Search Results: "andy"

27 October 2010

Joey Hess: three thousand lines of Haskell

Three thousand lines of code is not a huge program, but it is enough to get a pretty good feel for a language. Now that I've completed my first real Haskell program I feel that I've gotten over several of the humps in the learning curve and am starting to get a good feel for it. Actually, I've written closer to five thousand lines, since there were several big refactorings. One was when I stopped manually threading my program state around and added a StateT monad. I did know from the beginning I would need one, but it seemed easier and a better learning exercise to let the program start out with a vesigial tail and gills before growing up into a modern Haskell program. (I suppose it's still written in baby-Haskell, really..) Another refactoring came when I realized I needed to use a custom data type, not String, to represent keys. That was a great experience in type-based refactoring. Being able to keep typing ':make' and landing on the next bit of code that needed fixing was great, and simply adding that one type exposed several non-obvious bugs. I found myself writing code that is much more solid and reusable than normally comes easily. And yet it's also very malleable. Actually, pulling out better data types and abstractions can get a bit addictive. When I realized that I had a similar three-stage control flow being used for each of git-annex's subcommands, and factored that control flow out into a function that used the 3 data types below, I felt I'd gone down that rabbit hole perhaps far enough for now.
type SubCmdStart = String -> Annex (Maybe SubCmdPerform)
type SubCmdPerform = Annex (Maybe SubCmdCleanup)
type SubCmdCleanup = Annex Bool
(That will allow for some nice parallelism later though, and removed dozens of lines of code, so was worth it.) Since git-annex is a very Real World Haskell type program, there is a lot of impure code in it. I could probably do better at factoring out more pure code. I count 117 impure functions, and only 37 pure. Anyhow, from my perspective of a long-time perl programmer, some other random impressions..

17 October 2010

Christian Perrier: [life] [running] 3h40'20"

One more personal record broken for my 6th marathon (including those I ran alone). This time, it was a small marathon, the Seine-Eure marathon, in Normandy, between Paris and Rouen. But a small marathon is small only by number of runners (here, 500, plus about 160 teams of Ekiden runners -relay marathon-). It still has 42.195km. Despite a non optimal preparation (too many runs in September and no run over 25km since June), it went fairly well and I could benefit from the optimal conditions: ultra-flat race, few turns, few runners, goo dweather, though very cold for the season. Again, I started too fast (around 5'/km) and had trouble finishing with pace down to 5'30. But I'm still very happy for breaking my PB for the 4th time in a row with my results now being: Next marathon will be Paris marathon, on April 11th 2011. Target: 3h35 For french-speaking readers: full report on the Kikourou website.

16 October 2010

Pietro Abate: hidden ssh service via tor

We live in a nat-ed / firewall-ed world. Almost all DSL providers don't give public IPs and when the do, they are often behind a draconian firewall. In this context having an emergency remote shell, despite not fast and not public is very handy. A simple way to solve this problem it to create a hidden server on the tor network and the access the shell from anywhere in the world without caring of change of IPs, routing, dns or anything else. On debian you can just install tor from the official repository. Since Tor is not available in ubuntu (but it is available on debian), we need to get it directly from the tor website. There is a nice write-up on the ubuntu site : https://help.ubuntu.com/community/Tor . And these are the details on the tor website. So we add this to apt.sources
deb http://deb.torproject.org/torproject.org lucid main
and the we aptitude install tor .The package will install and run by default the tor daemon. Next step is to edit /etc/tor/torrc to add the proxy server.
HiddenServiceDir /var/lib/tor/ssh/
HiddenServicePort 22 127.0.0.1:22
Remember also to install the openssh-server server if you don't have it already. And this is it. In the directory /var/lib/tor/ssh/ you will find a file with the hostname on the TOR ring that you have to use to connect to you new hidden server. On the client side we need to aptitude install connect-proxy. It's a simple tool to tunnel ssh through a socks5 connection. Now you are ready to test. In your ~/.ssh/config you can simply add something like
Host *.onion
ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p
and then ssh-way youronionhost.onion server . The connection will be veeeeery slow since you are going through different layers of encryption and indirection. You should also check the hostid of your server before connecting and dropping in a pub-key as you should never trust your friendly TOR providers (US govt, Chinese gvt, Iranian govt, etc ...). For emergency is actually pretty handy. For anything else if will make you die of boredom ...

Update Ahhh . It seems I've assumed that since TOR was not available on ubuntu, this was the same on debian. Tor is definitely available on debian, but not on ubuntu. Blah... check before asserting wrong information ! Post fixed.

