgets that the music server is there. Either way, I've spent about as much time fighting this as I can afford. One lingering worry I have is security; unlike Debian, which has both a security mailing list and tools to inform me when I need to install a security update, the OpenWRT firmware doesn't seem to have any mechanism for distributing security notices. True, there is an openwrt-security-announce list, but it appears to be entirely unused, as is openwrt-announce. Something to keep an eye on, then. Also (file under note to self), I need to remember to verify that the router isn't exposing services to the outside world. The default iptables configuration is hideously complex; with just a quick glance, it could be setting up a floral shop for all I can tell. I'll need to test this empirically and maybe analyze the rules in more depth.

The Opera-Mini Dispute I have just read an interesting article about the Opera browser [1]. The article is very critical of Opera-Mini on the iPhone for many reasons most of which don t interest me greatly. There are lots of technical trade-offs that you can make when designing an application for a constrained environment (EG a phone with low resolution and low bandwidth). What does interest me is the criticism of the Opera Mini browser for proxying all Internet access (including HTTPS) through their own servers, this has been getting some traction around the Internet. Now it is obvious that if you have one server sitting on the net that proxies connections to lots of banks then there will be potential for abuse. What apparently isn t obvious to as many people is the fact that you have to trust the application. Causes of Software Security Problems When people think about computer security they usually think about worms and viruses that exploit existing bugs in software and about Trojan horse software that the user has to be tricked into running. These are both significant problems. But another problem is that of malicious software releases. I think that this is significantly different from Trojan horses because instead of having an application which was written for the sole purpose of tricking people (as is most similar to Greek history) you have an application that was written by many people who genuinely want to make a good product but you have a single person or small group that hijacks it. Rumor has it that rates well in excess of $10,000 are sometimes paid for previously unknown security vulnerabilities in widely used software. It seems likely that a programmer who was in a desperate financial situation could bolster their salary by deliberately putting bugs in software and then selling the exploits, this would not be a trivial task (making such bugs appear to be genuine mistakes would take some skill) but there are lots of people who could do it and plausibly deny any accusation other than carelessness. There have been many examples of gambling addicts who have done more foolish things to fund their habit. I don t think it s plausible to believe that every security flaw which has been discovered in widely used software was there purely as the result of a mistake. Given the huge number of programmers who have the skill needed to deliberately introduce a security flaw into the source of a program and conceal it from their colleagues I think it s quite likely that someone has done so and attempted to profit from it. Note that even if it could be proven that it was impossible to profit from creating a security flaw in a program that would not be sufficient to prove that it never happened. There is plenty of evidence of people committing crimes in the mistaken belief that it would be profitable for them. Should We Trust a Proprietary Application or an Internet Server? I agree with the people who don t like the Opera proxy idea, I would rather run a web browser on my phone that directly accesses the Internet. But I don t think that the web browser that is built in to my current smart-phone is particularly secure. It seems usual for a PC to need a security update for the base OS or the web browser at least once a year while mobile phones have a standard service life of two years without any updates. I suspect that there is a lot of flawed code running on smart phones that never get updated. It seems to me that the risks with Opera are the single point of failure of the proxy server in addition to the issues of code quality while the risks with the browser that is on my smart-phone is just the quality of the code. I suspect that Opera may do a better job of updating their software to fix security issues so this may mitigate the risk from using their proxy. At the moment China is producing a significant portion of the world s smart-phones. Some brands like LG are designed and manufactured in China, others are manufactured in China for marketing/engineering companies based in Europe and the US. A casual browse of information regarding Falun Gong makes the character of the Chinese leadership quite clear [2], I think that everything that comes out of China should be considered to be less trustworthy than equivalent products from Europe and the US. So I think that anyone who owns a Chinese mobile phone and rails against the Opera Mini hasn t considered the issue enough. I don t think it s possible to prove that an Opera Mini with it s proxy is more or less of a risk than a Chinese smart-phone. I m quite happy with my LG Viewty [3] but I wouldn t use it for Internet banking or checking my main email account. Also we have to keep in mind that mobile phones are really owned by telephone companies. You might pay for your phone or even get it unlocked so you can run it on a different network, but you won t get the custom menus of your telco removed. Most phones are designed to meet the needs of telcos not users and I doubt that secure Internet banking is a priority for a telco. Update: You can buy unlocked mobile phones. But AFAIK the Android is the only phone which might be described as not being designed for the needs of the telcos over the needs of the users. So while you can get a phone without custom menus for a telco, you probably can t get a phone that was specifically designed for what you want to do. The Scope of the Problem Mobile phones are not the extent of the problem, I think that anyone who buys a PC from a Chinese manufacturer and doesn t immediately wipe the hard drive and do a fresh OS install is taking an unreasonable risk. The same thing goes for anyone who buys a PC from a store where it s handled by low wage employees, I can imagine someone on a minimum income accepting a cash payment to run some special software on every PC before it goes out the door that wouldn t be any more difficult or risky than the employees who copy customer credit card numbers (a reasonably common crime). It s also quite conceivable that any major commercial software company could have a rogue employee who is deliberately introducing bugs into it s software. That includes Apple. If the iPhone OS was compromised before it shipped then the issue of browser security wouldn t matter much. I agree that having the minimum possible number of potential security weak points is a good idea. They should allow Opera Mini users to select that HTTPS traffic should not be proxied. But I don t think that merely not using a proxy would create a safe platform for Internet banking. In terms of mobile phones most things are done in the wrong way to try and get more money out of the users. Choose whichever phone or browser you want and it will probably still be a huge security risk. Harald Welte is doing some really good work on developing free software for running a GSM network [4]. But until that project gets to the stage of being widely usable I think that we just have to accept a certain level of security risk when using mobile phones.

