My Debian QA page shows what I consider to be a huge amount of packages I am currently uploader for 207 packages. Why so many? There are many factors The main one is group maintenance (I'm directly responsible only for 19; of course, this should not mean I disregard the rest of them), the second one is regularity. By far, most of my source packages (177) match lib.*perl, followed by lib.*ruby with 20. Anyway A strong factor that allows the pkg-perl group to be successful in maintaining 1411 packages is the regularity of the task: Packaging Perl modules is usually as easy as running dh-make-perl on them (of course, not taking away the merit of packaging the few strange corner cases In Ruby-land, the landscape is quite different. The developer community is quite anchored in agile worldviews, which go beyond coding practices and all the way over to confronting the way most Free Software projects distribute their work. I have previously ranted presented informed and opinionated blog posts on this topic Ruby culture dictates the distribution via Ruby Gems, which are for many reasons not Debian friendly. Besides Gems, most projects have adopted Git for development tracking and are hosted under Github That's why I came up with Githubredir, which basically presents an uscan-friendly listing of tags for a given project. But if you develop in Git, you might want to split a project in its constituent parts for easier organization, without meaning that each subproject should be an independent project by itself, right? After all, that's what Git submodules are for. That's what happened with a great PDF generating library for Ruby, Prawn. Thing is, the three parts of the main project are required for the project to be built. Anyway, that was a great reason to move the package over to the new dpkg 3.0 (quilt) source format. And, yes, it is a straightforward move! If you have not yet done so, take a look at Raphael Hertzog' explanation+FAQ wiki page. It just works, and makes many things way easier. There are still some wrinkles in my packaging, like where I'm getting the orig tarballs from As the submodules are not presently tagged in any way, I was only able to download a snapshot of their respective current master branches. This is suboptimal, I know, but I have talked to the upstream author, and he confirms that for the next major version (which should not be long in coming) the tags will be synchronized, and things will be even cleaner. PS- I love Hpricot. To get the numbers for my QA page, I just had to get three dirty but useful arrays:

And work from the three very simple lists there i.e. tot.select pkg pkg =~ /lib.*perl/ .size gives me 177.

I ve just been disappointed to read about the DNI (Defence in the National Interest) web site closing down [1]. The final blog post says In the meantime, I ll leave everything up unless we start having more security problems , but unfortunately they have had a number of security problems in the past. I doubt the ability of a Wordpress installation to remain unscathed on the Internet if it s not upgraded regularly. So I think it s only a matter of time before a new bad Wordpress bug is discovered and DNI goes offline for good. In the past I did idly consider volunteering to help them run their site, but apart from a lack of spare time there is the issue that a number of their policy positions are things that I strongly disagree with. I can agree with paleo-cons on a number of issues, but there are also significant areas of disagreement. So it seems that the combination of a lack of skilled system administrators and a lack of good security in their software is reducing their ability to spread their message. While the site content is going to be mirrored on other sites the URLs will break and Google will give it a lower rank. In many ways losing Google ranking is a way of being silenced. I wonder whether the apparent lack of moderate-right political expression on the Internet is partly due to that demographic having less IT skills than the groups who have centrist to left-wing political views and those who have extreme-right views. Naturally anyone can pay to have someone run their web site, but having to pay raises the barrier to entry and eliminates some of the potential contributors. I think it s a bad thing for democracy if the only people who get their voices heard are those who have significant amounts of money or technical skill. One of my hopes for the SE Linux project was that it would increase the longevity of servers while also decreasing the amount of money required to run them. But of course if you have buggy PHP code then there s not much SE Linux can do to help you.

• [1] http://www.d-n-i.net/dni/2009/11/23/dni-to-close-update/

I've been slacking on the RC bugs front. :) Let's see, my last blog post was on Monday 16th, so I'm late...

• 2009-11-17: #527838 in 'smart' - investigated, closed as fixed. (Blatant cheating.)
• 2009-11-18: #516338 in 'pornview' - debugged a segmentation fault on amd64
• 2009-11-19: #551251 in 'libjavascript-perl' - patch written, but need to finish off and release.
• On Friday I looked at postgresql-pllua and postgresql-plproxy, but they need a bit more work than I originally thought, so I joined the pkg-postgresql team. I'm amazed I wasn't a member before, in fact. :) Now just need to actually update the packages.
• Then I took the weekend off! Went out, had fun...
• Yesterday I followed up on bug #516338 above with a delayed NMU, but I believe we're close to a maintainer upload now.
• 2009-11-24: #553230 in 'libapache2-mod-macro' - NMU diff written. I think it's borderline removal material, since there's only been one maintainer upload ever, but it does have a few popcon votes.

The DELAYED queue is a wonderful mechanism for reducing the amount of busy waiting that needs to happen for NMUs; you don't have to remember to come back and upload several days later. For non-DDs, it takes a bit more co-ordination between you and your sponsor, unfortunately - do you send the NMUdiff to the bug before you get sponsorship, and risk having to change it? And then revisit the bug to give notice again once it does get sponsored? Or leave it until after upload, which might reduce the amount of notice you're actually giving the maintainer (if, say, your mentor is in a different timezone)? I've been opting for the first approach, but it doesn't have the same fire-and-forget quality of the real thing.

