There are few things I really hate. One of them is regressions. Regressions are bad because they usually take away things we are used to rely on, and leave us with the idea that perhaps the technical improvements didn t really improve our lifes as a user, despite putting less burden on the developers. Software is made for users, after all. As part of my work on WebKitGTK+, I always keep an eye on regressions, both from previous WebKitGTK+ releases, and those imposed on embedding applications on their migration away from Gecko, and try to focus some of my efforts into lowering their numbers, whenever I can. In recent times I have worked on removing a few very user-visible regressions in Epiphany, which I see as the most demanding WebKitGTK+ user in GNOME, such as save page not working, missing
favicon support, failing to
perform server-pushed downloads (such as GMail attachments), and not being able to view source. An example of a regression from a previous version of WebKit also exists: in 1.1.17 we started advertising more than we should as supported by the HTML5 media player, causing download to be almost completely broken. All of these are working if you are using WebKit and Epiphany from trunk/master, so should be on the next development versions of WebKitGTK+ and Epiphany. Other people have also fixed many other regressions; a few examples: Xan has reimplemented the Epiphany customization of the context menu, Frederic Peters provided a work-around for mailto: links while we don t have SoupURILoader yet, and Joanmarie Diggs keeps rocking on the accessibility front! If you find regressions, keep them coming! If you have a patch, even better! =) Next week WebKitGTK+ team gets together to work furiously on improving WebKitGTK+ in a hackfest sponsored by Collabora, and Igalia, and hosted/organized by Igalia. While there I should also get my hands on one of these. Can t wait! =)

For some reasons, I had to create some slides, and it's been some time I wanted to do some latex/beamer, so I jumped in and created them using vim (hating latex/beamer a few times in the process, but that's expected. At least, I didn't have to hate OpenOffice this time). Now, when presentation time comes, I started missing the nice Presenter Console extension for OpenOffice. It's a nice extension which (a bit like Keynote) (and maybe other) enables you to seperate the beamer and laptop screens. So you put on the beamer the presentation itself, and on the laptop one you can put you notes, the next slide preview, a nice countdown etc. Really useful, but it's only for OpenOffice (or PowerPoint) slides, not for pdf ones. So I started looking at PDF readers which could do that, and found multiple solutions:

• Cyril (Brulebois) proposed to start two pdf readers (one for each screen), to have them shifted by one slide, and to advance both of them at the same time (using xdotool for example). Not really convenient but, indeed, it /could/ work;
• in the same vein, some people proposed to use Impress!ve, which has the ability to run a script when changing slide. So again, one starts two pdf readers (Impress!ve and another one) and make Impress!ve change the preview reader each time it changes slide. Again, it should work, but it's not really convenient.

So in the end, I was almost ready to submit a bug report to epdfview (which I already maintain in Debian) asking for that new feature, when I found PDF Presenter Console which does exactly what I want. I'm not sure the project is really active at the moment, and I had some problems with the tool not detecting one of the screen (so it only appears on the beamer, or only on the laptop). It might be related to xfwm4 or something, I already contacted the developer about that. In the end, it's not 100% reliable (so I'm not yet packaging it for Debian) (especially since it uses CMAKE) but once it started, it does the job pretty fine. That's just something I wanted to share in case people would be interested.

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

Today is a nice milestone. For the first time my server is "in the cloud", and yet I have full control over the kernel it is running. While it should be possible to do this with Xen, I never found a host who would. So for the three years since I got rid of colocated physical hardware, I was constantly nagging my Xen hosters to update their kernels, often to fix security issues. And I sometimes struggled with things like udev that needed a newer kernel. Most importantly it just didn't feel right for "my" server to not run my kernel. Even though in this modern day, "my" server is just a fever dream of bigger computer. I'm infected with the Sovereign Computing meme. KVM probably makes this easier than does Xen. What Steve has set up at kvm-hosting.org is a great example and template for providing a small group with great hosting at a very fair price, with full control, and an excellent interface. It's the little things, like being able to view the my neighboring guests' virtial machines in top, that I really like.

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            
 2841 joey      20   0 1637m 1.0g 3152 S    7 13.2  48:27.20 kvm                
 6606 steve     20   0 1365m 1.0g 3540 S    2 13.2   9:29.52 kvm                
 2888 cernio    20   0 1269m 284m 3152 R    1  3.6   4:08.57 kvm   
 2800 ore2      20   0  754m 521m 3152 S    0  6.6   4:35.68 kvm     

This all feels sorta science fictional when I step back and look at it.

