There is an interesting conversation over at about the nature of peer production, and crowd based production over at PBS. Thankfully folks right off the bat noted that the types of activities they are addressing that range from 4chan to open source are so freaken distinct that perhaps it is not all that useful to use one moniker for them. The comments I am most fascinated by are danah s who notes:

We assume that the collective voice will be populist and, more importantly, that it will reflect the diversity of the populous. Yet, as we ve seen time and time again, certain values and attitudes and voices are over-represented in crowd-sourced activities. Who is looking out for those who aren t represented? In what ways are we reinforcing structural inequalities? What are the implications of this?

And then Clay s response:

So, to re-ask your question in a non-rhetorical way, under what
circumstances would we want to make the population of Deviant Art,
say, less white, or Linux less male, and if we wanted to do so, what
would need to happen?

What I find interesting about this discussion (and will be talking about this topic here, next week) is there not enough recognition of two related things: 1) the efforts are there (more on this soon) 2) that perhaps hacking and F/OSS in particular are not fully accessible to all and everyone because they are full-fledged, full-bodied, cultural worlds and all cultural worlds are to some degree not fully accessible and transparent for there are built on particularities, often invisible and unarticulated, forms of value. That is, just as some norms and values of Indo-Guyanese to take one random example, are not of my world, so too is hacking partially inaccessible for the fact that it is culturally configured. But I am starting to suspect that the culture-ness of these domains are often overlooked because they are overwhelmingly white, male, and chock full of computers (and so economically lucrative). All three, I suspect are (incorrectly) seen as lacking culture, as domains of rationality. (I stand rightly corrected and also forget this very fact, though I know it well from all the Brazil/Latin America Debconfs, as this diversity gets a bit lost from a pure US-European perspective, which I was assuming). Other historical factors have also produced certain distortions that don t allow us to see (easily at least) these worlds as culture-full. First is the fact that so many folks outside of this world lobbed onto F/OSS for being radical (and this is partially right in so far as its challenge to intellectual property can be seen as radical). But the portrayal or mere suggestion of these worlds as uber-democratic and populist, made people expect these groups to behave as radical egalitarian collectives. For the most part, they don t and yet never portrayed their own politics and forms of organization as such (openness comes in the form of code and technical merit). But this vision stuck and when some folks realized that larger projects, for example are very organized (which many people addressed only very late), have hierarchies (which are flexible and also allow them to function, which is I think is a good thing), and are not as diverse, there was deep disappointment that they did not conform to the sense that there was something extremely radical going on as opposed to a cultural group really into producing free software. But if I am offering a cultural alibi of sorts in which barriers to participation are to some degree a function of culture, one of the great things about the norms, values, ideas that compose culture is that there are dynamic and changing. They are alive and historical. They are pushed and pulled upon by insiders and outsiders based on wider social values. And there is an answer to these questions about diversity for there has been a dramatic, noticeable, and noteworthy push within this world, one that really started to coalesce I would say in the last year or so, to address these issues and it ranges from Python s mammoth efforts at addressing diversity (and I have been told that there was a great speech on the topic at Pycon recently), the geek feminism wiki, and smaller but increasingly common efforts such as Libre Planet s women s caucus and their funding of women to participate. So while I do think that culture goes at least part of the way to explain why these worlds are not fully open for culture limits this very domain has grown dissatisfied with its representational make-up and are leading some efforts for cultural change.

Last night, in two different instances I read the claim that the England s first copyright act, the statute of Anne passed in 1710 was never intended to protect authors but to protect the reproducers like printing houses and presses investing in authors implying that printing houses loved the act. After pouring through hundreds of pages of Adrian John s history of piracy, that statement is pretty off and in fact I don t think the Statute was really about printers/booksellers or authors but the public. While licensing had all together lapsed for a period before this statute was passed, and the printing houses and book sellers were indeed clamoring loudly for an official recognition of property in literary works, they wanted a perpetuall right in literary property rooted in common and natural law. Like I am talking here about forever, not like a measly, paltry 14 years. They were not exactly thrilled at this statute (in fact, they were downright pissssssssed off) for it severely limited how long they held a property right over books. In fact, so pissed were they, they challenged the statute, went to court in 1769 (Millar v Taylor) and got what they wanted: a perpetual right to literary work. It took s a fiery Scot and bookseller by the name of Alexander Donaldson (I kind of think of him as the RMS of booksellers; he was quite a rabble rouser) to challenge Millar and he finally got his day in the highest court of the land in 1774 in Donaldson v Beckett and the outcome was that a perpetual right in books was tossed out the window. The court ruled that copyright was a limited statute. One of the lords in the case even stated Knowledge has no value or use for the solitary owner: to be enjoyed it must be communicated. Adrian John s explains the significance of this case in the following way: Copyright, they decided, was not a right of man at all. Indeed, it was almost the very opposite: an artifact, and one that replaced a prior right established by an author s work of creation. . . In terms of revolution principles, liberty won out over property Again the printers booksellers (minus the pirate ones) were not happy a bunch. Unfortunately the subsequent history is one we all know well, one in which booksellers and others with vested interests in copyrights pushed to extend property rights in all sorts of ways to get to where we are today (obviously with a lot of different historical developments), a land, time, period where perpetuity may not be forever but it is long enough to nullify the very public domain envisioned by the first copyright act. However, I think it is nonetheless important to recognize how radical in many respects the first copyright act was: given what the book printers and sellers wanted (and they were a powerful bunch). For those interested in learning more about Alexander Donaldson, I would check out his Some Thoughts on the State of Literary Property, where he rails against the London booksellers for being monopolistic and calling for a limited property right in books.