1 October 2010

Joey Hess: Debian USB install from hybrid iso

I recently spent a little time adding support for isohybrid images to d-i. isohybrid is a tricksy boot sector hack that allows copying a CD image direct to a USB stick and booting it. I used it in anger for the first time yesterday, and it worked so well compared with the old method of booting d-i from USB sticks that I feel I need to blog about it so others can enjoy the fun.. The documentation on the web site has not caught up yet, but this is already usable with current d-i daily builds. For now only in the netboot mini.iso. That can be written directly to a USB stick or USB disk to make it boot d-i.
cat mini.iso > /dev/sdX
The netboot mini.iso is so named because it's functionally identical to netbooting d-i. Except without the need to set up a tftp server. Besides being a 16mb download that will fit on even your oldest USB stick, another advantage to using the mini.iso is that you don't even need to use a separate USB stick to boot the installer. You can write the mini.iso directly to the same disk that d-i will be installing to! (Particularly handy for installing debian to USB disks.) (This is also very handy for d-i development and testing, since a mini.iso can be written out to a USB key about as fast as a test machine will post..) adding firmware I also arranged for there to be a second partition on the mini.iso. The firmware partition is most easily accessed by unplugging and replugging the drive after writing the mini.iso to it -- then it will show up as /dev/sdX2 (or "Firmware" in a GUI). If you need to add firmware to d-i, you can just mount it and extract the firmware tarball into it. d-i will then automatically find, use, and install the firmware. isohybrid with other Debian CD images All this will also work with other larger Debian CD images, but we're not yet building the larger images with isohybrid, due to issues with jidgo. However, you can just run isohybrid yourself (from the syslinux package) on the CD image you download, and if it's got a recent version of d-i on it, d-i will be able to find and use the hybrid CD image after booting. That doesn't add the firmware partition to the image. If you need to do that, you could use this script. Flattr this

28 September 2010

Kartik Mistry: apt-get install moksha!

* No, we don t have moksha packaged yet. Sometime ago, Nirav forwarded me query regarding Utkarsh (my project where our goal was to provide complete Gujarati interface in OS) who got CD long time back but facing some issue. Last week, I decided to help and finish this pending task and went to place we decided. It was small laptop (ie EEE PC) for guru of group called, OM Parivar. I installed Ubuntu and customized it for Gujarati interface and required software. Second time, I went to Guruji s place for small training and I was wondering how fast man of 82 years can learn! He was very happy to see me helping and so I m converting more person to Linux. I also explained why I m using Linux and we even discussed about some Free Software philosophy. Next time: Keep Debian Installer with USB boot handy ;)

14 September 2010

Kees Cook: my part in the ecosystem

I was asked to write about what I do at Canonical and what I do in the Free Software community at large. There is obviously a great deal of overlap, but I ll start with the things I m involved with when I m wearing my Ubuntu hat. My primary job at Canonical is keeping Ubuntu secure. This means that I, along with the rest of the Ubuntu Security Team, coordinate with other Free Software distributions and upstream projects to publish fixes together so that everyone in the community has the smallest possible window of vulnerability, no matter if they re running Ubuntu, Debian, RedHat/Fedora, SUSE/openSUSE, Gentoo, etc. Between vendor-sec, oss-security, and the steady stream of new CVEs, there is plenty going on. In addition to updates, the Security Team works on pro-active security protections. I work on userspace security hardening via patches to gcc and the kernel, and via build-wrapper script packages. Much of this work has been related trying to coordinate these changes with Debian, and to clean up unfinished pieces that were left unsolved by RedHat, who had originally developed many of the hardening features. Things like proper /proc/$pid/maps permissions, real AT_RANDOM implementation, upstreaming executable stack fixing patches, upstreaming kernel NX-emu, etc. Most of the kernel work I ve done has gotten upstream, but lately some of the more aggressive protections have been hitting frustrating upstream roadblocks. Besides the hardening work, I also improve and support the AppArmor Mandatory Access Control system, as well as write and improve confinement profiles for processes on Ubuntu. This work ends up improving everyone s experience with AppArmor, especially now that it has gotten accepted upstream in the Linux kernel. I audit code from time to time, both on the clock with Canonical and in my free time. I m no Tavis Ormandy, but I try. ;) I ve found various security issues in Xorg, Koffice, smb4k, libgd2, Inkscape, curl+GnuTLS, hplip, wpa_supplicant, Flickr Drupal module, poppler/xpdf, LimeSurvey, tunapie, and the Linux kernel. With my Canonical hat off, I do all kinds of random things around the Free Software ecosystem. I m a sysadmin for kernel.org. In Debian, I maintain a few packages, continue to try to push for security hardening, and contribute to the CVE triage efforts of the Debian Security Team. I ve written or maintain several weird projects, including MythTVFS for browsing MythTV recordings, GOPchop for doing non-encoding editing of MPEG2-PS streams, Perl s Device::SerialPort module, and the TAP paging server Sendpage. For a selection of things I ve contributed to other project, I ve implemented TPM RNG access in rng-tools, made contributions to Inkscape s build and print systems, implemented CryptProtect for Wine, wrote a PayPal IPN agent in PHP that actually checks SSL certificates unlike every other implementation I could find, added additional protocol-specific STARTTLS negotiations to OpenSSL, implemented the initial DVD navigation support in MPlayer, updated serial port logic in Scantool for communicating with vehicle CAN interfaces, tried to add support for new types of timeouts in Snort and Ettercap, fixed bugs in mutt, and added HPUX audio support to the Apple ][ emulator XGS. As you can see, I like making weird/ancient protocols, unfriendly file formats, and security features more accessible to people using Free Software. I ve done this through patches, convincing people to take those patches, auditing code, testing fixes and features, and doing packaging work. When I go to conferences, I attend UDS, DefCon, OSCon, and LinuxCon. I ve presented in the past at OSCon on various topics including security, testing, and video formats, and presented at the Linux Security Summit (miniconf before LinuxCon this year) on the need to upstream various out-of-tree security features available to the Linux kernel. I love our ecosystem, and I love being part of it. :)