I recently had the misfortune to be compelled to install Proftpd on SCO Unix. There s nothing wrong with Proftpd of course, but everything is wrong with SCO. LDFLAGS=-L/usr/ucblib ./configure libdir=/usr/ucblib --enable-builtin-getnameinfo To get it to compile the above ./configure line is needed. It uses /usr/ucblib because having the basic BSD sockets API residing in a non-default directory makes things more exciting. The --enable-builtin-getnameinfo option is needed because the getnameinfo library call in SCO Unix doesn t work properly. On a real OS I would have downloaded the source to libc to figure out where the problem might be, but on SCO I had no option other than to disable that functionality. Then once I got it working I had to put UseIPv6 off in the configuration file, otherwise I got the error No Route to Host (from memory) when I tried to start proftpd. Finally the process was dying from an unhandled SIGALRM every 10 seconds. According to truss (a vastly inferior equivalent to strace) the sigaction() system call was being entered four times to handle SIGALRM (as was reported for every time the application code called sigaction() but the default action of terminating the application remained in place. I ended up running proftpd from inetd which removed the need for the alarm handling code. Then it all worked. SCO sucks. Last month Darl McBride was terminated from his position with the SCO group [1]. It s unfortunate that Darl wasn t terminated a lot earlier, if so then maybe SCO could have focussed on improving the quality of their products and delivering value for stock holders. Hopefully Darl will be sued by some of the people who lost money when SCO went bankrupt. It would be good if Darl could also be sued by companies that lost money due to the poor quality of SCO Unix that means every company that runs SCO servers or that writes software for it. The truly awful nature of SCO Unix is in large part due to the fact that all of SCO s money was spent on litigation that was well known to be baseless.

• [1] http://en.wikipedia.org/wiki/Darl_mcbride

Due entirely to the efforts of one inquisitive and indefatigable A. Dehqan, a web search for the phrase "In The Name Of God The compassionate merciful" now almost exclusively turns up hits to a wide variety of free software mailing lists, forums, and IRC channels with questions on everything from what is a kernel (in a minimum of half a line, no less), to how to send a FAX, to the intersection between Islam and copyright and much more! I've now run across in five distinct projects. Maybe you have too!

It seems that despite having a very important work deadline today I am destined to be interrupted every five minutes. Unfortunately I need to concentrate to get this done. And while i managed to get "in the zone" earlier, now I cannot string two words together.

This seems to be a recurring theme recently, my productivity is horribly low because I get interrupted all the time for "can you just" jobs. I turn the phone ringer off and hide my email window and I get called on my mobile and get asked why don't you answer your phone?

Its not so much the time lost to answering the specific query or doing the job but more my context switch time to restore to my previous task becomes huge. Somehow my switching time is absolutely non linear and today it has become so large I have decided to dump state altogether.

Because I know I have to do the school run soon and the interruptions continue I have abandoned the critical task altogether for now in the hope I can get back to it fresh. Do others get this I wonder? or is it a personal fault I should strive to fix? I know I used to be able to deal with this sort of thing with much less trouble, maybe I am getting less flexible as I age?

Fortunately (umm, you know what I mean) the Entropy Key software has some cleanups required which is an easy job and does not matter if I get interrupted so I do have a productive task to complete.

Oh speaking of the entropy key Niel blogged something silly I created the other day. I had a senior moment and filked the children's nursery rhyme "If You're happy and you know it" slapping some guitar chords on it.

It seems I cannot simply leave well enough alone and last Friday night (with the help of Mark Hymers) I made it a whole lot worse. I present to you the score of "If you're happy with your ekey, blog your praise" for piano and guitar. In fact I wrote this out in rosegarden so it can be turned into a midi file etc. all the source files are available. It is released under a CC license so I suppose someone could put the lyrics back to the proper nursery rhyme and use it for something less tacky.