Last night, in two different instances I read the claim that the England s first copyright act, the statute of Anne passed in 1710 was never intended to protect authors but to protect the reproducers like printing houses and presses investing in authors implying that printing houses loved the act. After pouring through hundreds of pages of Adrian John s history of piracy, that statement is pretty off and in fact I don t think the Statute was really about printers/booksellers or authors but the public. While licensing had all together lapsed for a period before this statute was passed, and the printing houses and book sellers were indeed clamoring loudly for an official recognition of property in literary works, they wanted a perpetuall right in literary property rooted in common and natural law. Like I am talking here about forever, not like a measly, paltry 14 years. They were not exactly thrilled at this statute (in fact, they were downright pissssssssed off) for it severely limited how long they held a property right over books. In fact, so pissed were they, they challenged the statute, went to court in 1769 (Millar v Taylor) and got what they wanted: a perpetual right to literary work. It took s a fiery Scot and bookseller by the name of Alexander Donaldson (I kind of think of him as the RMS of booksellers; he was quite a rabble rouser) to challenge Millar and he finally got his day in the highest court of the land in 1774 in Donaldson v Beckett and the outcome was that a perpetual right in books was tossed out the window. The court ruled that copyright was a limited statute. One of the lords in the case even stated Knowledge has no value or use for the solitary owner: to be enjoyed it must be communicated. Adrian John s explains the significance of this case in the following way: Copyright, they decided, was not a right of man at all. Indeed, it was almost the very opposite: an artifact, and one that replaced a prior right established by an author s work of creation. . . In terms of revolution principles, liberty won out over property Again the printers booksellers (minus the pirate ones) were not happy a bunch. Unfortunately the subsequent history is one we all know well, one in which booksellers and others with vested interests in copyrights pushed to extend property rights in all sorts of ways to get to where we are today (obviously with a lot of different historical developments), a land, time, period where perpetuity may not be forever but it is long enough to nullify the very public domain envisioned by the first copyright act. However, I think it is nonetheless important to recognize how radical in many respects the first copyright act was: given what the book printers and sellers wanted (and they were a powerful bunch). For those interested in learning more about Alexander Donaldson, I would check out his Some Thoughts on the State of Literary Property, where he rails against the London booksellers for being monopolistic and calling for a limited property right in books.

By the time this blog entry goes live I'll be running upon my new machine. The migration process was mostly straightfoward and followed my plan:

• Using my existing desktop system as a PXE server to install Lenny over the network.
• Copied over important directories.
• Restored backups.
• Turned off old machine.

Of course it wasn't that simple in practise, as previously mentioned the whole reason I was looking for a new machine was because the software RAID upon my old desktop was failing - One of the two drives was completely dead. As I'd feared the second drive failed partway through my migration. But thankfully I'd copied off the important stuff before then, and the backups I have off-site mostly covered everything else. (The things I lost were things I can find again such as ~/Music, ~/Videos. On the one hand they're too large to backup, on the other hand I should probably do it next time as they never change.) Unfortunately the version of X in Lenny refused to work with the GeForce G210 video card I had. To be more correct using the Vesa driver I could get a picture and a smooth desktop, but when watching videos with xine I got maybe two frames a second. Both the open nv driver and the closed nvidia driver failed to support the card - so I swapped hardware, and I'm now running with the GeForce 7300 GS card from my previous desktop. This allows me to watch videos at full-screen with no issues. (Desktop size is 1600x1200 FWIW). So now it's just a matter of tweaking the system. I've installed enough to be useful:

• miredo - So I have IPv6 connectivity despite Virgion.
• squid - So that I have a decent cache for surfing.
• pdnsd - So I have a caching nameserver and am not at the whim of Virgin.
• kvm - So I can setup scratch machines for play.

I've still got to setup pbuilder, but that'll be done shortly, and I've installed backported packages such that I can watch youtube videos. I'm currently running firefox from lenny but I expect that will change soon enough - not least because that version fails to support "adblockplus", only "adblock". Two partitions md0 for /boot and md1 used as LVM, from which I've taken /, /home, etc:

Filesystem                      Size    Used    Avail Use% Mounted on
/dev/mapper/birthday--vol-root   9.9G     2.8G   6.6G  30% /
/dev/mapper/birthday--vol-home   22G      4.3G  16G    22% /home
/dev/mapper/birthday--vol-music  127G    43G    78G    36% /mnt/music
/dev/md0                         988M    38M    901M    4% /boot
/dev/mapper/birthday--vol-kvm    22G      8.8G  12G    44% /mnt/kvm
/dev/sdg1                        163G    143G   12G    93% /media/disk
skx@birthday:~/hg/blog/data$

skx@birthday:~/hg/blog/data$ sudo pvs
[sudo] password for skx:
  PV         VG           Fmt  Attr PSize   PFree
  /dev/md1   birthday-vol lvm2 a-   464.82G 274.51G

Update: Three irritations with this machine:

1. As supplied the BIOS was set with "USB Mouse" and "USB Keyboard" set to "disabled". I had to beg the loan of a keyboard from a neighbour.
2. As supplied the BIOS had virtualisation set to "disabled". Not a huge shock, but it caught me out regardless.
3. As supplied the system had only a single SATA power connector. Annoying given that the motherboard is advertised as having "onboard RAID" and I'd purchased it with two hard drives. Happily I had a spare adaptor to hand.

I'd still recommend Novatech, but the last point had me swearing for a few minutes until I realised I did have a spare adaptor in the house. ObFilm: Chitty Chitty Bang Bang

Every year, at least one person asks me to run for DPL. I don't remember quite when this started, but it was more than five years ago. I have some standard responses: I don't have time to do a good job, and why commit if you know you can't do a good job? That's just irresponsible. Usually I get some feeble relativism back for that one. Oddly enough, this is the one year that I could actually make the time for it, but it is still not a good idea. Also I do not wish to self-nominate. I am told that everyone is too autistic to understand why, so I assume that by observing the timing of nominations (in specific, who stands at the beginning of the nomination period and who waits until close to the last minute), no moro-ethical conclusions will be drawn. To belabor this point: if the culture of self-nomination were fixed, I would actually nominate people I think would do a good job. At present, I cannot, and I resent that. Furthermore, you do not really want me as DPL. There are oodles and oodles of things I think are fundamentally flawed and I would try to fix them. I would not take advice from predecessors because I think that only perpetuates years of flawed DPL behavior. I would not entertain requests in private because there is far, far, far too much backroom discussion right now, and unfortunately it is actively encouraged and promoted by many people in power. Such departures would be extremely unpopular. I would be pleased if Stefano runs unopposed. I think that there is a good chance he will do a decent job.