• [1] http://counternotions.com/2010/02/18/mini/
• [2] http://www.faluninfo.net/
• [3] http://etbe.coker.com.au/2009/05/31/lg-u990-viewty/
• [4] http://laforge.gnumonks.org/weblog/2010/02/13/#20100213-six_weeks_to_bcch

I guess it's time to finally announce libopenstm32, a Free Software firmware library for STM32 ARM Cortex-M3 microcontrollers me and a few other people have been working on in recent weeks. The library is licensed under the GNU GPL, version 3 or later (yes, that's an intentional decision after some discussions we had). The code is available via git:

 $ git clone git://libopenstm32.git.sourceforge.net/gitroot/libopenstm32/libopenstm32
 $ cd libopenstm32
 $ make

Building is done using a standard ARM gcc cross-compiler (arm-elf or arm-none-eabi for instance), see the summon-arm-toolchain script for the basic idea about how to build one. The current status of the library is listed in the wiki. In short: some parts of GPIOs, UART, I2C, SPI, RCC, Timers and some other basic stuff works and has register definitions (and some convenience functions, but not too many, yet). We're working on adding support for more subsystems, any help with this is highly welcome of course! Luckily ARM stuff (and especially the STM32) has pretty good (and freely available) datasheets. We have a few simple example programs, e.g. for the Olimex STM32-H103 eval board (see photo). JTAG flashing can be done using OpenOCD, for example. Feel free to join the mailing lists and/or the #libopenstm32 IRC channel on Freenode. The current list of projects where we plan to use this library is Open-BLDC (an Open Hardware / Free Software brushless motor controller project by Piotr Esden-Tempski), openmulticopter (an Open Hardware / Free Software quadrocopter/UAV project), openbiosprog (an Open Hardware / Free Software BIOS chip flash programmer I'm in the process of designing using gEDA/PCB), and probably a few more. If you plan to work on any new (or existing) microcontroller hardware- or software-projects involving an STM32 microcontroller, please consider using libopenstm32 (it's the only Free Software library for this microcontroller family I know of) and help us make it better and more complete. Thanks!

I spent the day working with Daniel. He has been trying to get the correct runes for a GCC build in a strange environment. Turns out all he needed was me to throw stupid ideas at him until one caused him to examine some of the generated intermediate symbol maps...

(This has ended up longer than I intended, largely because I felt I should then get into why. I'm aware I haven't got into all the nuances, so I hope readers familiar with the area will appreciate this is the compact version.)

Thorsten had a rant last week about PGP keysigning problems. He apologises for his tone, but that's not the issue I take with his rant.

It starts "Keysigning is useless". And yet his complaints seem to be:

• Dealing with the private half of your GPG key securely involves some faff (in this case booting with a live CD and having to set things up ready to keysign).
• He doesn't get on with caff.
• People reject email from machines with invalid HELOs and perform other anti spam measures on ISP access ranges (I'm not clear if it's just greylisting or outright rejects as that's not made clear).
• PGP/MIME is a protocol violation (yes, but it's much better than inline OpenPGP. Unless you have to deal with RT, which mangles it. *sigh*)

None of these seem to actually be about keysigning being useless. The process of doing it, maybe, though he misses the main valid rant about this I'd have, which is that most mass keysignings don't actually allow you to accurately verify the identity of other participants unless you already know them reasonably well. (The LCA2010 keysigning and DebConf5 in Helsinki spring to mind as 2 good examples of bad keysignings I've attended, but speaking to others suggests it's far from an isolated thing.)