---

notes for kernel setup on kvm-hosting.org I want to be able to install regular Debian kernel packages. In these packages, the virtio drivers are modules, and need to be manually added to an initrd. So first edit /etc/initramfs-tools/modules and add the below to it, then run update-initramfs -k all -u to rebuild the initrd. BTW, some of these modules may not really be necessary.

virtio_blk
virtio_console
virtio_pci
virtio_net
virtio_balloon
virtio-rng

Then edit /etc/kernel-img.conf to configure the kernels to add a symlink to the latest version in /boot. This way, kvm-shell can be configured to boot the latest kernel automatically.

do_symlinks = yes
link_in_boot = yes

And here is a hook that rsyncs /boot, sending kernels and initrds to kvm-hosting, so its interface will let me boot them. This was put in /etc/initramfs-tools/hooks/kvm-hosting-rsync and made executable.

#!/bin/sh
# Use --copy-links so the symlinks to the current
# kernel and initrd are selectable in kvm-shell.
# 
# Use --delete because I like living dangerously. :)
rsync --copy-links --delete -vazr /boot/ kernels.kvm-hosting.net::joey-kernels/

A couple of weeks ago, Lucas Nussbaum wrote about his experience at the Ubuntu Developer Summit. Two things stuck out at me:

• "Ubuntu has clearly gone a very long way since 2004. Everything looks very well organized and polished, and gives the impression of a big machine that nothing can stop."

In the summer of 2004, my laptop (an iBook G4) ran Debian GNU/Linux on PowerPC. I tried out Ubuntu that autumn, and was very impressed. It's been five years since then. My desktop still runs Debian, and I'm proud to be a "two-distro" community member. At the same time, this juggernaut nature raises concern. When Ubuntu releases ship with significant flaws, I quietly sigh and wonder, Are we doing good service to the people coming to GNU/Linux for the first time and seeing Ubuntu? This bugginess has bit me a few times (even for upgrades between one release and the next), and it pushed a friend of mine to switch a lot of his computing to DragonflyBSD. Lucas points out that Ubuntu's done a fantastic job of becoming visible. A look at Google Trends shows that people search for "Ubuntu" about as much as they search for "Linux" at all. Richard Stallman complains when people refer to GNU/Linux as just "Linux." But today, the most popular name for an operating system based on GNU is probably "Ubuntu." For Stallman, having his hard work associated with someone else's "Linux" project must be frustrating. As a Debian contributor, it would be easy to succumb to the same feeling with regard to Ubuntu. Lucas is well aware of that. He asks,

• "Will Debian manage to stay relevant, or are we just going to be the technically-pure distro without many users that serves as a package supermarket for Ubuntu?"

Debian does have users! I was feeling a bit disheartened about my maintenance work on alpine lately, when out of the blue I received an email from a fellow at MIT asking me if I would accept some help with maintenance from him. Just seeing the note was a relief; it's very nice to be reminded that I have users to take care of. Debian is not as popular as Ubuntu on the desktop (or laptop), it's true. But technically sharp people do frequently still choose it. For example, the FreeNAS project recently announced a switch from FreeBSD to Debian (and a new name as coreNAS). But we could end up a "package supermarket". To stave this off, we must do good releases and make sure people know about them. Doing all that work takes us all time. We must recruit new contributors, help them find things to work on, and make sure they feel welcome. And sometimes-sloppy maintainers like me ought to fix our packages, and get help from others where necessary. I promise to work toward that.

As I ran out of time whilst writing the "introducing ujail" post on monday I would like to further elaborate on the idea, giving you some examples of possible use cases and then having a look at FAQs regarding ujail. Additionally I have created a second proof of concept that should be a lot faster, see below for more details.

Use cases of ujail

Monday's post was rather technical, so let's have a look at possible use cases today.

The main reason for both having the idea of ujail and starting working on it is my web server. I am running quite a few (S)CGI scripts there and, even though running them as different users, on a per-vhost basis, I have the impression of the whole thing being a bit insecure.

Okay, PHP does provide its famous open_basedir feature, but I am also running some Python applications which I simply cannot restrict easily. My first ideas involved adding something similar to open_basedir to Python, followed by the idea of replacing some C library functions, like fopen and friends on startup time.