13 September 2010

Iustin Pop: 3ware raid resize via pivot_root

How pivot_root won against a stupid RAID controller This post is brought to you by a very stupid 3ware 9650SE RAID controller, which doesn't understand the concept of growing a RAID array after all disks have been replaced by bigger ones. Or, well, it can, but the procedure, involving sending array dumps to the technical support, then receiving a program to run under DOS (!), doesn't inspire me with confidence. Furthermore, this stupid RAID card doesn't allow easy reordering (if it's possible, and I just missed it, please let me know) of the RAID arrays at runtime, only from the BIOS screen, and I didn't have access to that (only poor man's serial console under Linux). So, after buying new harddrives, and replacing the original ones in the RAID1 array with double the capacity, I realised I have to do a manual conversion. Basically, go into single-user mode, remount all read-only, split the RAID1 array into its (identical) components, change root directory to the second disk, re-partition the first disk, copy the data from the 2nd to the 1st disk, then re-add the 2nd disk to the 1st one (repartitioned) to re-establish the RAID1. All this, on a headless (no keyboard, no VGA) machine, just with a serial console. Of course, if this is just your local machine, you can easily reboot from an external media, and do all this easily from a full user-space. In any case, I'm writing this down, as there seem to be no easily findable guides on how to do the resize on a 3ware with its restrictions. Procedure Disclaimer: you might lose data via this, there are no guarantees. Have up-to-date backups. First, make sure you have power control (you can power-cycle the box if needed) and the serial console works. Also, make absolutely sure that the RAID array is fully consistent, and that you don't have any bad sectors on the drives, as you will lose redundancy during the operation. If /usr is not on your root file-system, then you need to copy /usr/sbin/chroot to somewhere on it. Also, if you have tools for the array that are not on your root file-system, you should copy them there now. In my case, that was tw_cli. First reboot Reboot into init=/bin/sh. Note: I've tried to simply go into single-user mode, or to reboot with emergency, but this doesn't work, because in both modes, beside the init process with PID 1 and your shell, there's another init process (the parent of the shell), and I didn't know how to tell it to re-execute itself. To the main init process it's easy, you just run telinit u, but that child keeps the old root directory mounted. If it's possible to re-exec that child too, then this step can be skipped please let me know how! Changing the root mount Make sure everything is mounted read-only (should be), then split the raid array into its component drives, using whatever tool the card needs. For me, it was:
# tw_cli /c0/u0 migrate type=single
The second drive now should be visible e.g. as /dev/sdc, so mount it somewhere, and pivot_root to it:
# mount -o ro /dev/sdcX /mnt
# cd /mnt/
# pivot_root . mnt/
# exec chroot .
At this point, the new root (on some partition on /dev/sdc) is mount at the root, and the exec call replaced the current shell with another one that has the right root directory. So nothing should keep the old root directory (at /dev/sdaX) in use, and umount /mnt (or umount /dev/sdaX) should succeed now. Recreate the first raid array Now, since it's no longer in use, you can delete and recreate the first raid array. Once it's available, you have two choices: I did the latter, since I wanted to use the new alignment standards (the initial installation was still using sector 63 for the boot partition, etc.) as a future preparation for either SSD or 4K-sector drives. So I used: In any case, either copy the entire disk, or each partition in turn, or possibly pvmove from the old to the new disk, etc. Switch back the root mount At this point, /dev/sdc is no longer used, and you can again change the root directory. This is similar to the first pivot_root, but now using /dev/sda as a target. All the instructions are the same. Convert back to RAID1 Now, since (in our example) /dev/sdc is no longer in-use, you can delete that drive and rejoin it to the first drive, recreating the RAID1 array. In my case:
# tw_cli
/> /c0/u2 delete
blah blah [y/n] y
/> /c0/u0 migrate type=raid1 disk=X
At this point, the machine is again redundant (or will be once the resync finishes), but it still needs one more step or it won't boot correctly. Reinstall the boot-loader Now, for reinstall the boot loader, you'll probably need to mount /boot (and mount it read-write), and do whatever you need. In my case, I re-ran lilo, but grub-install /dev/sda should also work. Final reboot And now, you only need to reboot into the normal, resized system. Since you can't easily use shutdown when booted with /bin/sh as init, just use /proc/sysrq-trigger to sync/unmount/reboot. Thoughts While I use a hardware RAID controller for the battery backup it offers, I have never thought it cannot do such a simple operation (compare with mdadm --grow /dev/mdX --size=max). Second, I knew about pivot_root but have not used it before. It's a very very nice thing, and the only downside is that you can't really use it with more than a few processes, since it's hard/impossible to change a random process' root directory. But anyway, it works, and it's damn handy for doing things to the root file-system or in general to the root drive (e.g. just repartitioning it) when you can't boot from another media (e.g. remote machine).