The LA Times has an interesting article about problems with Toyota and Lexus cars [1]. Basically there are problems where the cars have uncontrolled acceleration (there seems to be some dispute about whether it is due to engine management or the floor mat catching the accelerator pedal). When that happens the brakes don t work (due to the vacuum power-assistance for brakes going away when the engine is at full power) and a terrible crash seems inevitable. There are suggestions that the driver should shift the car to neutral and discussion about how the Toyota gear selection makes that difficult. Some years ago I was driving an automatic car on a freeway at 100Km/h and the engine stalled (due to a problem with the LPG system). I had become used to never touching the gear lever while driving so the possibility of moving the gear lever one notch to neutral didn t occur to me. With a dead engine in gear the car slowed rapidly which is quite dangerous when surrounded by 100Km/h traffic. Fortunately I was able to swerve into the emergency lane (across one lane of active traffic) before the car slowed much. That was in a relatively controlled environment with a gear shift mechanism that is a lot simpler than that which is common in some of the more expensive cars. According to Wikipedia the maximum speed limit in the US is 80M/h [2]. It seems to me that Toyota is being irresponsible by selling cars that can sustain 120M/h, while the probability of surviving a crash at 80M/h is quite low, it seems likely to be a lot greater than the probability of surviving a crash at 120M/h. Also if a car is out of control at 80M/h then the driver will have a lot more time to work out how to put the engine in neutral or turn it off the lower speed will extend the time available by more than 50% because bends in the road can be better handled at 80M/h. It seems to me that it would be a feature for the car owner to have the car limited to a speed that is not much greater than the speed limit. According to Wikipedia the highest speed limit in Australia is 130Km/h (in NT), but it s 110Km/h in all places where I have driven. If my car had a governor to limit the speed to 115Km/h and a switch to change the limit to 135Km/h in case I ever drive to the NT then it would not affect my driving patterns (I rarely drive on roads with a 100Km/h limit and almost never drive on roads with a 110Km/h limit) but it could reduce the probability of things going horribly wrong. Also one thing to note is that last time I checked car tyres sold in Australia were only required to operate safely at speeds below 190Km/h (118M/h), so a Lexus that went out of control at 120M/h in Australia might risk a tyre blow-out which admittedly would only make things marginally worse. A governor for the reverse gear would also be a good feature. Some time ago a granny got her foot stuck on the accelerator in a car park and caused serious damage to her car and a parked car after passing close by where I was standing. I don t think that there is a real need to do more than 5Km/h in reverse, limiting the speed would give pedestrians a better chance of escaping parking accidents. One serious problem with some of the Toyota and Lexus vehicles is that it apparently takes 3 seconds to turn the engine off in an emergency! I ve been driving for almost 20 years and experienced a number of dangerous situations, all of which were essentially resolved (for better or worse) in significantly less than 3 seconds. A 3 second delay is as good as a 1 hour delay for safety critical systems. Also if the accelerator and brake pedals are pressed at the same time then the brake should take precedence. It seems quite obvious that whenever both pedals are pressed hard then the driver would probably prefer hard braking to hard acceleration. If you look at industrial machinery (robots, lathes, etc) you will always see big red buttons (or whatever color is used for emergency stop in your region) that are clearly marked and obvious to the workers and to bystanders. Escalators have less obvious red buttons but they can still be shut down in an emergency. It seems to me that there are potential benefits to having an emergency shutdown button in a car, maybe in a position that is accessible to the front-seat passenger in case the driver is incapacitated. Such a shutdown button wouldn t do anything extreme such as fully activating the brakes (which would be very bad on a road that has high-speed traffic), but would prevent acceleration (with some sort of hardware control to avoid software problems) and maintain power to the brakes and the steering. One thing that needs to be considered is that people tend not to do the most logical things when in an emergency situation. It needs to be possible to do whatever is necessary to save your life without any great deal of thought. Pushing a big red button is easy, holding down the on button for 3 seconds or even navigating a gear shift to an uncommon setting is a lot more difficult. It seems to me that there is also an issue of driver training. If putting an automatic car into neutral and cruising to a stop was part of the test for new drivers then the results of such car problems might not always be so bad. But I don t expect there to be any serious changes to driver training or car design. People are too accepting of road deaths. Don Marti has expressed a plan to never buy a vehicle with an automatic transmission because of this issue [3]. But the number of new vehicles being sold with a manual transmission is steadily reducing. An automatic transmission allows better performance (F1 cars have used them for ages), better fuel efficiency (you could never make a manual Prius), a more comfortable ride (the Hybrid Lexus keeps winning the Australian Luxury Car of the Year award), and allows less skillful drivers. Unless Don wants to ride a moped or drive an old car then I expect that he will be forced to get an automatic transmission. Then of course he will still be at risk of other people having car problems (the LA Times article mentions a third party being killed after an out of control car hit them). Also I expect that the extra safety features that are implemented in luxury vehicles such as the Lexus would save a few lives, they should save enough to outweigh the number that are lost on the rare occasions when the car goes out of control. Other luxury cars such as the Mercedes S class have great safety features and don t have a history of going wrong in a newsworthy way. A second-hand S Class Mercedes was surprisingly cheap in the UK last time I checked, cheap enough to make it worth considering the importation of one to Australia. But my solution to these problems is to try and minimise my driving. A 1.5 ton Lexus driving out of control at the maximum speed possible in urban streets won t do much damage to a 20 ton tram.

• [1] http://www.latimes.com/business/la-fi-toyota-recall18-2009oct18,0,2352642,full.story
• [2] http://en.wikipedia.org/wiki/Speed_limits_by_country
• [3] http://zgp.org/~dmarti/wiki/mlp/chromium/

Yesterday was the last day of presidential campaign, the most poisonous campaign since 1989, when the communist rule has fallen ... or so says history.

This campaign period was one of firsts of all kinds, mostly bad.

This is the first presidential campaign:

• when, as a voter, one could clearly see polls were doctored massively as a means to influence the voters
• when the internet was crucial and almost the only means of spreading ideas for the campaign of a candidate, Remus Cernea
• in which an important internet news site, hotnews.ro, decided not to publish polls anymore
• when the public television didn't perform its duty to organise a debate with all the candidates at the same time
• when candidates were separated in two groups: "insignificant candidates" and "important candidates"
• when some candidates refused to participate in public debates, except on their own terms, as if it was a service done by them to others
• when candidates accused each other of being afraid to participate in face to face debates, while it was clear that this was true for many
  
• when a candidate, Remus Cernea, was kicked out of a debate where he was previously invited, without being given a reason
• when journalists' investigations found that all major parties had during the last year donations from at least 100 politicians with a declared income lower or identical to the donated sums totalling up to 91 millions of new lei (RON) (approximately 22 million euros)
• when we have proof directly from frauders that all major parties prepared to fraud the elections via electoral tourism, electoral bribes and vote purchase
• when a referendum was used as a electoral means by one of the candidates
• when opponents twisted and re-twisted others' electoral message
• when an illegitimate organisation organised a debate with only the first three candidates
• when it was announced that special polling stations were made to target people voting away from home, not allowing such voting on special lists in regular polling stations; also the special polling stations will be, for the first time, monitored via webcams which will record the voters when they insert the bulletin
• when some candidates clearly stole ideas from others mid-campaign
  
• when I decided I am going to vote out of conviction and cast a positive vote for Remus Cernea

This is the first time I realise how important it is for everybody to go and cast a vote for the candidate they prefer to dilute the effects of the frauds.