Whilst the adding open_basedir to Python would have involved changing a lot of Python's internals I soon discarded the library patching idea as those could be worked around by injected code directly invoking syscalls. It didn't take long for me to notice that I have to dig deeper. The idea of ujail was born and after coming up with the proof of concept this seems to be a viable solution.

Now ujail is not only about protecting a web server from its web applications, but could do a lot more, for example:

• Creating a sandbox for untrusted code (socket&file i/o emulation)
  
• Implementing some sort of personal firewall (socket-call only emulation)
• Testing applications that perform low-level system operations (read: package managers and friends, filesystem emulation)

I am sure you can come up with even more use-cases. What should be noted is that emulating a system call does not mean that one necessarily needs to emulate the whole filesystem. What can be done, for example, is patching through access to common files (libraries, executables, etc.) whilst maintaining a virtual filesystem for data that will eventually be modified. A copy-on-write approach is possible too, for example. There are multiple methods with which the multiple filesystem could be implemented, the most common would probably be using a state directory.

FAQs

There have been some questions about ujail in comments to my first post which I would like to answer. Also, I have been thinking about things that are different about ujail compared to other virtualization techniques. Feel free to add additional questions either in a comment or drop me an email: debian at sp dot or dot at.

1. Could you change the license of ujail to ... ?
   
   Not likely to happen. The proof of concept's license is GPLv3 and the actual code's license will be too. However, ujail is a userspace application that does not need any modifications to the kernel so there should be no problems with porting ujail from GNU/Linux to any other system.
   
   
2. Does ujail work on operating systems other than GNU/Linux?
   
   Not yet. If it's technically possible to implement the technique on other operating systems I would be happy to accept patches.
   
   
3. Do I need to patch my kernel for ujail to work?
   
   No, ujail is running in userspace. The only thing it needs is Linux with support for PTRACE_SYSEMU.
   
   
4. How is this approach different from using LD_PRELOAD?
   
   With LD_PRELOAD one can replace library functions, but malicious code could still directly invoke syscalls, working around this protection completely. Also, statically linked binaries cannot be restricted with LD_PRELOAD.
   
   
5. How is this approach different from user-mode-linux?
   
   User-mode-linux (UML) works by emulating a full kernel in userspace and allows you to virtualize a whole Linux instance (including a new init process, etc). ujail is about providing a way of restricting a single process (and its childs) inside a running system in terms of access to syscalls and the partial emulation of those.
   
   
6. How is this approach different from linux-vserver?
   
   Linux-vserver is a kernel patch and runs in kernel space, as opposed to ujail, which works in userspace.
   Also, linux-vserver works similarly to user-mode-linux, providing a fully virtualized Linux instance.
   
   
7. Does the account running ujail need any special privileges?
   
   No, the only restrictions that apply are those of ptrace.
   
   
8. Where is the code?
   
   Right now ujail is in a planning phase, and only the proof of concept code has been written and published. The actual ujail code is yet to be written and the code will be hosted on launchpad.net.
   
   

Proof of concept, part 2

An anonymous person (who were you stranger?) added a comment to my first post, suggesting "Also, why patch the process rather than just modifying its state and trapping into the kernel?". I have had a look at this approach earlier, but it didn't work out. However, I decided to give it yet another try and created a second proof of concept. That code does not require patching any code, but only modifies the instruction pointer (eip) and the first register (eax). This should be a lot faster than patching the code.

Technically the new main loop works by calling PTRACE_SYSEMU and waiting for a notification. It then saves the instruction pointer and switches to PTRACE_SYSCALL. As before it waits for the emulated syscall to exit and at this point sets eax from orig_eax and decreases the value of the instruction pointer by the size of the "int $0x80" instruction. Another call to PTRACE_SYSCALL resumes the process. The next event is the process actually entering the real syscall and yet another one leaving the syscall again. These are resumed by PTRACE_SYSCALL and PTRACE_SYSEMU respectively. So, comparing this with the first approach we are only modifying two registers now, instead of writing to the TEXT area of the running process.

Thanks should go to the anonymous commenter for making me give this approach another try.

Questions? Criticism? More ideas? Want to contribute?

Coming to an end I would yet again like to let you know that I am open for questions, criticism, more ideas and contributions in general. So if you are interested in this topic come join the discussion by either dropping me an email, writing a comment to this post or replying to this post on your own blog.