12 September 2010

Iustin Pop: Xen PVM under VirtualBox

Most people won't need this, but for testing things like Debian bug #596009, it is very handy. A few posts on the internet say this doesn't work, or not reliably, so here is my recipe. System: VirtualBox from sid (3.2.8), and VMs created with Enable IO APIC, Enable PAE/NX, Enable VT-x/AMD-V (I have an AMD Phenom II 940), and finally Enable Nested Paging. I don't know if all these are absolutely needed, but with this config the final guest runs nicely for some quick tests. There are just a few gotchas that I stumbled upon: If however dom0 hangs, you should activate the first serial port in the VirtualBox config (raw file), and then you can get at least a kernel trace. As for the pure CPU, speed, the results are interesting; I've used openssl speed rsa to do a quick test. Host (non-virtualized):
                  sign    verify    sign/s verify/s
rsa  512 bits 0.000089s 0.000009s  11176.2 116018.4
rsa 1024 bits 0.000422s 0.000024s   2370.9  41914.3
rsa 2048 bits 0.002643s 0.000075s    378.4  13255.5
rsa 4096 bits 0.017623s 0.000272s     56.7   3680.9
And domU guest (double-virtualized, that is):
                  sign    verify    sign/s verify/s slowdown
rsa  512 bits 0.000051s 0.000009s  19620.1 111644.0    3.78%
rsa 1024 bits 0.000390s 0.000026s   2561.1  38929.4    7.13%
rsa 2048 bits 0.002752s 0.000080s    363.4  12566.9    5.20%
rsa 4096 bits 0.018628s 0.000288s     53.7   3474.3    5.62%
So we have less than 10% for pure CPU work, nice. I'm not able to do I/O testing since my VirtualBox machines are using write-back cache, not write-through, so I end with this unrealistic speed:
# dd if=/dev/zero of=big-file bs=1024k count=127 oflag=direct
127+0 records in
127+0 records out
133169152 bytes (133 MB) copied, 1.21597 s, 110 MB/s
So no, this should not be used for any kind of benchmarking; but for testing and debugging issues, it's a good way to fire up a Xen box without having to change any config or risk breaking your main machine

6 September 2010

Gustavo Franco: Gooooogle!

We will celebrate Independency Day here in Brazil tomorrow (the year was 1822 for those into world history). I took the time to visit Belo Horizonte and meet a few googlers I don't see in a while. The cool part is that Rodrigo and his wife Ellen are also in town. We (me and Rodrigo) used to work in the same team at Google here in Belo, he's now living in Zurich.

I would like to let you know that I'll be rejoining Google in a month or so!

For those out of the loop: I quit Google San Francisco a few months ago to get back to Rio de Janeiro in order to assist my family with some complicated issues. They were all sorted out and Google rehired me! How cool is that?

I'm glad to be part of Google Site Reliability Engineering again and looking forward to meet all the Debian Developers in Mountain View and San Francisco. I've met Andy and a few others already. Please stop by and say hi!

Jan Hauke Rahm: tmux entered my system

Been playing with that thought for a while now, finally got to rebuilding it for lenny, now I m using it tmux is the new screen. To have fun already I read a few short introductions and got myself a few suggestions for a proper .tmux.conf. So, for root I have this one now: # Copy mode
unbind [
bind Escape copy-mode
# Use Vi mode
setw -g mode-keys vi
# Make mouse useful in copy mode
setw -g mode-mouse on
# More straight forward key bindings for splitting
unbind %
bind split-window -h
bind h split-window -h
unbind '"'
bind - split-window -v
bind v split-window -v
# History
set -g history-limit 4000
# Terminal emulator window title
set -g set-titles on
set -g set-titles-string '#S:#I.#P #W'
# Status Bar
set -g status-bg black
set -g status-fg white
set -g status-interval 1
set -g status-left '#[fg=green]#H#[default]'
# no line break here, it's just to long for my blog layout!
set -g status-right '#[fg=yellow]#(cut -d " " -f 1-4 /proc/loadavg)#[default] #[fg=cyan,bold]%Y-%m-%d %H:%M:%S#[default]'
# Notifying if other windows has activities
setw -g monitor-activity on
set -g visual-activity on
# Highlighting the active window in status bar
setw -g window-status-current-bg red
# Clock
setw -g clock-mode-colour green
setw -g clock-mode-style 24
# Create a default session
new -n htop -d htop
setw -t htop monitor-activity off
neww -n aptitude -d aptitude
neww -d
Then I added a new alias to my user s zsh config: alias root='su -c "tmux attach"' Why tmux attach ? Because tmux would start a new session which I don t want it to. The config already starts a session which we can immediately attach to. Also, when such session was started I can attach to it as a user with the very same command over and over again. That makes it pretty handy as I always have htop, aptitude and a free shell available in a nice tmux session. Great. How did I live until now? ;-)