The Threat Bruce Schneier s blog post about the Mariposa Botnet has an interesting discussion in the comments about how to make a secure system [1]. Note that the threat is considered to be remote attackers, that means viruses and trojan horses which includes infected files run from USB devices (IE you aren t safe just because you aren t on the Internet). The threat we are considering is not people who can replace hardware in the computer (people who have physical access to it which includes people who have access to where it is located or who are employed to repair it). This is the most common case, the risk involved in stealing a typical PC is far greater than the whatever benefit might be obtained from the data on it a typical computer user is at risk of theft only for the resale value of a second-hand computer. So the question is, how do can we most effectively use free software to protect against such threats? The first restriction is that the hardware in common use is cheap and has little special functionality for security. Systems that have a TPM seem unlikely to provide a useful benefit due to the TPM being designed more for Digital Restrictions Management than for protecting the user and due to TPM not being widely enough used. The BIOS and the Bootloader It seems that the first thing that is needed is a BIOS that is reliable. If an attacker manages to replace the BIOS then it could do exciting things like modifying the code of the kernel at boot time. It seems quite plausible for the real-mode boot loader code to be run in a VM86 session and to then have it s memory modified before it starts switches to protected mode. Every BIOS update is a potential attack. Coreboot replaces the default PC BIOS, it initialises the basic hardware and then executes an OS kernel or boot loader [2] (the Coreboot Wikipedia page has a good summary). The hardest part of the system startup process is initialising the hardware, Coreboot has that solved for 213 different motherboards. If engineers were allowed to freely design hardware without interference then probably a significant portion of the computers in the market would have a little switch to disable the write line for the flash BIOS. I heard a rumor that in the days of 286 systems a vendor of a secure OS shipped a scalpel to disable the hardware ability to leave protected mode, cutting a track on the motherboard is probably still an option. Usually once a system is working you don t want to upgrade the BIOS. One of the payloads for Coreboot is GRUB. The Grub Feature Requests page has as it s first entry Option to check signatures of the bootchain up to the cryptsetup/luksOpen: MBR, grub partition, kernel, initramfs [3]. Presumably this would allow a GPG signature to be checked so that a kernel and initrd would only be used if they came from a known good source. With this feature we could only boot a known good kernel. How to run User Space The next issue is how to run the user-space. There has been no shortage of Linux kernel exploits and I think it s reasonable to assume that there will continue to be a large number of exploits. Some of the kernel flaws will be known by the bad guys for some time before there are patches, some of them will have patches which don t get applied as quickly as desired. I think we have to assume that the Linux kernel will be compromised. Therefore the regular user applications can t be run against a kernel that has direct hardware access. It seems to me that the best way to go is to have the Linux kernel run in a virtual environment such as Xen or KVM. That means you have a hypervisor (Xen+Linux or Linux+KVM+QEMU) that controls the hardware and creates the environment for the OS image that the user interacts with. The hypervisor could create multiple virtual machines for different levels of data in a similar manner to the NSA NetTop project, not that this is really a required part of solving the general secure Internet terminal problem but as it would be a tiny bit of extra work you might as well do it. One problem with using a hypervisor is that the video hardware tends to want to use features such as bus-mastering to give best performance. Apparently KVM has IOMMU support so it should be possible to grant a virtual machine enough hardware access to run 3D graphics at full speed without allowing it to break free. Maintaining the Virtual Machine Image Google has a good design for the ChromiumOS in terms of security [4]. They are using CGroups [5] to control access to device nodes in jails, RAM, CPU time, and other resources. They also have some intrusion detection which can prompt a user to perform a hardware reset. Some of the features would need to be implemented in a different manner for a full desktop system but most of the Google design features would work well. For an OS running in a virtual machine when an intrusion is detected it would be best to have the hypervisor receive a message by some defined interface (maybe a line of text printed on the console ) and then terminate and restart the virtual machine. Dumping the entire address space of the virtual machine would be a good idea too, with typical RAM sizes at around 4G for laptops and desktops and typical storage sizes at around 200G for laptops and 2T for new desktops it should be easy to store a few dumps in case they are needed. The amount of data received by a typical ADSL link is not that great. Apart from the occasional big thing (like downloading a movie or listening to Internet radio for a long time) most data transfers are from casual web browsing which doesn t involve that much data. A hypervisor could potentially store the last few gigabytes of data that were received which would then permit forensic analysis if the virtual machine was believed to be compromised. With cheap SATA disks in excess of 1TB it would be conceivable to store the last few years of data transfer (with downloaded movies excluded) but such long-term storage would probably involve risks that would outweigh the rewards, probably storing no more than 24 hours of data would be best. Finally in terms of applying updates and installing new software the only way to do this would be via the hypervisor as you don t want any part of the virtual machine to be able to write to it s data files or programs. So if the user selects to install a new application then the request please install application X would have to be passed to the hypervisor. After the application is installed a reboot of the virtual machine would be needed to apply the change. This is a common experience for mobile phones (where you even have to reboot if the telco changes some of their network settings) and it s something that MS-Windows users have become used to but it would get a negative reaction from the more skilled Linux users. Would this be Accepted? The question is, if we built this would people want to use it? The NetTop functionality of having two OSs interchangeable on the one desktop would attract some people. But most users don t desire greater security and would find some reason to avoid this. They would claim that it lowered the performance (even for aspects of performance where benchmarks revealed no difference) and claim that they don t need it. At this time it seems that computer security isn t regarded as a big enough problem for users. It seems that the same people who will avoid catching a train because one mugging made it to the TV news will happily keep using insecure computers in spite of the huge number of cases of fraud that are reported all the time.

• [1] http://www.schneier.com/blog/archives/2010/03/mariposa_botnet.html
• [2] http://www.coreboot.org/Welcome_to_coreboot
• [3] http://grub.enbug.org/FeatureRequests
• [4] http://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/system-hardening
• [5] http://lxr.linux.no/linux+v2.6.30/Documentation/cgroups/

I've decided to take part in the 2010 Seven Day Roguelike Challenge My entry will be written in JavaScript as a KDE4 plasmoid (thus simultaneously allowing me to take part in this competition) Unfortunately today had to be spent in RL family activities so I'm already behind. however I've done lots of research into Roguelike development and I have accomplished the first step finding a name. Candidates are:

• Descent into the No-No Area
• Going Rogue
• Battle For Quiznosth
• Tol-in-Gaurhoth

...and the winner is:

• A Lively Fisting

It will be a simple combat heavy coffeebreak game inspired by things such as Solo Dungeon Bash and Pocket Dungeon though as time permits I will add as many more roguelike features as I can.

I finally got a few hours free this morning to check an item off my home system administration checklist: upgrading the wireless router's firmware to OpenWRT. There were a couple motivations for this, including the fact that my SoundBridge Radio couldn't maintain a connection to my firefly server using the built-in firmware, and I had read that OpenWRT would work better. Since this is posted on Planet Debian, I should mention why I didn't use DebianWRT. The basic answer is this text at the top of the DebianWRT homepage:

Currently the most common methods used to run Debian on these systems is to install OpenWRT or a similar firmware, add disk space either by USB storage or NFS, create a debian chroot by either running cdebootstrap from inside OpenWRT or debootstrap --foreign on a PC, and running Debian from this chroot. For example, instructions for the WLHDD.