Guess what happens when you use software that can fuck up your keyboard mappings (VMware Remote Console), in combination with software that uses these mappings to be able to switch back to a text console (X.org) and a screen saver that locks your screen (gnome-screensaver, but that would worl equally well with xlock or anything else similar) ? A recipe for FAIL. It so happens that VMware Remote Console, and apparently other VMware products such as Player or Workstation not only are unable to do anything useful with special keys (try installing Debian without the arrows keys, for example), but they are also able to remap keys (such as ctrl, shift and caps lock) to nothing. It also happens that X.org uses its keyboard mappings when dealing with the ctrl+alt+Fn key combinations that allow to get back to a text console. Yes, that means you can t switch to a text console after VMware fucked up your keyboard mappings. On top of all that, add a X session locking program, that won t allow you back until you type your password, and a password that, well, you just can t type without shift of caps-lock, because it is somehow strong. The X session locking program won t allow you to fix your keyboard mappings, you can t switch to a text console either, and you can t unlock for obvious reasons. The only solution that didn t involve a reboot or losing everything under the X session was to ssh in, change the password to one that can be typed without shift and unlock. It is said on the interwebs that adding xkeymap.nokeycodeMap = true in the ~/.vmware/config file solves the issue. At least, it works for the arrows. I ll see if it also prevents the special keys to be remapped.

Once you release something what gets at least a little bit popular, you can expect to receive fixes in various strange forms. Since I started to use Git for Gammu development merging all these crazy things is much more easier. The problem with these changes in past was that they are generally based on some random old versions (for example random daily snapshot). Now I just find the right place in history where to start (ChangeLog usually gives good hint where to search in the history), create branch and start to apply changes I received. I worst case (like it happened today) the "changes" is whole tarball with different changes made to different files. Fortunately I recently found great git add -i, which allows me to pick whatever changes I want from the patch. When all this is done, all I need is to merge changes back to master and Git is usually clever enough to handle it. PS: And yes, I'd really love if people would be able to send me series of patches, but it does not seem to happen in near future.

This is an updated version of yesterday's post with corrected URLs -- by copy-and-pasting I had still referenced the previous slides from UseR! 2009 in Rennes instead of last Friday's slides from the ISM presentation in Tokyo. The presentations page had the correct URLs, and this has been corrected below for this re-post. My apologies! As mentioned yesterday, I spent a few days last week in Japan as I had an opportunity to present the Introduction to High-Performance Computing with R tutorial at the Institute for Statistical Mathematics in Tachikawa near Tokyo thanks to an invitation by Junji Nakano. An updated version of the presentations slides (with a few typos corrected) is now available as is a 2-up handout version. Compared to previous versions, and reflecting the fact that this was the 'all-day variant' of almost five hours of lectures, the following changes were made:

• the 'parallel computing' section was expanded further with discussion of the recent R packages multicore, iterators, foreach, doNWS, doSNOW, doMPI;
• a first discussion of GPU computing using the gputools package was added;
• the section on 'out of memory computing' using ff, bigmemory and biglm (including an example borrowed from Jay Emerson) reappeared in this longer version;
• minor fixes and polishing throughout.

Comments and suggestions are, as always, appreciated.

As mentioned yesterday, I spent a few days last week in Japan as I had an opportunity to present the Introduction to High-Performance Computing with R tutorial at the Institute for Statistical Mathematics in Tachikawa near Tokyo thanks to an invitation by Junji Nakano. An updated version of the presentations slides (with a few typos corrected) is now available as is a 2-up handout version. Compared to previous versions, and reflecting the fact that this was the 'all-day variant' of almost five hours of lectures, the following changes were made:

• the 'parallel computing' section was expanded further with discussion of the recent R packages multicore, iterators, foreach, doNWS, doSNOW, doMPI;
• a first discussion of GPU computing using the gputools package was added;
• the section on 'out of memory computing' using ff, bigmemory and biglm (including an example borrowed from Jay Emerson) reappeared in this longer version;
• minor fixes and polishing throughout.

Comments and suggestions are, as always, appreciated.

In Debian, if there exists a bug in a version of a package in SID (let's take as an example GRUB2 version 1.97+20091125-1), and it has a severity marked as Critical, then it won't touch testing until such a bug is fixed... It is as simple as that.