25 August 2010

Jonathan Wiltshire: Taking good care of your keyring

Recently I was surprised to find that many of the rules I took for granted when dealing with an OpenPGP keyring, and the other activities associated with a web of trust, were new to some people I spoke to. These rules are born from a mixture of experience, accepted good practice, and wider reading, with a small dose of paranoia thrown in for good measure. And some rules about signing and signatures: Do you have other rules or guidelines that you use when dealing with keys and signatures?
Comments flattr this!

Mark Brown: Editor (and other) customisations

A discussion the other night suggested that I m quite unusual among geeks in doing vanishingly little customisation of my system most of my systems have something very close to their default configuration, individual programs are usually at most a very few tweaks away from their upstream settings. For Emacs all I tend to do is install revbufs, set Linux mode by default for C and turn on syntax highlighting and line number mode (sometimes the last two only get done when I start Emacs). For vim it s just configuring a 72 column word wrap if my main use for vi on the system will be writing e-mail. For GNOME it s putting a terminal launcher in one of the panels and setting focus follows mouse. All very trivial stuff done in five minutes. The theory here is partly that I just can t be bothered to spend more time on tweaking things (and the subsequent carrying around of those tweaks) and partly that it ensures that I m not confused when I end up using a new system or someone else s for whatever reason. I find it somewhat odd that this would be something you d want to spend any time on.

Russell Coker: A Netbook for Aircraft Navigation

There is apparently some MS-Windows software for navigating light aircraft in Australia. It takes input from a GPS device and knows the rules for certain types of common tasks (such as which direction to use when approaching an airport). My first question when I heard of this was so if the Windows laptop crashes does your plane crash? . But I ve been assured that paper maps will always be available. The requirement is for a touch-screen device because a regular laptop in the open position won t leave enough room for the control stick. So the question is, what is the best touch-screen Windows laptop? It must be relatively rugged spinning media for storage is unacceptable due to the risk of damage in turbulence, it should be relatively cheap (less than $1000), and can apparently have a somewhat low resolution for the screen. The pilot who asked me for advice on this matter is currently thinking of the ASUS Eee T91 which runs Windows XP home, has 16G of solid-state storage and a 1024*600 screen. I am concerned about the reliability of that system as the rotatable screen design seems inherently weak. The Smartbook concept sounds appealing, I don t expect that you would want to wait for a typical OS to boot while flying a plane. But those devices mostly use ARM CPUs and thus can t run MS-Windows. One particularly interesting device is the Always Innovating Touchbook [1] which has a detachable keyboard which would be handy for non-airline use. Unfortunately it seems that Always Innovating aren t doing production at the moment, they say The current Touch Book production is in stand-by and will resume in the summer when we will release our newest and craziest innovation well summer is almost over in the northern hemisphere so I guess that means there won t be anything from them for another 9 months. A device such as an iPad would also be a good option for looking at static documents. The pilot is considering using a MS-Windows PC to generate images and then viewing them on such a device. But he s not really enthusiastic about it. Are there any good and cheap touch-screen devices that run MS-Windows? Are there any particularly noteworthy PDF reader devices which would be better than an iPad for viewing maps while flying a plane? Is it possible to run a MS-Windows application that uses a GPS under Wine on a Netbook?

MJ Ray: Audio Processing Tips for ffmpeg

I did some sound file mangling earlier this week. I ve been using the Bambuser app for Symbian recently to capture some recordings. If you tell their site your User-Agent is a mobile browser, it ll work OK with free software icky but better than many video services today. Even when I was recording audio only, the site left me with flash video (flv) files which contained both audio (mp3) and video streams. Step one was to remove the blank video and convert to mp3: ffmpeg -i videofile -acodec copy -vn part1.mp3 Mobile service isn t great in rural Somerset around Weston-super-Mare, so some recordings were split into several parts. Step two is to combine them with cat part1.mp3 part2.mp3 >whole.mp3 That s OK, but it leaves some painful squawking at the join, where the player hits the header information of part2. If you re unlucky, it ll crash some players. So step three is to remove it: ffmpeg -i whole.mp3 -acodec copy whole-clean.mp3. Often I transcode to ogg vorbis at the same time with ffmpeg -i whole.mp3 whole-clean.ogg but it depends what I m doing with the recording. Are there any other handy ffmpeg tricks I could use here?