I'm not sure whether this is because DebianWRT is experimental, or because its goal is to use routers as cheap general computers. Either way, it sounds way too complicated and/or fragile for what I'm interested in (i.e., a wireless router with better software). The goal here is to get something that does a better job than the built-in WRT firmware, but doesn't require too much tinkering to get working or to maintain. I have plenty of outlets for my tinkering urges already. Nothing here was exactly difficult, but it was hard to find all the information I needed to get things working. Hopefully documenting the steps I went through here will save someone else some time. Step 1: acquire the firmware This was trickier than you might think. If you click on the download link at the OpenWRT web site, you end up at the top of an FTP server populated with a vast quantity of stuff. Worse, when you find the actual firmware images, you'll quickly discover that there are piles and piles of them divided between sixteen directories, and no guidance as to which one to pick. And picking the wrong one will turn your beautiful router into a doorstop. Luckily, the OpenWRT documentation contains a section called "Getting Started". Unluckily, that section consists of the following text:

1.1 Getting started 1.1.1 Installation 1.1.2 Initial configuration 1.1.3 Failsafe mode

Whoops, someone forgot to execute on a TODO. Undeterred, I consulted the usual fallback reference, Google. It pointed me at several references, some of which were hidden on other parts of the OpenWRT site. Armed with these, I was able to determine that:

1. My WRT54GL v1.1 probably uses a Broadcom 5352 chipset.
2. The correct firmware, according to multiple sources, is probably in the kamikaze top-level director, the latest version's subdirectory, and the bcrm-2.4 directory under the version (the link is to 8.09.2, which is current as of March 6, 2010). Apparently the bcrm47xx directory doesn't have wireless support; it helpfully contains a file called NO-BROADCOM-WIRELESS to warn you off, but unhelpfully doesn't include any additional information in that file (like what exactly is broken or that you can find a working firmware in a sibling directory) ... oh well.
3. The firmware file that you want is openwrt-wrt54g-squashfs.bin, even though it doesn't match the model number of the router. This directory could use a README file explaining which hardware is supported by each of the dozen or so firmware files it contains.

Step 2: install the firmware After Step 1, this was a real relief. I just used the built-in Linksys firmware installer, pointed it at the .bin file, and it went. Step 3: configure the router The installation guide I followed was pretty much silent about what to do after I got the firmware on. Luckily, this is just a software problem, meaning it's much more familiar territory for me.

1. First things first: I checked that I could still get a DHCP lease. It worked.
2. Armed with that, I tried telneting to the router. I used the resulting root prompt to set a password on the root account.
3. I logged out and tried telneting in. Apparently the router is configured to disallow root logins over telnet if you don't have a password. Good for them (although why allow telnet at all?); oops for me.
4. Luckily, an ssh server was installed by default. I like using keys to log in, so I tracked down the documentation on configuring the server to use public-key authentication; it turns out there's a single global key file named /etc/dropbear/authorized_keys that's exactly like OpenSSH's per-user authorized_keys file. No idea what would happen if I had multiple users, but I won't.
5. The next obstacle: I didn't have an Internet connection. For some reason, my cable modem didn't want to give the router a DHCP lease. On the off-chance that it was remembering too much, I rebooted it and ran ifup wan. That fixed the problem. I still don't know why.
6. Not a step, but a useful note: in the process of figuring the above out, I found readlog. It's basically dmesg for syslog files; it shows the most recent lines written to syslog. This is useful because there isn't a real syslog file, due to the fact that there would be no room to store it on the 54GL.
7. Finally, I had to get wireless working. The documentation is very helpful when it comes to describing the syntax of the wireless configuration. Unfortunately, I read the list of encryption options and missed the section right below where their meanings are explained (although, to be honest, I might not have understood the implications of the explanation without the research I did anyway).

   option encryption none, wep, psk, psk2, wpa, wpa2

   I wanted WPA2 encryption, so I entered wpa2. And nothing worked. After a good hour of trying different options on the client, swapping software components in and out on the router, experimenting with the encryption key syntax, and crawling Google, I finally found my answer. If you just want WPA2 encryption, you must not use wpa2 as the encryption type. Instead, use psk2. It turns out out that wpa2 actually means use WPA2 and also use an external RADIUS server for authentication. psk2 is the system you're familiar with from a typical consumer wireless router.

Step 4: enjoy And with that, it works. Unfortunately, contrary to what I wrote here originally, my Roku still doesn't work. On the other hand, having a real Linux installation is helpful for debugging it. Currently my suspicion is that the router isn't passing multicast packets between the wired and wireless interfaces (broadcast works fine, multicast doesn't). That said, it seems like if I restart Firefly just before I start playing music, I can play reasonably reliably -- as long as I don't stop, because if I do, the Roku forgets that the music server is there. Either way, I've spent about as much time fighting this as I can afford. One lingering worry I have is security; unlike Debian, which has both a security mailing list and tools to inform me when I need to install a security update, the OpenWRT firmware doesn't seem to have any mechanism for distributing security notices. True, there is an openwrt-security-announce list, but it appears to be entirely unused, as is openwrt-announce. Something to keep an eye on, then. Also (file under note to self), I need to remember to verify that the router isn't exposing services to the outside world. The default iptables configuration is hideously complex; with just a quick glance, it could be setting up a floral shop for all I can tell. I'll need to test this empirically and maybe analyze the rules in more depth.

OCaml Batteries Included 1.1.0 has arrived in Debian I've just uploaded the Debian package of OCaml Batteries Included 1.1.0 to the Debian unstable archive; hopefully, it will quickly enter testing to be released with the next Debian stable release. This is the first release in Debian of the "new generation" of Batteries Included, which has followed a strict diet, and now has Camomile as its only external dependency. It took me a while to package it due to an intertwining transition to OCaml 3.11.2 (during which we have fleshed out the last remaining few bits of transition to our new dependency system). Also, I had to fix some typical build issue with upstream, which kindly coordinated with me to have the fixes included in 1.1.0. So go, enjoy Batteries 1.1.0, and let me know your feedback:

    # apt-get install ocaml-batteries-included

(check that it will install 1.1.0 though, it might take a few days to hit your favorite architecture and mirror) Tip: starting from this version you will need the following to use Batteries in place of the legacy standard library in your sources:

    open Batteries_uni

for multi-threaded programs you should rather use open Batteries. Check the FAQ file installed under /usr/share/doc/libbatteries-ocaml-dev/ for more quick start information.