What happen when?:

a) You are not sure which Debian release you are using.
b) You are not sure how Debian handles bugs reported with severity: critical.

Answer: http://pvanhoof.be/blog/index.php/2009/11/27/debian-wtf

:S

Just read Mark Kretschmann about application naming. Another consideration is: will the name show up in Google? Some projects have been extremely bad at this, the prime example I'm thinking of is the KVM virtualisation module in Linux. I'm treating KVM as the name here, since the term Kernel-based Virtual Machine is not even a name, really... (ok, it has become popular enough so that linux-kvm.org now shows up at the top.)

Cory Doctorow wrote an interesting little column for Make magazine about Wikipedia and the way that it contains facts about facts [1]. One of the issues with this is that you can t (or at least shouldn t) make corrections based on your own knowledge of a subject, you need to cite references. Cory gives a hypothetical example where a world renowned expert couldn t simply fix an error in Wikipedia, but they could give an interview with the New York Times decrying the quality of Wikipedia and citing the correct data then once the NYT article was published it could be referenced as an authoritative source and the page updated. Mako wrote about the Wikireader (an offline reader for Wikipedia) and advocated a facility for writing changes while offline and uploading them [2]. From the perspective of improving the state of the art in computer science and making new features available for more users this sounds like a great idea. But in terms of fitting in with the way Wikipedia works it doesn t seem viable to me. Any time that you need to use an offline Wikipedia reader it seems that it will either be impossible or unreasonably difficult to gain the net access necessary to find the reference that Wikipedia requires. Sure you could fix spelling errors, reformat paragraphs, etc but not do anything serious. I wonder how many people actually put any serious effort into Wikipedia with the sole purpose of making it more readable. In terms of my own editing I have made a number of changes that improve readability, but all of them were due to reviewing pages for technical accuracy. One of the comments on Mako s post suggested that instead of having an option to directly edit pages there be an option to take notes on pages which could then be used for later editing. Maybe something like a two button combination to flag a particular paragraph as being of dubious accuracy so that the user could later do some Google searches for references. Of course another problem with this is the delay in updating a Wikireader. For most reading of Wikipedia it doesn t matter if the content is 6 months old, so we should expect that most users of the Wikireader don t have the latest data. The Wikireader company offers an update service of posting a new memory card twice a year [3]. Given postage delays etc we should expect that the average age of the content is about 4 months for people who subscribe to the update service, and probably a lot greater for people who download the updates. The popular pages of Wikipedia change fast, in the space of 4 months a page can change significantly. In terms of general Wikipedia operation I wonder if it would be beneficial to have a button to flag content as possibly not meeting the Wikipedia guidelines. It seems that the number of people who can recognise low quality pages is going to be significantly higher than the number of people who have the skill and time to fix them. I m sure that there are many people who would just love to be able to choose from a list of Wikipedia pages that have received many negative votes. Such votes could be stored offline and uploaded later, but again that would rely on having recent content on the reader (it would be annoying for a recently fixed page to keep getting voted down). One area where offline editing of a Wiki would work well is that of niche Wikis. For example if I downloaded a copy of the Debian Wiki (which would only take a tiny fraction of the space in a Wikireader) then I could easily update it every week and the incidence of other people editing a page in the mean time would often be low. I could write long updates that make significant changes to SE Linux related pages while offline without needing any references and in many cases without much risk of conflicts. Implementing a distributed version control system to manage such updates shouldn t be difficult in principle, although the VCS might have to run on a laptop or desktop system after taking raw data from the Wikireader (tools like GIT seem memory hungry and might not fit on a small device). Also Mako refers to the already indefensibly large gap between the number of readers and editors on Wikipedia . Like Mako I don t have a TV watching personality. I agree that it is desirable to facilitate read-write access for everyone, but that doesn t have to involve write access to Wikipedia. I am not convinced that there is a difference between the number of readers and editors of Wikipedia that indicates a problem here. As something becomes more popular the number of people who use it without being committed to it increases, and it also becomes more integrated into society. I don t think it s a problem that many people use their writing time for other tasks such as blogging rather than editing Wikipedia. Wikipedia makes a great reference for blog posts and blog posts drive readers (and thus potential editors) to Wikipedia. Finally I think we should consider the fact that different people have different skill sets. Maybe the Wikipedia reader base gained a significant portion of the people who have the skills to make good editors a long time ago and now the majority of new users just don t have the skills. If that is the case then having the ratio of readers to editors change in favor of readers while the number of readers expands would be a good thing. I don t think that I am being elitist in acknowledging that different people have different skill sets, and that some portion of the population will lack the skills necessary to make good contributions to Wikipedia (good enough to outweigh the mistakes that they make). I think that valuing the contributions of all people in society does not require that we value all contributions to Wikipedia.