19 August 2010

Jonathan Wiltshire: Batch importing caff signatures

Having swapped details with many, many people at Debconf, and then been away for a week after that, I found myself with an overflowing mailbox and a long task of open mail, provide pass-phrase, pipe to gpg import . I wanted a way to batch-import all these signatures (there are three times as many, because my key has three UIDs) in one or two goes, and tidy up the stragglers later. David Bremner wrote a small Perl script to do this from an mbox file, but I wanted to work in pure shell and with mutt. Just shoving the mbox at gpg resulted in it decrypting one message, then bailing at the fact the IDEA plugin is not present. Here was my eventual workflow, which only requires you to provide the pass-phrase once:
  1. create a maildir, either with maildir-make or a directory with cur, new and tmp directories nested inside;
  2. mark all relevant messages as read, and save them to here (it doesn t matter if others get caught up in it);
  3. now change to the maildir /cur directory, and run the following bash (disclaimer: totally untested and used at your own risk):

    for a in ls ; do mv $a $a.gpg; done
    gpg --decrypt-files *.gpg
    rm *.gpg
    gpg --import *
    rm *
I expect there are better/quicker/safer ways to do it, but this worked well for me at midnight on a Monday evening. 19/08/10: Yes, it turns out I am a numpty, and Mutt can handle this all by itself with Ctrl-K and a tagged list. This is still quite handy when the private key is not on the machine you re using to read mail, though. Thanks for the corrections.
Comments flattr this!

18 August 2010

Jonathan Wiltshire: Home, James

Since I didn t actually come home from Debconf, but instead took a further week s holiday and lazed around by the beach, I haven t sat down to write anything about it yet. Most importantly, I should say thank you to Joey Hess, Steve McIntyre and Stefano Zacchiroli for arranging the Debconf Newbies programme, without which I would have been stuck at work watching the videos again (though this does have the advantage of seeing three talks at once). Every year I am astounded at the generosity of certain companies who sponsor the conference, since I ve experienced for myself the difficulty of trying to put a corporate price on free software even more so to specifically sponsor newbies, who by definition probably aren t as active in ways that interest sponsors than more established developers. Right up to the day I flew I was nervous (as in any social situation) at meeting so many new people in one go, on my own, and long way from home after all, it s not really easy to back out and go home after that But in fact, everybody I met was warm and friendly, and very supportive in all sorts of ways. I got to see and hear many talks; in the first two days alone: And of course social events, like Cheese and Wine, Keysigning (handy for putting faces to names), many nights in the third hacklab, a day trip to Coney Island, a privileged viewing of the most nerdy organ in the world, and a trip up the Empire State building: The campus was ideally suited to such a conference, and apart from the mugginess we had excellent weather. I discovered that I rather enjoy watching baseball and that one should repeat the application of sunblock after paddling. But what I enjoyed most of all was being in the same area as so many eminent Debian people, and being so inspired by them to be even more involved technically and socially. I hope to see you all again soon!
Comments<script type="text/javascript"> var flattr_wp_ver = '0.9.11'; var flattr_uid = '32970'; var flattr_url = 'http://www.jwiltshire.org.uk/content'; var flattr_lng = 'en_GB'; var flattr_cat = 'text'; var flattr_tag = 'blog,wordpress,rss,feed'; var flattr_btn = 'large'; var flattr_tle = 'jwiltshire.org.uk'; var flattr_dsc = 'The public face of jwiltshire'; </script> <script src="http://api.flattr.com/button/load.js?v=0.2" type="text/javascript"></script> flattr this!

2 August 2010

Jaldhar Vyas: PreventaCamp Days 3 and 4

I missed yesterdays report but there was not a lot to say anyway. I've made further progress on the DHCP problem in the sense that I can make it go away if I use NAT in VMWare instead of Bridged networking. Tried compiling gcc 4.4.4 and ran out of disk space. I've been feeling guilty about not volunteering so that evening I assisted the organizers by eating some of their excess baked ziti. It's my civic duty. Today (Sunday) was Debian day. I spent some time in the hacklab trying to compile gcc again. This time I ran out of inodes. I did manage to get to two of the presentations. One was about the GSoC projects various students are doing. Perhaps next year Debian Minix will be a subject for GSoC? The other one was by Andy Oram about FLOSS Manuals. They are doing important work in Free Software documentation and have developed some interesting tech towards that end. One is CSS3 print profile support. This will be a relief for anyone who has had to deal with the bletcherous XSL. Another is booki a platform for collaborative writing and editing. I shall be following the progress of this project as I hope to make a big contribution to Debian documentation soon. Andy works for O'Reilly and after the talk we had some informative discussion about the publishing world. This "hallway track" is the great thing about gatherings like Debconf.