Go and vote for the candidate you agree the most!

Don't cast a "useful vote", otherwise you will disservice your prefered candidate in three ways:

• you're strentghning one of the adversaries
• your prefered candidate will be in a worse position to negotiate with others the implementation of some of the points on his platform in case he doesn't win
• you're canceling one of the votes somebody did vote for the one you prefer

Don't forget, tomorrow, the 22nd of November spare some 15-30 minutes and vote for the person that represents you most! Don't follow the flock, vote sincerely!


Vote, because your vote counts! Otherwise why would they bother to convince you to vote for them?

During the month of October I spent quite a bit of time thinking about the past, present, and future of F/OSS. This was due in part to participation in a Berkman Center event on Free Culture, where we discussed the historical arc of Free Software to Free Culture, the relationships between them (and their differences), and also the content and meaning each. Over the years, what I have found so interesting about Free Software is how it left its enclave to inspire countless groups into rethinking the politics and ethics of production and access and yet, as I raised in this pod-cast interview (due to the prompting of my interviewer, Elizabeth Stark), Free Software and/or Free Culture is still pretty bounded and contained phenomenon especially when compared to something like the existing consciousness over the environmental movement, which many folks know about and understand even when and if they are not involved in doing anything for the movement. I always ask my first year students whether they know what Free Software or Free Culture is and 9 out 10 stare at me with those blank eyes that basically speak in silence: no. Now, there are a group of activists, many located in Europe, a number of them with deep roots in the social justice movement who are taking Free Culture down a different path, trying to expand its meaning and conjoin it to social justice issues, build a broad set of coalitions across the political spectrum so as to override the fragmentation that is so characteristic to contemporary political moment, and use FC as an opportunity to critique the market fundamentalism of the last few decades. If you are interested in these issues, take a look at their charter: they are looking for comments (critical and constructive) as well as endorsements (here is the long version). I myself have a few comments, for example, I think it is worth noting something like the limits of what FC can do, that even if in many ways it can be activated to do good in the world, it is also best to highlight in the same swoop that FC is not some political panacea and has limits. For example some groups in the world, notably some indigenous communities abide by a different logic of access and culture, whereby full access is not culturally or ethically desirable, as the work of Kim Christen has illuminated. I also wonder in what ways issues of labor might be addressed more forcefully, and though they briefly raise the question of environmental sustainability, it is worth expanding these more directly and deeplyas this article by Toby Miller and Richard Maxwell make clear. There is more to say but I will leave it here for now and just say it is really great to see Free Culture taken down another political path that is rooted in coalition building.

During the month of October I spent quite a bit of time thinking about the past, present, and future of F/OSS. This was due in part to participation in a Berkman Center event on Free Culture, where we discussed the historical arc of Free Software to Free Culture, the relationships between them (and their differences), and also the content and meaning each. Over the years, what I have found so interesting about Free Software is how it left its enclave to inspire countless groups into rethinking the politics and ethics of production and access and yet, as I raised in this pod-cast interview (due to the prompting of my interviewer, Elizabeth Stark), Free Software and/or Free Culture is still pretty bounded and contained phenomenon especially when compared to something like the existing consciousness over the environmental movement, which many folks know about and understand even when and if they are not involved in doing anything for the movement. I always ask my first year students whether they know what Free Software or Free Culture is and 9 out 10 stare at me with those blank eyes that basically speak in silence: no. Now, there are a group of activists, many located in Europe, a number of them with deep roots in the social justice movement who are taking Free Culture down a different path, trying to expand its meaning and conjoin it to social justice issues, build a broad set of coalitions across the political spectrum so as to override the fragmentation that is so characteristic to contemporary political moment, and use FC as an opportunity to critique the market fundamentalism of the last few decades. If you are interested in these issues, take a look at their charter: they are looking for comments (critical and constructive) as well as endorsements (here is the long version). I myself have a few comments, for example, I think it is worth noting something like the limits of what FC can do, that even if in many ways it can be activated to do good in the world, it is also best to highlight in the same swoop that FC is not some political panacea and has limits. For example some groups in the world, notably some indigenous communities abide by a different logic of access and culture, whereby full access is not culturally or ethically desirable, as the work of Kim Christen has illuminated. I also wonder in what ways issues of labor might be addressed more forcefully, and though they briefly raise the question of environmental sustainability, it is worth expanding these more directly and deeplyas this article by Toby Miller and Richard Maxwell make clear. There is more to say but I will leave it here for now and just say it is really great to see Free Culture taken down another political path that is rooted in coalition building.

Since some days we keep packages of Architecture: all in the archive as long as they are needed. You can find some details about that in my former post:
dak dominate will dodadoda the Debian archive soon.