• [1] http://www.make-digital.com/make/vol20/?pg=16
• [2] http://mako.cc/copyrighteous/20091123-00.comment
• [3] http://thewikireader.com/update.html

This is it. We know the faces of people who will count in Europe during the 2009-2014 period. And we can count on them to make the EU weigh even less than it did until now. Jos Manuel Dur o Barroso, president of the European Commission. For 5 years, this ultra-liberal brought in his fanatic views of the free market, leading to unprecedented removals of regulations and legislations that could prevent large corporations to extort money from citizens. He holds a non-negligible responsibility on the (still unsolved) bank crisis of 2007. Yet, citizens voted en masse earlier this year for the EPP all across Europe, leading to his renewal. You get the commission you deserve. Herman Van Rompuy, president of the European Council. This is no secret that this transparent non-leader was the choice of Sarkozy after Tony Blair turned out to be an unsustainable choice. Yet, none of the 26 other members of the Council dared to raise a single finger against this choice. Sarkozy has completely lost his credit in France, but that doesn t prevent this council of cowards from trusting him, apparently. It s not as if there weren t good candidates, like Jean-Claude Juncker or Vaira V e-Freiberga. But having a competent, Europe-friendly president who actually knows his files and speaks many languages would have cast shadows on those who don t (see below). Catherine Ashton, foreign ministry of the EU. If there was any worse possible choice, I don t know which. This was the only position supposed to be affected to a socialist. And since the Labour party is still member of the PASD, despite their insane liberal economic policy and their full-scale paranoia leading to unprecedented freedom hunting in the UK, the position was given to someone from this party. And among them, they chose a person with a reputation of sloppiness and incompetence, who doesn t speak correctly a single foreign language. It is probable that, just like Van Rompuy s going to be Sarkozy s puppet, she s going to be the UK Foreign Office s servant. And we continentals all love the Foreign Office s policy, which is often in complete opposition to what the rest of Europe feels like. Jerzy Buzek, president of the European Parliament. You don t know him? Neither do I. A weak parliament goes with a weak parliament president. This way, the European Council has its hands free for behind-the-curtains arrangements, rather than letting the citizens representatives take action. Martin Schultz, president of the PASD group at the European Parliament. In order to ensure his place as president of the Parliament for the second half of the period, he betrayed his own people, and accepted any rotten compromise the EPP would propose for the key positions. Socialists have never been so weak in Brussels, and the total absence of leadership has something to do with it. Makes you proud to be European, heh? And of course you already know the real faces of Europe for the next years. Sarkozy, Merkel, Berlusconi, Brown. The main leaders from Western Europe, with their rotten governments who swore to slay any of the remaining personal freedoms in each of their countries. What a great image for EU in the world. What a great example to set. But again, you get the leaders you deserve. That s the whole point of democracy.

Some technology evolves very quickly, for example the following things are used by probably 80% of readers of this page:

• A web browser.
• A mail client.
• A webserver.

But other technology is stuck in the past and only sees laclustre updates and innovations (not that inovation is mandatory or automatically a good thing) Right now I'm looking at my webserver logs, trying to see who is viewing my sites, where they came from, and what their favourite pie is. In the free world we have the choice of awstats, webalizer, and visitors (possibly more that I'm unaware of). In the commercial world everybody and their dog uses Google's analytics. On the face of it a web analysis package is trivial:

• Read in some access.log files.
• Process to some internal database representaqtion.
• Generate static/dynamic HTML output from your intermediate form, optionally including graphs, images, and pie-charts.