I spent the day working with Daniel. He has been trying to get the correct runes for a GCC build in a strange environment. Turns out all he needed was me to throw stupid ideas at him until one caused him to examine some of the generated intermediate symbol maps...

I've been playing around a bit with Geo-Temporal visualization. Here's a screenshot of an experimental visualization on Google Maps:The icons are placed on approximate coordinates; multiple events in a small area are aggregated into a single marker. The red sectors correspond to temporal information: to the right is the current day, a full turn corresponds to a duration of 7 days. Typical events listed on this map cover 1 to 4 hours in the evening of a day, resulting in a rather small sectors in typical angles corresponding to the seven days of a week. There are three larger events, one being a weekend workshop in Hamburg (covering the saturday and sunday sectors), a Friday to Saturday in Leipzig and an event incorrectly set for all tuesday in Dresden. M nchen on the other hand seems to take a day off on Saturday (in fact they have a full-week workshop on Lanzarote, on a part of the map not shown ...).While this visualization is quite fancy and can scale to arbitrary time window, I will not be able to add it to the public version of this map (which can be tried out on http://swing.vitavonni.de/).The rendering of so many polygons with Google Maps is just way to slow for all the browsers I tried. Maybe I could use cached png images instead and traditional overlays to improve performance.For some visualizations, it would also make sense to turn the sectors into a spiral, for example where the angle corresponds to the day of the month and the distance from the center corresponds to the month.

My automatic rule-based time tracker (arbtt), which is written in Haskell, collects every minute a data sample consisting mainly of the list of currently open windows (window title and program name). Naturally, this log grows rather large. Since October of last year, I collected 70,000 samples. I already went from a text-based file format to a binary format using Data.Binary, which gave a big performance boost.
But by now, I was afraid that this is not enough. My log file is now 30MB large. Looking at the memory graph of gnome-panel, it is taking up more than half of my memory. When running arbtt-stats, the Haskell run time system reports 569 MB total memory in use and the command finishes after 28.5 seconds. Naturally, the log file is highly redundant: Compressing it with bzip2 shrinks it to 1.6MB. But as I would like to preserve the ability to just append samples at the end, without having to read the file, I chose not just to add bzip2 or gzip compression. Rather, I am now exploiting a very obvious redundancy: Two adjacent samples usually list exactly the same windows, and a focus change only changes a flag. So now, when storing a string that is part of a sample, it will check if this string was already present in the previous sample and, in this case, just store the number of that string (one byte). Only if the string was not present it will write a zero byte and then the string. When reading the sample, the process is reversed. This greatly reduces the file size: It is down to 6.2MB. It also improves the memory consumption, due to Haskell s abilities with regard to sharing: When a reference to a string in a previous sample is read, then only one instance of this string is in memory, even if it occurs several times in the log. This brings the memory consumption down to 264 MB and the runtime to 17 seconds. I released the changes as version 0.4.5.1 to Hackage, Debian and as a Windows installer. The log file is not automatically converted, but new samples will be written in the compressed format. If you want to convert your whole file, you have to stop arbtt-capture, run arbtt-recover, and then move the hopefully noticeable smaller ~/.arbtt/capture.log.recovered to ~/.arbtt/capture.log.
The required code changes were not too big. I somewhat isolated the relevant code in the Data.Binary.StringRef module. Unfortunately, I have to use OverlappingInstances to be able to provide the special instance for String is there a cleaner way (besides the trick used for the Show class)?

Review: Coders at Work, by Peter Seibel

Publisher:	Apress
Copyright:	2009
ISBN:	1-4302-1948-3
Format:	Trade paperback
Pages:	601

Coders at Work is a collection of edited interviews by Peter Seibel (probably best known previously for his book Practical Common Lisp) of an eclectic and excellent collection of fifteen programmers. It opens with an interview with Jamie Zawinski (one of the original Netscape developers) and closes with Donald Knuth. In between, the interview subjects range in programmer generations from Fran Allen (who started at IBM in 1957) and Bernie Cosell (one of the original ARPANET developers) to Brad Fitzpatrick (LiveJournal founder and original developer). Techniques and preferences also range widely, including two people involved in JavaScript development and standardization (Brendan Eich and Douglas Crockford), a functional programming language designer and developer (Simon Peyton Jones), language designers and standardizers such as Guy Steele, and people like Dan Ingalls who have a different experimental approach to programming than the normal application development focus. All of the interviewees are asked roughly the same basic questions, but each discussion goes in different directions. Seibel does an excellent job letting the interview subjects shape the discussion. Two things immediately stood out for me about this book. First, it's huge, and that's not padding. There are just over 600 pages of content here, much of it fascinating. The discussions Seibel has are broad-ranging, covering topics from the best way to learn programming to history and anecdotes of the field. There's some discussion of technique, but primarily at the level of basic approaches and mindset. One typical question is how each programmer organizes their approach to reading code that isn't familiar with them. Each interviewee is also asked for book recommendations, for their debugging techniques, for their opinions on proving code correct, and how they design code. The participants are so different in their backgrounds and approaches that these conversations go in fifteen different directions. This is one of the most compelling and engrossing non-fiction books I've read. Second, the selection of interview subjects, while full of well-known names in the field, is not the usual suspects. While I'm interested in the opinions of people like Larry Wall and Guido van Rossum, I've already heard quite a lot about how they think about programming. That's material that Coders at Work doesn't need to cover, and it doesn't. Many of the interview subjects here are people I'd heard of only vaguely or not at all prior to this book, often because they work in an area of programming that I'm not yet personally familiar with. Those who I had heard of, such as L. Peter Deutsch, I often knew in only one context (Ghostscript in that case) and was unfamiliar with the rest of their work. This gives the book a great exploratory feel and a lot of originality. There is so much good material here that it's hard to give a capsule review. This is a book I'm highly likely to re-read, taking more detailed notes. There's entertaining snarking from Jamie Zawinski and Brendan Eich, fascinating history of the field (including in gender balance) from Fran Allen, and an intriguing interview with Joe Armstrong (creator of Erlang), who seems to have a far different attitude towards languages and libraries than the other interviewees. Every interview is full of gems, bits of insight that I now want to research or play with. A couple of examples come to mind, just to provide a feel of the sort of insights I took out of the book. In the interview with Joshua Bloch, who does a lot of work on library APIs, he mentions that empathy is one of the most important skills for designing an API. You have to be able to put yourself in the shoes of the programmer who's going to use the API and understand how it will feel to them. This came up in the context of a discussion about different types of programmers, and how programmers can be good at different things; the one who can do low-level deep optimization may not have that sense of empathy. Another example: Bernie Cosell talked about how he did debugging, and how he got a reputation for being a fantastic debugger who was able to fix just about anything. He confessed that he often reached a portion of the code that he didn't understand, that seemed too complex and tricky for what it was attempting to accomplish, and rather than trace through it and try to understand it, he just rewrote it. And after rewriting, the bug was often gone. It wasn't really debugging, but at the same time it's close to the more recent concept of refactoring. Several of the interview subjects commented on a subjective feeling of complexity and how when it gets too high that's a warning sign that code may need to be rethought and rewritten. A third example: I was fascinated by the number of interviewees who said that they used printf, assert, and eyeballs to debug rather than using any more advanced debugging tools. The former Lisp developers would often bemoan the primitiveness of tools like gdb, but many of them found that print statements and thinking hard about the code were usually all that's needed. (There was also a lot of discussion about test suites and test-driven development.) The general consensus was that concurrency problems were the hardest to debug; they made up a disproportional number of the responses to Seibel's question about the hardest bug the programmer ever had to track down. I could go on giving similar examples at great length, but apart from the specific bits of wisdom, the strongest impact this book made on me was emotional. Coders at Work is full of people who love programming and love software, and that enthusiasm, both in general and for specific tools and ideas, comes through very clearly. I found it inspiring. I realized while reading this book, and I suspect I'm not alone among programmers in this, that I largely stopped learning how to program a few years back and have been reusing skills that I already have. Reading Coders at Work gave me a strong push towards finding ways to start learning, experimenting, and trying new techniques again. It also filled me with enthusiasm for the process of programming, which immediately helped my productivity on my own coding projects. This is obviously a book whose primary target audience is practicing programmers, and while it doesn't go too far into language theory, I was relying on remembered terms and structure from my master's degree for a few of the interviews. I think it's approachable for anyone who has a working background in programming and a few languages or a CS degree, but it might be a stretch for someone new to the field. But even someone without any programming knowledge at all would get a lot out of the anecdotes and snapshots of the history of software development. Coders at Work is also full of jumping-off points for some additional research on Google or additional reading in other recommended books. I only have one complaint, which I have to mention in passing: for such a large book full of interesting ideas and book recommendations, the index is wholly inadequate. I tried looking up five or six things in it, including the source of some of the book recommendations that are collected in an appendix, and I struck out every time. It's very hard to find something again in 600 pages, and more attention paid to the index would have been greatly appreciated. But, despite that, for people within the target audience, I cannot recommend this book too highly. Not only was it full of useful information, at the level of programming above the code details that's often the hardest to talk about, but it's consistently entertaining and emotionally invigorating and inspiring. It made the rounds of tech blogs when it was first released, to nearly universal approval, and I can only echo that. If you're a practicing programmer, I don't think you'll regret spending a few weeks reading and thinking about this book. Rating: 10 out of 10