The package that could currently profit most from that change is rpm! But the package dependencies are actually not strong enough. The source package rpm builds some arch all packages like rpm-common and several arch any packages and some of them (rpm, librpm0) have an unversioned field
Depends: rpm-common.
This dependency can be improved to
Depends: rpm-common (= $ source:Version )
to avoid nasty bugs after upgrading.

I fear that we have more of such packages in Debian.

Such was the scene I arrived at on Wednesday last week at the municipal health center at Kyll , Jyv skyl , Finland. A queue extended a hundred meters beyond the door. It was not hard to guess what it was about, as it had been announced that the pandemic influenza A/H1N1 vaccine would be administered there to people in specific risk groups from 10 am to 3:30 pm. I should explain here the Finnish health care setup. There are three parallel systems a comprehensive public health care system maintained by the municipalities to standards set by the state, a network of private for-profit health care providers, and a national foundation dedicated to university student health care. Employers are required by law to provide a minimal level of health care to their employees, and most of them also provide, free of charge to the employees, access to near-comprehensive general-practice-level care; most employers buy this service from the for-profit providers. The public system suffers from resource starvation at the general-practice level but provides excellent care in the central hospitals that handle the difficult cases. Anyway, the H1N1 vaccine is only available through the public system and through the foundation free of charge if you qualify for the vaccine, and no amount of money buys it for you in this country if you don t. Thus, I and many others, normally cared by the employee services, found ourselves queuing up at a public health care institute. And clearly, the public health care system was overwhelmed on that first day. When I entered the queue, its tail was a traffic hazard. Fortunately, the queue moved faster than new people arrived thereafter, and the hazard ended. The queue moved surprisingly fast it took me one hour to advance the 100 meters to the door. Even so, this was a failure in the system there is no good reason to have people with underlying illnesses (and we all had them, to qualify for the vaccine) stand around in freezing cold weather for an hour! Once, a nurse came and asked us if any of us was 63 years old or older. Apparently no-one was, since no-one was asked to leave (they will be vaccinated later). Later, another nurse asked everyone in the queue outside to show their KELA cards KELA is the national health insurance system, and its card carries information about extra coverage one qualifies for due to underlying illnesses. Eventually, I reached the door. Two guards stopped anyone who tried to enter directly, sidestepping the queue, and let in only those who had legitimate business other than vaccination. The main hall was full of people, and I quickly realized that the queue took a full circle inside the hall to reach the multiplexing point. It took me another hour to slowly advance my way though the hall. At the multiplexing point, I was asked to wait a bit, and then I was assigned a vaccination room and a waiting number. Some twenty minutes later I was called in. The vaccination room I was assigned to was a nurse s office. Two nurses were there, one who would administer the vaccine, and another at the computer, to keep a record. I gave them my KELA card, and shed my coat and my outer shirt, and bared my left shoulder. I was quickly given the pandemic vaccine; there was no question I was qualified for it, not with my obesity being obvious. Then they asked what my diagnosis was. Prmarily I m here because of my obesity, I said. But I also have paroxysmal atrial fibrillation. That s not what your KELA card says, accused the nurse at the computer. The diagnosis is so new, I countered. There has been no time to do the paperwork for KELA. (And indeed, I later learned, it would come up in my next checkup in the spring.) They stared at each other. I can show you my prescriptions, I said, making no move for them. Stares. I stared back. Do you want the seasonal vaccine or not? asked the nurse with the injectors. I lauged briefly. I might as well. It had, honestly, never crossed my mind that I might qualify. She injected me on my right shoulder. You should stay in out there for ten minutes. I picked up my clothes and found the cafeteria with coffee and pastry. Then the real fun started. Next day, I woke with horrible upper back pain. The thermometer showed mild fever; but since i didn t have any respiratory symptoms, I decided to go to work. In the evening, turning in bed was excruciatingly painful. It took days for the pain to subside. I left the building three hours after I arrived at the end of the queue. What? You think that s excessive? So do I and many others; queuing feels so Soviet Union! But honestly, while it did take time, it worked. I am vaccinated; are you?

Bastien mentioned the Chromium OS xorg.conf file, which includes an irritating wart - namely, Option "SHMConfig" "on". This tells the Synaptics touchpad driver to export its configuration data to a shared memory region which is accessible to any user on the system. The reason for this is that in the past, there was no good way for configuration information to be passed to input drivers through the X server at runtime. This got fixed with the advent of X input properties, and synaptics can now be configured sensibly over the X protocol.

But why was it off by default? Because, as I said, the configuration data is exported to a shared memory region which is accessible to any user on the system. And while it contains a bunch of information that's not terribly interesting (an attacker being able to disable my touchpad or turn on two finger emulation may be a DoS of sorts, but...), it also contains some values that are used to scale the input coordinates. Which means that anyone with access to the SHM region can effectively take control of your mouse. The current position is exported too, so they can also track all of your mouse input.

Now, this isn't stunningly bad. The attacker can only do this while you're touching the pad. You'll see everything that happens as a result. There's no way to fake keyboard input. They need to be running code as another user on the system - if they're running as the logged in user then they can already do all of this. And for a device as single-user as Google seem to be looking at, it's obviously not a concern at all.