If you add javascript-fu to each of your pages you can track page titles, exit links, screen resolutions, and other data to record too. (Though I guess thats a seperate problem; trying to merge that data in with the data you have in your access log without making nasty links like "GET /trackin.gif?x_res=800;y_res=600". Anyway I guess with cookies you could correlate reasonably carefully.) In conclusion why are my web statistics so dull, boring, and less educational than I desire? I'd be tempted to experiment, but I suspect this is a problem which has subtle issues I'm overlooking and requires an artistic slant to make pretty. (ObLink: asql is my semi-solution to logfile analysis.) ObFilm: Bound

I m back from Dallas, where I was invited at the Ubuntu Developer Summit for Lucid. I spent a great week there ; the event was extremely well organized (by organizing them every 6 months, you are probably able to gather a lot of experience!). Of course, after all I had heard about people hugging each other all the time in the Ubuntu community, I was a bit worried, especially with the flu spreading! But there are lots of fantastic people around Ubuntu, and it was a very nice opportunity to be able to meet them all. Since it was my first UDS (I was at FOSSCAMP in Prague a few years ago, but didn t stay for UDS back then), I was not really sure of what to expect. I was very pleasantly surprised. UDS vs Debconf UDS is very different from Debconf. In Debconf, we do three different kind of things:

• we hack, mostly on our own, in the hacklabs
• during talks, we report on what we have done recently
• during some talks or BOFs, we discuss future (possible) changes

In UDS, the main focus is on the third point: most of the sessions are about discussing what will be implemented for the next release. All of the relevant developers are in the same room to discuss possible problems, and the outcome of each session is usually a detailed plan, with a list of action items. It s a very nice way to ensure that changes are well thought, and allows making large-scale changes in Ubuntu very easily (you don t spend weeks arguing about them on mailing lists). Of course, it s probably also helped by the fact that there s a company behind Ubuntu, with a set of large teams (kernel, foundations, desktop, etc), which helps transfering trust (not everybody feel like they have to participate in each discussion, even when they affect the whole distribution: the team in charge is trusted by the rest of the project). On the other hand (yeah, let s be negative for a while) it doesn t really help spreading information between Ubuntu developers: it s often a bit difficult to get the global view of what is happening inside Ubuntu, especially since lots of things are discussed on IRC. Collaboration between Debian and Ubuntu During the week, I mainly was interested on collaboration between Debian and Ubuntu. There s a strong focus on doing the right thing wrt Debian (and also other upstreams). Then, of course, Ubuntu also has an agenda, which sometimes requires moving very fast on some things, or making compromises between technical purity and pragmatism. But the willingness to have common foundations between Debian Squeeze and Ubuntu Lucid will surely benefit both distros. Quality Assurance On the QA front, I am planning to do archive rebuilds for Ubuntu as well (fixing FTBFS is an easy way to start contributing to Ubuntu or Debian, and having those bugs fixed in Lucid would benefit Debian as well, by having patches already prepared). I also had a session with the QA team, where I gave an overview of what we are doing in the Debian QA group, to discuss opportunities for collaboration. The Ubuntu QA team focuses more on testing (with automated or manual testing) and bug triaging than archive quality that part is left to the MOTUs and the release managers. (About MOTUs, I liked how what they do was described as long-tail maintenance, landscape gardening or terraforming. That gives a good idea of what it s about). Ultimate Debian Database On the Ultimate Debian Database front, I did a plenary talk to try to demonstrate how UDD could be useful to Ubuntu as well, and, with Jorge Castro, we examined some metrics of Ubuntu s giving back to Debian. I also talked with the Launchpad team to try to resolve my long standing pretty please provide an export of Ubuntu bugs, so I can easily import them in UDD! issue. Ubuntu and ARM ARM netbooks and smartbooks (mix between netbooks and smartphones) are coming, and Ubuntu is clearly very well positioned to play an important role on that market. There was a whole track about ARM support, with lots of changes that will be done for Lucid. Let s all hope that Ubuntu-powered ARM netbooks win that market, so we don t reproduce the failures of the non-ARM netbooks. Distributed Development James Westby has been working on a set of tools to be able to work on Ubuntu packaging using bzr. The point is not to store the canonical source for Ubuntu packages in bzr (well, at least it s not the plan yet), but to provide a set of branches to make it easier to merge or cherry-pick from Debian. The resulting workflow looks extremely nice, with lots of syntaxic sugar. And even better, he assured me that his code is portable to Git ;)
Using his work, merging Ubuntu-specific changes in a new version of a Debian package basically means pulling from lp:ubuntu/foopkg, merging from lp:debian/sid/foopkg, and you are done!
As a bonus, we (Debian) would get bzr branches with the history of packages (kind of bzr-powered snapshots.debian.org).
James project is not completely ready yet, but should be very soon. It s already basically usable, apparently. Conclusion Ubuntu has clearly gone a very long way since 2004. Everything looks very well organized and polished, and gives the impression of a big machine that nothing can stop. With Cloud Computing and now ARM netbooks, Ubuntu has proven to be able to adapt to the current trends and attract a lot of visibility. It is great news for Free Software, but also proposes an interesting challenge to Debian: of course, it s nice that a Debian-based distro is in that position, but will Debian manage to stay relevant, or are we just going to be the technically-pure distro without many users that serves as a package supermarket for Ubuntu?