Matt Zimmerman: DebConf 10: Day 1

This week, I am attending DebConf 10 at Columbia University in New York. The first day of DebConf is known as Debian Day. While most of DebConf is for the benefit of people involved in Debian itself, Debian Day is aimed at a wider audience, and invites the public to learn about, and interact with, the Debian project. These are the talks I attended. Debian Day Opening Plenary (Gabriella Coleman, Hans-Christoph Steiner) Hans-Christoph discussed Debian and free software from a big picture perspective: why software freedom matters, challenging the producer/consumer dichotomy, how the Debian ecosystem hangs together, and so on. Steps to adopting F/OSS in government (Andy Oram) Andy discussed FLOSS adoption in governments, drawing on examples from Peru, the city of Munich, the state of Massachusetts. He covered the reasons why this is valuable, the relationship between government transparency and software freedom, and practical advice for successful adoption and deployment. Pedagogical Freedom (panel, Jonah Bossewitch et al) The panelists discussed the use of technology in education, especially free software, some of the parallels between free software and education, and what these communities could learn from each other. This is a promising topic, though the perspectives seemed to be mostly from the education realm. There is much to be learned on both sides. Google Summer of Code 2010 at Debian (Obey Arthur Liu) This talk covered the student projects for this year s Summer of Code. Most of the students were in attendance, and presented their own work. They ranged from more specialized projects like the Hurd installer, to core infrastructure improvements like multi-arch in APT. Beyond Sharing: Open Source Design (Mushon Zer-Aviv) Mushon gave an excellent talk on open design. This is a subject I ve thought quite a bit about, and Asheesh validated many of my conclusions from a different angle. I ve added a new post to my todo list to go into more detail on this subject. Some points from his talk which resonated with me: How Government can Foster Freedom in Technology (Hon. Gale Brewer) Councillor Brewer paid a visit to DebConf to tell us about the work she is doing on the city council to promote better government through technology. Brewer seems to be a strong advocate of open data, saying essentially that all government data should be public. She summarized a bill to mandate that New York City government data be public, shared in raw form using open standards, and kept up to date. It sounded like a very strong move which would encourage third party innovation around the data. She also discussed the need for greater access to computers and Internet connectivity, particularly in educational settings, and a desire to to have all public hearings and meetings shared online. Why is GNU/Linux Like a Player Piano? (Jon Anderson Hall, Esq.) Jon is a very engaging speaker. He drew parallels between the development of player pianos, reproducing pianos, reed organs, pipe organs and free software. He even tied in Hedi Lamarr s work which led to spread spectrum wireless technology. To be quite honest, I did not find that these analogies taught me much about either free software or player pianos, but nonetheless, I couldn t help but take an interest in what he was saying and how he presented it. DebConf Opening Plenary (Gabriella Coleman) Biella and company explained all the ins and outs of the event: where to go, what to do (and not do), and most importantly, whom to thank for all of it. Now in its 11th year, DebConf is an impressively well-run conference. I m looking forward to the rest of the week!

29 July 2010

Stefano Zacchiroli: DebConf BoF HOWTO

Here at DebConf10 the schedule is starting to get really packed of events, which is great! About a half of those events are BoFs (in the IETF sense), i.e. discussion sessions among people interested in specific topics. (Other conferences use "BoF" to refer to impromptu, non-scheduled, and spontaneous events, while at DebConf we have traditionally submitted, reviewed, and scheduled BoFs in advance.) As most DebConf regulars, I've attended quite some BoFs in the past and I share with others the impression that the quality and usefulness for the project of BoFs varies substantially from BoF to BoF. That's why I'd like to share a BoF recipe, which comes from possibly the best organized BoF I've ever attended. As it happens with all good recipes (and with free software), I've took the liberty of customizing it a bit.
DebConf BoF HOWTO have a coordinator A good BoF should have a coordinator, which is usually (but not necessarily) the person who proposed the BoF in the first place. The role of the coordinator encompasses at least 2 tasks: preparing the BoF in advance (read below) and moderating the discussion to ensure everybody get a chance to participate. prepare in advance A good BoF is more than just getting together, vaguely knowing the BoF topic, and ... discuss. Mind you, it might work very well that way too, but the chances of having a successful BoF are much higher if attendees arrive prepared. That is quite simple to achieve. It just takes the BoF coordinator to prepare some working questions and/or detailed discussion topics, and advertise them as such. That way potential participants can make up their minds, recall experiences that they want to share, note down comments they want to bring into the discussion, etc. In my experience, the BoF time will then be used in a much more productive, exciting, and ultimately fun way. Most BoFs can also benefit from a few introductory slides on the BoF topic, to ensure all participants start from a common ground. The last slide could contain a brief recap of the working questions, so that the audience have them handy. don't be exclusive Debian is not a company and Debian contributors are not employees, therefore we cannot expect all relevant people to attend a specific BoF, just if they had to. As usual, the risk of cutting off community members who cannot attend should be mitigated as much as possible. To that end, minutes are just great; after the BoF, minutes should be posted where appropriate, and possibly uploaded to Penta as event attachments. ... but taking minutes is just boring and not everyone is good at that (for instance, yours truly used to suck at taking minutes, even if I'm trying to get better ...). If you have a trusted participant which is good at taking minutes, great, go for it! If you don't, use collaboration. During past DebConfs as well as at UDS this year, I've been shown a nice way of doing that. It takes a dedicated projector in the BoF room showing some real-time, collaborative editing facility (e.g. gobby). With such a setup, people usually just start taking minutes collaboratively, although explicitly inviting the audience to do that is a very good idea. Ideally, the room should have two projectors, one for supporting slides, another for collaborative minutes taking. In case there is only one, as it is usually the case for DebConf, it's probably better to use it for minutes and switch to them as soon as supporting slides are over.
gobby.debian.net for BoF minutes at DebConf10 For DebConf10, the DebConf team has setup a gobby (infinote) server at gobby.debian.net. Just do the following in order to be ready for collaborative minutes taking:
    # apt-get install gobby-0.5
    $ gobby-0.5 -c gobby.debian.net