Torsten does say that he'll continue to do keysigning on a per-person basis, so it doesn't sound like he's completely given up. I'm posting this largely so other Debian related people don't get the idea that it's not important to think about keysigning.

Why should we care?

Firstly, let's clarify what I mean when I sign someone else's key. If I sign your key then I think that I believe you hold the private part of a key that has your name and an email address I believe I can use to contact you on it. It means I have seen government issued ID that matches that name. It also means that I have interacted with you (and watched others interact with you) under that persona. In short I am happy that the key is a reasonable digital representation of your identity - something signed by it either comes from you or has involved the key being compromised or you coerced into using it against your will.

Why is this useful?

It gets useful thanks to the web of trust; ie the idea that there are a bunch of people I trust partially to sign other keys, and if enough of them have signed a key then I can have a reasonable expectation that the key belongs to the person I want to talk to. Which means I might be prepared to send private data to them. Or Debian might be prepared to accept an upload from them. Which, when you're dealing with a community that spans the planet and where most of the contributors haven't met each other, is pretty freakin' useful - I, as part of Debian's keyring team, don't need to personally be able to identify every Debian developer. All I need to do is be able to trust other DDs to be able to do so. (Though maybe I'm missing out on something here - perhaps Debian should be paying for Gunnar and me to travel the world verifying fingerprints. \o/)

(I still do mass keysignings btw. I'm picky about which keys I actually sign - this is in no way intended as a slight against those I don't, but a mass keysigning at least lets me know that the people involved are happy to exchange fingerprints. Though, FWIW, I normally have ID on me and frequently have fingerprint slips, so if you know me and want me to sign your key/want to sign mine then by all means ask me when you see me!)

Protecting our privacy is important. For example, I wouldn't like if my mailing list subscriptions get known to anybody else (except the relevant listmasters of course as part of their job), for the simple reason that this is just my own decisions which lists I get mail from (and read, but that's not necessarily the same). This is an classical example of "personal information are handed out on a need-to-know-basis" (like to listmasters if necessary), and is also in line with european laws (I don't know the legal situation in other parts of the world enough). Now, publishing mailing list subscriptions hased sounds like an good idea to protect privacy. But if thinking twice, this just doesn't work. Most peoples subscription addresses could be known by other means or are even the addresses they use for sending mails (some systems even enforce this). So this is a huge privacy fail. Getting back to debian, and speaking the obvious out: The new interface to udd is just broken and wrong. Please remove all my adresses from being displayed, either in direct or hashed form, even in restricted mode. Thanks.

Here are some more examples of libguestfs usage: What kernels, modules and packages are in a (currently powered off) libvirt based virtual machine vmfoo:

virt-inspector -c qemu:///system vmfoo

Show free space in virtual machine vmfoo:

virt-df -c qemu:///system vmfoo

List file systems:

virt-list-filesystems -c qemu:///system -l vmfoo

Edit /etc/passwd in vmfoo:

virt-edit -c qemu:///system lenny-base-clone /etc/passwd

Tell guestfish to mount all filesystems of virtual machine vmfoo for more complex inspection and manipulation tasks like LVM operations, partitioning, resizing or filesystem check or creation:

guestfish $(virt-inspector -c qemu:///system --ro-fish vmfoo)

Debian packages are still on alioth.

The Debian Packages Tracking System has a great feature: you can subscribe to packages that matter to you, and be informed of all uploads, bugs, testing migrations, etc. However, when (co-)maintaining a lot of packages, it is easy to forget to subscribe. And then you might miss important information about your packages (uploaders don t receive bugmail by default, for example). Since PTS subscriptions are now imported into Ultimate Debian Database, it is easy to find out if you missed some subscriptions. It s just a matter of going to http://udd.debian.org/cgi-bin/pts-check.cgi and entering your email! And for those concerned with privacy, it should be noted that the unauthenticated access to UDD only gives you the hash of the subscribers emails. You need to be a DD, and use the guestdd account to see the email addresses (which DDs can already see on master.d.o).