Dear Lazyweb, I'm tempted to buy one of this neat boxes with embedded hard drive, network interface, sound card and TV output to use as a media center for the house. I've seen some of them in an ample range of prices, but all of them lack any detailed description of what's running inside. I'll bet that most of them are running Linux, but I'd like to be able to modify it to my heart's content. For example to use MPD as a music server, be able to mount filesystems with sshfs, and whatnot. I'm also tempted to take the 'Neuf box' that was given by the internet company, add a USB sound card and external hard drive; but already some people jumped to warn me about the dreaded terms of use contract, and all that jazz. Plus, having everything in a compact box seems more convenient for a not so big price. Does anybody have a recommendation on this? Being able to buy it in France is a plus :) Tags: Planet Lugfi, Planet Debian

The Computer in My Pocket -- which I intended mostly as a one-off blog-post -- ended up having some legs. First, Carolina Flores Hine translated the essay into Spanish. More recently the FSF published a slightly patched-up version in the Fall 2009 bulletin, sent to all members, along with a bunch of more interesting writing by other free software folks. Certainly, there is growing recognition in our communities that phones are a critical battleground in the fight for software freedom. More exciting for me though, my post elicited a bunch of comments from folks pointing to promising projects (Replicant was just one often cited example) making real progress toward freedom for all the computers in our pockets. I knew about most of them, but growing knowledge and excitement about problems and potential solutions was striking. There is an enormous amount to do, but there are reasons to believe that all is not lost.

Sometimes computers fail. If you run enough computers then you encounter failures regularly. If the computers are important then you need to plan for the failure. An ideal situation is to have redundant servers. Misconfigured clusters can cause more downtime than they can prevent and it requires more expensive hardware to properly implement a cluster (you need at least two servers and hardware to allow a good node to kill a bad node) as well as more time (from people who may charge higher rates). Most companies don t have redundant servers. So if you have some non-redundant servers there seem to be two reasonable options. The first one is to use more expensive hardware on a support contract. If a server is really important to you then get a 24*7 support contract it only takes an extra mouse click (and a couple of thousand dollars) when ordering a Dell server. I am not going to debate the relative merits of Dell vs IBM vs HP at this time, but I think that most people will agree that Dell offers significant advantages over a white-box server, both in terms of quality (the low incidence of failure) and support (including 24*7 part replacement). The second option is to have a cheap server that can be easily replaced. This IS appropriate for some tasks. For example I have installed many cheap desktop systems with two IDE disks in a RAID-1 array that run as Internet gateway systems for small businesses. The requirements were that they be quiet, use little power (due to poorly ventilated server rooms / cupboards), be relatively reliable, and be reasonably cheap. If one of those systems suddenly fails and no replacement hardware is available then someone s desktop PC can be taken as a replacement, having one person unable to work due to a lack of a PC is better than having everyone s work impeded by lack of Internet access! This ability to swap hardware is dependent on the new hardware being reasonably similar. Finding a desktop PC in an office today which can support two IDE disks and which has an Ethernet port on the motherboard and a spare PCI slot is not too difficult. I expect that in the near future such machines will start to disappear which will be an incentive for using systems with SATA disks and USB keyboards as routers. This evening I had to advise someone who was dealing with a broken server. The system in question is mission critical, was based on white-box hardware, and had four SATA disks in a LVM volume group for the root filesystem. This gave a 600G filesystem with less than 10G in use. If the person who installed it had chosen to use only a single disk (or even better two disks in a RAID-1 array) then there would have been a wide range of systems that could take the disks and be used to keep the company running for business tomorrow. But finding a computer that can handle four SATA disks is a little more tricky. Of course running a mission critical server that doesn t use RAID is obviously very wrong. But using four disks in an LVM volume group both increases the probability of a data destroying disk failure and makes it more difficult to replace the computer itself. Some server installations are fractally wrong.