(Note: you shouldn't use the non versioned gobby package as it uses a different protocol and doesn't support undo, which is quite risky; see Debian bug #590753 for more background.) As the naming convention for DebConf10 minutes, using document names that start with dc10- sounds sensible.
comments welcome! So, what do you think of the above suggestions? Do you have further best practices to share on BoF organization at DebConf? Leave a comment or mail me. In the end it would be nice to author a proper "DebConf BoF HOWTO" document for further reference. Thanks to Gregor for his feedback on early versions of this post.

27 July 2010

Petter Reinholdtsen: First Debian Edu test release (alpha0) based on Squeeze is released

I just posted this announcement culminating several months of work with the next Debian Edu release. Not nearly done, but one major step completed.
This is the first test release based on Squeeze. The focus of this release is to test the user application selection. To have a look, install the standalone profile and let the developers know if the set of installed packages i.e. applications should be modified. If some user application is missing, or if there are some applications that no longer make sense to be included in Debian Edu, please let us know. Also, if a useful application is missing the translation for your language of choice, please let us know too. In addition, feedback and help to polish the desktop (menus, artwork, starters, etc.) is appreciated. We would like to ship a nice and handy KDE4 desktop targeted for schools out of the box. The other profiles should be installable, but there is a lot more work left to be done before they are ready, so do not expect to much. Changes compared to the lenny based version
  • Everything from Debian Squeeze
    • Desktop environment KDE 4.4 => the new KDE desktop in combination with some new artwork
    • Web browser Iceweasel 3.5
    • OpenOffice.org 3.2
    • Educational toolbox GCompris 9.3
    • Music creator Rosegarden 10.04.2
    • Image editor Gimp 2.6.10
    • Virtual universe Celestia 1.6.0
    • Virtual stargazer Stellarium 0.10.4
    • 3D modeler Blender 2.49.2 (new application)
    • Video editor Kdenlive 0.7.7 (new application)
  • Now using Kerberos for password checking (migration not finished). Enabled for:
    • PAM
    • LDAP
    • IMAP
    • SMTP (sender verification)
  • New experimental roaming workstation profile for laptops.
  • Show welcome page to users when they first log in. The URL is fetched from LDAP.
  • New LXDE desktop option, in addition to KDE (default) and Gnome.
  • General cleanup (not finished)
The following features are not working as they should
  • No web based administration tool for creating users and groups. The scripts ldap-createuser-krb and ldap-add-user-to-group can be used for testing.
  • DVD installs are missing debian-installer images for the PXE boot, and do not set up the PXE menu on eth0 because of this. LTSP clients should still boot from eth1 on thin client servers.
  • The restructured KDE menu is not implemented.
  • The LDAP server setup need to be reviewed for security.
  • The LDAP directory structure need to be reworked.
  • Different sets of packages are installed when using the DVD and the netinst CD. More packages are installed using the netinst CD.
  • The jackd package fail to install. This is believed to be caused by some ongoing transition, and hopefully should be solved soon. The jackd1 package can be installed manually for those that need it.
  • Some packages lack translations. See http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status, and help out with translations.
To download this multiarch netinstall release you can use To download this multiarch dvd release you can use There is no source DVD available yet. It will be prepared when we get closer to the final release. The MD5SUM of these images are
  • 3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso
  • 22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso
The SHA1SUM of these images are
  • c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso
  • 2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso
How to report bugs: http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla Please direct replies to debian-edu@lists.debian.org

Next.

Previous.