DebConf 11 will be held in Banja Luka, Bosnia and Herzegovina. Munich, Germany arrived on a close second and our bid, Quito, Ecuador, arrived last, allegedly because some points flipped over since DC 11 was meant to happen in Europe. So, after having three DebConfs hosted in America in the last four years, DebConf 11 will travel to Europe in 2011! Good news for all our fellow DDs and contributors over there. The Banja Luka team managed to get an important support from their Government. They even met with the Prime Minister and got him to sign an offer of full support. I think this becomes dangerous for a DebConf, given that I ve worked and have had mishaps while funding conferences with at least three governments (Ecuador, Venezuela and Brazil) with stronger levels of support (Law-like level) for free software and I know that at least other two governments in the World have unfortunately done this in the past. So we need backup plans and lots of follow-up activities with the stakeholders. However, this agreement sets an important milestone in government support for free and open source software as well as Debian. I ll use it in my Debian slides, and congratulations! IMO, Munich would have made a great host for DC11 in terms of air travel connectivity, at a bigger hit on local costs, but nothing that would differ that much from DC7, though! I don t think I ll be able to make it at this moment to Bosnia (struggling for NYC) and at this point it s premature to think on supporting Quito s again for DC12. People and sponsors get gradually tired, even with spiritual commitment. The DC10 decision meeting was long and lots of things needed to be improved. At that moment I thought the Project learnt useful lessons for future meetings, but we re repeating ourselves now on the DC11 decision meeting. And now, I m just hoping for the best, for the sake of the time and sanity of all us here. Ditch the priority list altogether, increase the stakeholders on the global team, filter bids early in the process and use more technology to improve the information flow before the decision!

Barnes and Noble released the nook source code last week. This includes the code to busybox, uboot and their kernel. Unfortunately, the uboot and kernel code both appear to be missing swathes of code found statically linked in the binaries that they're distributing. License compliance is hard, let's flail wildly.

This afternoon, a box arrived from Advanced Circuits, containing 108 fully assembled TeleDongle boards! This is not only the first "intended for sale" build of hardware from the Altus Metrum family of projects, it's also the first time that I've ever sent out one of my board designs for someone else to assemble. I therefore approached the turn-on and test of the first board out of the box with more than a little trepidation... fortunately, for no reason! I'm immensely pleased to report that TeleDongle serial number 100 turned on and works entirely as expected! I celebrated by packaging it in a cool little Hammond translucent blue plastic box with a USB cable, yielding the first prototype of a fully packaged TeleDongle board such as we anticipate selling for use receiving data from rockets carrying TeleMetrum boards. We also intend to sell these boards as-is (flashed with default firmware and measured oscillator cal value) to folks who'd like a robust wireless link for their next microcontroller project, whether rocket-related or not. I will, of course, post something here when we're ready to start taking orders. Now we just need the weather to cooperate long enough to log more test flights of TeleMetrum. The new version looks great so far, but I want a few more flights before I'll be confident enough to place an order with our assembler for a run of those too... Stay tuned!

At the FSF's Libre Planet conference this year in March, there will be a track focusing on increasing the participation of women in free software. If you are able and support this cause, consider donating to fund additional women's travel to this event. Being able to meet in person with other people like you is such an energizing opportunity. Give this gift to someone who wouldn't otherwise be able to make it!