But there's still plenty of places on the web suggesting that you enable SHMConfig, and various distributions that ship with it turned on (Ubuntu on the Dell mini used to, but got turned off after I contacted them about it). It's absolutely fine to do this as long as you're aware of the security implications of it, but otherwise please use X input properties instead.

Last night I was in the middle of checking my email when I found that clicking on a URL link wouldn t work. It turned out that my web browser had become unavailable due to a read error on the partition for my root filesystem (the usual IDE uncorrectable error thing). My main machine is a Thinkpad T41p, it is apparently possible to replace the CD-ROM drive with a second hard drive to allow RAID-1 but I haven t felt inclined to spend the money on that. So any hard drive error is a big problem. Fortunately I had made a backup of /home only a few days ago. I use offline IMAP for my email so that my recent email (the most variable data that matters to me) is stored on a server with a RAID-1 as well as on my laptop and my netbook. The amount of other stuff I ve been working on in my home directory is fairly small, and the amount of that which isn t on other systems is even smaller (I usually build packages on servers and then scp the relevant files to my laptop for Debian uploads, bug reports, etc. The first thing I did was to ssh to one of my servers and paste a bunch of text from various open programs into a file there. That was the contents of all open programs, the URLs of web pages I was reading, and the contents of an OpenOffice spread-sheet which I couldn t save directly (it seems that a read-only /tmp will prevent OpenOffice from saving anything). Then I used scp to copy 600M of ted.com videos that I hadn t backed up, I don t usually backup such things but I don t want to download them twice if I can avoid it (I only have a quota of 25G per month). After that I made new backups of all filesystems starting with /home. I then used tar to backup the root filesystem. The hard drive in the laptop only had a single bad sector, so I could have re-written it so that it would be remapped (as I have done before with that disk), but I think that on a 5yo disk it s probably best to replace it. I had been thinking of installing a larger disk anyway. On restore I restored the root filesystem from a month-old backup and then used diff -r to discover what had changed, it took me less than an hour to merge the changes from the corrupted root filesystem to the restored one. Now I have lots of free disk space and no data loss! I am now considering making an automated backup system for /home. My backup method is to make an LVM snapshot of the LV which is used and then copy that this gets the encrypted data so I can safely store it on USB devices while traveling. I could easily write a cron job that uses scp to transfer a backup to one of my servers at some strange time of the night. The next issue is how many other disks I will lose this summer. I have installed many small mail server and Internet gateway systems running RAID-1, it seems most likely that some of them will have dead disks with the expected record temperatures this summer.

Keith and I have been pretty quiet about TeleMetrum for a while... but that doesn't mean we've been idle! In recent weeks, I've built up several more flight units and two more ground station boards, as noted in my production log. We're both trusting rockets solely to our boards and Keith's firmware at this point. In fact, we've accumulated a significant number of succesful flights, including a cool drag-race between 4" airframes at NCR Oktoberfest where we both put brand-new, nearly identical rockets fully at risk flying only TeleMetrum boards, and a flight by Keith the same weekend on a full-K Loki K350W moon-burner in which he set a new personal altitude record! I've also flown a board with 100-g accelerometer installed successfully in a flight that peaked at 52.8 g! We're now hard at work on a "next version" of the hardware, incorporating everything we've learned so far. There are a number of significant changes planned:

• Fully integrated, on-board GPS receiver and patch antenna, with support for off-board amplified antennas when airframe geometry or materials demand it.
• A change in the design of the circuit for firing e-matches to ignite ejection charges that will improve mechanical reliability, plus explicit support for using a separate pyro battery if desired.
• Inclusion of a "companion board interface" that we envision using for a pyro channel expansion board to support staging and air starts, among other things.
• Dramatic increase in the capacity of the on-board data logging memory.
• Changes in connector series to eliminate our dependency on expensive crimping tools for making cables.

To make all this fit, I'm stretching the board an extra 1/4 inch to a total outline of 1 by 2.75 inches. We're also moving all the connectors, the GPS patch antenna, and the beeper to the "back side" of the PC board. This is a win on several levels... it will allow us to have silk-screen labels for the connectors, will help protect the baro sensor from sunlight and the various surface mount parts from physical damage during rocket prep, and opens up more board surface area for component placement and routing on the "top side" of the board. In practice, this means that boards will be mounted on standoffs with all the active components facing "down" and the connectors facing "up." Before we'll be ready to build some of these, we need to get in some more flights to test the various changes we're making. In particular, the change in ejection charge circuit, and the GPS receiver chip and antenna choices we're now favoring. Unfortunately, Keith and I are now both into the time of year where launch opportunities come less frequently, even before we consider the weather. Meanwhile, Keith's firmware and ground station software are now doing nearly everything we've envisioned wanting from this project. It seems entirely likely that he'll be ready to declare "version 1.0" soon after we obtain and verify the functionality of our next version of the hardware... In the meantime, our friends at Woot have posted a really funny video combining material from a couple launches this summer of my 10-inch Goblin, on one of which we flew some of their screaming flying monkey dolls... Enjoy!