Past Sins Sam Varghese wrote an article about Matthew Garrett s LCA talk The Linux community: what is it and how to be a part of it [1]. In page 2 Sam quotes Martin Krafft as asking about how Matthew s behavior had changed between 2004 and the present, Sam cites some references for Matthew s actions in 2005 to demonstrate. I think that this raises the issue of how far back it is reasonable to go in search of evidence of past behavior, something that I think is far more important than the specific details of what Matthew said on mailing lists many years ago and whether he now regrets such email. If someone did something that you consider to be wrong yesterday and did the same thing five years ago you might consider it to be evidence of a pattern of behavior. If someone s statements today don t match their actions yesterday then you should consider it to be evidence of hypocrisy. But if someone did something five years ago which doesn t match their current statements then in many situations it seems more reasonable to consider it as evidence that they have changed their mind. Then of course there is the significance of what was done. Flaming some people excessively on some mailing lists is something that can be easily forgiven and forgotten if Google doesn t keep bringing it up. But as a counter-example I don t think that Hans Reiser will be welcome in any part of the Linux community when he gets out of jail. For the development of the Linux community (and society in general) I think it s best to not tie people to their past minor mistakes. While it is nice when someone apologises for their past actions, the practical benefits of someone just quietly improving their behavior are almost identical. A particular corner case in this regard is the actions of young people, anyone who was born after about 1980 will have had great access to electronic media for their entire life and will have left a trail. Most people do a variety of silly things when they were young, the older members of the Linux community were fortunate enough not to have electronic records remaining where Google could find them. Back to Matthew, I think that if he is to be criticised about such things then evidence that is much more recent than 2005 needs to be used. Cultural Differences Sam quotes Matthew as claiming that the Linux community was largely a Western, English-speaking one, those who participated in it necessarily had to adapt to the norms of this group . I don t believe that there is a single Linux community. There are a number of different communities that are formed around free software, which have significant amounts of overlap. I don t believe that there s any reason why a Chinese or Indian Linux mailing list should conform to the same standards as those of an American list. But there will be a trend towards meme propagation through people who are associated with the Linux communities in multiple countries every time you meet Linux people in another country you are helping to reduce the cultural differences in the Linux community. Someone from China or India who joins a LUG in Australia will have to adapt to some of the norms of Australian behavior in the same way as an Australian who migrates to China or India would have to adapt to some local norms. On page 4 of the discussion Matthew disagrees with Sam s interpretation [2], maybe Matthew s opinions on this matter are closer to mine than the way Sam describes them. Is Division Inherently Bad? I believe that the word divisive is overused. The only way to avoid division is to have everyone agree with the majority, but sometimes the minority will be right. Note that I am using the word minority to refer to any group of people who happen to disagree with the majority, among other things that includes people who vote for a political party that isn t one of the two biggest ones. An entirely separate issue is that of the treatment of minority groups , one of the most divisive events in history was the US civil war it s good that slavery is outlawed but unfortunate that a war was required to gain that result. On page 4 of the discussion Matthew says to Sam Your writing is influenced by members of the Linux community, and in turn it influences the Linux community. The tone of it is entirely relevant to the behavioural standards of the community [2]. If a community can be easily divided then the real problem probably isn t the person who triggered a particular division. Also there is the issue that even if you could get a general agreement that certain issues shouldn t be discussed in certain ways then with the wide range of cultural attitudes and ages of participants you have to expect someone to raise the issue you don t want raised. Of course it s impossible to objectively determine whether a division is productive or not, so it doesn t seem at all viable to have any expectations regarding outsiders not being divisive. Sometimes you just have to deal with the fact that the Internet contains people who disagree with you. It seems to me that the most divisive issues we face involve people who mostly agree on contentious issues. If someone entirely disagrees with you then it s easy to ignore them (if you even have a conversation with them), but if they are someone that you communicate with and they are almost right in your opinion then there s the potential for a big argument. Probably the best way to minimise division in the community is to have the first people who get involved in a dispute take a Rogerian approach [3]. Failing that a good approach is to respond by writing an essay. When an issue is made popular by services such as Twitter that give little explanation then everyone rushes to the barricades. It seems to me that the unreliability of some blogging platforms is part of the cause of the problem in this regard. I ve just given up on writing comments on Blogger, I m not going to write a good comment only to have it eaten by blogger. There are lots of blogs that have problems which discourage the population from writing anything other than a one-sentence response. The Good that can come from Disputes On page 5 of the discussion there is a comment from Anirudh the Indian student who was criticised by Sam (which ended up inspiring part of Matthew s talk and leading to more disputes) [4]. Here is the start: I am the person who wrote the ill thought-out post that drew criticism eight months ago. There has been some discussion about that, so I wish to say something.

I am very grateful to Sam Varghese. I say this with utmost sincerity. Read the rest, it s educational. I m sure that there are others who have had similar learning experiences but who don t want to write about them. I m sure that there have been many disputes which would appear to the casual observer to have resulted in no good at all, but which would actually have resulted in people learning things and amending their behavior. The issue of Age Car rental companies generally don t do business with men who are less than 25 years old. Life insurance policies don t offer reasonable rates to males between the ages of about 16 and 25. This is because the insurance companies have good statistical data on the results of the typical actions of people at various ages and know that young men tend to be at a high risk of earning a Darwin Award. The same combination of hormones and life experience that makes a young man a danger on the road will also tend to make him get involved in flame-wars on the net. If we could figure out how to influence teenagers into being less anti-social then it would be a great achievement. The current young people will become older and more sensible soon enough but will be replaced by a larger number of young people who will do the same things. As things stand I don t expect the next cohort of young people to learn from Anirudh.

• [1] http://www.itwire.com/opinion-and-analysis/open-sauce/36850
• [2] http://discuss.itwire.com/viewtopic.php?f=8&t=18319&start=28
• [3] http://en.wikipedia.org/wiki/Rogerian_argument
• [4] http://discuss.itwire.com/viewtopic.php?f=8&t=18319&start=28

As I mentioned, I headed to Pittsburgh last week to give some talks at CMU and find out something about what they're doing there. Despite the dire weather that had closed the airport the day before, I had no trouble getting into town and was soon safely in a hotel room with a heater that seemed oddly enthusiastic about blasting cold air at me for ten seconds every fifteen minutes. Unfortunately, it seems that life wasn't as easy for everyone - ten minutes after I arrived, I got a phone call telling me that the city had asked CMU to cancel classes the next day.

This turned out to be much less of a problem than I'd expected - whether because of their enthusiasm to learn about ACPI or because they simply hadn't noticed the alert telling them about the cancellation, a decent body of students turned up the next morning. After a brief chat with Mark Stehlik, the assistant dean for undergraduate education, I headed off to the lecture hall. The fact that I can now just plug my laptop into a VGA cable and have my desktop automatically extend itself continues to amaze me, as does OpenOffice's seemingly unerring ability to get confused about which screen should have my content and which should be showing me the next slide. Nevertheless, facts were imparted and knowledge dropped on those assembled. I'm even reasonably sure that the contents were factually accurate, which is a shame because the most attractive part of teaching always struck me as being able to lie to students who will then happily regurgitate whatever you tell them because in case it turns up on the exam. Perhaps this is why I'm safer out of academia.

Lunch offered an opportunity to visit the Red Hat sponsored lab, which was pleasingly located somewhere other than a basement. The guy on the right of the picture is Greg Kesden, the director of undergraduate laboratories in CS there - it was wonderful to get an opportunity to see the machines getting used, and students seemed genuinely appreciative of the facility.

After lunch I spent a while talking to Satya about the Internet Suspend and Resume project. This is an impressive combination of virtualisation and migration, using a Fedora-based live image to bring up an OS on arbitrary hardware before downloading a machine image and launching it. The majority of the data is pulled in on demand, meaning that initial performance can be slow but ensuring that data is only downloaded if it's needed. When the user is finished, the delta between the original image and the new one can be pushed back to the server while remaining cached on the local machine in case the image is used again.

It's an interesting approach, combining the flexibility of thin clients with the advantages of having actually useful computing power at the local end. There's a few functional awkwardnesses, such as some VMs being unhappy if images are migrated between machines with different CPU features, and it obviously benefits from having significant bandwidth. But the idea of being able to combine the convenience of a floating session with the knowledge that you can still keep copies of your data on you is an attractive one, and I'd love a future where I can move my session between my laptop and a desktop.

After that there was some time to talk to Bill Scherlis and Philip Lehman about the software engineering courses that CMU run. Part of the minor in software engineering includes a course requirement to make a meaningful contribution to an existing software project, from design through to submission and upstream acceptance. I had the opportunity to talk to a couple of the students about this and the differences they found between working with the Mozilla and Chrome communities, which I'll try to write up at some point.

Finally I gave a presentation on Fedora and some of the issues that we face in providing a useful OS when patents and recalcitrant hardware vendors do their best to thwart us. Despite the ice outside and the significantly-below-freezing temperatures, enough people turned up that sorties had to be sent out to find extra chairs. It was great to see how interested people were in learning about what we do, although it's probably the case that the free pizza did help encourage people.

After that it was an early trip back to the airport, where I found that my plane was delayed and the only "restaurant" still open was McDonalds. Even so, I left with the feeling that it had been an interesting and educational visit. Many thanks to David Eckhardt, who runs the OS course I presented to and who looked after me all day - thanks too to Joshua Wise who picked me up when David was running late due to the ground being covered with blocks of ice.

I've been overhauling the way that I am host a number of virtual websites upon my main box. Partly to increase security, and partly for a cleaner separation or roles, ownership, and control. (In general everything on my box is "mine", but some things are "ours"...) After a fair amount of experimentation I decided that I wasn't willing or able to rewrite all my Apache mod_rewrite rules just yet. So my interim plan was to update each existing virtual host:

• Add a dedicated user & group to run it under.
• Launch it via a minimal server listening upon the loopback adapter.
• Have Apache 2.x proxy through to it.
  • Expanding any mod_rewrite rules prior to the proxying.

To make it clear what the users were for I decided that every hosting-user would have an "s-" prefix. So the virtual host "static.steve.org.uk" was initially going to be served by the s-static user. The thttpd configuration file would look like this, and would be located in /etc/thttpd/sites/static.steve.org.uk:

host=127.0.0.1
port=1008
dir=/home/www/static.steve.org.uk/htdocs/
chroot
user=s-static
throttles=/etc/thttpd/throttle.conf
logfile=/home/www/static.steve.org.uk/logs/thttpd.log
pidfile=/home/www/static.steve.org.uk/pid/file

(I wrote a trivial script to stop/start all the sites en mass, and removed the default thttpd init script, logrotation job, and similar things.) How did I decide which port to run this instance under? By taking the UID of the user:

steve@skx:~$ id s-static
uid=1008(s-static) gid=1009(s-static) groups=1009(s-static)

With this in place I could then update the Apache configuration file from serving the site directly to merely proxying to the back-end server:

<VirtualHost *>
    ServerName  static.steve.org.uk
    # Proxy ACL
    <Proxy *>
        Order allow,deny
        Allow from all
    </Proxy>
    # Proxy directives
    ProxyPass          /   http://localhost:1008/
    ProxyPassReverse   /   http://localhost:1008/
    ProxyPreserveHost on
</VirtualHost>

So was that all there is to it? Sadly not. There were a couple of minor issues, some of which were:

cronjobs

I have various cron-jobs in my main steve account which previously updated blog indexes, etc. (I use namazu2 to make my blog searchable.) I had to change the ownership of the existing indexes, the scripts themselves, and move the cronjob to the new s-blog user.

cross-user dependencies

I run a couple of sites which pull in content from other locations. For example a couple of list summaries, and archives. These are generally fed from a ~/.procmail snippet under my primary login. Since my primary login no longer owns the web-tree it is no longer able to update things directly. Instead I had to duplicate a couple of subscriptions and move this work under the UID of the site-owner.

I'm no longer running apache

For a day or two I'd forgotten I was using the apache facility to include snippets in my site; such as links to my wishlist. Since I'm not using Apache in the back-end server-parsed files no longer work. Happily I'm using a simple template-based setup for my main sites, so I updated the template-parser to understand "##include ./path/to/file". For example this source file produces my donation page. The upshot is my "static" site is even more static, which is a good thing.

uploads are harder

Several of my domains host entirely static content which is generated on my main desktop machine, and then uploaded via rsync post-build. I had to add some more accounts and configure SSH keys, then update the uploading routines/Makefiles appropriately. Not a major annoyance, but suddenly my sshd_config file has gone from "PermitUser steve,backup" to including many additional accounts.

The single biggest pain was handling my my mercurial repositories - overhauling that took a bit of creativity to ensure that nothing was broken for existing or new checkouts. I wish that a backport of mercurial-server was trivial because I'd love to be using that. In general though watching the thttpd logs has been sufficient to spot problems. I had to tweak things a little to generate statistics properly, but otherwise all is good. Why thttpd? Well small, lightweight, and the ability to run CGI scripts. Something missing from nginx for example. I'm still aiming to remove apache2 from the front-end - it is mostly just a dumb proxy, but it does perform some ACL operations and expand mod_rewrite rules. I could port those to another engine .. but not today. The most likely candidates are nginx, perlbal, or lighttpd - each of these should be capable of doing simple ACL checks, and performing mod_rewrite-like rules. ObFilm: Mallrats