We ordered a couple of the new HP DL160 G6, cause they can be equipped with a lot of RAM. Unfortunately it s always the same with HP and the bandnew ProLiant 100 series the driver for the NICs is missing/too old in the latest stable debian release. The DL160 G6 is shipped with a Intel 82576 GBit NIC, which isn t recognized by Lenny, see also #522922.
I installed the system with another NIC installed (not really, but this is a way it works :) and wanted to get free the PCI-X slot again. So I did backport dkms and downloaded the latest igb driver. A short look into /usr/share/doc/dkms/HOWTO.Debian did advice me the way to create the DKMS driver package. Just after a couple of minutes I did roll out the igb-dkms_2.0.6_all.deb to the target maschine(s).
On the target systems I just installed dkms, the DKMS package and appropriate linux-headers and sim, salabim there was the interfaces. :)

Some time ago, I made an attempt at a gvfs package with disabled HAL support. The latest upstream version allows to use DeviceKit-Disks instead, through the gnome-disk-utility library. This change was supposed to bring a lot of improvement, among which:

• improved LUKS support;
• better management of permissions, using ConsoleKit and PolicyKit 1;
• simpler software stack, getting rid of gnome-mount.

Unfortunately, it turned out as a real fiasco, since there is no support for IDE CDs using ide_mod in DeviceKit-Disks. Upstream only uses libata, and Fedora has no requirements for compatibility with kernels shipped more than 2 months ago. The change had to be backed out. What you don t know yet is that Michael Biebl is awesome. Not only did he find some ways to comply with Bastian s requirements, but he implemented IDE CD support in DeviceKit. Which was not really easy. So, I d appreciate if some adventurous people could test the experimental gvfs packages in which there is still DeviceKit support. Please look for any regressions in them, especially with regard to removable media handling.

Yesterday s RAM mystery was solved after dozens of people have written in with helpful comments. Thank you all. I need to find time to create a proper, commentable blog soon so that you all can get the credit you deserve! I now have the full 4GB of RAM available:

$ free   head -2
            total       used       free     shared    buffers     cached
Mem:       4063324    1657440    2405884          0     149080     643732

Yay! The suggestions ranged from timing issues to defective modules, from 64bit OS via south/north bridge limitations to sacrificing chickens to god spongebobs. In the end, several people put their finger on a concept called memory hole remapping , and that turned out to be the ticket. Here is what I learnt: This motherboard and the CPU memory controller supports (which means can address ) 4096MB of RAM. Since extensions cards, such as the graphics card and the network controller, also need addressable slabs of memory for their RAM or registers, ranges in the upper memory regions are mapped to the RAM of those cards. The file /proc/mtrr gives a clue over what s happening:

reg00: base=0x000000000 (    0MB), size= 2048MB, count=1: write-back
reg01: base=0x080000000 ( 2048MB), size= 1024MB, count=1: write-back
reg02: base=0x0c0000000 ( 3072MB), size=  256MB, count=2: write-combining
reg03: base=0x0d8000000 ( 3456MB), size=  128MB, count=1: write-combining
reg04: base=0x0e8000000 ( 3712MB), size=   64MB, count=1: write-combining
reg05: base=0x0ec000000 ( 3776MB), size=   64MB, count=1: write-combining

Registers 0 and 1 represent the addressable RAM available to the operating system. At position 3072, we find two slabs of 256MB each, most likely corresponding to the two graphics cards in the system. I think that the 128MB in register 3 is the AGP aperture. Registers 4 and 5 correspond to 64MB slabs each, most likely relating to the two network cards I have installed. The result is that addresses in memory beyond 3072MB are routed to the extension cards, which overshadow the original system RAM and leave it unusable. When I turned on the memory hole remapping feature in the BIOS, I empowered the BIOS to remap the memory space. The way it does this is BIOS-dependent, but most likely, it will remap the overshadowed memory region to the end of the total memory space. This is a software-only remapping, but the effect is that the system appears to have more memory. /proc/mtrr now reads:

reg00: base=0x000000000 (    0MB), size= 4096MB, count=1: write-back
reg01: base=0x100000000 ( 4096MB), size= 1024MB, count=1: write-back
reg02: base=0x0c0000000 ( 3072MB), size= 1024MB, count=1: uncachable
reg03: base=0x0c0000000 ( 3072MB), size=  256MB, count=1: write-combining

I am not entirely sure how to interpret this yet, but you can see that there are now an additional 1024MB at position 4096 (register 1), so the system seems to have 5GB of RAM available. Register 2 describes memory between 3072 and 4096 as not cacheable, because it maps to extension cards. I do not know how register 3 fits into the picture. By remapping, we cross the 4096MB mark. To make use of the additional memory, we will need PAE enabled to give you 36 bits, or a 64bit operating system: 2^32 is 4096M, so with only 32 bits available, 4GB is all the memory that can ever be addressed (dirty hacks excluded). Fortunately, this system has been running the Debian amd64 port even before it was officially released, and thus, once the BIOS remapped the memory, I could fully make use of it. Mystery solved, some knowledge acquired, many of you left to thank!

This blog post is about fixing the bug #246992: 'arch all package available before arch any dependancy'. What does that mean: we will keep multiple versions of arch all and source packages per suite as long as older arch 'any' package are still available because maybe newer versions haven't been built by the buildds yet. That means that packages from the unstable suite will always be installable in the future.

The old code in make_suite_file_list.py has been replaced by generate_filelist.py and dominate.py. The first one is generating the file lists for apt-ftparchive and the second one removes obsolete packages from the database. The code in make_suite_file_list.py has been written by people that are no longer members of the ftpteam. Its main control function has a nice name: do_da_do_da(). The new script dominate.py still ships with a small function doDaDoDa() as a reminiscence to our forefathers.

My code has been merged into dak and will be activated on ftp-master.debian.org soon. It can't re-add packages that have already been removed in the past but is will make the archive more friendly in the future. Unfortunately it will leave more cruft in the archive that cannot be cleaned fully automatically. We will need your help to find such corner cases. Please report any errors in the archive as a bug report against the virtual package 'ftp.debian.org'.

More information about the topic can be found in ftpteam's wiki.

Sigh I am starting to fill up my annual report for my real-life work. You know, that chore you must do every year where you score little bullets next to each completed project and talk well about yourself. For my workplace, fortunately, I do not have to lie and convince people I am worth rehiring - As this year I achieved definitividad as a T cnico Acad mico Asociado C de Tiempo Completo at my University, I can say for sure I have long-term job safety. UNAM is the best place for me to work, and I am most grateful Even if I do want to advance for the future, even though I would strongly like at some point to start working in a real academic position My job is mostly operative, limited to keeping things running smoothly in our network and servers. I work in a social sciences (Economics) research institute, and even though I have taken on an interesting project that is viewed from the social sciences I do expect to finish with a very interesting product in the near future, my interest lies in computing as a science. Anyway, back on track This is the time of year to start evaluating many things, many factors, from many different sides. And yes, for me that involves measuring how am I faring in my involvement in the projects I most care about Specifically, Debian, but also several other Free Software projects, even if my involvement in them is mostly organizational. I am once again going through a tough period in my personal life, and the impact it carries is obviously deep. However, I am not fond of finding excuses for my underachievement or underperformance. And that's what I feel now. Even more when I see posts such as Zack's and Tim's status updates, and when I see that we continue to be on a history-high streak of RC bugs. Regarding the several teams I am (at least formally) involved with in Debian, I have been away from the pkg-perl group for far too long... It is still my first group when it comes to identifying myself with - Both as on a personal level, as I consider them as good friends and great people to work with, and I do feel the responsability to share the load with them, as maintaining >1300 packages (even if they are so highly regular) is just not an easy task. But for over a year, my involvement has been basically zero. I have been a bit more active on pkg-ruby-extras, maybe paradoxically as it is a smaller team and with less packages (as I know it is much less probable for somebody to keep my packages in adequate shape if I don't do it)... and also because I am working more with Ruby than Perl nowadays. And finally, about Cherokee, I decided during DebConf9 to redo the packaging to fully use DH7 instead of our old-style quasimanual style. I have had several bursts of activity, and am almost-almost-ready to do the first newstyle upload... But so far, have been unable to do so. Of course, keyring-maint: With Jonathan's help, I have come to terms with most of the processes. Both Jonathan and I have been swamped lately, but at least I think I am finally helping speed up the process instead of holding it down. We do, yes, have several pending updates - but are working our way up the queue, and I hope not to leave people waiting for too long. And yes, we have discussed several ways of documenting and automating several of the tasks we currently sustain, and that should come soon I have been also leaving maybe a bit too much responsability aside on EDUSOL, for which today we are entering the second week of activity, and I'm very sorry to see our server is just too overloaded to even reply to even answer to me And even lacking admin powers myself, I should have worked earlier on setting up redundancy on a more automatic way (as we have an off-site backup we can promote to live and redirect to, but I am unable to do this... Given that I am the techie person on board/the only "professional" sysadmin). This year I also quietly finished the bulk of the Comas rewrite. What? Comas? Still alive? Yes, and you can expect me to show it off to more people soon, and get it used for more conferences. I will talk more about it (and its motivation, and its current status) later on But basically, the only two things that Comas shares in common with the mod_perl-based system most of you got to know (mainly at CONSOL 2004-2008 or at Debconf 5 and 6, although I know of several other conferences which used it) and the current incarnation are The (most) basic database structure and the name. The project underwent a full rewrite, and is now a far more flexible, far easier to install, Ruby-on-Rails based application. And most important, it does no longer involve your name being Gunnar Wolf as a prerequisite for successfully setting it up ;-) Regarding DebConf, I have promoted a Central American MiniDebConf, and we are right on track for holding it in late March in Panam City. Everybody's invited, and we will have (surprise, surprise!) the very professional involvement of Mr. Anto Recio as local team, as it seems he didn't have enough with last year's DebConf9 and wants to suffer further. What am I lacking here? Motivation. I have been quite pessimistic, possibly turning some people away, even though we have a good first sampling of interested people's profiles and expectations. If you want to get involved, tomorrow (Tuesday 17-nov) we will have a meeting at Freenode's #sl-centroamerica, 17:00 GMT-6. Please note we do need involvement from the Central American communities, it is more than just a motivational issue. Last meeting it seemed Anto and I were the only people pushing the MiniDebConf - and frankly, that would be a basis for not even holding it. We need motivation from the very people involved in it! Anyway You can see I have (and it seems to be a constant in my life) a series of contradictions going on. However, the excercise of putting it all into writing helps me understand better where I am standing. When I started writing this post I felt much heavier, much more at a loss Right now I feel I want to refocus my energy on the same projects and teams I have been involved with, yes, but feel it at least more plausible. Hope so.